diff --git a/src/HOL/Analysis/Bochner_Integration.thy b/src/HOL/Analysis/Bochner_Integration.thy
--- a/src/HOL/Analysis/Bochner_Integration.thy
+++ b/src/HOL/Analysis/Bochner_Integration.thy
@@ -1,3427 +1,3427 @@
 (*  Title:      HOL/Analysis/Bochner_Integration.thy
     Author:     Johannes Hölzl, TU München
 *)
 
 section \<open>Bochner Integration for Vector-Valued Functions\<close>
 
 theory Bochner_Integration
   imports Finite_Product_Measure
 begin
 
 text \<open>
 
 In the following development of the Bochner integral we use second countable topologies instead
 of separable spaces. A second countable topology is also separable.
 
 \<close>
 
 proposition borel_measurable_implies_sequence_metric:
   fixes f :: "'a \<Rightarrow> 'b :: {metric_space, second_countable_topology}"
   assumes [measurable]: "f \<in> borel_measurable M"
   shows "\<exists>F. (\<forall>i. simple_function M (F i)) \<and> (\<forall>x\<in>space M. (\<lambda>i. F i x) \<longlonglongrightarrow> f x) \<and>
     (\<forall>i. \<forall>x\<in>space M. dist (F i x) z \<le> 2 * dist (f x) z)"
 proof -
   obtain D :: "'b set" where "countable D" and D: "\<And>X. open X \<Longrightarrow> X \<noteq> {} \<Longrightarrow> \<exists>d\<in>D. d \<in> X"
     by (erule countable_dense_setE)
 
   define e where "e = from_nat_into D"
   { fix n x
     obtain d where "d \<in> D" and d: "d \<in> ball x (1 / Suc n)"
       using D[of "ball x (1 / Suc n)"] by auto
     from \<open>d \<in> D\<close> D[of UNIV] \<open>countable D\<close> obtain i where "d = e i"
       unfolding e_def by (auto dest: from_nat_into_surj)
     with d have "\<exists>i. dist x (e i) < 1 / Suc n"
       by auto }
   note e = this
 
   define A where [abs_def]: "A m n =
     {x\<in>space M. dist (f x) (e n) < 1 / (Suc m) \<and> 1 / (Suc m) \<le> dist (f x) z}" for m n
   define B where [abs_def]: "B m = disjointed (A m)" for m
 
   define m where [abs_def]: "m N x = Max {m. m \<le> N \<and> x \<in> (\<Union>n\<le>N. B m n)}" for N x
   define F where [abs_def]: "F N x =
     (if (\<exists>m\<le>N. x \<in> (\<Union>n\<le>N. B m n)) \<and> (\<exists>n\<le>N. x \<in> B (m N x) n)
      then e (LEAST n. x \<in> B (m N x) n) else z)" for N x
 
   have B_imp_A[intro, simp]: "\<And>x m n. x \<in> B m n \<Longrightarrow> x \<in> A m n"
     using disjointed_subset[of "A m" for m] unfolding B_def by auto
 
   { fix m
     have "\<And>n. A m n \<in> sets M"
       by (auto simp: A_def)
     then have "\<And>n. B m n \<in> sets M"
       using sets.range_disjointed_sets[of "A m" M] by (auto simp: B_def) }
   note this[measurable]
 
   { fix N i x assume "\<exists>m\<le>N. x \<in> (\<Union>n\<le>N. B m n)"
     then have "m N x \<in> {m::nat. m \<le> N \<and> x \<in> (\<Union>n\<le>N. B m n)}"
       unfolding m_def by (intro Max_in) auto
     then have "m N x \<le> N" "\<exists>n\<le>N. x \<in> B (m N x) n"
       by auto }
   note m = this
 
   { fix j N i x assume "j \<le> N" "i \<le> N" "x \<in> B j i"
     then have "j \<le> m N x"
       unfolding m_def by (intro Max_ge) auto }
   note m_upper = this
 
   show ?thesis
     unfolding simple_function_def
   proof (safe intro!: exI[of _ F])
     have [measurable]: "\<And>i. F i \<in> borel_measurable M"
       unfolding F_def m_def by measurable
     show "\<And>x i. F i -` {x} \<inter> space M \<in> sets M"
       by measurable
 
     { fix i
       { fix n x assume "x \<in> B (m i x) n"
         then have "(LEAST n. x \<in> B (m i x) n) \<le> n"
           by (intro Least_le)
         also assume "n \<le> i"
         finally have "(LEAST n. x \<in> B (m i x) n) \<le> i" . }
       then have "F i ` space M \<subseteq> {z} \<union> e ` {.. i}"
         by (auto simp: F_def)
       then show "finite (F i ` space M)"
         by (rule finite_subset) auto }
 
     { fix N i n x assume "i \<le> N" "n \<le> N" "x \<in> B i n"
       then have 1: "\<exists>m\<le>N. x \<in> (\<Union>n\<le>N. B m n)" by auto
       from m[OF this] obtain n where n: "m N x \<le> N" "n \<le> N" "x \<in> B (m N x) n" by auto
       moreover
       define L where "L = (LEAST n. x \<in> B (m N x) n)"
       have "dist (f x) (e L) < 1 / Suc (m N x)"
       proof -
         have "x \<in> B (m N x) L"
           using n(3) unfolding L_def by (rule LeastI)
         then have "x \<in> A (m N x) L"
           by auto
         then show ?thesis
           unfolding A_def by simp
       qed
       ultimately have "dist (f x) (F N x) < 1 / Suc (m N x)"
         by (auto simp add: F_def L_def) }
     note * = this
 
     fix x assume "x \<in> space M"
     show "(\<lambda>i. F i x) \<longlonglongrightarrow> f x"
     proof cases
       assume "f x = z"
       then have "\<And>i n. x \<notin> A i n"
         unfolding A_def by auto
       then have "\<And>i. F i x = z"
         by (auto simp: F_def)
       then show ?thesis
         using \<open>f x = z\<close> by auto
     next
       assume "f x \<noteq> z"
 
       show ?thesis
       proof (rule tendstoI)
         fix e :: real assume "0 < e"
         with \<open>f x \<noteq> z\<close> obtain n where "1 / Suc n < e" "1 / Suc n < dist (f x) z"
           by (metis dist_nz order_less_trans neq_iff nat_approx_posE)
         with \<open>x\<in>space M\<close> \<open>f x \<noteq> z\<close> have "x \<in> (\<Union>i. B n i)"
           unfolding A_def B_def UN_disjointed_eq using e by auto
         then obtain i where i: "x \<in> B n i" by auto
 
         show "eventually (\<lambda>i. dist (F i x) (f x) < e) sequentially"
           using eventually_ge_at_top[of "max n i"]
         proof eventually_elim
           fix j assume j: "max n i \<le> j"
           with i have "dist (f x) (F j x) < 1 / Suc (m j x)"
             by (intro *[OF _ _ i]) auto
           also have "\<dots> \<le> 1 / Suc n"
             using j m_upper[OF _ _ i]
             by (auto simp: field_simps)
           also note \<open>1 / Suc n < e\<close>
           finally show "dist (F j x) (f x) < e"
             by (simp add: less_imp_le dist_commute)
         qed
       qed
     qed
     fix i
     { fix n m assume "x \<in> A n m"
       then have "dist (e m) (f x) + dist (f x) z \<le> 2 * dist (f x) z"
         unfolding A_def by (auto simp: dist_commute)
       also have "dist (e m) z \<le> dist (e m) (f x) + dist (f x) z"
         by (rule dist_triangle)
       finally (xtrans) have "dist (e m) z \<le> 2 * dist (f x) z" . }
     then show "dist (F i x) z \<le> 2 * dist (f x) z"
       unfolding F_def
       apply auto
       apply (rule LeastI2)
       apply auto
       done
   qed
 qed
 
 lemma
   fixes f :: "'a \<Rightarrow> 'b::semiring_1" assumes "finite A"
   shows sum_mult_indicator[simp]: "(\<Sum>x \<in> A. f x * indicator (B x) (g x)) = (\<Sum>x\<in>{x\<in>A. g x \<in> B x}. f x)"
   and sum_indicator_mult[simp]: "(\<Sum>x \<in> A. indicator (B x) (g x) * f x) = (\<Sum>x\<in>{x\<in>A. g x \<in> B x}. f x)"
   unfolding indicator_def
   using assms by (auto intro!: sum.mono_neutral_cong_right split: if_split_asm)
 
 lemma borel_measurable_induct_real[consumes 2, case_names set mult add seq]:
   fixes P :: "('a \<Rightarrow> real) \<Rightarrow> bool"
   assumes u: "u \<in> borel_measurable M" "\<And>x. 0 \<le> u x"
   assumes set: "\<And>A. A \<in> sets M \<Longrightarrow> P (indicator A)"
   assumes mult: "\<And>u c. 0 \<le> c \<Longrightarrow> u \<in> borel_measurable M \<Longrightarrow> (\<And>x. 0 \<le> u x) \<Longrightarrow> P u \<Longrightarrow> P (\<lambda>x. c * u x)"
   assumes add: "\<And>u v. u \<in> borel_measurable M \<Longrightarrow> (\<And>x. 0 \<le> u x) \<Longrightarrow> P u \<Longrightarrow> v \<in> borel_measurable M \<Longrightarrow> (\<And>x. 0 \<le> v x) \<Longrightarrow> (\<And>x. x \<in> space M \<Longrightarrow> u x = 0 \<or> v x = 0) \<Longrightarrow> P v \<Longrightarrow> P (\<lambda>x. v x + u x)"
   assumes seq: "\<And>U. (\<And>i. U i \<in> borel_measurable M) \<Longrightarrow> (\<And>i x. 0 \<le> U i x) \<Longrightarrow> (\<And>i. P (U i)) \<Longrightarrow> incseq U \<Longrightarrow> (\<And>x. x \<in> space M \<Longrightarrow> (\<lambda>i. U i x) \<longlonglongrightarrow> u x) \<Longrightarrow> P u"
   shows "P u"
 proof -
   have "(\<lambda>x. ennreal (u x)) \<in> borel_measurable M" using u by auto
   from borel_measurable_implies_simple_function_sequence'[OF this]
   obtain U where U: "\<And>i. simple_function M (U i)" "incseq U" "\<And>i x. U i x < top" and
     sup: "\<And>x. (SUP i. U i x) = ennreal (u x)"
     by blast
 
   define U' where [abs_def]: "U' i x = indicator (space M) x * enn2real (U i x)" for i x
   then have U'_sf[measurable]: "\<And>i. simple_function M (U' i)"
     using U by (auto intro!: simple_function_compose1[where g=enn2real])
 
   show "P u"
   proof (rule seq)
     show U': "U' i \<in> borel_measurable M" "\<And>x. 0 \<le> U' i x" for i
       using U by (auto
           intro: borel_measurable_simple_function
           intro!: borel_measurable_enn2real borel_measurable_times
           simp: U'_def zero_le_mult_iff)
     show "incseq U'"
       using U(2,3)
       by (auto simp: incseq_def le_fun_def image_iff eq_commute U'_def indicator_def enn2real_mono)
 
     fix x assume x: "x \<in> space M"
     have "(\<lambda>i. U i x) \<longlonglongrightarrow> (SUP i. U i x)"
       using U(2) by (intro LIMSEQ_SUP) (auto simp: incseq_def le_fun_def)
     moreover have "(\<lambda>i. U i x) = (\<lambda>i. ennreal (U' i x))"
       using x U(3) by (auto simp: fun_eq_iff U'_def image_iff eq_commute)
     moreover have "(SUP i. U i x) = ennreal (u x)"
       using sup u(2) by (simp add: max_def)
     ultimately show "(\<lambda>i. U' i x) \<longlonglongrightarrow> u x"
       using u U' by simp
   next
     fix i
     have "U' i ` space M \<subseteq> enn2real ` (U i ` space M)" "finite (U i ` space M)"
       unfolding U'_def using U(1) by (auto dest: simple_functionD)
     then have fin: "finite (U' i ` space M)"
       by (metis finite_subset finite_imageI)
     moreover have "\<And>z. {y. U' i z = y \<and> y \<in> U' i ` space M \<and> z \<in> space M} = (if z \<in> space M then {U' i z} else {})"
       by auto
     ultimately have U': "(\<lambda>z. \<Sum>y\<in>U' i`space M. y * indicator {x\<in>space M. U' i x = y} z) = U' i"
       by (simp add: U'_def fun_eq_iff)
     have "\<And>x. x \<in> U' i ` space M \<Longrightarrow> 0 \<le> x"
       by (auto simp: U'_def)
     with fin have "P (\<lambda>z. \<Sum>y\<in>U' i`space M. y * indicator {x\<in>space M. U' i x = y} z)"
     proof induct
       case empty from set[of "{}"] show ?case
         by (simp add: indicator_def[abs_def])
     next
       case (insert x F)
       from insert.prems have nonneg: "x \<ge> 0" "\<And>y. y \<in> F \<Longrightarrow> y \<ge> 0"
         by simp_all
       hence *: "P (\<lambda>xa. x * indicat_real {x' \<in> space M. U' i x' = x} xa)"
         by (intro mult set) auto
       have "P (\<lambda>z. x * indicat_real {x' \<in> space M. U' i x' = x} z + 
                    (\<Sum>y\<in>F. y * indicat_real {x \<in> space M. U' i x = y} z))"
         using insert(1-3)
         by (intro add * sum_nonneg mult_nonneg_nonneg)
-           (auto simp: nonneg indicator_def sum_nonneg_eq_0_iff)
+           (auto simp: nonneg indicator_def of_bool_def sum_nonneg_eq_0_iff)
       thus ?case 
         using insert.hyps by (subst sum.insert) auto
     qed
     with U' show "P (U' i)" by simp
   qed
 qed
 
 lemma scaleR_cong_right:
   fixes x :: "'a :: real_vector"
   shows "(x \<noteq> 0 \<Longrightarrow> r = p) \<Longrightarrow> r *\<^sub>R x = p *\<^sub>R x"
   by (cases "x = 0") auto
 
 inductive simple_bochner_integrable :: "'a measure \<Rightarrow> ('a \<Rightarrow> 'b::real_vector) \<Rightarrow> bool" for M f where
   "simple_function M f \<Longrightarrow> emeasure M {y\<in>space M. f y \<noteq> 0} \<noteq> \<infinity> \<Longrightarrow>
     simple_bochner_integrable M f"
 
 lemma simple_bochner_integrable_compose2:
   assumes p_0: "p 0 0 = 0"
   shows "simple_bochner_integrable M f \<Longrightarrow> simple_bochner_integrable M g \<Longrightarrow>
     simple_bochner_integrable M (\<lambda>x. p (f x) (g x))"
 proof (safe intro!: simple_bochner_integrable.intros elim!: simple_bochner_integrable.cases del: notI)
   assume sf: "simple_function M f" "simple_function M g"
   then show "simple_function M (\<lambda>x. p (f x) (g x))"
     by (rule simple_function_compose2)
 
   from sf have [measurable]:
       "f \<in> measurable M (count_space UNIV)"
       "g \<in> measurable M (count_space UNIV)"
     by (auto intro: measurable_simple_function)
 
   assume fin: "emeasure M {y \<in> space M. f y \<noteq> 0} \<noteq> \<infinity>" "emeasure M {y \<in> space M. g y \<noteq> 0} \<noteq> \<infinity>"
 
   have "emeasure M {x\<in>space M. p (f x) (g x) \<noteq> 0} \<le>
       emeasure M ({x\<in>space M. f x \<noteq> 0} \<union> {x\<in>space M. g x \<noteq> 0})"
     by (intro emeasure_mono) (auto simp: p_0)
   also have "\<dots> \<le> emeasure M {x\<in>space M. f x \<noteq> 0} + emeasure M {x\<in>space M. g x \<noteq> 0}"
     by (intro emeasure_subadditive) auto
   finally show "emeasure M {y \<in> space M. p (f y) (g y) \<noteq> 0} \<noteq> \<infinity>"
     using fin by (auto simp: top_unique)
 qed
 
 lemma simple_function_finite_support:
   assumes f: "simple_function M f" and fin: "(\<integral>\<^sup>+x. f x \<partial>M) < \<infinity>" and nn: "\<And>x. 0 \<le> f x"
   shows "emeasure M {x\<in>space M. f x \<noteq> 0} \<noteq> \<infinity>"
 proof cases
   from f have meas[measurable]: "f \<in> borel_measurable M"
     by (rule borel_measurable_simple_function)
 
   assume non_empty: "\<exists>x\<in>space M. f x \<noteq> 0"
 
   define m where "m = Min (f`space M - {0})"
   have "m \<in> f`space M - {0}"
     unfolding m_def using f non_empty by (intro Min_in) (auto simp: simple_function_def)
   then have m: "0 < m"
     using nn by (auto simp: less_le)
 
   from m have "m * emeasure M {x\<in>space M. 0 \<noteq> f x} =
     (\<integral>\<^sup>+x. m * indicator {x\<in>space M. 0 \<noteq> f x} x \<partial>M)"
     using f by (intro nn_integral_cmult_indicator[symmetric]) auto
   also have "\<dots> \<le> (\<integral>\<^sup>+x. f x \<partial>M)"
     using AE_space
   proof (intro nn_integral_mono_AE, eventually_elim)
     fix x assume "x \<in> space M"
     with nn show "m * indicator {x \<in> space M. 0 \<noteq> f x} x \<le> f x"
       using f by (auto split: split_indicator simp: simple_function_def m_def)
   qed
   also note \<open>\<dots> < \<infinity>\<close>
   finally show ?thesis
     using m by (auto simp: ennreal_mult_less_top)
 next
   assume "\<not> (\<exists>x\<in>space M. f x \<noteq> 0)"
   with nn have *: "{x\<in>space M. f x \<noteq> 0} = {}"
     by auto
   show ?thesis unfolding * by simp
 qed
 
 lemma simple_bochner_integrableI_bounded:
   assumes f: "simple_function M f" and fin: "(\<integral>\<^sup>+x. norm (f x) \<partial>M) < \<infinity>"
   shows "simple_bochner_integrable M f"
 proof
   have "emeasure M {y \<in> space M. ennreal (norm (f y)) \<noteq> 0} \<noteq> \<infinity>"
   proof (rule simple_function_finite_support)
     show "simple_function M (\<lambda>x. ennreal (norm (f x)))"
       using f by (rule simple_function_compose1)
     show "(\<integral>\<^sup>+ y. ennreal (norm (f y)) \<partial>M) < \<infinity>" by fact
   qed simp
   then show "emeasure M {y \<in> space M. f y \<noteq> 0} \<noteq> \<infinity>" by simp
 qed fact
 
 definition\<^marker>\<open>tag important\<close> simple_bochner_integral :: "'a measure \<Rightarrow> ('a \<Rightarrow> 'b::real_vector) \<Rightarrow> 'b" where
   "simple_bochner_integral M f = (\<Sum>y\<in>f`space M. measure M {x\<in>space M. f x = y} *\<^sub>R y)"
 
 proposition simple_bochner_integral_partition:
   assumes f: "simple_bochner_integrable M f" and g: "simple_function M g"
   assumes sub: "\<And>x y. x \<in> space M \<Longrightarrow> y \<in> space M \<Longrightarrow> g x = g y \<Longrightarrow> f x = f y"
   assumes v: "\<And>x. x \<in> space M \<Longrightarrow> f x = v (g x)"
   shows "simple_bochner_integral M f = (\<Sum>y\<in>g ` space M. measure M {x\<in>space M. g x = y} *\<^sub>R v y)"
     (is "_ = ?r")
 proof -
   from f g have [simp]: "finite (f`space M)" "finite (g`space M)"
     by (auto simp: simple_function_def elim: simple_bochner_integrable.cases)
 
   from f have [measurable]: "f \<in> measurable M (count_space UNIV)"
     by (auto intro: measurable_simple_function elim: simple_bochner_integrable.cases)
 
   from g have [measurable]: "g \<in> measurable M (count_space UNIV)"
     by (auto intro: measurable_simple_function elim: simple_bochner_integrable.cases)
 
   { fix y assume "y \<in> space M"
     then have "f ` space M \<inter> {i. \<exists>x\<in>space M. i = f x \<and> g y = g x} = {v (g y)}"
       by (auto cong: sub simp: v[symmetric]) }
   note eq = this
 
   have "simple_bochner_integral M f =
     (\<Sum>y\<in>f`space M. (\<Sum>z\<in>g`space M.
       if \<exists>x\<in>space M. y = f x \<and> z = g x then measure M {x\<in>space M. g x = z} else 0) *\<^sub>R y)"
     unfolding simple_bochner_integral_def
   proof (safe intro!: sum.cong scaleR_cong_right)
     fix y assume y: "y \<in> space M" "f y \<noteq> 0"
     have [simp]: "g ` space M \<inter> {z. \<exists>x\<in>space M. f y = f x \<and> z = g x} =
         {z. \<exists>x\<in>space M. f y = f x \<and> z = g x}"
       by auto
     have eq:"{x \<in> space M. f x = f y} =
         (\<Union>i\<in>{z. \<exists>x\<in>space M. f y = f x \<and> z = g x}. {x \<in> space M. g x = i})"
       by (auto simp: eq_commute cong: sub rev_conj_cong)
     have "finite (g`space M)" by simp
     then have "finite {z. \<exists>x\<in>space M. f y = f x \<and> z = g x}"
       by (rule rev_finite_subset) auto
     moreover
     { fix x assume "x \<in> space M" "f x = f y"
       then have "x \<in> space M" "f x \<noteq> 0"
         using y by auto
       then have "emeasure M {y \<in> space M. g y = g x} \<le> emeasure M {y \<in> space M. f y \<noteq> 0}"
         by (auto intro!: emeasure_mono cong: sub)
       then have "emeasure M {xa \<in> space M. g xa = g x} < \<infinity>"
         using f by (auto simp: simple_bochner_integrable.simps less_top) }
     ultimately
     show "measure M {x \<in> space M. f x = f y} =
       (\<Sum>z\<in>g ` space M. if \<exists>x\<in>space M. f y = f x \<and> z = g x then measure M {x \<in> space M. g x = z} else 0)"
       apply (simp add: sum.If_cases eq)
       apply (subst measure_finite_Union[symmetric])
       apply (auto simp: disjoint_family_on_def less_top)
       done
   qed
   also have "\<dots> = (\<Sum>y\<in>f`space M. (\<Sum>z\<in>g`space M.
       if \<exists>x\<in>space M. y = f x \<and> z = g x then measure M {x\<in>space M. g x = z} *\<^sub>R y else 0))"
     by (auto intro!: sum.cong simp: scaleR_sum_left)
   also have "\<dots> = ?r"
     by (subst sum.swap)
        (auto intro!: sum.cong simp: sum.If_cases scaleR_sum_right[symmetric] eq)
   finally show "simple_bochner_integral M f = ?r" .
 qed
 
 lemma simple_bochner_integral_add:
   assumes f: "simple_bochner_integrable M f" and g: "simple_bochner_integrable M g"
   shows "simple_bochner_integral M (\<lambda>x. f x + g x) =
     simple_bochner_integral M f + simple_bochner_integral M g"
 proof -
   from f g have "simple_bochner_integral M (\<lambda>x. f x + g x) =
     (\<Sum>y\<in>(\<lambda>x. (f x, g x)) ` space M. measure M {x \<in> space M. (f x, g x) = y} *\<^sub>R (fst y + snd y))"
     by (intro simple_bochner_integral_partition)
        (auto simp: simple_bochner_integrable_compose2 elim: simple_bochner_integrable.cases)
   moreover from f g have "simple_bochner_integral M f =
     (\<Sum>y\<in>(\<lambda>x. (f x, g x)) ` space M. measure M {x \<in> space M. (f x, g x) = y} *\<^sub>R fst y)"
     by (intro simple_bochner_integral_partition)
        (auto simp: simple_bochner_integrable_compose2 elim: simple_bochner_integrable.cases)
   moreover from f g have "simple_bochner_integral M g =
     (\<Sum>y\<in>(\<lambda>x. (f x, g x)) ` space M. measure M {x \<in> space M. (f x, g x) = y} *\<^sub>R snd y)"
     by (intro simple_bochner_integral_partition)
        (auto simp: simple_bochner_integrable_compose2 elim: simple_bochner_integrable.cases)
   ultimately show ?thesis
     by (simp add: sum.distrib[symmetric] scaleR_add_right)
 qed
 
 lemma simple_bochner_integral_linear:
   assumes "linear f"
   assumes g: "simple_bochner_integrable M g"
   shows "simple_bochner_integral M (\<lambda>x. f (g x)) = f (simple_bochner_integral M g)"
 proof -
   interpret linear f by fact
   from g have "simple_bochner_integral M (\<lambda>x. f (g x)) =
     (\<Sum>y\<in>g ` space M. measure M {x \<in> space M. g x = y} *\<^sub>R f y)"
     by (intro simple_bochner_integral_partition)
        (auto simp: simple_bochner_integrable_compose2[where p="\<lambda>x y. f x"]
              elim: simple_bochner_integrable.cases)
   also have "\<dots> = f (simple_bochner_integral M g)"
     by (simp add: simple_bochner_integral_def sum scale)
   finally show ?thesis .
 qed
 
 lemma simple_bochner_integral_minus:
   assumes f: "simple_bochner_integrable M f"
   shows "simple_bochner_integral M (\<lambda>x. - f x) = - simple_bochner_integral M f"
 proof -
   from linear_uminus f show ?thesis
     by (rule simple_bochner_integral_linear)
 qed
 
 lemma simple_bochner_integral_diff:
   assumes f: "simple_bochner_integrable M f" and g: "simple_bochner_integrable M g"
   shows "simple_bochner_integral M (\<lambda>x. f x - g x) =
     simple_bochner_integral M f - simple_bochner_integral M g"
   unfolding diff_conv_add_uminus using f g
   by (subst simple_bochner_integral_add)
      (auto simp: simple_bochner_integral_minus simple_bochner_integrable_compose2[where p="\<lambda>x y. - y"])
 
 lemma simple_bochner_integral_norm_bound:
   assumes f: "simple_bochner_integrable M f"
   shows "norm (simple_bochner_integral M f) \<le> simple_bochner_integral M (\<lambda>x. norm (f x))"
 proof -
   have "norm (simple_bochner_integral M f) \<le>
     (\<Sum>y\<in>f ` space M. norm (measure M {x \<in> space M. f x = y} *\<^sub>R y))"
     unfolding simple_bochner_integral_def by (rule norm_sum)
   also have "\<dots> = (\<Sum>y\<in>f ` space M. measure M {x \<in> space M. f x = y} *\<^sub>R norm y)"
     by simp
   also have "\<dots> = simple_bochner_integral M (\<lambda>x. norm (f x))"
     using f
     by (intro simple_bochner_integral_partition[symmetric])
        (auto intro: f simple_bochner_integrable_compose2 elim: simple_bochner_integrable.cases)
   finally show ?thesis .
 qed
 
 lemma simple_bochner_integral_nonneg[simp]:
   fixes f :: "'a \<Rightarrow> real"
   shows "(\<And>x. 0 \<le> f x) \<Longrightarrow> 0 \<le> simple_bochner_integral M f"
   by (force simp add: simple_bochner_integral_def intro: sum_nonneg)
 
 lemma simple_bochner_integral_eq_nn_integral:
   assumes f: "simple_bochner_integrable M f" "\<And>x. 0 \<le> f x"
   shows "simple_bochner_integral M f = (\<integral>\<^sup>+x. f x \<partial>M)"
 proof -
   { fix x y z have "(x \<noteq> 0 \<Longrightarrow> y = z) \<Longrightarrow> ennreal x * y = ennreal x * z"
       by (cases "x = 0") (auto simp: zero_ennreal_def[symmetric]) }
   note ennreal_cong_mult = this
 
   have [measurable]: "f \<in> borel_measurable M"
     using f(1) by (auto intro: borel_measurable_simple_function elim: simple_bochner_integrable.cases)
 
   { fix y assume y: "y \<in> space M" "f y \<noteq> 0"
     have "ennreal (measure M {x \<in> space M. f x = f y}) = emeasure M {x \<in> space M. f x = f y}"
     proof (rule emeasure_eq_ennreal_measure[symmetric])
       have "emeasure M {x \<in> space M. f x = f y} \<le> emeasure M {x \<in> space M. f x \<noteq> 0}"
         using y by (intro emeasure_mono) auto
       with f show "emeasure M {x \<in> space M. f x = f y} \<noteq> top"
         by (auto simp: simple_bochner_integrable.simps top_unique)
     qed
     moreover have "{x \<in> space M. f x = f y} = (\<lambda>x. ennreal (f x)) -` {ennreal (f y)} \<inter> space M"
       using f by auto
     ultimately have "ennreal (measure M {x \<in> space M. f x = f y}) =
           emeasure M ((\<lambda>x. ennreal (f x)) -` {ennreal (f y)} \<inter> space M)" by simp }
   with f have "simple_bochner_integral M f = (\<integral>\<^sup>Sx. f x \<partial>M)"
     unfolding simple_integral_def
     by (subst simple_bochner_integral_partition[OF f(1), where g="\<lambda>x. ennreal (f x)" and v=enn2real])
        (auto intro: f simple_function_compose1 elim: simple_bochner_integrable.cases
              intro!: sum.cong ennreal_cong_mult
              simp: ac_simps ennreal_mult
              simp flip: sum_ennreal)
   also have "\<dots> = (\<integral>\<^sup>+x. f x \<partial>M)"
     using f
     by (intro nn_integral_eq_simple_integral[symmetric])
        (auto simp: simple_function_compose1 simple_bochner_integrable.simps)
   finally show ?thesis .
 qed
 
 lemma simple_bochner_integral_bounded:
   fixes f :: "'a \<Rightarrow> 'b::{real_normed_vector, second_countable_topology}"
   assumes f[measurable]: "f \<in> borel_measurable M"
   assumes s: "simple_bochner_integrable M s" and t: "simple_bochner_integrable M t"
   shows "ennreal (norm (simple_bochner_integral M s - simple_bochner_integral M t)) \<le>
     (\<integral>\<^sup>+ x. norm (f x - s x) \<partial>M) + (\<integral>\<^sup>+ x. norm (f x - t x) \<partial>M)"
     (is "ennreal (norm (?s - ?t)) \<le> ?S + ?T")
 proof -
   have [measurable]: "s \<in> borel_measurable M" "t \<in> borel_measurable M"
     using s t by (auto intro: borel_measurable_simple_function elim: simple_bochner_integrable.cases)
 
   have "ennreal (norm (?s - ?t)) = norm (simple_bochner_integral M (\<lambda>x. s x - t x))"
     using s t by (subst simple_bochner_integral_diff) auto
   also have "\<dots> \<le> simple_bochner_integral M (\<lambda>x. norm (s x - t x))"
     using simple_bochner_integrable_compose2[of "(-)" M "s" "t"] s t
     by (auto intro!: simple_bochner_integral_norm_bound)
   also have "\<dots> = (\<integral>\<^sup>+x. norm (s x - t x) \<partial>M)"
     using simple_bochner_integrable_compose2[of "\<lambda>x y. norm (x - y)" M "s" "t"] s t
     by (auto intro!: simple_bochner_integral_eq_nn_integral)
   also have "\<dots> \<le> (\<integral>\<^sup>+x. ennreal (norm (f x - s x)) + ennreal (norm (f x - t x)) \<partial>M)"
     by (auto intro!: nn_integral_mono simp flip: ennreal_plus)
        (metis (erased, hide_lams) add_diff_cancel_left add_diff_eq diff_add_eq order_trans
               norm_minus_commute norm_triangle_ineq4 order_refl)
   also have "\<dots> = ?S + ?T"
    by (rule nn_integral_add) auto
   finally show ?thesis .
 qed
 
 inductive has_bochner_integral :: "'a measure \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> 'b::{real_normed_vector, second_countable_topology} \<Rightarrow> bool"
   for M f x where
   "f \<in> borel_measurable M \<Longrightarrow>
     (\<And>i. simple_bochner_integrable M (s i)) \<Longrightarrow>
     (\<lambda>i. \<integral>\<^sup>+x. norm (f x - s i x) \<partial>M) \<longlonglongrightarrow> 0 \<Longrightarrow>
     (\<lambda>i. simple_bochner_integral M (s i)) \<longlonglongrightarrow> x \<Longrightarrow>
     has_bochner_integral M f x"
 
 lemma has_bochner_integral_cong:
   assumes "M = N" "\<And>x. x \<in> space N \<Longrightarrow> f x = g x" "x = y"
   shows "has_bochner_integral M f x \<longleftrightarrow> has_bochner_integral N g y"
   unfolding has_bochner_integral.simps assms(1,3)
   using assms(2) by (simp cong: measurable_cong_simp nn_integral_cong_simp)
 
 lemma has_bochner_integral_cong_AE:
   "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow> (AE x in M. f x = g x) \<Longrightarrow>
     has_bochner_integral M f x \<longleftrightarrow> has_bochner_integral M g x"
   unfolding has_bochner_integral.simps
   by (intro arg_cong[where f=Ex] ext conj_cong rev_conj_cong refl arg_cong[where f="\<lambda>x. x \<longlonglongrightarrow> 0"]
             nn_integral_cong_AE)
      auto
 
 lemma borel_measurable_has_bochner_integral:
   "has_bochner_integral M f x \<Longrightarrow> f \<in> borel_measurable M"
   by (rule has_bochner_integral.cases)
 
 lemma borel_measurable_has_bochner_integral'[measurable_dest]:
   "has_bochner_integral M f x \<Longrightarrow> g \<in> measurable N M \<Longrightarrow> (\<lambda>x. f (g x)) \<in> borel_measurable N"
   using borel_measurable_has_bochner_integral[measurable] by measurable
 
 lemma has_bochner_integral_simple_bochner_integrable:
   "simple_bochner_integrable M f \<Longrightarrow> has_bochner_integral M f (simple_bochner_integral M f)"
   by (rule has_bochner_integral.intros[where s="\<lambda>_. f"])
      (auto intro: borel_measurable_simple_function
            elim: simple_bochner_integrable.cases
            simp: zero_ennreal_def[symmetric])
 
 lemma has_bochner_integral_real_indicator:
   assumes [measurable]: "A \<in> sets M" and A: "emeasure M A < \<infinity>"
   shows "has_bochner_integral M (indicator A) (measure M A)"
 proof -
   have sbi: "simple_bochner_integrable M (indicator A::'a \<Rightarrow> real)"
   proof
     have "{y \<in> space M. (indicator A y::real) \<noteq> 0} = A"
       using sets.sets_into_space[OF \<open>A\<in>sets M\<close>] by (auto split: split_indicator)
     then show "emeasure M {y \<in> space M. (indicator A y::real) \<noteq> 0} \<noteq> \<infinity>"
       using A by auto
   qed (rule simple_function_indicator assms)+
   moreover have "simple_bochner_integral M (indicator A) = measure M A"
     using simple_bochner_integral_eq_nn_integral[OF sbi] A
     by (simp add: ennreal_indicator emeasure_eq_ennreal_measure)
   ultimately show ?thesis
     by (metis has_bochner_integral_simple_bochner_integrable)
 qed
 
 lemma has_bochner_integral_add[intro]:
   "has_bochner_integral M f x \<Longrightarrow> has_bochner_integral M g y \<Longrightarrow>
     has_bochner_integral M (\<lambda>x. f x + g x) (x + y)"
 proof (safe intro!: has_bochner_integral.intros elim!: has_bochner_integral.cases)
   fix sf sg
   assume f_sf: "(\<lambda>i. \<integral>\<^sup>+ x. norm (f x - sf i x) \<partial>M) \<longlonglongrightarrow> 0"
   assume g_sg: "(\<lambda>i. \<integral>\<^sup>+ x. norm (g x - sg i x) \<partial>M) \<longlonglongrightarrow> 0"
 
   assume sf: "\<forall>i. simple_bochner_integrable M (sf i)"
     and sg: "\<forall>i. simple_bochner_integrable M (sg i)"
   then have [measurable]: "\<And>i. sf i \<in> borel_measurable M" "\<And>i. sg i \<in> borel_measurable M"
     by (auto intro: borel_measurable_simple_function elim: simple_bochner_integrable.cases)
   assume [measurable]: "f \<in> borel_measurable M" "g \<in> borel_measurable M"
 
   show "\<And>i. simple_bochner_integrable M (\<lambda>x. sf i x + sg i x)"
     using sf sg by (simp add: simple_bochner_integrable_compose2)
 
   show "(\<lambda>i. \<integral>\<^sup>+ x. (norm (f x + g x - (sf i x + sg i x))) \<partial>M) \<longlonglongrightarrow> 0"
     (is "?f \<longlonglongrightarrow> 0")
   proof (rule tendsto_sandwich)
     show "eventually (\<lambda>n. 0 \<le> ?f n) sequentially" "(\<lambda>_. 0) \<longlonglongrightarrow> 0"
       by auto
     show "eventually (\<lambda>i. ?f i \<le> (\<integral>\<^sup>+ x. (norm (f x - sf i x)) \<partial>M) + \<integral>\<^sup>+ x. (norm (g x - sg i x)) \<partial>M) sequentially"
       (is "eventually (\<lambda>i. ?f i \<le> ?g i) sequentially")
     proof (intro always_eventually allI)
       fix i have "?f i \<le> (\<integral>\<^sup>+ x. (norm (f x - sf i x)) + ennreal (norm (g x - sg i x)) \<partial>M)"
         by (auto intro!: nn_integral_mono norm_diff_triangle_ineq
                  simp flip: ennreal_plus)
       also have "\<dots> = ?g i"
         by (intro nn_integral_add) auto
       finally show "?f i \<le> ?g i" .
     qed
     show "?g \<longlonglongrightarrow> 0"
       using tendsto_add[OF f_sf g_sg] by simp
   qed
 qed (auto simp: simple_bochner_integral_add tendsto_add)
 
 lemma has_bochner_integral_bounded_linear:
   assumes "bounded_linear T"
   shows "has_bochner_integral M f x \<Longrightarrow> has_bochner_integral M (\<lambda>x. T (f x)) (T x)"
 proof (safe intro!: has_bochner_integral.intros elim!: has_bochner_integral.cases)
   interpret T: bounded_linear T by fact
   have [measurable]: "T \<in> borel_measurable borel"
     by (intro borel_measurable_continuous_onI T.continuous_on continuous_on_id)
   assume [measurable]: "f \<in> borel_measurable M"
   then show "(\<lambda>x. T (f x)) \<in> borel_measurable M"
     by auto
 
   fix s assume f_s: "(\<lambda>i. \<integral>\<^sup>+ x. norm (f x - s i x) \<partial>M) \<longlonglongrightarrow> 0"
   assume s: "\<forall>i. simple_bochner_integrable M (s i)"
   then show "\<And>i. simple_bochner_integrable M (\<lambda>x. T (s i x))"
     by (auto intro: simple_bochner_integrable_compose2 T.zero)
 
   have [measurable]: "\<And>i. s i \<in> borel_measurable M"
     using s by (auto intro: borel_measurable_simple_function elim: simple_bochner_integrable.cases)
 
   obtain K where K: "K > 0" "\<And>x i. norm (T (f x) - T (s i x)) \<le> norm (f x - s i x) * K"
     using T.pos_bounded by (auto simp: T.diff[symmetric])
 
   show "(\<lambda>i. \<integral>\<^sup>+ x. norm (T (f x) - T (s i x)) \<partial>M) \<longlonglongrightarrow> 0"
     (is "?f \<longlonglongrightarrow> 0")
   proof (rule tendsto_sandwich)
     show "eventually (\<lambda>n. 0 \<le> ?f n) sequentially" "(\<lambda>_. 0) \<longlonglongrightarrow> 0"
       by auto
 
     show "eventually (\<lambda>i. ?f i \<le> K * (\<integral>\<^sup>+ x. norm (f x - s i x) \<partial>M)) sequentially"
       (is "eventually (\<lambda>i. ?f i \<le> ?g i) sequentially")
     proof (intro always_eventually allI)
       fix i have "?f i \<le> (\<integral>\<^sup>+ x. ennreal K * norm (f x - s i x) \<partial>M)"
         using K by (intro nn_integral_mono) (auto simp: ac_simps ennreal_mult[symmetric])
       also have "\<dots> = ?g i"
         using K by (intro nn_integral_cmult) auto
       finally show "?f i \<le> ?g i" .
     qed
     show "?g \<longlonglongrightarrow> 0"
       using ennreal_tendsto_cmult[OF _ f_s] by simp
   qed
 
   assume "(\<lambda>i. simple_bochner_integral M (s i)) \<longlonglongrightarrow> x"
   with s show "(\<lambda>i. simple_bochner_integral M (\<lambda>x. T (s i x))) \<longlonglongrightarrow> T x"
     by (auto intro!: T.tendsto simp: simple_bochner_integral_linear T.linear_axioms)
 qed
 
 lemma has_bochner_integral_zero[intro]: "has_bochner_integral M (\<lambda>x. 0) 0"
   by (auto intro!: has_bochner_integral.intros[where s="\<lambda>_ _. 0"]
            simp: zero_ennreal_def[symmetric] simple_bochner_integrable.simps
                  simple_bochner_integral_def image_constant_conv)
 
 lemma has_bochner_integral_scaleR_left[intro]:
   "(c \<noteq> 0 \<Longrightarrow> has_bochner_integral M f x) \<Longrightarrow> has_bochner_integral M (\<lambda>x. f x *\<^sub>R c) (x *\<^sub>R c)"
   by (cases "c = 0") (auto simp add: has_bochner_integral_bounded_linear[OF bounded_linear_scaleR_left])
 
 lemma has_bochner_integral_scaleR_right[intro]:
   "(c \<noteq> 0 \<Longrightarrow> has_bochner_integral M f x) \<Longrightarrow> has_bochner_integral M (\<lambda>x. c *\<^sub>R f x) (c *\<^sub>R x)"
   by (cases "c = 0") (auto simp add: has_bochner_integral_bounded_linear[OF bounded_linear_scaleR_right])
 
 lemma has_bochner_integral_mult_left[intro]:
   fixes c :: "_::{real_normed_algebra,second_countable_topology}"
   shows "(c \<noteq> 0 \<Longrightarrow> has_bochner_integral M f x) \<Longrightarrow> has_bochner_integral M (\<lambda>x. f x * c) (x * c)"
   by (cases "c = 0") (auto simp add: has_bochner_integral_bounded_linear[OF bounded_linear_mult_left])
 
 lemma has_bochner_integral_mult_right[intro]:
   fixes c :: "_::{real_normed_algebra,second_countable_topology}"
   shows "(c \<noteq> 0 \<Longrightarrow> has_bochner_integral M f x) \<Longrightarrow> has_bochner_integral M (\<lambda>x. c * f x) (c * x)"
   by (cases "c = 0") (auto simp add: has_bochner_integral_bounded_linear[OF bounded_linear_mult_right])
 
 lemmas has_bochner_integral_divide =
   has_bochner_integral_bounded_linear[OF bounded_linear_divide]
 
 lemma has_bochner_integral_divide_zero[intro]:
   fixes c :: "_::{real_normed_field, field, second_countable_topology}"
   shows "(c \<noteq> 0 \<Longrightarrow> has_bochner_integral M f x) \<Longrightarrow> has_bochner_integral M (\<lambda>x. f x / c) (x / c)"
   using has_bochner_integral_divide by (cases "c = 0") auto
 
 lemma has_bochner_integral_inner_left[intro]:
   "(c \<noteq> 0 \<Longrightarrow> has_bochner_integral M f x) \<Longrightarrow> has_bochner_integral M (\<lambda>x. f x \<bullet> c) (x \<bullet> c)"
   by (cases "c = 0") (auto simp add: has_bochner_integral_bounded_linear[OF bounded_linear_inner_left])
 
 lemma has_bochner_integral_inner_right[intro]:
   "(c \<noteq> 0 \<Longrightarrow> has_bochner_integral M f x) \<Longrightarrow> has_bochner_integral M (\<lambda>x. c \<bullet> f x) (c \<bullet> x)"
   by (cases "c = 0") (auto simp add: has_bochner_integral_bounded_linear[OF bounded_linear_inner_right])
 
 lemmas has_bochner_integral_minus =
   has_bochner_integral_bounded_linear[OF bounded_linear_minus[OF bounded_linear_ident]]
 lemmas has_bochner_integral_Re =
   has_bochner_integral_bounded_linear[OF bounded_linear_Re]
 lemmas has_bochner_integral_Im =
   has_bochner_integral_bounded_linear[OF bounded_linear_Im]
 lemmas has_bochner_integral_cnj =
   has_bochner_integral_bounded_linear[OF bounded_linear_cnj]
 lemmas has_bochner_integral_of_real =
   has_bochner_integral_bounded_linear[OF bounded_linear_of_real]
 lemmas has_bochner_integral_fst =
   has_bochner_integral_bounded_linear[OF bounded_linear_fst]
 lemmas has_bochner_integral_snd =
   has_bochner_integral_bounded_linear[OF bounded_linear_snd]
 
 lemma has_bochner_integral_indicator:
   "A \<in> sets M \<Longrightarrow> emeasure M A < \<infinity> \<Longrightarrow>
     has_bochner_integral M (\<lambda>x. indicator A x *\<^sub>R c) (measure M A *\<^sub>R c)"
   by (intro has_bochner_integral_scaleR_left has_bochner_integral_real_indicator)
 
 lemma has_bochner_integral_diff:
   "has_bochner_integral M f x \<Longrightarrow> has_bochner_integral M g y \<Longrightarrow>
     has_bochner_integral M (\<lambda>x. f x - g x) (x - y)"
   unfolding diff_conv_add_uminus
   by (intro has_bochner_integral_add has_bochner_integral_minus)
 
 lemma has_bochner_integral_sum:
   "(\<And>i. i \<in> I \<Longrightarrow> has_bochner_integral M (f i) (x i)) \<Longrightarrow>
     has_bochner_integral M (\<lambda>x. \<Sum>i\<in>I. f i x) (\<Sum>i\<in>I. x i)"
   by (induct I rule: infinite_finite_induct) auto
 
 proposition has_bochner_integral_implies_finite_norm:
   "has_bochner_integral M f x \<Longrightarrow> (\<integral>\<^sup>+x. norm (f x) \<partial>M) < \<infinity>"
 proof (elim has_bochner_integral.cases)
   fix s v
   assume [measurable]: "f \<in> borel_measurable M" and s: "\<And>i. simple_bochner_integrable M (s i)" and
     lim_0: "(\<lambda>i. \<integral>\<^sup>+ x. ennreal (norm (f x - s i x)) \<partial>M) \<longlonglongrightarrow> 0"
   from order_tendstoD[OF lim_0, of "\<infinity>"]
   obtain i where f_s_fin: "(\<integral>\<^sup>+ x. ennreal (norm (f x - s i x)) \<partial>M) < \<infinity>"
     by (auto simp: eventually_sequentially)
 
   have [measurable]: "\<And>i. s i \<in> borel_measurable M"
     using s by (auto intro: borel_measurable_simple_function elim: simple_bochner_integrable.cases)
 
   define m where "m = (if space M = {} then 0 else Max ((\<lambda>x. norm (s i x))`space M))"
   have "finite (s i ` space M)"
     using s by (auto simp: simple_function_def simple_bochner_integrable.simps)
   then have "finite (norm ` s i ` space M)"
     by (rule finite_imageI)
   then have "\<And>x. x \<in> space M \<Longrightarrow> norm (s i x) \<le> m" "0 \<le> m"
     by (auto simp: m_def image_comp comp_def Max_ge_iff)
   then have "(\<integral>\<^sup>+x. norm (s i x) \<partial>M) \<le> (\<integral>\<^sup>+x. ennreal m * indicator {x\<in>space M. s i x \<noteq> 0} x \<partial>M)"
     by (auto split: split_indicator intro!: Max_ge nn_integral_mono simp:)
   also have "\<dots> < \<infinity>"
     using s by (subst nn_integral_cmult_indicator) (auto simp: \<open>0 \<le> m\<close> simple_bochner_integrable.simps ennreal_mult_less_top less_top)
   finally have s_fin: "(\<integral>\<^sup>+x. norm (s i x) \<partial>M) < \<infinity>" .
 
   have "(\<integral>\<^sup>+ x. norm (f x) \<partial>M) \<le> (\<integral>\<^sup>+ x. ennreal (norm (f x - s i x)) + ennreal (norm (s i x)) \<partial>M)"
     by (auto intro!: nn_integral_mono simp flip: ennreal_plus)
        (metis add.commute norm_triangle_sub)
   also have "\<dots> = (\<integral>\<^sup>+x. norm (f x - s i x) \<partial>M) + (\<integral>\<^sup>+x. norm (s i x) \<partial>M)"
     by (rule nn_integral_add) auto
   also have "\<dots> < \<infinity>"
     using s_fin f_s_fin by auto
   finally show "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M) < \<infinity>" .
 qed
 
 proposition has_bochner_integral_norm_bound:
   assumes i: "has_bochner_integral M f x"
   shows "norm x \<le> (\<integral>\<^sup>+x. norm (f x) \<partial>M)"
 using assms proof
   fix s assume
     x: "(\<lambda>i. simple_bochner_integral M (s i)) \<longlonglongrightarrow> x" (is "?s \<longlonglongrightarrow> x") and
     s[simp]: "\<And>i. simple_bochner_integrable M (s i)" and
     lim: "(\<lambda>i. \<integral>\<^sup>+ x. ennreal (norm (f x - s i x)) \<partial>M) \<longlonglongrightarrow> 0" and
     f[measurable]: "f \<in> borel_measurable M"
 
   have [measurable]: "\<And>i. s i \<in> borel_measurable M"
     using s by (auto simp: simple_bochner_integrable.simps intro: borel_measurable_simple_function)
 
   show "norm x \<le> (\<integral>\<^sup>+x. norm (f x) \<partial>M)"
   proof (rule LIMSEQ_le)
     show "(\<lambda>i. ennreal (norm (?s i))) \<longlonglongrightarrow> norm x"
       using x by (auto simp: tendsto_ennreal_iff intro: tendsto_intros)
     show "\<exists>N. \<forall>n\<ge>N. norm (?s n) \<le> (\<integral>\<^sup>+x. norm (f x - s n x) \<partial>M) + (\<integral>\<^sup>+x. norm (f x) \<partial>M)"
       (is "\<exists>N. \<forall>n\<ge>N. _ \<le> ?t n")
     proof (intro exI allI impI)
       fix n
       have "ennreal (norm (?s n)) \<le> simple_bochner_integral M (\<lambda>x. norm (s n x))"
         by (auto intro!: simple_bochner_integral_norm_bound)
       also have "\<dots> = (\<integral>\<^sup>+x. norm (s n x) \<partial>M)"
         by (intro simple_bochner_integral_eq_nn_integral)
            (auto intro: s simple_bochner_integrable_compose2)
       also have "\<dots> \<le> (\<integral>\<^sup>+x. ennreal (norm (f x - s n x)) + norm (f x) \<partial>M)"
         by (auto intro!: nn_integral_mono simp flip: ennreal_plus)
            (metis add.commute norm_minus_commute norm_triangle_sub)
       also have "\<dots> = ?t n"
         by (rule nn_integral_add) auto
       finally show "norm (?s n) \<le> ?t n" .
     qed
     have "?t \<longlonglongrightarrow> 0 + (\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M)"
       using has_bochner_integral_implies_finite_norm[OF i]
       by (intro tendsto_add tendsto_const lim)
     then show "?t \<longlonglongrightarrow> \<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M"
       by simp
   qed
 qed
 
 lemma has_bochner_integral_eq:
   "has_bochner_integral M f x \<Longrightarrow> has_bochner_integral M f y \<Longrightarrow> x = y"
 proof (elim has_bochner_integral.cases)
   assume f[measurable]: "f \<in> borel_measurable M"
 
   fix s t
   assume "(\<lambda>i. \<integral>\<^sup>+ x. norm (f x - s i x) \<partial>M) \<longlonglongrightarrow> 0" (is "?S \<longlonglongrightarrow> 0")
   assume "(\<lambda>i. \<integral>\<^sup>+ x. norm (f x - t i x) \<partial>M) \<longlonglongrightarrow> 0" (is "?T \<longlonglongrightarrow> 0")
   assume s: "\<And>i. simple_bochner_integrable M (s i)"
   assume t: "\<And>i. simple_bochner_integrable M (t i)"
 
   have [measurable]: "\<And>i. s i \<in> borel_measurable M" "\<And>i. t i \<in> borel_measurable M"
     using s t by (auto intro: borel_measurable_simple_function elim: simple_bochner_integrable.cases)
 
   let ?s = "\<lambda>i. simple_bochner_integral M (s i)"
   let ?t = "\<lambda>i. simple_bochner_integral M (t i)"
   assume "?s \<longlonglongrightarrow> x" "?t \<longlonglongrightarrow> y"
   then have "(\<lambda>i. norm (?s i - ?t i)) \<longlonglongrightarrow> norm (x - y)"
     by (intro tendsto_intros)
   moreover
   have "(\<lambda>i. ennreal (norm (?s i - ?t i))) \<longlonglongrightarrow> ennreal 0"
   proof (rule tendsto_sandwich)
     show "eventually (\<lambda>i. 0 \<le> ennreal (norm (?s i - ?t i))) sequentially" "(\<lambda>_. 0) \<longlonglongrightarrow> ennreal 0"
       by auto
 
     show "eventually (\<lambda>i. norm (?s i - ?t i) \<le> ?S i + ?T i) sequentially"
       by (intro always_eventually allI simple_bochner_integral_bounded s t f)
     show "(\<lambda>i. ?S i + ?T i) \<longlonglongrightarrow> ennreal 0"
       using tendsto_add[OF \<open>?S \<longlonglongrightarrow> 0\<close> \<open>?T \<longlonglongrightarrow> 0\<close>] by simp
   qed
   then have "(\<lambda>i. norm (?s i - ?t i)) \<longlonglongrightarrow> 0"
     by (simp flip: ennreal_0)
   ultimately have "norm (x - y) = 0"
     by (rule LIMSEQ_unique)
   then show "x = y" by simp
 qed
 
 lemma has_bochner_integralI_AE:
   assumes f: "has_bochner_integral M f x"
     and g: "g \<in> borel_measurable M"
     and ae: "AE x in M. f x = g x"
   shows "has_bochner_integral M g x"
   using f
 proof (safe intro!: has_bochner_integral.intros elim!: has_bochner_integral.cases)
   fix s assume "(\<lambda>i. \<integral>\<^sup>+ x. ennreal (norm (f x - s i x)) \<partial>M) \<longlonglongrightarrow> 0"
   also have "(\<lambda>i. \<integral>\<^sup>+ x. ennreal (norm (f x - s i x)) \<partial>M) = (\<lambda>i. \<integral>\<^sup>+ x. ennreal (norm (g x - s i x)) \<partial>M)"
     using ae
     by (intro ext nn_integral_cong_AE, eventually_elim) simp
   finally show "(\<lambda>i. \<integral>\<^sup>+ x. ennreal (norm (g x - s i x)) \<partial>M) \<longlonglongrightarrow> 0" .
 qed (auto intro: g)
 
 lemma has_bochner_integral_eq_AE:
   assumes f: "has_bochner_integral M f x"
     and g: "has_bochner_integral M g y"
     and ae: "AE x in M. f x = g x"
   shows "x = y"
 proof -
   from assms have "has_bochner_integral M g x"
     by (auto intro: has_bochner_integralI_AE)
   from this g show "x = y"
     by (rule has_bochner_integral_eq)
 qed
 
 lemma simple_bochner_integrable_restrict_space:
   fixes f :: "_ \<Rightarrow> 'b::real_normed_vector"
   assumes \<Omega>: "\<Omega> \<inter> space M \<in> sets M"
   shows "simple_bochner_integrable (restrict_space M \<Omega>) f \<longleftrightarrow>
     simple_bochner_integrable M (\<lambda>x. indicator \<Omega> x *\<^sub>R f x)"
   by (simp add: simple_bochner_integrable.simps space_restrict_space
     simple_function_restrict_space[OF \<Omega>] emeasure_restrict_space[OF \<Omega>] Collect_restrict
     indicator_eq_0_iff conj_left_commute)
 
 lemma simple_bochner_integral_restrict_space:
   fixes f :: "_ \<Rightarrow> 'b::real_normed_vector"
   assumes \<Omega>: "\<Omega> \<inter> space M \<in> sets M"
   assumes f: "simple_bochner_integrable (restrict_space M \<Omega>) f"
   shows "simple_bochner_integral (restrict_space M \<Omega>) f =
     simple_bochner_integral M (\<lambda>x. indicator \<Omega> x *\<^sub>R f x)"
 proof -
   have "finite ((\<lambda>x. indicator \<Omega> x *\<^sub>R f x)`space M)"
     using f simple_bochner_integrable_restrict_space[OF \<Omega>, of f]
     by (simp add: simple_bochner_integrable.simps simple_function_def)
   then show ?thesis
     by (auto simp: space_restrict_space measure_restrict_space[OF \<Omega>(1)] le_infI2
                    simple_bochner_integral_def Collect_restrict
              split: split_indicator split_indicator_asm
              intro!: sum.mono_neutral_cong_left arg_cong2[where f=measure])
 qed
 
 context
   notes [[inductive_internals]]
 begin
 
 inductive integrable for M f where
   "has_bochner_integral M f x \<Longrightarrow> integrable M f"
 
 end
 
 definition\<^marker>\<open>tag important\<close> lebesgue_integral ("integral\<^sup>L") where
   "integral\<^sup>L M f = (if \<exists>x. has_bochner_integral M f x then THE x. has_bochner_integral M f x else 0)"
 
 syntax
   "_lebesgue_integral" :: "pttrn \<Rightarrow> real \<Rightarrow> 'a measure \<Rightarrow> real" ("\<integral>((2 _./ _)/ \<partial>_)" [60,61] 110)
 
 translations
   "\<integral> x. f \<partial>M" == "CONST lebesgue_integral M (\<lambda>x. f)"
 
 syntax
   "_ascii_lebesgue_integral" :: "pttrn \<Rightarrow> 'a measure \<Rightarrow> real \<Rightarrow> real" ("(3LINT (1_)/|(_)./ _)" [0,110,60] 60)
 
 translations
   "LINT x|M. f" == "CONST lebesgue_integral M (\<lambda>x. f)"
 
 lemma has_bochner_integral_integral_eq: "has_bochner_integral M f x \<Longrightarrow> integral\<^sup>L M f = x"
   by (metis the_equality has_bochner_integral_eq lebesgue_integral_def)
 
 lemma has_bochner_integral_integrable:
   "integrable M f \<Longrightarrow> has_bochner_integral M f (integral\<^sup>L M f)"
   by (auto simp: has_bochner_integral_integral_eq integrable.simps)
 
 lemma has_bochner_integral_iff:
   "has_bochner_integral M f x \<longleftrightarrow> integrable M f \<and> integral\<^sup>L M f = x"
   by (metis has_bochner_integral_integrable has_bochner_integral_integral_eq integrable.intros)
 
 lemma simple_bochner_integrable_eq_integral:
   "simple_bochner_integrable M f \<Longrightarrow> simple_bochner_integral M f = integral\<^sup>L M f"
   using has_bochner_integral_simple_bochner_integrable[of M f]
   by (simp add: has_bochner_integral_integral_eq)
 
 lemma not_integrable_integral_eq: "\<not> integrable M f \<Longrightarrow> integral\<^sup>L M f = 0"
   unfolding integrable.simps lebesgue_integral_def by (auto intro!: arg_cong[where f=The])
 
 lemma integral_eq_cases:
   "integrable M f \<longleftrightarrow> integrable N g \<Longrightarrow>
     (integrable M f \<Longrightarrow> integrable N g \<Longrightarrow> integral\<^sup>L M f = integral\<^sup>L N g) \<Longrightarrow>
     integral\<^sup>L M f = integral\<^sup>L N g"
   by (metis not_integrable_integral_eq)
 
 lemma borel_measurable_integrable[measurable_dest]: "integrable M f \<Longrightarrow> f \<in> borel_measurable M"
   by (auto elim: integrable.cases has_bochner_integral.cases)
 
 lemma borel_measurable_integrable'[measurable_dest]:
   "integrable M f \<Longrightarrow> g \<in> measurable N M \<Longrightarrow> (\<lambda>x. f (g x)) \<in> borel_measurable N"
   using borel_measurable_integrable[measurable] by measurable
 
 lemma integrable_cong:
   "M = N \<Longrightarrow> (\<And>x. x \<in> space N \<Longrightarrow> f x = g x) \<Longrightarrow> integrable M f \<longleftrightarrow> integrable N g"
   by (simp cong: has_bochner_integral_cong add: integrable.simps)
 
 lemma integrable_cong_AE:
   "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow> AE x in M. f x = g x \<Longrightarrow>
     integrable M f \<longleftrightarrow> integrable M g"
   unfolding integrable.simps
   by (intro has_bochner_integral_cong_AE arg_cong[where f=Ex] ext)
 
 lemma integrable_cong_AE_imp:
   "integrable M g \<Longrightarrow> f \<in> borel_measurable M \<Longrightarrow> (AE x in M. g x = f x) \<Longrightarrow> integrable M f"
   using integrable_cong_AE[of f M g] by (auto simp: eq_commute)
 
 lemma integral_cong:
   "M = N \<Longrightarrow> (\<And>x. x \<in> space N \<Longrightarrow> f x = g x) \<Longrightarrow> integral\<^sup>L M f = integral\<^sup>L N g"
   by (simp cong: has_bochner_integral_cong cong del: if_weak_cong add: lebesgue_integral_def)
 
 lemma integral_cong_AE:
   "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow> AE x in M. f x = g x \<Longrightarrow>
     integral\<^sup>L M f = integral\<^sup>L M g"
   unfolding lebesgue_integral_def
   by (rule arg_cong[where x="has_bochner_integral M f"]) (intro has_bochner_integral_cong_AE ext)
 
 lemma integrable_add[simp, intro]: "integrable M f \<Longrightarrow> integrable M g \<Longrightarrow> integrable M (\<lambda>x. f x + g x)"
   by (auto simp: integrable.simps)
 
 lemma integrable_zero[simp, intro]: "integrable M (\<lambda>x. 0)"
   by (metis has_bochner_integral_zero integrable.simps)
 
 lemma integrable_sum[simp, intro]: "(\<And>i. i \<in> I \<Longrightarrow> integrable M (f i)) \<Longrightarrow> integrable M (\<lambda>x. \<Sum>i\<in>I. f i x)"
   by (metis has_bochner_integral_sum integrable.simps)
 
 lemma integrable_indicator[simp, intro]: "A \<in> sets M \<Longrightarrow> emeasure M A < \<infinity> \<Longrightarrow>
   integrable M (\<lambda>x. indicator A x *\<^sub>R c)"
   by (metis has_bochner_integral_indicator integrable.simps)
 
 lemma integrable_real_indicator[simp, intro]: "A \<in> sets M \<Longrightarrow> emeasure M A < \<infinity> \<Longrightarrow>
   integrable M (indicator A :: 'a \<Rightarrow> real)"
   by (metis has_bochner_integral_real_indicator integrable.simps)
 
 lemma integrable_diff[simp, intro]: "integrable M f \<Longrightarrow> integrable M g \<Longrightarrow> integrable M (\<lambda>x. f x - g x)"
   by (auto simp: integrable.simps intro: has_bochner_integral_diff)
 
 lemma integrable_bounded_linear: "bounded_linear T \<Longrightarrow> integrable M f \<Longrightarrow> integrable M (\<lambda>x. T (f x))"
   by (auto simp: integrable.simps intro: has_bochner_integral_bounded_linear)
 
 lemma integrable_scaleR_left[simp, intro]: "(c \<noteq> 0 \<Longrightarrow> integrable M f) \<Longrightarrow> integrable M (\<lambda>x. f x *\<^sub>R c)"
   unfolding integrable.simps by fastforce
 
 lemma integrable_scaleR_right[simp, intro]: "(c \<noteq> 0 \<Longrightarrow> integrable M f) \<Longrightarrow> integrable M (\<lambda>x. c *\<^sub>R f x)"
   unfolding integrable.simps by fastforce
 
 lemma integrable_mult_left[simp, intro]:
   fixes c :: "_::{real_normed_algebra,second_countable_topology}"
   shows "(c \<noteq> 0 \<Longrightarrow> integrable M f) \<Longrightarrow> integrable M (\<lambda>x. f x * c)"
   unfolding integrable.simps by fastforce
 
 lemma integrable_mult_right[simp, intro]:
   fixes c :: "_::{real_normed_algebra,second_countable_topology}"
   shows "(c \<noteq> 0 \<Longrightarrow> integrable M f) \<Longrightarrow> integrable M (\<lambda>x. c * f x)"
   unfolding integrable.simps by fastforce
 
 lemma integrable_divide_zero[simp, intro]:
   fixes c :: "_::{real_normed_field, field, second_countable_topology}"
   shows "(c \<noteq> 0 \<Longrightarrow> integrable M f) \<Longrightarrow> integrable M (\<lambda>x. f x / c)"
   unfolding integrable.simps by fastforce
 
 lemma integrable_inner_left[simp, intro]:
   "(c \<noteq> 0 \<Longrightarrow> integrable M f) \<Longrightarrow> integrable M (\<lambda>x. f x \<bullet> c)"
   unfolding integrable.simps by fastforce
 
 lemma integrable_inner_right[simp, intro]:
   "(c \<noteq> 0 \<Longrightarrow> integrable M f) \<Longrightarrow> integrable M (\<lambda>x. c \<bullet> f x)"
   unfolding integrable.simps by fastforce
 
 lemmas integrable_minus[simp, intro] =
   integrable_bounded_linear[OF bounded_linear_minus[OF bounded_linear_ident]]
 lemmas integrable_divide[simp, intro] =
   integrable_bounded_linear[OF bounded_linear_divide]
 lemmas integrable_Re[simp, intro] =
   integrable_bounded_linear[OF bounded_linear_Re]
 lemmas integrable_Im[simp, intro] =
   integrable_bounded_linear[OF bounded_linear_Im]
 lemmas integrable_cnj[simp, intro] =
   integrable_bounded_linear[OF bounded_linear_cnj]
 lemmas integrable_of_real[simp, intro] =
   integrable_bounded_linear[OF bounded_linear_of_real]
 lemmas integrable_fst[simp, intro] =
   integrable_bounded_linear[OF bounded_linear_fst]
 lemmas integrable_snd[simp, intro] =
   integrable_bounded_linear[OF bounded_linear_snd]
 
 lemma integral_zero[simp]: "integral\<^sup>L M (\<lambda>x. 0) = 0"
   by (intro has_bochner_integral_integral_eq has_bochner_integral_zero)
 
 lemma integral_add[simp]: "integrable M f \<Longrightarrow> integrable M g \<Longrightarrow>
     integral\<^sup>L M (\<lambda>x. f x + g x) = integral\<^sup>L M f + integral\<^sup>L M g"
   by (intro has_bochner_integral_integral_eq has_bochner_integral_add has_bochner_integral_integrable)
 
 lemma integral_diff[simp]: "integrable M f \<Longrightarrow> integrable M g \<Longrightarrow>
     integral\<^sup>L M (\<lambda>x. f x - g x) = integral\<^sup>L M f - integral\<^sup>L M g"
   by (intro has_bochner_integral_integral_eq has_bochner_integral_diff has_bochner_integral_integrable)
 
 lemma integral_sum: "(\<And>i. i \<in> I \<Longrightarrow> integrable M (f i)) \<Longrightarrow>
   integral\<^sup>L M (\<lambda>x. \<Sum>i\<in>I. f i x) = (\<Sum>i\<in>I. integral\<^sup>L M (f i))"
   by (intro has_bochner_integral_integral_eq has_bochner_integral_sum has_bochner_integral_integrable)
 
 lemma integral_sum'[simp]: "(\<And>i. i \<in> I =simp=> integrable M (f i)) \<Longrightarrow>
   integral\<^sup>L M (\<lambda>x. \<Sum>i\<in>I. f i x) = (\<Sum>i\<in>I. integral\<^sup>L M (f i))"
   unfolding simp_implies_def by (rule integral_sum)
 
 lemma integral_bounded_linear: "bounded_linear T \<Longrightarrow> integrable M f \<Longrightarrow>
     integral\<^sup>L M (\<lambda>x. T (f x)) = T (integral\<^sup>L M f)"
   by (metis has_bochner_integral_bounded_linear has_bochner_integral_integrable has_bochner_integral_integral_eq)
 
 lemma integral_bounded_linear':
   assumes T: "bounded_linear T" and T': "bounded_linear T'"
   assumes *: "\<not> (\<forall>x. T x = 0) \<Longrightarrow> (\<forall>x. T' (T x) = x)"
   shows "integral\<^sup>L M (\<lambda>x. T (f x)) = T (integral\<^sup>L M f)"
 proof cases
   assume "(\<forall>x. T x = 0)" then show ?thesis
     by simp
 next
   assume **: "\<not> (\<forall>x. T x = 0)"
   show ?thesis
   proof cases
     assume "integrable M f" with T show ?thesis
       by (rule integral_bounded_linear)
   next
     assume not: "\<not> integrable M f"
     moreover have "\<not> integrable M (\<lambda>x. T (f x))"
     proof
       assume "integrable M (\<lambda>x. T (f x))"
       from integrable_bounded_linear[OF T' this] not *[OF **]
       show False
         by auto
     qed
     ultimately show ?thesis
       using T by (simp add: not_integrable_integral_eq linear_simps)
   qed
 qed
 
 lemma integral_scaleR_left[simp]: "(c \<noteq> 0 \<Longrightarrow> integrable M f) \<Longrightarrow> (\<integral> x. f x *\<^sub>R c \<partial>M) = integral\<^sup>L M f *\<^sub>R c"
   by (intro has_bochner_integral_integral_eq has_bochner_integral_integrable has_bochner_integral_scaleR_left)
 
 lemma integral_scaleR_right[simp]: "(\<integral> x. c *\<^sub>R f x \<partial>M) = c *\<^sub>R integral\<^sup>L M f"
   by (rule integral_bounded_linear'[OF bounded_linear_scaleR_right bounded_linear_scaleR_right[of "1 / c"]]) simp
 
 lemma integral_mult_left[simp]:
   fixes c :: "_::{real_normed_algebra,second_countable_topology}"
   shows "(c \<noteq> 0 \<Longrightarrow> integrable M f) \<Longrightarrow> (\<integral> x. f x * c \<partial>M) = integral\<^sup>L M f * c"
   by (intro has_bochner_integral_integral_eq has_bochner_integral_integrable has_bochner_integral_mult_left)
 
 lemma integral_mult_right[simp]:
   fixes c :: "_::{real_normed_algebra,second_countable_topology}"
   shows "(c \<noteq> 0 \<Longrightarrow> integrable M f) \<Longrightarrow> (\<integral> x. c * f x \<partial>M) = c * integral\<^sup>L M f"
   by (intro has_bochner_integral_integral_eq has_bochner_integral_integrable has_bochner_integral_mult_right)
 
 lemma integral_mult_left_zero[simp]:
   fixes c :: "_::{real_normed_field,second_countable_topology}"
   shows "(\<integral> x. f x * c \<partial>M) = integral\<^sup>L M f * c"
   by (rule integral_bounded_linear'[OF bounded_linear_mult_left bounded_linear_mult_left[of "1 / c"]]) simp
 
 lemma integral_mult_right_zero[simp]:
   fixes c :: "_::{real_normed_field,second_countable_topology}"
   shows "(\<integral> x. c * f x \<partial>M) = c * integral\<^sup>L M f"
   by (rule integral_bounded_linear'[OF bounded_linear_mult_right bounded_linear_mult_right[of "1 / c"]]) simp
 
 lemma integral_inner_left[simp]: "(c \<noteq> 0 \<Longrightarrow> integrable M f) \<Longrightarrow> (\<integral> x. f x \<bullet> c \<partial>M) = integral\<^sup>L M f \<bullet> c"
   by (intro has_bochner_integral_integral_eq has_bochner_integral_integrable has_bochner_integral_inner_left)
 
 lemma integral_inner_right[simp]: "(c \<noteq> 0 \<Longrightarrow> integrable M f) \<Longrightarrow> (\<integral> x. c \<bullet> f x \<partial>M) = c \<bullet> integral\<^sup>L M f"
   by (intro has_bochner_integral_integral_eq has_bochner_integral_integrable has_bochner_integral_inner_right)
 
 lemma integral_divide_zero[simp]:
   fixes c :: "_::{real_normed_field, field, second_countable_topology}"
   shows "integral\<^sup>L M (\<lambda>x. f x / c) = integral\<^sup>L M f / c"
   by (rule integral_bounded_linear'[OF bounded_linear_divide bounded_linear_mult_left[of c]]) simp
 
 lemma integral_minus[simp]: "integral\<^sup>L M (\<lambda>x. - f x) = - integral\<^sup>L M f"
   by (rule integral_bounded_linear'[OF bounded_linear_minus[OF bounded_linear_ident] bounded_linear_minus[OF bounded_linear_ident]]) simp
 
 lemma integral_complex_of_real[simp]: "integral\<^sup>L M (\<lambda>x. complex_of_real (f x)) = of_real (integral\<^sup>L M f)"
   by (rule integral_bounded_linear'[OF bounded_linear_of_real bounded_linear_Re]) simp
 
 lemma integral_cnj[simp]: "integral\<^sup>L M (\<lambda>x. cnj (f x)) = cnj (integral\<^sup>L M f)"
   by (rule integral_bounded_linear'[OF bounded_linear_cnj bounded_linear_cnj]) simp
 
 lemmas integral_divide[simp] =
   integral_bounded_linear[OF bounded_linear_divide]
 lemmas integral_Re[simp] =
   integral_bounded_linear[OF bounded_linear_Re]
 lemmas integral_Im[simp] =
   integral_bounded_linear[OF bounded_linear_Im]
 lemmas integral_of_real[simp] =
   integral_bounded_linear[OF bounded_linear_of_real]
 lemmas integral_fst[simp] =
   integral_bounded_linear[OF bounded_linear_fst]
 lemmas integral_snd[simp] =
   integral_bounded_linear[OF bounded_linear_snd]
 
 lemma integral_norm_bound_ennreal:
   "integrable M f \<Longrightarrow> norm (integral\<^sup>L M f) \<le> (\<integral>\<^sup>+x. norm (f x) \<partial>M)"
   by (metis has_bochner_integral_integrable has_bochner_integral_norm_bound)
 
 lemma integrableI_sequence:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes f[measurable]: "f \<in> borel_measurable M"
   assumes s: "\<And>i. simple_bochner_integrable M (s i)"
   assumes lim: "(\<lambda>i. \<integral>\<^sup>+x. norm (f x - s i x) \<partial>M) \<longlonglongrightarrow> 0" (is "?S \<longlonglongrightarrow> 0")
   shows "integrable M f"
 proof -
   let ?s = "\<lambda>n. simple_bochner_integral M (s n)"
 
   have "\<exists>x. ?s \<longlonglongrightarrow> x"
     unfolding convergent_eq_Cauchy
   proof (rule metric_CauchyI)
     fix e :: real assume "0 < e"
     then have "0 < ennreal (e / 2)" by auto
     from order_tendstoD(2)[OF lim this]
     obtain M where M: "\<And>n. M \<le> n \<Longrightarrow> ?S n < e / 2"
       by (auto simp: eventually_sequentially)
     show "\<exists>M. \<forall>m\<ge>M. \<forall>n\<ge>M. dist (?s m) (?s n) < e"
     proof (intro exI allI impI)
       fix m n assume m: "M \<le> m" and n: "M \<le> n"
       have "?S n \<noteq> \<infinity>"
         using M[OF n] by auto
       have "norm (?s n - ?s m) \<le> ?S n + ?S m"
         by (intro simple_bochner_integral_bounded s f)
       also have "\<dots> < ennreal (e / 2) + e / 2"
         by (intro add_strict_mono M n m)
       also have "\<dots> = e" using \<open>0<e\<close> by (simp flip: ennreal_plus)
       finally show "dist (?s n) (?s m) < e"
         using \<open>0<e\<close> by (simp add: dist_norm ennreal_less_iff)
     qed
   qed
   then obtain x where "?s \<longlonglongrightarrow> x" ..
   show ?thesis
     by (rule, rule) fact+
 qed
 
 proposition nn_integral_dominated_convergence_norm:
   fixes u' :: "_ \<Rightarrow> _::{real_normed_vector, second_countable_topology}"
   assumes [measurable]:
        "\<And>i. u i \<in> borel_measurable M" "u' \<in> borel_measurable M" "w \<in> borel_measurable M"
     and bound: "\<And>j. AE x in M. norm (u j x) \<le> w x"
     and w: "(\<integral>\<^sup>+x. w x \<partial>M) < \<infinity>"
     and u': "AE x in M. (\<lambda>i. u i x) \<longlonglongrightarrow> u' x"
   shows "(\<lambda>i. (\<integral>\<^sup>+x. norm (u' x - u i x) \<partial>M)) \<longlonglongrightarrow> 0"
 proof -
   have "AE x in M. \<forall>j. norm (u j x) \<le> w x"
     unfolding AE_all_countable by rule fact
   with u' have bnd: "AE x in M. \<forall>j. norm (u' x - u j x) \<le> 2 * w x"
   proof (eventually_elim, intro allI)
     fix i x assume "(\<lambda>i. u i x) \<longlonglongrightarrow> u' x" "\<forall>j. norm (u j x) \<le> w x" "\<forall>j. norm (u j x) \<le> w x"
     then have "norm (u' x) \<le> w x" "norm (u i x) \<le> w x"
       by (auto intro: LIMSEQ_le_const2 tendsto_norm)
     then have "norm (u' x) + norm (u i x) \<le> 2 * w x"
       by simp
     also have "norm (u' x - u i x) \<le> norm (u' x) + norm (u i x)"
       by (rule norm_triangle_ineq4)
     finally (xtrans) show "norm (u' x - u i x) \<le> 2 * w x" .
   qed
   have w_nonneg: "AE x in M. 0 \<le> w x"
     using bound[of 0] by (auto intro: order_trans[OF norm_ge_zero])
 
   have "(\<lambda>i. (\<integral>\<^sup>+x. norm (u' x - u i x) \<partial>M)) \<longlonglongrightarrow> (\<integral>\<^sup>+x. 0 \<partial>M)"
   proof (rule nn_integral_dominated_convergence)
     show "(\<integral>\<^sup>+x. 2 * w x \<partial>M) < \<infinity>"
       by (rule nn_integral_mult_bounded_inf[OF _ w, of 2]) (insert w_nonneg, auto simp: ennreal_mult )
     show "AE x in M. (\<lambda>i. ennreal (norm (u' x - u i x))) \<longlonglongrightarrow> 0"
       using u'
     proof eventually_elim
       fix x assume "(\<lambda>i. u i x) \<longlonglongrightarrow> u' x"
       from tendsto_diff[OF tendsto_const[of "u' x"] this]
       show "(\<lambda>i. ennreal (norm (u' x - u i x))) \<longlonglongrightarrow> 0"
         by (simp add: tendsto_norm_zero_iff flip: ennreal_0)
     qed
   qed (insert bnd w_nonneg, auto)
   then show ?thesis by simp
 qed
 
 proposition integrableI_bounded:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes f[measurable]: "f \<in> borel_measurable M" and fin: "(\<integral>\<^sup>+x. norm (f x) \<partial>M) < \<infinity>"
   shows "integrable M f"
 proof -
   from borel_measurable_implies_sequence_metric[OF f, of 0] obtain s where
     s: "\<And>i. simple_function M (s i)" and
     pointwise: "\<And>x. x \<in> space M \<Longrightarrow> (\<lambda>i. s i x) \<longlonglongrightarrow> f x" and
     bound: "\<And>i x. x \<in> space M \<Longrightarrow> norm (s i x) \<le> 2 * norm (f x)"
     by simp metis
 
   show ?thesis
   proof (rule integrableI_sequence)
     { fix i
       have "(\<integral>\<^sup>+x. norm (s i x) \<partial>M) \<le> (\<integral>\<^sup>+x. ennreal (2 * norm (f x)) \<partial>M)"
         by (intro nn_integral_mono) (simp add: bound)
       also have "\<dots> = 2 * (\<integral>\<^sup>+x. ennreal (norm (f x)) \<partial>M)"
         by (simp add: ennreal_mult nn_integral_cmult)
       also have "\<dots> < top"
         using fin by (simp add: ennreal_mult_less_top)
       finally have "(\<integral>\<^sup>+x. norm (s i x) \<partial>M) < \<infinity>"
         by simp }
     note fin_s = this
 
     show "\<And>i. simple_bochner_integrable M (s i)"
       by (rule simple_bochner_integrableI_bounded) fact+
 
     show "(\<lambda>i. \<integral>\<^sup>+ x. ennreal (norm (f x - s i x)) \<partial>M) \<longlonglongrightarrow> 0"
     proof (rule nn_integral_dominated_convergence_norm)
       show "\<And>j. AE x in M. norm (s j x) \<le> 2 * norm (f x)"
         using bound by auto
       show "\<And>i. s i \<in> borel_measurable M" "(\<lambda>x. 2 * norm (f x)) \<in> borel_measurable M"
         using s by (auto intro: borel_measurable_simple_function)
       show "(\<integral>\<^sup>+ x. ennreal (2 * norm (f x)) \<partial>M) < \<infinity>"
         using fin by (simp add: nn_integral_cmult ennreal_mult ennreal_mult_less_top)
       show "AE x in M. (\<lambda>i. s i x) \<longlonglongrightarrow> f x"
         using pointwise by auto
     qed fact
   qed fact
 qed
 
 lemma integrableI_bounded_set:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes [measurable]: "A \<in> sets M" "f \<in> borel_measurable M"
   assumes finite: "emeasure M A < \<infinity>"
     and bnd: "AE x in M. x \<in> A \<longrightarrow> norm (f x) \<le> B"
     and null: "AE x in M. x \<notin> A \<longrightarrow> f x = 0"
   shows "integrable M f"
 proof (rule integrableI_bounded)
   { fix x :: 'b have "norm x \<le> B \<Longrightarrow> 0 \<le> B"
       using norm_ge_zero[of x] by arith }
   with bnd null have "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M) \<le> (\<integral>\<^sup>+ x. ennreal (max 0 B) * indicator A x \<partial>M)"
     by (intro nn_integral_mono_AE) (auto split: split_indicator split_max)
   also have "\<dots> < \<infinity>"
     using finite by (subst nn_integral_cmult_indicator) (auto simp: ennreal_mult_less_top)
   finally show "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M) < \<infinity>" .
 qed simp
 
 lemma integrableI_bounded_set_indicator:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   shows "A \<in> sets M \<Longrightarrow> f \<in> borel_measurable M \<Longrightarrow>
     emeasure M A < \<infinity> \<Longrightarrow> (AE x in M. x \<in> A \<longrightarrow> norm (f x) \<le> B) \<Longrightarrow>
     integrable M (\<lambda>x. indicator A x *\<^sub>R f x)"
   by (rule integrableI_bounded_set[where A=A]) auto
 
 lemma integrableI_nonneg:
   fixes f :: "'a \<Rightarrow> real"
   assumes "f \<in> borel_measurable M" "AE x in M. 0 \<le> f x" "(\<integral>\<^sup>+x. f x \<partial>M) < \<infinity>"
   shows "integrable M f"
 proof -
   have "(\<integral>\<^sup>+x. norm (f x) \<partial>M) = (\<integral>\<^sup>+x. f x \<partial>M)"
     using assms by (intro nn_integral_cong_AE) auto
   then show ?thesis
     using assms by (intro integrableI_bounded) auto
 qed
 
 lemma integrable_iff_bounded:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   shows "integrable M f \<longleftrightarrow> f \<in> borel_measurable M \<and> (\<integral>\<^sup>+x. norm (f x) \<partial>M) < \<infinity>"
   using integrableI_bounded[of f M] has_bochner_integral_implies_finite_norm[of M f]
   unfolding integrable.simps has_bochner_integral.simps[abs_def] by auto
 
 lemma (in finite_measure) square_integrable_imp_integrable:
   fixes f :: "'a \<Rightarrow> 'b :: {second_countable_topology, banach, real_normed_div_algebra}"
   assumes [measurable]: "f \<in> borel_measurable M"
   assumes "integrable M (\<lambda>x. f x ^ 2)"
   shows   "integrable M f"
 proof -
   have less_top: "emeasure M (space M) < top"
     using finite_emeasure_space by (meson top.not_eq_extremum)
   have "nn_integral M (\<lambda>x. norm (f x)) ^ 2 \<le>
         nn_integral M (\<lambda>x. norm (f x) ^ 2) * emeasure M (space M)"
     using Cauchy_Schwarz_nn_integral[of "\<lambda>x. norm (f x)" M "\<lambda>_. 1"]
     by (simp add: ennreal_power)
   also have "\<dots> < \<infinity>"
     using assms(2) less_top
     by (subst (asm) integrable_iff_bounded) (auto simp: norm_power ennreal_mult_less_top)
   finally have "nn_integral M (\<lambda>x. norm (f x)) < \<infinity>"
     by (simp add: power_less_top_ennreal)
   thus ?thesis
     by (simp add: integrable_iff_bounded)
 qed
 
 lemma integrable_bound:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
     and g :: "'a \<Rightarrow> 'c::{banach, second_countable_topology}"
   shows "integrable M f \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow> (AE x in M. norm (g x) \<le> norm (f x)) \<Longrightarrow>
     integrable M g"
   unfolding integrable_iff_bounded
 proof safe
   assume "f \<in> borel_measurable M" "g \<in> borel_measurable M"
   assume "AE x in M. norm (g x) \<le> norm (f x)"
   then have "(\<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M) \<le> (\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M)"
     by  (intro nn_integral_mono_AE) auto
   also assume "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M) < \<infinity>"
   finally show "(\<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M) < \<infinity>" .
 qed
 
 lemma integrable_mult_indicator:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   shows "A \<in> sets M \<Longrightarrow> integrable M f \<Longrightarrow> integrable M (\<lambda>x. indicator A x *\<^sub>R f x)"
   by (rule integrable_bound[of M f]) (auto split: split_indicator)
 
 lemma integrable_real_mult_indicator:
   fixes f :: "'a \<Rightarrow> real"
   shows "A \<in> sets M \<Longrightarrow> integrable M f \<Longrightarrow> integrable M (\<lambda>x. f x * indicator A x)"
   using integrable_mult_indicator[of A M f] by (simp add: mult_ac)
 
 lemma integrable_abs[simp, intro]:
   fixes f :: "'a \<Rightarrow> real"
   assumes [measurable]: "integrable M f" shows "integrable M (\<lambda>x. \<bar>f x\<bar>)"
   using assms by (rule integrable_bound) auto
 
 lemma integrable_norm[simp, intro]:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes [measurable]: "integrable M f" shows "integrable M (\<lambda>x. norm (f x))"
   using assms by (rule integrable_bound) auto
 
 lemma integrable_norm_cancel:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes [measurable]: "integrable M (\<lambda>x. norm (f x))" "f \<in> borel_measurable M" shows "integrable M f"
   using assms by (rule integrable_bound) auto
 
 lemma integrable_norm_iff:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   shows "f \<in> borel_measurable M \<Longrightarrow> integrable M (\<lambda>x. norm (f x)) \<longleftrightarrow> integrable M f"
   by (auto intro: integrable_norm_cancel)
 
 lemma integrable_abs_cancel:
   fixes f :: "'a \<Rightarrow> real"
   assumes [measurable]: "integrable M (\<lambda>x. \<bar>f x\<bar>)" "f \<in> borel_measurable M" shows "integrable M f"
   using assms by (rule integrable_bound) auto
 
 lemma integrable_abs_iff:
   fixes f :: "'a \<Rightarrow> real"
   shows "f \<in> borel_measurable M \<Longrightarrow> integrable M (\<lambda>x. \<bar>f x\<bar>) \<longleftrightarrow> integrable M f"
   by (auto intro: integrable_abs_cancel)
 
 lemma integrable_max[simp, intro]:
   fixes f :: "'a \<Rightarrow> real"
   assumes fg[measurable]: "integrable M f" "integrable M g"
   shows "integrable M (\<lambda>x. max (f x) (g x))"
   using integrable_add[OF integrable_norm[OF fg(1)] integrable_norm[OF fg(2)]]
   by (rule integrable_bound) auto
 
 lemma integrable_min[simp, intro]:
   fixes f :: "'a \<Rightarrow> real"
   assumes fg[measurable]: "integrable M f" "integrable M g"
   shows "integrable M (\<lambda>x. min (f x) (g x))"
   using integrable_add[OF integrable_norm[OF fg(1)] integrable_norm[OF fg(2)]]
   by (rule integrable_bound) auto
 
 lemma integral_minus_iff[simp]:
   "integrable M (\<lambda>x. - f x ::'a::{banach, second_countable_topology}) \<longleftrightarrow> integrable M f"
   unfolding integrable_iff_bounded
   by (auto)
 
 lemma integrable_indicator_iff:
   "integrable M (indicator A::_ \<Rightarrow> real) \<longleftrightarrow> A \<inter> space M \<in> sets M \<and> emeasure M (A \<inter> space M) < \<infinity>"
   by (simp add: integrable_iff_bounded borel_measurable_indicator_iff ennreal_indicator nn_integral_indicator'
            cong: conj_cong)
 
 lemma integral_indicator[simp]: "integral\<^sup>L M (indicator A) = measure M (A \<inter> space M)"
 proof cases
   assume *: "A \<inter> space M \<in> sets M \<and> emeasure M (A \<inter> space M) < \<infinity>"
   have "integral\<^sup>L M (indicator A) = integral\<^sup>L M (indicator (A \<inter> space M))"
     by (intro integral_cong) (auto split: split_indicator)
   also have "\<dots> = measure M (A \<inter> space M)"
     using * by (intro has_bochner_integral_integral_eq has_bochner_integral_real_indicator) auto
   finally show ?thesis .
 next
   assume *: "\<not> (A \<inter> space M \<in> sets M \<and> emeasure M (A \<inter> space M) < \<infinity>)"
   have "integral\<^sup>L M (indicator A) = integral\<^sup>L M (indicator (A \<inter> space M) :: _ \<Rightarrow> real)"
     by (intro integral_cong) (auto split: split_indicator)
   also have "\<dots> = 0"
     using * by (subst not_integrable_integral_eq) (auto simp: integrable_indicator_iff)
   also have "\<dots> = measure M (A \<inter> space M)"
     using * by (auto simp: measure_def emeasure_notin_sets not_less top_unique)
   finally show ?thesis .
 qed
 
 lemma integrable_discrete_difference:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes X: "countable X"
   assumes null: "\<And>x. x \<in> X \<Longrightarrow> emeasure M {x} = 0"
   assumes sets: "\<And>x. x \<in> X \<Longrightarrow> {x} \<in> sets M"
   assumes eq: "\<And>x. x \<in> space M \<Longrightarrow> x \<notin> X \<Longrightarrow> f x = g x"
   shows "integrable M f \<longleftrightarrow> integrable M g"
   unfolding integrable_iff_bounded
 proof (rule conj_cong)
   { assume "f \<in> borel_measurable M" then have "g \<in> borel_measurable M"
       by (rule measurable_discrete_difference[where X=X]) (auto simp: assms) }
   moreover
   { assume "g \<in> borel_measurable M" then have "f \<in> borel_measurable M"
       by (rule measurable_discrete_difference[where X=X]) (auto simp: assms) }
   ultimately show "f \<in> borel_measurable M \<longleftrightarrow> g \<in> borel_measurable M" ..
 next
   have "AE x in M. x \<notin> X"
     by (rule AE_discrete_difference) fact+
   then have "(\<integral>\<^sup>+ x. norm (f x) \<partial>M) = (\<integral>\<^sup>+ x. norm (g x) \<partial>M)"
     by (intro nn_integral_cong_AE) (auto simp: eq)
   then show "(\<integral>\<^sup>+ x. norm (f x) \<partial>M) < \<infinity> \<longleftrightarrow> (\<integral>\<^sup>+ x. norm (g x) \<partial>M) < \<infinity>"
     by simp
 qed
 
 lemma integral_discrete_difference:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes X: "countable X"
   assumes null: "\<And>x. x \<in> X \<Longrightarrow> emeasure M {x} = 0"
   assumes sets: "\<And>x. x \<in> X \<Longrightarrow> {x} \<in> sets M"
   assumes eq: "\<And>x. x \<in> space M \<Longrightarrow> x \<notin> X \<Longrightarrow> f x = g x"
   shows "integral\<^sup>L M f = integral\<^sup>L M g"
 proof (rule integral_eq_cases)
   show eq: "integrable M f \<longleftrightarrow> integrable M g"
     by (rule integrable_discrete_difference[where X=X]) fact+
 
   assume f: "integrable M f"
   show "integral\<^sup>L M f = integral\<^sup>L M g"
   proof (rule integral_cong_AE)
     show "f \<in> borel_measurable M" "g \<in> borel_measurable M"
       using f eq by (auto intro: borel_measurable_integrable)
 
     have "AE x in M. x \<notin> X"
       by (rule AE_discrete_difference) fact+
     with AE_space show "AE x in M. f x = g x"
       by eventually_elim fact
   qed
 qed
 
 lemma has_bochner_integral_discrete_difference:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes X: "countable X"
   assumes null: "\<And>x. x \<in> X \<Longrightarrow> emeasure M {x} = 0"
   assumes sets: "\<And>x. x \<in> X \<Longrightarrow> {x} \<in> sets M"
   assumes eq: "\<And>x. x \<in> space M \<Longrightarrow> x \<notin> X \<Longrightarrow> f x = g x"
   shows "has_bochner_integral M f x \<longleftrightarrow> has_bochner_integral M g x"
   using integrable_discrete_difference[of X M f g, OF assms]
   using integral_discrete_difference[of X M f g, OF assms]
   by (metis has_bochner_integral_iff)
 
 lemma
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}" and w :: "'a \<Rightarrow> real"
   assumes "f \<in> borel_measurable M" "\<And>i. s i \<in> borel_measurable M" "integrable M w"
   assumes lim: "AE x in M. (\<lambda>i. s i x) \<longlonglongrightarrow> f x"
   assumes bound: "\<And>i. AE x in M. norm (s i x) \<le> w x"
   shows integrable_dominated_convergence: "integrable M f"
     and integrable_dominated_convergence2: "\<And>i. integrable M (s i)"
     and integral_dominated_convergence: "(\<lambda>i. integral\<^sup>L M (s i)) \<longlonglongrightarrow> integral\<^sup>L M f"
 proof -
   have w_nonneg: "AE x in M. 0 \<le> w x"
     using bound[of 0] by eventually_elim (auto intro: norm_ge_zero order_trans)
   then have "(\<integral>\<^sup>+x. w x \<partial>M) = (\<integral>\<^sup>+x. norm (w x) \<partial>M)"
     by (intro nn_integral_cong_AE) auto
   with \<open>integrable M w\<close> have w: "w \<in> borel_measurable M" "(\<integral>\<^sup>+x. w x \<partial>M) < \<infinity>"
     unfolding integrable_iff_bounded by auto
 
   show int_s: "\<And>i. integrable M (s i)"
     unfolding integrable_iff_bounded
   proof
     fix i
     have "(\<integral>\<^sup>+ x. ennreal (norm (s i x)) \<partial>M) \<le> (\<integral>\<^sup>+x. w x \<partial>M)"
       using bound[of i] w_nonneg by (intro nn_integral_mono_AE) auto
     with w show "(\<integral>\<^sup>+ x. ennreal (norm (s i x)) \<partial>M) < \<infinity>" by auto
   qed fact
 
   have all_bound: "AE x in M. \<forall>i. norm (s i x) \<le> w x"
     using bound unfolding AE_all_countable by auto
 
   show int_f: "integrable M f"
     unfolding integrable_iff_bounded
   proof
     have "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M) \<le> (\<integral>\<^sup>+x. w x \<partial>M)"
       using all_bound lim w_nonneg
     proof (intro nn_integral_mono_AE, eventually_elim)
       fix x assume "\<forall>i. norm (s i x) \<le> w x" "(\<lambda>i. s i x) \<longlonglongrightarrow> f x" "0 \<le> w x"
       then show "ennreal (norm (f x)) \<le> ennreal (w x)"
         by (intro LIMSEQ_le_const2[where X="\<lambda>i. ennreal (norm (s i x))"]) (auto intro: tendsto_intros)
     qed
     with w show "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M) < \<infinity>" by auto
   qed fact
 
   have "(\<lambda>n. ennreal (norm (integral\<^sup>L M (s n) - integral\<^sup>L M f))) \<longlonglongrightarrow> ennreal 0" (is "?d \<longlonglongrightarrow> ennreal 0")
   proof (rule tendsto_sandwich)
     show "eventually (\<lambda>n. ennreal 0 \<le> ?d n) sequentially" "(\<lambda>_. ennreal 0) \<longlonglongrightarrow> ennreal 0" by auto
     show "eventually (\<lambda>n. ?d n \<le> (\<integral>\<^sup>+x. norm (s n x - f x) \<partial>M)) sequentially"
     proof (intro always_eventually allI)
       fix n
       have "?d n = norm (integral\<^sup>L M (\<lambda>x. s n x - f x))"
         using int_f int_s by simp
       also have "\<dots> \<le> (\<integral>\<^sup>+x. norm (s n x - f x) \<partial>M)"
         by (intro int_f int_s integrable_diff integral_norm_bound_ennreal)
       finally show "?d n \<le> (\<integral>\<^sup>+x. norm (s n x - f x) \<partial>M)" .
     qed
     show "(\<lambda>n. \<integral>\<^sup>+x. norm (s n x - f x) \<partial>M) \<longlonglongrightarrow> ennreal 0"
       unfolding ennreal_0
       apply (subst norm_minus_commute)
     proof (rule nn_integral_dominated_convergence_norm[where w=w])
       show "\<And>n. s n \<in> borel_measurable M"
         using int_s unfolding integrable_iff_bounded by auto
     qed fact+
   qed
   then have "(\<lambda>n. integral\<^sup>L M (s n) - integral\<^sup>L M f) \<longlonglongrightarrow> 0"
     by (simp add: tendsto_norm_zero_iff del: ennreal_0)
   from tendsto_add[OF this tendsto_const[of "integral\<^sup>L M f"]]
   show "(\<lambda>i. integral\<^sup>L M (s i)) \<longlonglongrightarrow> integral\<^sup>L M f"  by simp
 qed
 
 context
   fixes s :: "real \<Rightarrow> 'a \<Rightarrow> 'b::{banach, second_countable_topology}" and w :: "'a \<Rightarrow> real"
     and f :: "'a \<Rightarrow> 'b" and M
   assumes "f \<in> borel_measurable M" "\<And>t. s t \<in> borel_measurable M" "integrable M w"
   assumes lim: "AE x in M. ((\<lambda>i. s i x) \<longlongrightarrow> f x) at_top"
   assumes bound: "\<forall>\<^sub>F i in at_top. AE x in M. norm (s i x) \<le> w x"
 begin
 
 lemma integral_dominated_convergence_at_top: "((\<lambda>t. integral\<^sup>L M (s t)) \<longlongrightarrow> integral\<^sup>L M f) at_top"
 proof (rule tendsto_at_topI_sequentially)
   fix X :: "nat \<Rightarrow> real" assume X: "filterlim X at_top sequentially"
   from filterlim_iff[THEN iffD1, OF this, rule_format, OF bound]
   obtain N where w: "\<And>n. N \<le> n \<Longrightarrow> AE x in M. norm (s (X n) x) \<le> w x"
     by (auto simp: eventually_sequentially)
 
   show "(\<lambda>n. integral\<^sup>L M (s (X n))) \<longlonglongrightarrow> integral\<^sup>L M f"
   proof (rule LIMSEQ_offset, rule integral_dominated_convergence)
     show "AE x in M. norm (s (X (n + N)) x) \<le> w x" for n
       by (rule w) auto
     show "AE x in M. (\<lambda>n. s (X (n + N)) x) \<longlonglongrightarrow> f x"
       using lim
     proof eventually_elim
       fix x assume "((\<lambda>i. s i x) \<longlongrightarrow> f x) at_top"
       then show "(\<lambda>n. s (X (n + N)) x) \<longlonglongrightarrow> f x"
         by (intro LIMSEQ_ignore_initial_segment filterlim_compose[OF _ X])
     qed
   qed fact+
 qed
 
 lemma integrable_dominated_convergence_at_top: "integrable M f"
 proof -
   from bound obtain N where w: "\<And>n. N \<le> n \<Longrightarrow> AE x in M. norm (s n x) \<le> w x"
     by (auto simp: eventually_at_top_linorder)
   show ?thesis
   proof (rule integrable_dominated_convergence)
     show "AE x in M. norm (s (N + i) x) \<le> w x" for i :: nat
       by (intro w) auto
     show "AE x in M. (\<lambda>i. s (N + real i) x) \<longlonglongrightarrow> f x"
       using lim
     proof eventually_elim
       fix x assume "((\<lambda>i. s i x) \<longlongrightarrow> f x) at_top"
       then show "(\<lambda>n. s (N + n) x) \<longlonglongrightarrow> f x"
         by (rule filterlim_compose)
            (auto intro!: filterlim_tendsto_add_at_top filterlim_real_sequentially)
     qed
   qed fact+
 qed
 
 end
 
 lemma integrable_mult_left_iff [simp]:
   fixes f :: "'a \<Rightarrow> real"
   shows "integrable M (\<lambda>x. c * f x) \<longleftrightarrow> c = 0 \<or> integrable M f"
   using integrable_mult_left[of c M f] integrable_mult_left[of "1 / c" M "\<lambda>x. c * f x"]
   by (cases "c = 0") auto
 
 lemma integrable_mult_right_iff [simp]:
   fixes f :: "'a \<Rightarrow> real"
   shows "integrable M (\<lambda>x. f x * c) \<longleftrightarrow> c = 0 \<or> integrable M f"
   using integrable_mult_left_iff [of M c f] by (simp add: mult.commute)
 
 lemma integrableI_nn_integral_finite:
   assumes [measurable]: "f \<in> borel_measurable M"
     and nonneg: "AE x in M. 0 \<le> f x"
     and finite: "(\<integral>\<^sup>+x. f x \<partial>M) = ennreal x"
   shows "integrable M f"
 proof (rule integrableI_bounded)
   have "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M) = (\<integral>\<^sup>+ x. ennreal (f x) \<partial>M)"
     using nonneg by (intro nn_integral_cong_AE) auto
   with finite show "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M) < \<infinity>"
     by auto
 qed simp
 
 lemma integral_nonneg_AE:
   fixes f :: "'a \<Rightarrow> real"
   assumes nonneg: "AE x in M. 0 \<le> f x"
   shows "0 \<le> integral\<^sup>L M f"
 proof cases
   assume f: "integrable M f"
   then have [measurable]: "f \<in> M \<rightarrow>\<^sub>M borel"
     by auto
   have "(\<lambda>x. max 0 (f x)) \<in> M \<rightarrow>\<^sub>M borel" "\<And>x. 0 \<le> max 0 (f x)" "integrable M (\<lambda>x. max 0 (f x))"
     using f by auto
   from this have "0 \<le> integral\<^sup>L M (\<lambda>x. max 0 (f x))"
   proof (induction rule: borel_measurable_induct_real)
     case (add f g)
     then have "integrable M f" "integrable M g"
       by (auto intro!: integrable_bound[OF add.prems])
     with add show ?case
       by (simp add: nn_integral_add)
   next
     case (seq U)
     show ?case
     proof (rule LIMSEQ_le_const)
       have U_le: "x \<in> space M \<Longrightarrow> U i x \<le> max 0 (f x)" for x i
         using seq by (intro incseq_le) (auto simp: incseq_def le_fun_def)
       with seq nonneg show "(\<lambda>i. integral\<^sup>L M (U i)) \<longlonglongrightarrow> LINT x|M. max 0 (f x)"
         by (intro integral_dominated_convergence) auto
       have "integrable M (U i)" for i
         using seq.prems by (rule integrable_bound) (insert U_le seq, auto)
       with seq show "\<exists>N. \<forall>n\<ge>N. 0 \<le> integral\<^sup>L M (U n)"
         by auto
     qed
   qed (auto)
   also have "\<dots> = integral\<^sup>L M f"
     using nonneg by (auto intro!: integral_cong_AE)
   finally show ?thesis .
 qed (simp add: not_integrable_integral_eq)
 
 lemma integral_nonneg[simp]:
   fixes f :: "'a \<Rightarrow> real"
   shows "(\<And>x. x \<in> space M \<Longrightarrow> 0 \<le> f x) \<Longrightarrow> 0 \<le> integral\<^sup>L M f"
   by (intro integral_nonneg_AE) auto
 
 proposition nn_integral_eq_integral:
   assumes f: "integrable M f"
   assumes nonneg: "AE x in M. 0 \<le> f x"
   shows "(\<integral>\<^sup>+ x. f x \<partial>M) = integral\<^sup>L M f"
 proof -
   { fix f :: "'a \<Rightarrow> real" assume f: "f \<in> borel_measurable M" "\<And>x. 0 \<le> f x" "integrable M f"
     then have "(\<integral>\<^sup>+ x. f x \<partial>M) = integral\<^sup>L M f"
     proof (induct rule: borel_measurable_induct_real)
       case (set A) then show ?case
         by (simp add: integrable_indicator_iff ennreal_indicator emeasure_eq_ennreal_measure)
     next
       case (mult f c) then show ?case
         by (auto simp add: nn_integral_cmult ennreal_mult integral_nonneg_AE)
     next
       case (add g f)
       then have "integrable M f" "integrable M g"
         by (auto intro!: integrable_bound[OF add.prems])
       with add show ?case
         by (simp add: nn_integral_add integral_nonneg_AE)
     next
       case (seq U)
       show ?case
       proof (rule LIMSEQ_unique)
         have U_le_f: "x \<in> space M \<Longrightarrow> U i x \<le> f x" for x i
           using seq by (intro incseq_le) (auto simp: incseq_def le_fun_def)
         have int_U: "\<And>i. integrable M (U i)"
           using seq f U_le_f by (intro integrable_bound[OF f(3)]) auto
         from U_le_f seq have "(\<lambda>i. integral\<^sup>L M (U i)) \<longlonglongrightarrow> integral\<^sup>L M f"
           by (intro integral_dominated_convergence) auto
         then show "(\<lambda>i. ennreal (integral\<^sup>L M (U i))) \<longlonglongrightarrow> ennreal (integral\<^sup>L M f)"
           using seq f int_U by (simp add: f integral_nonneg_AE)
         have "(\<lambda>i. \<integral>\<^sup>+ x. U i x \<partial>M) \<longlonglongrightarrow> \<integral>\<^sup>+ x. f x \<partial>M"
           using seq U_le_f f
           by (intro nn_integral_dominated_convergence[where w=f]) (auto simp: integrable_iff_bounded)
         then show "(\<lambda>i. \<integral>x. U i x \<partial>M) \<longlonglongrightarrow> \<integral>\<^sup>+x. f x \<partial>M"
           using seq int_U by simp
       qed
     qed }
   from this[of "\<lambda>x. max 0 (f x)"] assms have "(\<integral>\<^sup>+ x. max 0 (f x) \<partial>M) = integral\<^sup>L M (\<lambda>x. max 0 (f x))"
     by simp
   also have "\<dots> = integral\<^sup>L M f"
     using assms by (auto intro!: integral_cong_AE simp: integral_nonneg_AE)
   also have "(\<integral>\<^sup>+ x. max 0 (f x) \<partial>M) = (\<integral>\<^sup>+ x. f x \<partial>M)"
     using assms by (auto intro!: nn_integral_cong_AE simp: max_def)
   finally show ?thesis .
 qed
 
 lemma nn_integral_eq_integrable:
   assumes f: "f \<in> M \<rightarrow>\<^sub>M borel" "AE x in M. 0 \<le> f x" and "0 \<le> x"
   shows "(\<integral>\<^sup>+x. f x \<partial>M) = ennreal x \<longleftrightarrow> (integrable M f \<and> integral\<^sup>L M f = x)"
 proof (safe intro!: nn_integral_eq_integral assms)
   assume *: "(\<integral>\<^sup>+x. f x \<partial>M) = ennreal x"
   with integrableI_nn_integral_finite[OF f this] nn_integral_eq_integral[of M f, OF _ f(2)]
   show "integrable M f" "integral\<^sup>L M f = x"
     by (simp_all add: * assms integral_nonneg_AE)
 qed
 
 lemma
   fixes f :: "_ \<Rightarrow> _ \<Rightarrow> 'a :: {banach, second_countable_topology}"
   assumes integrable[measurable]: "\<And>i. integrable M (f i)"
   and summable: "AE x in M. summable (\<lambda>i. norm (f i x))"
   and sums: "summable (\<lambda>i. (\<integral>x. norm (f i x) \<partial>M))"
   shows integrable_suminf: "integrable M (\<lambda>x. (\<Sum>i. f i x))" (is "integrable M ?S")
     and sums_integral: "(\<lambda>i. integral\<^sup>L M (f i)) sums (\<integral>x. (\<Sum>i. f i x) \<partial>M)" (is "?f sums ?x")
     and integral_suminf: "(\<integral>x. (\<Sum>i. f i x) \<partial>M) = (\<Sum>i. integral\<^sup>L M (f i))"
     and summable_integral: "summable (\<lambda>i. integral\<^sup>L M (f i))"
 proof -
   have 1: "integrable M (\<lambda>x. \<Sum>i. norm (f i x))"
   proof (rule integrableI_bounded)
     have "(\<integral>\<^sup>+ x. ennreal (norm (\<Sum>i. norm (f i x))) \<partial>M) = (\<integral>\<^sup>+ x. (\<Sum>i. ennreal (norm (f i x))) \<partial>M)"
       apply (intro nn_integral_cong_AE)
       using summable
       apply eventually_elim
       apply (simp add: suminf_nonneg ennreal_suminf_neq_top)
       done
     also have "\<dots> = (\<Sum>i. \<integral>\<^sup>+ x. norm (f i x) \<partial>M)"
       by (intro nn_integral_suminf) auto
     also have "\<dots> = (\<Sum>i. ennreal (\<integral>x. norm (f i x) \<partial>M))"
       by (intro arg_cong[where f=suminf] ext nn_integral_eq_integral integrable_norm integrable) auto
     finally show "(\<integral>\<^sup>+ x. ennreal (norm (\<Sum>i. norm (f i x))) \<partial>M) < \<infinity>"
       by (simp add: sums ennreal_suminf_neq_top less_top[symmetric] integral_nonneg_AE)
   qed simp
 
   have 2: "AE x in M. (\<lambda>n. \<Sum>i<n. f i x) \<longlonglongrightarrow> (\<Sum>i. f i x)"
     using summable by eventually_elim (auto intro: summable_LIMSEQ summable_norm_cancel)
 
   have 3: "\<And>j. AE x in M. norm (\<Sum>i<j. f i x) \<le> (\<Sum>i. norm (f i x))"
     using summable
   proof eventually_elim
     fix j x assume [simp]: "summable (\<lambda>i. norm (f i x))"
     have "norm (\<Sum>i<j. f i x) \<le> (\<Sum>i<j. norm (f i x))" by (rule norm_sum)
     also have "\<dots> \<le> (\<Sum>i. norm (f i x))"
       using sum_le_suminf[of "\<lambda>i. norm (f i x)"] unfolding sums_iff by auto
     finally show "norm (\<Sum>i<j. f i x) \<le> (\<Sum>i. norm (f i x))" by simp
   qed
 
   note ibl = integrable_dominated_convergence[OF _ _ 1 2 3]
   note int = integral_dominated_convergence[OF _ _ 1 2 3]
 
   show "integrable M ?S"
     by (rule ibl) measurable
 
   show "?f sums ?x" unfolding sums_def
     using int by (simp add: integrable)
   then show "?x = suminf ?f" "summable ?f"
     unfolding sums_iff by auto
 qed
 
 proposition integral_norm_bound [simp]:
   fixes f :: "_ \<Rightarrow> 'a :: {banach, second_countable_topology}"
   shows "norm (integral\<^sup>L M f) \<le> (\<integral>x. norm (f x) \<partial>M)"
 proof (cases "integrable M f")
   case True then show ?thesis
     using nn_integral_eq_integral[of M "\<lambda>x. norm (f x)"] integral_norm_bound_ennreal[of M f]
     by (simp add: integral_nonneg_AE)
 next
   case False
   then have "norm (integral\<^sup>L M f) = 0" by (simp add: not_integrable_integral_eq)
   moreover have "(\<integral>x. norm (f x) \<partial>M) \<ge> 0" by auto
   ultimately show ?thesis by simp
 qed
 
 proposition integral_abs_bound [simp]:
   fixes f :: "'a \<Rightarrow> real" shows "abs (\<integral>x. f x \<partial>M) \<le> (\<integral>x. \<bar>f x\<bar> \<partial>M)"
 using integral_norm_bound[of M f] by auto
 
 lemma integral_eq_nn_integral:
   assumes [measurable]: "f \<in> borel_measurable M"
   assumes nonneg: "AE x in M. 0 \<le> f x"
   shows "integral\<^sup>L M f = enn2real (\<integral>\<^sup>+ x. ennreal (f x) \<partial>M)"
 proof cases
   assume *: "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>M) = \<infinity>"
   also have "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>M) = (\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M)"
     using nonneg by (intro nn_integral_cong_AE) auto
   finally have "\<not> integrable M f"
     by (auto simp: integrable_iff_bounded)
   then show ?thesis
     by (simp add: * not_integrable_integral_eq)
 next
   assume "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>M) \<noteq> \<infinity>"
   then have "integrable M f"
     by (cases "\<integral>\<^sup>+ x. ennreal (f x) \<partial>M" rule: ennreal_cases)
        (auto intro!: integrableI_nn_integral_finite assms)
   from nn_integral_eq_integral[OF this] nonneg show ?thesis
     by (simp add: integral_nonneg_AE)
 qed
 
 lemma enn2real_nn_integral_eq_integral:
   assumes eq: "AE x in M. f x = ennreal (g x)" and nn: "AE x in M. 0 \<le> g x"
     and fin: "(\<integral>\<^sup>+x. f x \<partial>M) < top"
     and [measurable]: "g \<in> M \<rightarrow>\<^sub>M borel"
   shows "enn2real (\<integral>\<^sup>+x. f x \<partial>M) = (\<integral>x. g x \<partial>M)"
 proof -
   have "ennreal (enn2real (\<integral>\<^sup>+x. f x \<partial>M)) = (\<integral>\<^sup>+x. f x \<partial>M)"
     using fin by (intro ennreal_enn2real) auto
   also have "\<dots> = (\<integral>\<^sup>+x. g x \<partial>M)"
     using eq by (rule nn_integral_cong_AE)
   also have "\<dots> = (\<integral>x. g x \<partial>M)"
   proof (rule nn_integral_eq_integral)
     show "integrable M g"
     proof (rule integrableI_bounded)
       have "(\<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M) = (\<integral>\<^sup>+ x. f x \<partial>M)"
         using eq nn by (auto intro!: nn_integral_cong_AE elim!: eventually_elim2)
       also note fin
       finally show "(\<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M) < \<infinity>"
         by simp
     qed simp
   qed fact
   finally show ?thesis
     using nn by (simp add: integral_nonneg_AE)
 qed
 
 lemma has_bochner_integral_nn_integral:
   assumes "f \<in> borel_measurable M" "AE x in M. 0 \<le> f x" "0 \<le> x"
   assumes "(\<integral>\<^sup>+x. f x \<partial>M) = ennreal x"
   shows "has_bochner_integral M f x"
   unfolding has_bochner_integral_iff
   using assms by (auto simp: assms integral_eq_nn_integral intro: integrableI_nn_integral_finite)
 
 lemma integrableI_simple_bochner_integrable:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   shows "simple_bochner_integrable M f \<Longrightarrow> integrable M f"
   by (intro integrableI_sequence[where s="\<lambda>_. f"] borel_measurable_simple_function)
      (auto simp: zero_ennreal_def[symmetric] simple_bochner_integrable.simps)
 
 proposition integrable_induct[consumes 1, case_names base add lim, induct pred: integrable]:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes "integrable M f"
   assumes base: "\<And>A c. A \<in> sets M \<Longrightarrow> emeasure M A < \<infinity> \<Longrightarrow> P (\<lambda>x. indicator A x *\<^sub>R c)"
   assumes add: "\<And>f g. integrable M f \<Longrightarrow> P f \<Longrightarrow> integrable M g \<Longrightarrow> P g \<Longrightarrow> P (\<lambda>x. f x + g x)"
   assumes lim: "\<And>f s. (\<And>i. integrable M (s i)) \<Longrightarrow> (\<And>i. P (s i)) \<Longrightarrow>
    (\<And>x. x \<in> space M \<Longrightarrow> (\<lambda>i. s i x) \<longlonglongrightarrow> f x) \<Longrightarrow>
    (\<And>i x. x \<in> space M \<Longrightarrow> norm (s i x) \<le> 2 * norm (f x)) \<Longrightarrow> integrable M f \<Longrightarrow> P f"
   shows "P f"
 proof -
   from \<open>integrable M f\<close> have f: "f \<in> borel_measurable M" "(\<integral>\<^sup>+x. norm (f x) \<partial>M) < \<infinity>"
     unfolding integrable_iff_bounded by auto
   from borel_measurable_implies_sequence_metric[OF f(1)]
   obtain s where s: "\<And>i. simple_function M (s i)" "\<And>x. x \<in> space M \<Longrightarrow> (\<lambda>i. s i x) \<longlonglongrightarrow> f x"
     "\<And>i x. x \<in> space M \<Longrightarrow> norm (s i x) \<le> 2 * norm (f x)"
     unfolding norm_conv_dist by metis
 
   { fix f A
     have [simp]: "P (\<lambda>x. 0)"
       using base[of "{}" undefined] by simp
     have "(\<And>i::'b. i \<in> A \<Longrightarrow> integrable M (f i::'a \<Rightarrow> 'b)) \<Longrightarrow>
     (\<And>i. i \<in> A \<Longrightarrow> P (f i)) \<Longrightarrow> P (\<lambda>x. \<Sum>i\<in>A. f i x)"
     by (induct A rule: infinite_finite_induct) (auto intro!: add) }
   note sum = this
 
   define s' where [abs_def]: "s' i z = indicator (space M) z *\<^sub>R s i z" for i z
   then have s'_eq_s: "\<And>i x. x \<in> space M \<Longrightarrow> s' i x = s i x"
     by simp
 
   have sf[measurable]: "\<And>i. simple_function M (s' i)"
     unfolding s'_def using s(1)
     by (intro simple_function_compose2[where h="(*\<^sub>R)"] simple_function_indicator) auto
 
   { fix i
     have "\<And>z. {y. s' i z = y \<and> y \<in> s' i ` space M \<and> y \<noteq> 0 \<and> z \<in> space M} =
         (if z \<in> space M \<and> s' i z \<noteq> 0 then {s' i z} else {})"
       by (auto simp add: s'_def split: split_indicator)
     then have "\<And>z. s' i = (\<lambda>z. \<Sum>y\<in>s' i`space M - {0}. indicator {x\<in>space M. s' i x = y} z *\<^sub>R y)"
       using sf by (auto simp: fun_eq_iff simple_function_def s'_def) }
   note s'_eq = this
 
   show "P f"
   proof (rule lim)
     fix i
 
     have "(\<integral>\<^sup>+x. norm (s' i x) \<partial>M) \<le> (\<integral>\<^sup>+x. ennreal (2 * norm (f x)) \<partial>M)"
       using s by (intro nn_integral_mono) (auto simp: s'_eq_s)
     also have "\<dots> < \<infinity>"
       using f by (simp add: nn_integral_cmult ennreal_mult_less_top ennreal_mult)
     finally have sbi: "simple_bochner_integrable M (s' i)"
       using sf by (intro simple_bochner_integrableI_bounded) auto
     then show "integrable M (s' i)"
       by (rule integrableI_simple_bochner_integrable)
 
     { fix x assume"x \<in> space M" "s' i x \<noteq> 0"
       then have "emeasure M {y \<in> space M. s' i y = s' i x} \<le> emeasure M {y \<in> space M. s' i y \<noteq> 0}"
         by (intro emeasure_mono) auto
       also have "\<dots> < \<infinity>"
         using sbi by (auto elim: simple_bochner_integrable.cases simp: less_top)
       finally have "emeasure M {y \<in> space M. s' i y = s' i x} \<noteq> \<infinity>" by simp }
     then show "P (s' i)"
       by (subst s'_eq) (auto intro!: sum base simp: less_top)
 
     fix x assume "x \<in> space M" with s show "(\<lambda>i. s' i x) \<longlonglongrightarrow> f x"
       by (simp add: s'_eq_s)
     show "norm (s' i x) \<le> 2 * norm (f x)"
       using \<open>x \<in> space M\<close> s by (simp add: s'_eq_s)
   qed fact
 qed
 
 lemma integral_eq_zero_AE:
   "(AE x in M. f x = 0) \<Longrightarrow> integral\<^sup>L M f = 0"
   using integral_cong_AE[of f M "\<lambda>_. 0"]
   by (cases "integrable M f") (simp_all add: not_integrable_integral_eq)
 
 lemma integral_nonneg_eq_0_iff_AE:
   fixes f :: "_ \<Rightarrow> real"
   assumes f[measurable]: "integrable M f" and nonneg: "AE x in M. 0 \<le> f x"
   shows "integral\<^sup>L M f = 0 \<longleftrightarrow> (AE x in M. f x = 0)"
 proof
   assume "integral\<^sup>L M f = 0"
   then have "integral\<^sup>N M f = 0"
     using nn_integral_eq_integral[OF f nonneg] by simp
   then have "AE x in M. ennreal (f x) \<le> 0"
     by (simp add: nn_integral_0_iff_AE)
   with nonneg show "AE x in M. f x = 0"
     by auto
 qed (auto simp add: integral_eq_zero_AE)
 
 lemma integral_mono_AE:
   fixes f :: "'a \<Rightarrow> real"
   assumes "integrable M f" "integrable M g" "AE x in M. f x \<le> g x"
   shows "integral\<^sup>L M f \<le> integral\<^sup>L M g"
 proof -
   have "0 \<le> integral\<^sup>L M (\<lambda>x. g x - f x)"
     using assms by (intro integral_nonneg_AE integrable_diff assms) auto
   also have "\<dots> = integral\<^sup>L M g - integral\<^sup>L M f"
     by (intro integral_diff assms)
   finally show ?thesis by simp
 qed
 
 lemma integral_mono:
   fixes f :: "'a \<Rightarrow> real"
   shows "integrable M f \<Longrightarrow> integrable M g \<Longrightarrow> (\<And>x. x \<in> space M \<Longrightarrow> f x \<le> g x) \<Longrightarrow>
     integral\<^sup>L M f \<le> integral\<^sup>L M g"
   by (intro integral_mono_AE) auto
 
 lemma integral_norm_bound_integral:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::{banach,second_countable_topology}"
   assumes "integrable M f" "integrable M g" "\<And>x. x \<in> space M \<Longrightarrow> norm(f x) \<le> g x"
   shows "norm (\<integral>x. f x \<partial>M) \<le> (\<integral>x. g x \<partial>M)"
 proof -
   have "norm (\<integral>x. f x \<partial>M) \<le> (\<integral>x. norm (f x) \<partial>M)"
     by (rule integral_norm_bound)
   also have "... \<le> (\<integral>x. g x \<partial>M)"
     using assms integrable_norm integral_mono by blast
   finally show ?thesis .
 qed
 
 lemma integral_abs_bound_integral:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "integrable M f" "integrable M g" "\<And>x. x \<in> space M \<Longrightarrow> \<bar>f x\<bar> \<le> g x"
   shows "\<bar>\<integral>x. f x \<partial>M\<bar> \<le> (\<integral>x. g x \<partial>M)"
   by (metis integral_norm_bound_integral assms real_norm_def)
 
 text \<open>The next two statements are useful to bound Lebesgue integrals, as they avoid one
 integrability assumption. The price to pay is that the upper function has to be nonnegative,
 but this is often true and easy to check in computations.\<close>
 
 lemma integral_mono_AE':
   fixes f::"_ \<Rightarrow> real"
   assumes "integrable M f" "AE x in M. g x \<le> f x" "AE x in M. 0 \<le> f x"
   shows "(\<integral>x. g x \<partial>M) \<le> (\<integral>x. f x \<partial>M)"
 proof (cases "integrable M g")
   case True
   show ?thesis by (rule integral_mono_AE, auto simp add: assms True)
 next
   case False
   then have "(\<integral>x. g x \<partial>M) = 0" by (simp add: not_integrable_integral_eq)
   also have "... \<le> (\<integral>x. f x \<partial>M)" by (simp add: integral_nonneg_AE[OF assms(3)])
   finally show ?thesis by simp
 qed
 
 lemma integral_mono':
   fixes f::"_ \<Rightarrow> real"
   assumes "integrable M f" "\<And>x. x \<in> space M \<Longrightarrow> g x \<le> f x" "\<And>x. x \<in> space M \<Longrightarrow> 0 \<le> f x"
   shows "(\<integral>x. g x \<partial>M) \<le> (\<integral>x. f x \<partial>M)"
 by (rule integral_mono_AE', insert assms, auto)
 
 lemma (in finite_measure) integrable_measure:
   assumes I: "disjoint_family_on X I" "countable I"
   shows "integrable (count_space I) (\<lambda>i. measure M (X i))"
 proof -
   have "(\<integral>\<^sup>+i. measure M (X i) \<partial>count_space I) = (\<integral>\<^sup>+i. measure M (if X i \<in> sets M then X i else {}) \<partial>count_space I)"
     by (auto intro!: nn_integral_cong measure_notin_sets)
   also have "\<dots> = measure M (\<Union>i\<in>I. if X i \<in> sets M then X i else {})"
     using I unfolding emeasure_eq_measure[symmetric]
     by (subst emeasure_UN_countable) (auto simp: disjoint_family_on_def)
   finally show ?thesis
     by (auto intro!: integrableI_bounded)
 qed
 
 lemma integrableI_real_bounded:
   assumes f: "f \<in> borel_measurable M" and ae: "AE x in M. 0 \<le> f x" and fin: "integral\<^sup>N M f < \<infinity>"
   shows "integrable M f"
 proof (rule integrableI_bounded)
   have "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M) = \<integral>\<^sup>+ x. ennreal (f x) \<partial>M"
     using ae by (auto intro: nn_integral_cong_AE)
   also note fin
   finally show "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M) < \<infinity>" .
 qed fact
 
 lemma nn_integral_nonneg_infinite:
   fixes f::"'a \<Rightarrow> real"
   assumes "f \<in> borel_measurable M" "\<not> integrable M f" "AE x in M. f x \<ge> 0"
   shows "(\<integral>\<^sup>+x. f x \<partial>M) = \<infinity>"
 using assms integrableI_real_bounded less_top by auto
 
 lemma integral_real_bounded:
   assumes "0 \<le> r" "integral\<^sup>N M f \<le> ennreal r"
   shows "integral\<^sup>L M f \<le> r"
 proof cases
   assume [simp]: "integrable M f"
 
   have "integral\<^sup>L M (\<lambda>x. max 0 (f x)) = integral\<^sup>N M (\<lambda>x. max 0 (f x))"
     by (intro nn_integral_eq_integral[symmetric]) auto
   also have "\<dots> = integral\<^sup>N M f"
     by (intro nn_integral_cong) (simp add: max_def ennreal_neg)
   also have "\<dots> \<le> r"
     by fact
   finally have "integral\<^sup>L M (\<lambda>x. max 0 (f x)) \<le> r"
     using \<open>0 \<le> r\<close> by simp
 
   moreover have "integral\<^sup>L M f \<le> integral\<^sup>L M (\<lambda>x. max 0 (f x))"
     by (rule integral_mono_AE) auto
   ultimately show ?thesis
     by simp
 next
   assume "\<not> integrable M f" then show ?thesis
     using \<open>0 \<le> r\<close> by (simp add: not_integrable_integral_eq)
 qed
 
 lemma integrable_MIN:
   fixes f:: "_ \<Rightarrow> _ \<Rightarrow> real"
   shows "\<lbrakk> finite I;  I \<noteq> {}; \<And>i. i \<in> I \<Longrightarrow> integrable M (f i) \<rbrakk>
    \<Longrightarrow> integrable M (\<lambda>x. MIN i\<in>I. f i x)"
 by (induct rule: finite_ne_induct) simp+
 
 lemma integrable_MAX:
   fixes f:: "_ \<Rightarrow> _ \<Rightarrow> real"
   shows "\<lbrakk> finite I;  I \<noteq> {};  \<And>i. i \<in> I \<Longrightarrow> integrable M (f i) \<rbrakk>
   \<Longrightarrow> integrable M (\<lambda>x. MAX i\<in>I. f i x)"
 by (induct rule: finite_ne_induct) simp+
 
 theorem integral_Markov_inequality:
   assumes [measurable]: "integrable M u" and "AE x in M. 0 \<le> u x" "0 < (c::real)"
   shows "(emeasure M) {x\<in>space M. u x \<ge> c} \<le> (1/c) * (\<integral>x. u x \<partial>M)"
 proof -
   have "(\<integral>\<^sup>+ x. ennreal(u x) * indicator (space M) x \<partial>M) \<le> (\<integral>\<^sup>+ x. u x \<partial>M)"
     by (rule nn_integral_mono_AE, auto simp add: \<open>c>0\<close> less_eq_real_def)
   also have "... = (\<integral>x. u x \<partial>M)"
     by (rule nn_integral_eq_integral, auto simp add: assms)
   finally have *: "(\<integral>\<^sup>+ x. ennreal(u x) * indicator (space M) x \<partial>M) \<le> (\<integral>x. u x \<partial>M)"
     by simp
 
   have "{x \<in> space M. u x \<ge> c} = {x \<in> space M. ennreal(1/c) * u x \<ge> 1} \<inter> (space M)"
     using \<open>c>0\<close> by (auto simp: ennreal_mult'[symmetric])
   then have "emeasure M {x \<in> space M. u x \<ge> c} = emeasure M ({x \<in> space M. ennreal(1/c) * u x \<ge> 1})"
     by simp
   also have "... \<le> ennreal(1/c) * (\<integral>\<^sup>+ x. ennreal(u x) * indicator (space M) x \<partial>M)"
     by (rule nn_integral_Markov_inequality) (auto simp add: assms)
   also have "... \<le> ennreal(1/c) * (\<integral>x. u x \<partial>M)"
     by (rule mult_left_mono) (use * \<open>c > 0\<close> in auto)
   finally show ?thesis
     using \<open>0<c\<close> by (simp add: ennreal_mult'[symmetric])
 qed
 
 theorem integral_Markov_inequality_measure:
   assumes [measurable]: "integrable M u" and "A \<in> sets M" and "AE x in M. 0 \<le> u x" "0 < (c::real)"
   shows "measure M {x\<in>space M. u x \<ge> c} \<le> (\<integral>x. u x \<partial>M) / c"
 proof -
   have le: "emeasure M {x\<in>space M. u x \<ge> c} \<le> ennreal ((1/c) * (\<integral>x. u x \<partial>M))"
     by (rule integral_Markov_inequality) (use assms in auto)
   also have "\<dots> < top"
     by auto
   finally have "ennreal (measure M {x\<in>space M. u x \<ge> c}) = emeasure M {x\<in>space M. u x \<ge> c}"
     by (intro emeasure_eq_ennreal_measure [symmetric]) auto
   also note le
   finally show ?thesis
     by (subst (asm) ennreal_le_iff)
        (auto intro!: divide_nonneg_pos Bochner_Integration.integral_nonneg_AE assms)
 qed
 
 theorem%important (in finite_measure) second_moment_method:
   assumes [measurable]: "f \<in> M \<rightarrow>\<^sub>M borel"
   assumes "integrable M (\<lambda>x. f x ^ 2)"
   defines "\<mu> \<equiv> lebesgue_integral M f"
   assumes "a > 0"
   shows "measure M {x\<in>space M. \<bar>f x\<bar> \<ge> a} \<le> lebesgue_integral M (\<lambda>x. f x ^ 2) / a\<^sup>2"
 proof -
   have integrable: "integrable M f"
     using assms by (blast dest: square_integrable_imp_integrable)
   have "{x\<in>space M. \<bar>f x\<bar> \<ge> a} = {x\<in>space M. f x ^ 2 \<ge> a\<^sup>2}"
     using \<open>a > 0\<close> by (simp flip: abs_le_square_iff)
   hence "measure M {x\<in>space M. \<bar>f x\<bar> \<ge> a} = measure M {x\<in>space M. f x ^ 2 \<ge> a\<^sup>2}"
     by simp
   also have "\<dots> \<le> lebesgue_integral M (\<lambda>x. f x ^ 2) / a\<^sup>2"
     using assms by (intro integral_Markov_inequality_measure) auto
   finally show ?thesis .
 qed
 
 lemma integral_ineq_eq_0_then_AE:
   fixes f::"_ \<Rightarrow> real"
   assumes "AE x in M. f x \<le> g x" "integrable M f" "integrable M g"
           "(\<integral>x. f x \<partial>M) = (\<integral>x. g x \<partial>M)"
   shows "AE x in M. f x = g x"
 proof -
   define h where "h = (\<lambda>x. g x - f x)"
   have "AE x in M. h x = 0"
     apply (subst integral_nonneg_eq_0_iff_AE[symmetric])
     unfolding h_def using assms by auto
   then show ?thesis unfolding h_def by auto
 qed
 
 lemma not_AE_zero_int_E:
   fixes f::"'a \<Rightarrow> real"
   assumes "AE x in M. f x \<ge> 0" "(\<integral>x. f x \<partial>M) > 0"
       and [measurable]: "f \<in> borel_measurable M"
   shows "\<exists>A e. A \<in> sets M \<and> e>0 \<and> emeasure M A > 0 \<and> (\<forall>x \<in> A. f x \<ge> e)"
 proof (rule not_AE_zero_E, auto simp add: assms)
   assume *: "AE x in M. f x = 0"
   have "(\<integral>x. f x \<partial>M) = (\<integral>x. 0 \<partial>M)" by (rule integral_cong_AE, auto simp add: *)
   then have "(\<integral>x. f x \<partial>M) = 0" by simp
   then show False using assms(2) by simp
 qed
 
 proposition tendsto_L1_int:
   fixes u :: "_ \<Rightarrow> _ \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes [measurable]: "\<And>n. integrable M (u n)" "integrable M f"
           and "((\<lambda>n. (\<integral>\<^sup>+x. norm(u n x - f x) \<partial>M)) \<longlongrightarrow> 0) F"
   shows "((\<lambda>n. (\<integral>x. u n x \<partial>M)) \<longlongrightarrow> (\<integral>x. f x \<partial>M)) F"
 proof -
   have "((\<lambda>n. norm((\<integral>x. u n x \<partial>M) - (\<integral>x. f x \<partial>M))) \<longlongrightarrow> (0::ennreal)) F"
   proof (rule tendsto_sandwich[of "\<lambda>_. 0", where ?h = "\<lambda>n. (\<integral>\<^sup>+x. norm(u n x - f x) \<partial>M)"], auto simp add: assms)
     {
       fix n
       have "(\<integral>x. u n x \<partial>M) - (\<integral>x. f x \<partial>M) = (\<integral>x. u n x - f x \<partial>M)"
         apply (rule Bochner_Integration.integral_diff[symmetric]) using assms by auto
       then have "norm((\<integral>x. u n x \<partial>M) - (\<integral>x. f x \<partial>M)) = norm (\<integral>x. u n x - f x \<partial>M)"
         by auto
       also have "... \<le> (\<integral>x. norm(u n x - f x) \<partial>M)"
         by (rule integral_norm_bound)
       finally have "ennreal(norm((\<integral>x. u n x \<partial>M) - (\<integral>x. f x \<partial>M))) \<le> (\<integral>x. norm(u n x - f x) \<partial>M)"
         by simp
       also have "... = (\<integral>\<^sup>+x. norm(u n x - f x) \<partial>M)"
         apply (rule nn_integral_eq_integral[symmetric]) using assms by auto
       finally have "norm((\<integral>x. u n x \<partial>M) - (\<integral>x. f x \<partial>M)) \<le> (\<integral>\<^sup>+x. norm(u n x - f x) \<partial>M)" by simp
     }
     then show "eventually (\<lambda>n. norm((\<integral>x. u n x \<partial>M) - (\<integral>x. f x \<partial>M)) \<le> (\<integral>\<^sup>+x. norm(u n x - f x) \<partial>M)) F"
       by auto
   qed
   then have "((\<lambda>n. norm((\<integral>x. u n x \<partial>M) - (\<integral>x. f x \<partial>M))) \<longlongrightarrow> 0) F"
     by (simp flip: ennreal_0)
   then have "((\<lambda>n. ((\<integral>x. u n x \<partial>M) - (\<integral>x. f x \<partial>M))) \<longlongrightarrow> 0) F" using tendsto_norm_zero_iff by blast
   then show ?thesis using Lim_null by auto
 qed
 
 text \<open>The next lemma asserts that, if a sequence of functions converges in \<open>L\<^sup>1\<close>, then
 it admits a subsequence that converges almost everywhere.\<close>
 
 proposition tendsto_L1_AE_subseq:
   fixes u :: "nat \<Rightarrow> 'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes [measurable]: "\<And>n. integrable M (u n)"
       and "(\<lambda>n. (\<integral>x. norm(u n x) \<partial>M)) \<longlonglongrightarrow> 0"
   shows "\<exists>r::nat\<Rightarrow>nat. strict_mono r \<and> (AE x in M. (\<lambda>n. u (r n) x) \<longlonglongrightarrow> 0)"
 proof -
   {
     fix k
     have "eventually (\<lambda>n. (\<integral>x. norm(u n x) \<partial>M) < (1/2)^k) sequentially"
       using order_tendstoD(2)[OF assms(2)] by auto
     with eventually_elim2[OF eventually_gt_at_top[of k] this]
     have "\<exists>n>k. (\<integral>x. norm(u n x) \<partial>M) < (1/2)^k"
       by (metis eventually_False_sequentially)
   }
   then have "\<exists>r. \<forall>n. True \<and> (r (Suc n) > r n \<and> (\<integral>x. norm(u (r (Suc n)) x) \<partial>M) < (1/2)^(r n))"
     by (intro dependent_nat_choice, auto)
   then obtain r0 where r0: "strict_mono r0" "\<And>n. (\<integral>x. norm(u (r0 (Suc n)) x) \<partial>M) < (1/2)^(r0 n)"
     by (auto simp: strict_mono_Suc_iff)
   define r where "r = (\<lambda>n. r0(n+1))"
   have "strict_mono r" unfolding r_def using r0(1) by (simp add: strict_mono_Suc_iff)
   have I: "(\<integral>\<^sup>+x. norm(u (r n) x) \<partial>M) < ennreal((1/2)^n)" for n
   proof -
     have "r0 n \<ge> n" using \<open>strict_mono r0\<close> by (simp add: seq_suble)
     have "(1/2::real)^(r0 n) \<le> (1/2)^n" by (rule power_decreasing[OF \<open>r0 n \<ge> n\<close>], auto)
     then have "(\<integral>x. norm(u (r0 (Suc n)) x) \<partial>M) < (1/2)^n" 
       using r0(2) less_le_trans by blast
     then have "(\<integral>x. norm(u (r n) x) \<partial>M) < (1/2)^n" 
       unfolding r_def by auto
     moreover have "(\<integral>\<^sup>+x. norm(u (r n) x) \<partial>M) = (\<integral>x. norm(u (r n) x) \<partial>M)"
       by (rule nn_integral_eq_integral, auto simp add: integrable_norm[OF assms(1)[of "r n"]])
     ultimately show ?thesis by (auto intro: ennreal_lessI)
   qed
 
   have "AE x in M. limsup (\<lambda>n. ennreal (norm(u (r n) x))) \<le> 0"
   proof (rule AE_upper_bound_inf_ennreal)
     fix e::real assume "e > 0"
     define A where "A = (\<lambda>n. {x \<in> space M. norm(u (r n) x) \<ge> e})"
     have A_meas [measurable]: "\<And>n. A n \<in> sets M" unfolding A_def by auto
     have A_bound: "emeasure M (A n) < (1/e) * ennreal((1/2)^n)" for n
     proof -
       have *: "indicator (A n) x \<le> (1/e) * ennreal(norm(u (r n) x))" for x
         apply (cases "x \<in> A n") unfolding A_def using \<open>0 < e\<close> by (auto simp: ennreal_mult[symmetric])
       have "emeasure M (A n) = (\<integral>\<^sup>+x. indicator (A n) x \<partial>M)" by auto
       also have "... \<le> (\<integral>\<^sup>+x. (1/e) * ennreal(norm(u (r n) x)) \<partial>M)"
         apply (rule nn_integral_mono) using * by auto
       also have "... = (1/e) * (\<integral>\<^sup>+x. norm(u (r n) x) \<partial>M)"
         apply (rule nn_integral_cmult) using \<open>e > 0\<close> by auto
       also have "... < (1/e) * ennreal((1/2)^n)"
         using I[of n] \<open>e > 0\<close> by (intro ennreal_mult_strict_left_mono) auto
       finally show ?thesis by simp
     qed
     have A_fin: "emeasure M (A n) < \<infinity>" for n
       using \<open>e > 0\<close> A_bound[of n]
       by (auto simp add: ennreal_mult less_top[symmetric])
 
     have A_sum: "summable (\<lambda>n. measure M (A n))"
     proof (rule summable_comparison_test'[of "\<lambda>n. (1/e) * (1/2)^n" 0])
       have "summable (\<lambda>n. (1/(2::real))^n)" by (simp add: summable_geometric)
       then show "summable (\<lambda>n. (1/e) * (1/2)^n)" using summable_mult by blast
       fix n::nat assume "n \<ge> 0"
       have "norm(measure M (A n)) = measure M (A n)" by simp
       also have "... = enn2real(emeasure M (A n))" unfolding measure_def by simp
       also have "... < enn2real((1/e) * (1/2)^n)"
         using A_bound[of n] \<open>emeasure M (A n) < \<infinity>\<close> \<open>0 < e\<close>
         by (auto simp: emeasure_eq_ennreal_measure ennreal_mult[symmetric] ennreal_less_iff)
       also have "... = (1/e) * (1/2)^n"
         using \<open>0<e\<close> by auto
       finally show "norm(measure M (A n)) \<le> (1/e) * (1/2)^n" by simp
     qed
 
     have "AE x in M. eventually (\<lambda>n. x \<in> space M - A n) sequentially"
       by (rule borel_cantelli_AE1[OF A_meas A_fin A_sum])
     moreover
     {
       fix x assume "eventually (\<lambda>n. x \<in> space M - A n) sequentially"
       moreover have "norm(u (r n) x) \<le> ennreal e" if "x \<in> space M - A n" for n
         using that unfolding A_def by (auto intro: ennreal_leI)
       ultimately have "eventually (\<lambda>n. norm(u (r n) x) \<le> ennreal e) sequentially"
         by (simp add: eventually_mono)
       then have "limsup (\<lambda>n. ennreal (norm(u (r n) x))) \<le> e"
         by (simp add: Limsup_bounded)
     }
     ultimately show "AE x in M. limsup (\<lambda>n. ennreal (norm(u (r n) x))) \<le> 0 + ennreal e" by auto
   qed
   moreover
   {
     fix x assume "limsup (\<lambda>n. ennreal (norm(u (r n) x))) \<le> 0"
     moreover then have "liminf (\<lambda>n. ennreal (norm(u (r n) x))) \<le> 0"
       by (rule order_trans[rotated]) (auto intro: Liminf_le_Limsup)
     ultimately have "(\<lambda>n. ennreal (norm(u (r n) x))) \<longlonglongrightarrow> 0"
       using tendsto_Limsup[of sequentially "\<lambda>n. ennreal (norm(u (r n) x))"] by auto
     then have "(\<lambda>n. norm(u (r n) x)) \<longlonglongrightarrow> 0"
       by (simp flip: ennreal_0)
     then have "(\<lambda>n. u (r n) x) \<longlonglongrightarrow> 0"
       by (simp add: tendsto_norm_zero_iff)
   }
   ultimately have "AE x in M. (\<lambda>n. u (r n) x) \<longlonglongrightarrow> 0" by auto
   then show ?thesis using \<open>strict_mono r\<close> by auto
 qed
 
 subsection \<open>Restricted measure spaces\<close>
 
 lemma integrable_restrict_space:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes \<Omega>[simp]: "\<Omega> \<inter> space M \<in> sets M"
   shows "integrable (restrict_space M \<Omega>) f \<longleftrightarrow> integrable M (\<lambda>x. indicator \<Omega> x *\<^sub>R f x)"
   unfolding integrable_iff_bounded
     borel_measurable_restrict_space_iff[OF \<Omega>]
     nn_integral_restrict_space[OF \<Omega>]
   by (simp add: ac_simps ennreal_indicator ennreal_mult)
 
 lemma integral_restrict_space:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes \<Omega>[simp]: "\<Omega> \<inter> space M \<in> sets M"
   shows "integral\<^sup>L (restrict_space M \<Omega>) f = integral\<^sup>L M (\<lambda>x. indicator \<Omega> x *\<^sub>R f x)"
 proof (rule integral_eq_cases)
   assume "integrable (restrict_space M \<Omega>) f"
   then show ?thesis
   proof induct
     case (base A c) then show ?case
       by (simp add: indicator_inter_arith[symmetric] sets_restrict_space_iff
                     emeasure_restrict_space Int_absorb1 measure_restrict_space)
   next
     case (add g f) then show ?case
       by (simp add: scaleR_add_right integrable_restrict_space)
   next
     case (lim f s)
     show ?case
     proof (rule LIMSEQ_unique)
       show "(\<lambda>i. integral\<^sup>L (restrict_space M \<Omega>) (s i)) \<longlonglongrightarrow> integral\<^sup>L (restrict_space M \<Omega>) f"
         using lim by (intro integral_dominated_convergence[where w="\<lambda>x. 2 * norm (f x)"]) simp_all
 
       show "(\<lambda>i. integral\<^sup>L (restrict_space M \<Omega>) (s i)) \<longlonglongrightarrow> (\<integral> x. indicator \<Omega> x *\<^sub>R f x \<partial>M)"
         unfolding lim
         using lim
         by (intro integral_dominated_convergence[where w="\<lambda>x. 2 * norm (indicator \<Omega> x *\<^sub>R f x)"])
            (auto simp add: space_restrict_space integrable_restrict_space simp del: norm_scaleR
                  split: split_indicator)
     qed
   qed
 qed (simp add: integrable_restrict_space)
 
 lemma integral_empty:
   assumes "space M = {}"
   shows "integral\<^sup>L M f = 0"
 proof -
   have "(\<integral> x. f x \<partial>M) = (\<integral> x. 0 \<partial>M)"
     by(rule integral_cong)(simp_all add: assms)
   thus ?thesis by simp
 qed
 
 subsection \<open>Measure spaces with an associated density\<close>
 
 lemma integrable_density:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}" and g :: "'a \<Rightarrow> real"
   assumes [measurable]: "f \<in> borel_measurable M" "g \<in> borel_measurable M"
     and nn: "AE x in M. 0 \<le> g x"
   shows "integrable (density M g) f \<longleftrightarrow> integrable M (\<lambda>x. g x *\<^sub>R f x)"
   unfolding integrable_iff_bounded using nn
   apply (simp add: nn_integral_density less_top[symmetric])
   apply (intro arg_cong2[where f="(=)"] refl nn_integral_cong_AE)
   apply (auto simp: ennreal_mult)
   done
 
 lemma integral_density:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}" and g :: "'a \<Rightarrow> real"
   assumes f: "f \<in> borel_measurable M"
     and g[measurable]: "g \<in> borel_measurable M" "AE x in M. 0 \<le> g x"
   shows "integral\<^sup>L (density M g) f = integral\<^sup>L M (\<lambda>x. g x *\<^sub>R f x)"
 proof (rule integral_eq_cases)
   assume "integrable (density M g) f"
   then show ?thesis
   proof induct
     case (base A c)
     then have [measurable]: "A \<in> sets M" by auto
 
     have int: "integrable M (\<lambda>x. g x * indicator A x)"
       using g base integrable_density[of "indicator A :: 'a \<Rightarrow> real" M g] by simp
     then have "integral\<^sup>L M (\<lambda>x. g x * indicator A x) = (\<integral>\<^sup>+ x. ennreal (g x * indicator A x) \<partial>M)"
       using g by (subst nn_integral_eq_integral) auto
     also have "\<dots> = (\<integral>\<^sup>+ x. ennreal (g x) * indicator A x \<partial>M)"
       by (intro nn_integral_cong) (auto split: split_indicator)
     also have "\<dots> = emeasure (density M g) A"
       by (rule emeasure_density[symmetric]) auto
     also have "\<dots> = ennreal (measure (density M g) A)"
       using base by (auto intro: emeasure_eq_ennreal_measure)
     also have "\<dots> = integral\<^sup>L (density M g) (indicator A)"
       using base by simp
     finally show ?case
       using base g
       apply (simp add: int integral_nonneg_AE)
       apply (subst (asm) ennreal_inj)
       apply (auto intro!: integral_nonneg_AE)
       done
   next
     case (add f h)
     then have [measurable]: "f \<in> borel_measurable M" "h \<in> borel_measurable M"
       by (auto dest!: borel_measurable_integrable)
     from add g show ?case
       by (simp add: scaleR_add_right integrable_density)
   next
     case (lim f s)
     have [measurable]: "f \<in> borel_measurable M" "\<And>i. s i \<in> borel_measurable M"
       using lim(1,5)[THEN borel_measurable_integrable] by auto
 
     show ?case
     proof (rule LIMSEQ_unique)
       show "(\<lambda>i. integral\<^sup>L M (\<lambda>x. g x *\<^sub>R s i x)) \<longlonglongrightarrow> integral\<^sup>L M (\<lambda>x. g x *\<^sub>R f x)"
       proof (rule integral_dominated_convergence)
         show "integrable M (\<lambda>x. 2 * norm (g x *\<^sub>R f x))"
           by (intro integrable_mult_right integrable_norm integrable_density[THEN iffD1] lim g) auto
         show "AE x in M. (\<lambda>i. g x *\<^sub>R s i x) \<longlonglongrightarrow> g x *\<^sub>R f x"
           using lim(3) by (auto intro!: tendsto_scaleR AE_I2[of M])
         show "\<And>i. AE x in M. norm (g x *\<^sub>R s i x) \<le> 2 * norm (g x *\<^sub>R f x)"
           using lim(4) g by (auto intro!: AE_I2[of M] mult_left_mono simp: field_simps)
       qed auto
       show "(\<lambda>i. integral\<^sup>L M (\<lambda>x. g x *\<^sub>R s i x)) \<longlonglongrightarrow> integral\<^sup>L (density M g) f"
         unfolding lim(2)[symmetric]
         by (rule integral_dominated_convergence[where w="\<lambda>x. 2 * norm (f x)"])
            (insert lim(3-5), auto)
     qed
   qed
 qed (simp add: f g integrable_density)
 
 lemma
   fixes g :: "'a \<Rightarrow> real"
   assumes "f \<in> borel_measurable M" "AE x in M. 0 \<le> f x" "g \<in> borel_measurable M"
   shows integral_real_density: "integral\<^sup>L (density M f) g = (\<integral> x. f x * g x \<partial>M)"
     and integrable_real_density: "integrable (density M f) g \<longleftrightarrow> integrable M (\<lambda>x. f x * g x)"
   using assms integral_density[of g M f] integrable_density[of g M f] by auto
 
 lemma has_bochner_integral_density:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}" and g :: "'a \<Rightarrow> real"
   shows "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow> (AE x in M. 0 \<le> g x) \<Longrightarrow>
     has_bochner_integral M (\<lambda>x. g x *\<^sub>R f x) x \<Longrightarrow> has_bochner_integral (density M g) f x"
   by (simp add: has_bochner_integral_iff integrable_density integral_density)
 
 subsection \<open>Distributions\<close>
 
 lemma integrable_distr_eq:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes [measurable]: "g \<in> measurable M N" "f \<in> borel_measurable N"
   shows "integrable (distr M N g) f \<longleftrightarrow> integrable M (\<lambda>x. f (g x))"
   unfolding integrable_iff_bounded by (simp_all add: nn_integral_distr)
 
 lemma integrable_distr:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   shows "T \<in> measurable M M' \<Longrightarrow> integrable (distr M M' T) f \<Longrightarrow> integrable M (\<lambda>x. f (T x))"
   by (subst integrable_distr_eq[symmetric, where g=T])
      (auto dest: borel_measurable_integrable)
 
 lemma integral_distr:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes g[measurable]: "g \<in> measurable M N" and f: "f \<in> borel_measurable N"
   shows "integral\<^sup>L (distr M N g) f = integral\<^sup>L M (\<lambda>x. f (g x))"
 proof (rule integral_eq_cases)
   assume "integrable (distr M N g) f"
   then show ?thesis
   proof induct
     case (base A c)
     then have [measurable]: "A \<in> sets N" by auto
     from base have int: "integrable (distr M N g) (\<lambda>a. indicator A a *\<^sub>R c)"
       by (intro integrable_indicator)
 
     have "integral\<^sup>L (distr M N g) (\<lambda>a. indicator A a *\<^sub>R c) = measure (distr M N g) A *\<^sub>R c"
       using base by auto
     also have "\<dots> = measure M (g -` A \<inter> space M) *\<^sub>R c"
       by (subst measure_distr) auto
     also have "\<dots> = integral\<^sup>L M (\<lambda>a. indicator (g -` A \<inter> space M) a *\<^sub>R c)"
       using base by (auto simp: emeasure_distr)
     also have "\<dots> = integral\<^sup>L M (\<lambda>a. indicator A (g a) *\<^sub>R c)"
       using int base by (intro integral_cong_AE) (auto simp: emeasure_distr split: split_indicator)
     finally show ?case .
   next
     case (add f h)
     then have [measurable]: "f \<in> borel_measurable N" "h \<in> borel_measurable N"
       by (auto dest!: borel_measurable_integrable)
     from add g show ?case
       by (simp add: scaleR_add_right integrable_distr_eq)
   next
     case (lim f s)
     have [measurable]: "f \<in> borel_measurable N" "\<And>i. s i \<in> borel_measurable N"
       using lim(1,5)[THEN borel_measurable_integrable] by auto
 
     show ?case
     proof (rule LIMSEQ_unique)
       show "(\<lambda>i. integral\<^sup>L M (\<lambda>x. s i (g x))) \<longlonglongrightarrow> integral\<^sup>L M (\<lambda>x. f (g x))"
       proof (rule integral_dominated_convergence)
         show "integrable M (\<lambda>x. 2 * norm (f (g x)))"
           using lim by (auto simp: integrable_distr_eq)
         show "AE x in M. (\<lambda>i. s i (g x)) \<longlonglongrightarrow> f (g x)"
           using lim(3) g[THEN measurable_space] by auto
         show "\<And>i. AE x in M. norm (s i (g x)) \<le> 2 * norm (f (g x))"
           using lim(4) g[THEN measurable_space] by auto
       qed auto
       show "(\<lambda>i. integral\<^sup>L M (\<lambda>x. s i (g x))) \<longlonglongrightarrow> integral\<^sup>L (distr M N g) f"
         unfolding lim(2)[symmetric]
         by (rule integral_dominated_convergence[where w="\<lambda>x. 2 * norm (f x)"])
            (insert lim(3-5), auto)
     qed
   qed
 qed (simp add: f g integrable_distr_eq)
 
 lemma has_bochner_integral_distr:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   shows "f \<in> borel_measurable N \<Longrightarrow> g \<in> measurable M N \<Longrightarrow>
     has_bochner_integral M (\<lambda>x. f (g x)) x \<Longrightarrow> has_bochner_integral (distr M N g) f x"
   by (simp add: has_bochner_integral_iff integrable_distr_eq integral_distr)
 
 subsection \<open>Lebesgue integration on \<^const>\<open>count_space\<close>\<close>
 
 lemma integrable_count_space:
   fixes f :: "'a \<Rightarrow> 'b::{banach,second_countable_topology}"
   shows "finite X \<Longrightarrow> integrable (count_space X) f"
   by (auto simp: nn_integral_count_space integrable_iff_bounded)
 
 lemma measure_count_space[simp]:
   "B \<subseteq> A \<Longrightarrow> finite B \<Longrightarrow> measure (count_space A) B = card B"
   unfolding measure_def by (subst emeasure_count_space ) auto
 
 lemma lebesgue_integral_count_space_finite_support:
   assumes f: "finite {a\<in>A. f a \<noteq> 0}"
   shows "(\<integral>x. f x \<partial>count_space A) = (\<Sum>a | a \<in> A \<and> f a \<noteq> 0. f a)"
 proof -
   have eq: "\<And>x. x \<in> A \<Longrightarrow> (\<Sum>a | x = a \<and> a \<in> A \<and> f a \<noteq> 0. f a) = (\<Sum>x\<in>{x}. f x)"
     by (intro sum.mono_neutral_cong_left) auto
 
   have "(\<integral>x. f x \<partial>count_space A) = (\<integral>x. (\<Sum>a | a \<in> A \<and> f a \<noteq> 0. indicator {a} x *\<^sub>R f a) \<partial>count_space A)"
     by (intro integral_cong refl) (simp add: f eq)
   also have "\<dots> = (\<Sum>a | a \<in> A \<and> f a \<noteq> 0. measure (count_space A) {a} *\<^sub>R f a)"
     by (subst integral_sum) (auto intro!: sum.cong)
   finally show ?thesis
     by auto
 qed
 
 lemma lebesgue_integral_count_space_finite: "finite A \<Longrightarrow> (\<integral>x. f x \<partial>count_space A) = (\<Sum>a\<in>A. f a)"
   by (subst lebesgue_integral_count_space_finite_support)
      (auto intro!: sum.mono_neutral_cong_left)
 
 lemma integrable_count_space_nat_iff:
   fixes f :: "nat \<Rightarrow> _::{banach,second_countable_topology}"
   shows "integrable (count_space UNIV) f \<longleftrightarrow> summable (\<lambda>x. norm (f x))"
   by (auto simp add: integrable_iff_bounded nn_integral_count_space_nat ennreal_suminf_neq_top
            intro:  summable_suminf_not_top)
 
 lemma sums_integral_count_space_nat:
   fixes f :: "nat \<Rightarrow> _::{banach,second_countable_topology}"
   assumes *: "integrable (count_space UNIV) f"
   shows "f sums (integral\<^sup>L (count_space UNIV) f)"
 proof -
   let ?f = "\<lambda>n i. indicator {n} i *\<^sub>R f i"
   have f': "\<And>n i. ?f n i = indicator {n} i *\<^sub>R f n"
     by (auto simp: fun_eq_iff split: split_indicator)
 
   have "(\<lambda>i. \<integral>n. ?f i n \<partial>count_space UNIV) sums \<integral> n. (\<Sum>i. ?f i n) \<partial>count_space UNIV"
   proof (rule sums_integral)
     show "\<And>i. integrable (count_space UNIV) (?f i)"
       using * by (intro integrable_mult_indicator) auto
     show "AE n in count_space UNIV. summable (\<lambda>i. norm (?f i n))"
       using summable_finite[of "{n}" "\<lambda>i. norm (?f i n)" for n] by simp
     show "summable (\<lambda>i. \<integral> n. norm (?f i n) \<partial>count_space UNIV)"
       using * by (subst f') (simp add: integrable_count_space_nat_iff)
   qed
   also have "(\<integral> n. (\<Sum>i. ?f i n) \<partial>count_space UNIV) = (\<integral>n. f n \<partial>count_space UNIV)"
     using suminf_finite[of "{n}" "\<lambda>i. ?f i n" for n] by (auto intro!: integral_cong)
   also have "(\<lambda>i. \<integral>n. ?f i n \<partial>count_space UNIV) = f"
     by (subst f') simp
   finally show ?thesis .
 qed
 
 lemma integral_count_space_nat:
   fixes f :: "nat \<Rightarrow> _::{banach,second_countable_topology}"
   shows "integrable (count_space UNIV) f \<Longrightarrow> integral\<^sup>L (count_space UNIV) f = (\<Sum>x. f x)"
   using sums_integral_count_space_nat by (rule sums_unique)
 
 lemma integrable_bij_count_space:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes g: "bij_betw g A B"
   shows "integrable (count_space A) (\<lambda>x. f (g x)) \<longleftrightarrow> integrable (count_space B) f"
   unfolding integrable_iff_bounded by (subst nn_integral_bij_count_space[OF g]) auto
 
 lemma integral_bij_count_space:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes g: "bij_betw g A B"
   shows "integral\<^sup>L (count_space A) (\<lambda>x. f (g x)) = integral\<^sup>L (count_space B) f"
   using g[THEN bij_betw_imp_funcset]
   apply (subst distr_bij_count_space[OF g, symmetric])
   apply (intro integral_distr[symmetric])
   apply auto
   done
 
 lemma has_bochner_integral_count_space_nat:
   fixes f :: "nat \<Rightarrow> _::{banach,second_countable_topology}"
   shows "has_bochner_integral (count_space UNIV) f x \<Longrightarrow> f sums x"
   unfolding has_bochner_integral_iff by (auto intro!: sums_integral_count_space_nat)
 
 subsection \<open>Point measure\<close>
 
 lemma lebesgue_integral_point_measure_finite:
   fixes g :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   shows "finite A \<Longrightarrow> (\<And>a. a \<in> A \<Longrightarrow> 0 \<le> f a) \<Longrightarrow>
     integral\<^sup>L (point_measure A f) g = (\<Sum>a\<in>A. f a *\<^sub>R g a)"
   by (simp add: lebesgue_integral_count_space_finite AE_count_space integral_density point_measure_def)
 
 proposition integrable_point_measure_finite:
   fixes g :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}" and f :: "'a \<Rightarrow> real"
   shows "finite A \<Longrightarrow> integrable (point_measure A f) g"
   unfolding point_measure_def
   apply (subst density_cong[where f'="\<lambda>x. ennreal (max 0 (f x))"])
   apply (auto split: split_max simp: ennreal_neg)
   apply (subst integrable_density)
   apply (auto simp: AE_count_space integrable_count_space)
   done
 
 subsection \<open>Lebesgue integration on \<^const>\<open>null_measure\<close>\<close>
 
 lemma has_bochner_integral_null_measure_iff[iff]:
   "has_bochner_integral (null_measure M) f 0 \<longleftrightarrow> f \<in> borel_measurable M"
   by (auto simp add: has_bochner_integral.simps simple_bochner_integral_def[abs_def]
            intro!: exI[of _ "\<lambda>n x. 0"] simple_bochner_integrable.intros)
 
 lemma integrable_null_measure_iff[iff]: "integrable (null_measure M) f \<longleftrightarrow> f \<in> borel_measurable M"
   by (auto simp add: integrable.simps)
 
 lemma integral_null_measure[simp]: "integral\<^sup>L (null_measure M) f = 0"
   by (cases "integrable (null_measure M) f")
      (auto simp add: not_integrable_integral_eq has_bochner_integral_integral_eq)
 
 subsection \<open>Legacy lemmas for the real-valued Lebesgue integral\<close>
 theorem real_lebesgue_integral_def:
   assumes f[measurable]: "integrable M f"
   shows "integral\<^sup>L M f = enn2real (\<integral>\<^sup>+x. f x \<partial>M) - enn2real (\<integral>\<^sup>+x. ennreal (- f x) \<partial>M)"
 proof -
   have "integral\<^sup>L M f = integral\<^sup>L M (\<lambda>x. max 0 (f x) - max 0 (- f x))"
     by (auto intro!: arg_cong[where f="integral\<^sup>L M"])
   also have "\<dots> = integral\<^sup>L M (\<lambda>x. max 0 (f x)) - integral\<^sup>L M (\<lambda>x. max 0 (- f x))"
     by (intro integral_diff integrable_max integrable_minus integrable_zero f)
   also have "integral\<^sup>L M (\<lambda>x. max 0 (f x)) = enn2real (\<integral>\<^sup>+x. ennreal (f x) \<partial>M)"
     by (subst integral_eq_nn_integral) (auto intro!: arg_cong[where f=enn2real] nn_integral_cong simp: max_def ennreal_neg)
   also have "integral\<^sup>L M (\<lambda>x. max 0 (- f x)) = enn2real (\<integral>\<^sup>+x. ennreal (- f x) \<partial>M)"
     by (subst integral_eq_nn_integral) (auto intro!: arg_cong[where f=enn2real] nn_integral_cong simp: max_def ennreal_neg)
   finally show ?thesis .
 qed
 
 theorem real_integrable_def:
   "integrable M f \<longleftrightarrow> f \<in> borel_measurable M \<and>
     (\<integral>\<^sup>+ x. ennreal (f x) \<partial>M) \<noteq> \<infinity> \<and> (\<integral>\<^sup>+ x. ennreal (- f x) \<partial>M) \<noteq> \<infinity>"
   unfolding integrable_iff_bounded
 proof (safe del: notI)
   assume *: "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M) < \<infinity>"
   have "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>M) \<le> (\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M)"
     by (intro nn_integral_mono) auto
   also note *
   finally show "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>M) \<noteq> \<infinity>"
     by simp
   have "(\<integral>\<^sup>+ x. ennreal (- f x) \<partial>M) \<le> (\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>M)"
     by (intro nn_integral_mono) auto
   also note *
   finally show "(\<integral>\<^sup>+ x. ennreal (- f x) \<partial>M) \<noteq> \<infinity>"
     by simp
 next
   assume [measurable]: "f \<in> borel_measurable M"
   assume fin: "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>M) \<noteq> \<infinity>" "(\<integral>\<^sup>+ x. ennreal (- f x) \<partial>M) \<noteq> \<infinity>"
   have "(\<integral>\<^sup>+ x. norm (f x) \<partial>M) = (\<integral>\<^sup>+ x. ennreal (f x) + ennreal (- f x) \<partial>M)"
     by (intro nn_integral_cong) (auto simp: abs_real_def ennreal_neg)
   also have"\<dots> = (\<integral>\<^sup>+ x. ennreal (f x) \<partial>M) + (\<integral>\<^sup>+ x. ennreal (- f x) \<partial>M)"
     by (intro nn_integral_add) auto
   also have "\<dots> < \<infinity>"
     using fin by (auto simp: less_top)
   finally show "(\<integral>\<^sup>+ x. norm (f x) \<partial>M) < \<infinity>" .
 qed
 
 lemma integrableD[dest]:
   assumes "integrable M f"
   shows "f \<in> borel_measurable M" "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>M) \<noteq> \<infinity>" "(\<integral>\<^sup>+ x. ennreal (- f x) \<partial>M) \<noteq> \<infinity>"
   using assms unfolding real_integrable_def by auto
 
 lemma integrableE:
   assumes "integrable M f"
   obtains r q where "0 \<le> r" "0 \<le> q"
     "(\<integral>\<^sup>+x. ennreal (f x)\<partial>M) = ennreal r"
     "(\<integral>\<^sup>+x. ennreal (-f x)\<partial>M) = ennreal q"
     "f \<in> borel_measurable M" "integral\<^sup>L M f = r - q"
   using assms unfolding real_integrable_def real_lebesgue_integral_def[OF assms]
   by (cases rule: ennreal2_cases[of "(\<integral>\<^sup>+x. ennreal (-f x)\<partial>M)" "(\<integral>\<^sup>+x. ennreal (f x)\<partial>M)"]) auto
 
 lemma integral_monotone_convergence_nonneg:
   fixes f :: "nat \<Rightarrow> 'a \<Rightarrow> real"
   assumes i: "\<And>i. integrable M (f i)" and mono: "AE x in M. mono (\<lambda>n. f n x)"
     and pos: "\<And>i. AE x in M. 0 \<le> f i x"
     and lim: "AE x in M. (\<lambda>i. f i x) \<longlonglongrightarrow> u x"
     and ilim: "(\<lambda>i. integral\<^sup>L M (f i)) \<longlonglongrightarrow> x"
     and u: "u \<in> borel_measurable M"
   shows "integrable M u"
   and "integral\<^sup>L M u = x"
 proof -
   have nn: "AE x in M. \<forall>i. 0 \<le> f i x"
     using pos unfolding AE_all_countable by auto
   with lim have u_nn: "AE x in M. 0 \<le> u x"
     by eventually_elim (auto intro: LIMSEQ_le_const)
   have [simp]: "0 \<le> x"
     by (intro LIMSEQ_le_const[OF ilim] allI exI impI integral_nonneg_AE pos)
   have "(\<integral>\<^sup>+ x. ennreal (u x) \<partial>M) = (SUP n. (\<integral>\<^sup>+ x. ennreal (f n x) \<partial>M))"
   proof (subst nn_integral_monotone_convergence_SUP_AE[symmetric])
     fix i
     from mono nn show "AE x in M. ennreal (f i x) \<le> ennreal (f (Suc i) x)"
       by eventually_elim (auto simp: mono_def)
     show "(\<lambda>x. ennreal (f i x)) \<in> borel_measurable M"
       using i by auto
   next
     show "(\<integral>\<^sup>+ x. ennreal (u x) \<partial>M) = \<integral>\<^sup>+ x. (SUP i. ennreal (f i x)) \<partial>M"
       apply (rule nn_integral_cong_AE)
       using lim mono nn u_nn
       apply eventually_elim
       apply (simp add: LIMSEQ_unique[OF _ LIMSEQ_SUP] incseq_def)
       done
   qed
   also have "\<dots> = ennreal x"
     using mono i nn unfolding nn_integral_eq_integral[OF i pos]
     by (subst LIMSEQ_unique[OF LIMSEQ_SUP]) (auto simp: mono_def integral_nonneg_AE pos intro!: integral_mono_AE ilim)
   finally have "(\<integral>\<^sup>+ x. ennreal (u x) \<partial>M) = ennreal x" .
   moreover have "(\<integral>\<^sup>+ x. ennreal (- u x) \<partial>M) = 0"
     using u u_nn by (subst nn_integral_0_iff_AE) (auto simp add: ennreal_neg)
   ultimately show "integrable M u" "integral\<^sup>L M u = x"
     by (auto simp: real_integrable_def real_lebesgue_integral_def u)
 qed
 
 lemma
   fixes f :: "nat \<Rightarrow> 'a \<Rightarrow> real"
   assumes f: "\<And>i. integrable M (f i)" and mono: "AE x in M. mono (\<lambda>n. f n x)"
   and lim: "AE x in M. (\<lambda>i. f i x) \<longlonglongrightarrow> u x"
   and ilim: "(\<lambda>i. integral\<^sup>L M (f i)) \<longlonglongrightarrow> x"
   and u: "u \<in> borel_measurable M"
   shows integrable_monotone_convergence: "integrable M u"
     and integral_monotone_convergence: "integral\<^sup>L M u = x"
     and has_bochner_integral_monotone_convergence: "has_bochner_integral M u x"
 proof -
   have 1: "\<And>i. integrable M (\<lambda>x. f i x - f 0 x)"
     using f by auto
   have 2: "AE x in M. mono (\<lambda>n. f n x - f 0 x)"
     using mono by (auto simp: mono_def le_fun_def)
   have 3: "\<And>n. AE x in M. 0 \<le> f n x - f 0 x"
     using mono by (auto simp: field_simps mono_def le_fun_def)
   have 4: "AE x in M. (\<lambda>i. f i x - f 0 x) \<longlonglongrightarrow> u x - f 0 x"
     using lim by (auto intro!: tendsto_diff)
   have 5: "(\<lambda>i. (\<integral>x. f i x - f 0 x \<partial>M)) \<longlonglongrightarrow> x - integral\<^sup>L M (f 0)"
     using f ilim by (auto intro!: tendsto_diff)
   have 6: "(\<lambda>x. u x - f 0 x) \<in> borel_measurable M"
     using f[of 0] u by auto
   note diff = integral_monotone_convergence_nonneg[OF 1 2 3 4 5 6]
   have "integrable M (\<lambda>x. (u x - f 0 x) + f 0 x)"
     using diff(1) f by (rule integrable_add)
   with diff(2) f show "integrable M u" "integral\<^sup>L M u = x"
     by auto
   then show "has_bochner_integral M u x"
     by (metis has_bochner_integral_integrable)
 qed
 
 lemma integral_norm_eq_0_iff:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes f[measurable]: "integrable M f"
   shows "(\<integral>x. norm (f x) \<partial>M) = 0 \<longleftrightarrow> emeasure M {x\<in>space M. f x \<noteq> 0} = 0"
 proof -
   have "(\<integral>\<^sup>+x. norm (f x) \<partial>M) = (\<integral>x. norm (f x) \<partial>M)"
     using f by (intro nn_integral_eq_integral integrable_norm) auto
   then have "(\<integral>x. norm (f x) \<partial>M) = 0 \<longleftrightarrow> (\<integral>\<^sup>+x. norm (f x) \<partial>M) = 0"
     by simp
   also have "\<dots> \<longleftrightarrow> emeasure M {x\<in>space M. ennreal (norm (f x)) \<noteq> 0} = 0"
     by (intro nn_integral_0_iff) auto
   finally show ?thesis
     by simp
 qed
 
 lemma integral_0_iff:
   fixes f :: "'a \<Rightarrow> real"
   shows "integrable M f \<Longrightarrow> (\<integral>x. \<bar>f x\<bar> \<partial>M) = 0 \<longleftrightarrow> emeasure M {x\<in>space M. f x \<noteq> 0} = 0"
   using integral_norm_eq_0_iff[of M f] by simp
 
 lemma (in finite_measure) integrable_const[intro!, simp]: "integrable M (\<lambda>x. a)"
   using integrable_indicator[of "space M" M a] by (simp cong: integrable_cong add: less_top[symmetric])
 
 lemma lebesgue_integral_const[simp]:
   fixes a :: "'a :: {banach, second_countable_topology}"
   shows "(\<integral>x. a \<partial>M) = measure M (space M) *\<^sub>R a"
 proof -
   { assume "emeasure M (space M) = \<infinity>" "a \<noteq> 0"
     then have ?thesis
       by (auto simp add: not_integrable_integral_eq ennreal_mult_less_top measure_def integrable_iff_bounded) }
   moreover
   { assume "a = 0" then have ?thesis by simp }
   moreover
   { assume "emeasure M (space M) \<noteq> \<infinity>"
     interpret finite_measure M
       proof qed fact
     have "(\<integral>x. a \<partial>M) = (\<integral>x. indicator (space M) x *\<^sub>R a \<partial>M)"
       by (intro integral_cong) auto
     also have "\<dots> = measure M (space M) *\<^sub>R a"
       by (simp add: less_top[symmetric])
     finally have ?thesis . }
   ultimately show ?thesis by blast
 qed
 
 lemma (in finite_measure) integrable_const_bound:
   fixes f :: "'a \<Rightarrow> 'b::{banach,second_countable_topology}"
   shows "AE x in M. norm (f x) \<le> B \<Longrightarrow> f \<in> borel_measurable M \<Longrightarrow> integrable M f"
   apply (rule integrable_bound[OF integrable_const[of B], of f])
   apply assumption
   apply (cases "0 \<le> B")
   apply auto
   done
 
 lemma (in finite_measure) integral_bounded_eq_bound_then_AE:
   assumes "AE x in M. f x \<le> (c::real)"
     "integrable M f" "(\<integral>x. f x \<partial>M) = c * measure M (space M)"
   shows "AE x in M. f x = c"
   apply (rule integral_ineq_eq_0_then_AE) using assms by auto
 
 lemma integral_indicator_finite_real:
   fixes f :: "'a \<Rightarrow> real"
   assumes [simp]: "finite A"
   assumes [measurable]: "\<And>a. a \<in> A \<Longrightarrow> {a} \<in> sets M"
   assumes finite: "\<And>a. a \<in> A \<Longrightarrow> emeasure M {a} < \<infinity>"
   shows "(\<integral>x. f x * indicator A x \<partial>M) = (\<Sum>a\<in>A. f a * measure M {a})"
 proof -
   have "(\<integral>x. f x * indicator A x \<partial>M) = (\<integral>x. (\<Sum>a\<in>A. f a * indicator {a} x) \<partial>M)"
   proof (intro integral_cong refl)
     fix x show "f x * indicator A x = (\<Sum>a\<in>A. f a * indicator {a} x)"
       by (auto split: split_indicator simp: eq_commute[of x] cong: conj_cong)
   qed
   also have "\<dots> = (\<Sum>a\<in>A. f a * measure M {a})"
     using finite by (subst integral_sum) (auto)
   finally show ?thesis .
 qed
 
 lemma (in finite_measure) ennreal_integral_real:
   assumes [measurable]: "f \<in> borel_measurable M"
   assumes ae: "AE x in M. f x \<le> ennreal B" "0 \<le> B"
   shows "ennreal (\<integral>x. enn2real (f x) \<partial>M) = (\<integral>\<^sup>+x. f x \<partial>M)"
 proof (subst nn_integral_eq_integral[symmetric])
   show "integrable M (\<lambda>x. enn2real (f x))"
     using ae by (intro integrable_const_bound[where B=B]) (auto simp: enn2real_leI)
   show "(\<integral>\<^sup>+ x. ennreal (enn2real (f x)) \<partial>M) = integral\<^sup>N M f"
     using ae by (intro nn_integral_cong_AE) (auto simp: le_less_trans[OF _ ennreal_less_top])
 qed auto
 
 lemma (in finite_measure) integral_less_AE:
   fixes X Y :: "'a \<Rightarrow> real"
   assumes int: "integrable M X" "integrable M Y"
   assumes A: "(emeasure M) A \<noteq> 0" "A \<in> sets M" "AE x in M. x \<in> A \<longrightarrow> X x \<noteq> Y x"
   assumes gt: "AE x in M. X x \<le> Y x"
   shows "integral\<^sup>L M X < integral\<^sup>L M Y"
 proof -
   have "integral\<^sup>L M X \<le> integral\<^sup>L M Y"
     using gt int by (intro integral_mono_AE) auto
   moreover
   have "integral\<^sup>L M X \<noteq> integral\<^sup>L M Y"
   proof
     assume eq: "integral\<^sup>L M X = integral\<^sup>L M Y"
     have "integral\<^sup>L M (\<lambda>x. \<bar>Y x - X x\<bar>) = integral\<^sup>L M (\<lambda>x. Y x - X x)"
       using gt int by (intro integral_cong_AE) auto
     also have "\<dots> = 0"
       using eq int by simp
     finally have "(emeasure M) {x \<in> space M. Y x - X x \<noteq> 0} = 0"
       using int by (simp add: integral_0_iff)
     moreover
     have "(\<integral>\<^sup>+x. indicator A x \<partial>M) \<le> (\<integral>\<^sup>+x. indicator {x \<in> space M. Y x - X x \<noteq> 0} x \<partial>M)"
       using A by (intro nn_integral_mono_AE) auto
     then have "(emeasure M) A \<le> (emeasure M) {x \<in> space M. Y x - X x \<noteq> 0}"
       using int A by (simp add: integrable_def)
     ultimately have "emeasure M A = 0"
       by simp
     with \<open>(emeasure M) A \<noteq> 0\<close> show False by auto
   qed
   ultimately show ?thesis by auto
 qed
 
 lemma (in finite_measure) integral_less_AE_space:
   fixes X Y :: "'a \<Rightarrow> real"
   assumes int: "integrable M X" "integrable M Y"
   assumes gt: "AE x in M. X x < Y x" "emeasure M (space M) \<noteq> 0"
   shows "integral\<^sup>L M X < integral\<^sup>L M Y"
   using gt by (intro integral_less_AE[OF int, where A="space M"]) auto
 
 lemma tendsto_integral_at_top:
   fixes f :: "real \<Rightarrow> 'a::{banach, second_countable_topology}"
   assumes [measurable_cong]: "sets M = sets borel" and f[measurable]: "integrable M f"
   shows "((\<lambda>y. \<integral> x. indicator {.. y} x *\<^sub>R f x \<partial>M) \<longlongrightarrow> \<integral> x. f x \<partial>M) at_top"
 proof (rule tendsto_at_topI_sequentially)
   fix X :: "nat \<Rightarrow> real" assume "filterlim X at_top sequentially"
   show "(\<lambda>n. \<integral>x. indicator {..X n} x *\<^sub>R f x \<partial>M) \<longlonglongrightarrow> integral\<^sup>L M f"
   proof (rule integral_dominated_convergence)
     show "integrable M (\<lambda>x. norm (f x))"
       by (rule integrable_norm) fact
     show "AE x in M. (\<lambda>n. indicator {..X n} x *\<^sub>R f x) \<longlonglongrightarrow> f x"
     proof
       fix x
       from \<open>filterlim X at_top sequentially\<close>
       have "eventually (\<lambda>n. x \<le> X n) sequentially"
         unfolding filterlim_at_top_ge[where c=x] by auto
       then show "(\<lambda>n. indicator {..X n} x *\<^sub>R f x) \<longlonglongrightarrow> f x"
         by (intro tendsto_eventually) (auto split: split_indicator elim!: eventually_mono)
     qed
     fix n show "AE x in M. norm (indicator {..X n} x *\<^sub>R f x) \<le> norm (f x)"
       by (auto split: split_indicator)
   qed auto
 qed
 
 lemma
   fixes f :: "real \<Rightarrow> real"
   assumes M: "sets M = sets borel"
   assumes nonneg: "AE x in M. 0 \<le> f x"
   assumes borel: "f \<in> borel_measurable borel"
   assumes int: "\<And>y. integrable M (\<lambda>x. f x * indicator {.. y} x)"
   assumes conv: "((\<lambda>y. \<integral> x. f x * indicator {.. y} x \<partial>M) \<longlongrightarrow> x) at_top"
   shows has_bochner_integral_monotone_convergence_at_top: "has_bochner_integral M f x"
     and integrable_monotone_convergence_at_top: "integrable M f"
     and integral_monotone_convergence_at_top:"integral\<^sup>L M f = x"
 proof -
   from nonneg have "AE x in M. mono (\<lambda>n::nat. f x * indicator {..real n} x)"
     by (auto split: split_indicator intro!: monoI)
   { fix x have "eventually (\<lambda>n. f x * indicator {..real n} x = f x) sequentially"
       by (rule eventually_sequentiallyI[of "nat \<lceil>x\<rceil>"])
          (auto split: split_indicator simp: nat_le_iff ceiling_le_iff) }
   from filterlim_cong[OF refl refl this]
   have "AE x in M. (\<lambda>i. f x * indicator {..real i} x) \<longlonglongrightarrow> f x"
     by simp
   have "(\<lambda>i. \<integral> x. f x * indicator {..real i} x \<partial>M) \<longlonglongrightarrow> x"
     using conv filterlim_real_sequentially by (rule filterlim_compose)
   have M_measure[simp]: "borel_measurable M = borel_measurable borel"
     using M by (simp add: sets_eq_imp_space_eq measurable_def)
   have "f \<in> borel_measurable M"
     using borel by simp
   show "has_bochner_integral M f x"
     by (rule has_bochner_integral_monotone_convergence) fact+
   then show "integrable M f" "integral\<^sup>L M f = x"
     by (auto simp: _has_bochner_integral_iff)
 qed
 
 subsection \<open>Product measure\<close>
 
 lemma (in sigma_finite_measure) borel_measurable_lebesgue_integrable[measurable (raw)]:
   fixes f :: "_ \<Rightarrow> _ \<Rightarrow> _::{banach, second_countable_topology}"
   assumes [measurable]: "case_prod f \<in> borel_measurable (N \<Otimes>\<^sub>M M)"
   shows "Measurable.pred N (\<lambda>x. integrable M (f x))"
 proof -
   have [simp]: "\<And>x. x \<in> space N \<Longrightarrow> integrable M (f x) \<longleftrightarrow> (\<integral>\<^sup>+y. norm (f x y) \<partial>M) < \<infinity>"
     unfolding integrable_iff_bounded by simp
   show ?thesis
     by (simp cong: measurable_cong)
 qed
 
 lemma (in sigma_finite_measure) measurable_measure[measurable (raw)]:
   "(\<And>x. x \<in> space N \<Longrightarrow> A x \<subseteq> space M) \<Longrightarrow>
     {x \<in> space (N \<Otimes>\<^sub>M M). snd x \<in> A (fst x)} \<in> sets (N \<Otimes>\<^sub>M M) \<Longrightarrow>
     (\<lambda>x. measure M (A x)) \<in> borel_measurable N"
   unfolding measure_def by (intro measurable_emeasure borel_measurable_enn2real) auto
 
 proposition (in sigma_finite_measure) borel_measurable_lebesgue_integral[measurable (raw)]:
   fixes f :: "_ \<Rightarrow> _ \<Rightarrow> _::{banach, second_countable_topology}"
   assumes f[measurable]: "case_prod f \<in> borel_measurable (N \<Otimes>\<^sub>M M)"
   shows "(\<lambda>x. \<integral>y. f x y \<partial>M) \<in> borel_measurable N"
 proof -
   from borel_measurable_implies_sequence_metric[OF f, of 0] guess s ..
   then have s: "\<And>i. simple_function (N \<Otimes>\<^sub>M M) (s i)"
     "\<And>x y. x \<in> space N \<Longrightarrow> y \<in> space M \<Longrightarrow> (\<lambda>i. s i (x, y)) \<longlonglongrightarrow> f x y"
     "\<And>i x y. x \<in> space N \<Longrightarrow> y \<in> space M \<Longrightarrow> norm (s i (x, y)) \<le> 2 * norm (f x y)"
     by (auto simp: space_pair_measure)
 
   have [measurable]: "\<And>i. s i \<in> borel_measurable (N \<Otimes>\<^sub>M M)"
     by (rule borel_measurable_simple_function) fact
 
   have "\<And>i. s i \<in> measurable (N \<Otimes>\<^sub>M M) (count_space UNIV)"
     by (rule measurable_simple_function) fact
 
   define f' where [abs_def]: "f' i x =
     (if integrable M (f x) then simple_bochner_integral M (\<lambda>y. s i (x, y)) else 0)" for i x
 
   { fix i x assume "x \<in> space N"
     then have "simple_bochner_integral M (\<lambda>y. s i (x, y)) =
       (\<Sum>z\<in>s i ` (space N \<times> space M). measure M {y \<in> space M. s i (x, y) = z} *\<^sub>R z)"
       using s(1)[THEN simple_functionD(1)]
       unfolding simple_bochner_integral_def
       by (intro sum.mono_neutral_cong_left)
          (auto simp: eq_commute space_pair_measure image_iff cong: conj_cong) }
   note eq = this
 
   show ?thesis
   proof (rule borel_measurable_LIMSEQ_metric)
     fix i show "f' i \<in> borel_measurable N"
       unfolding f'_def by (simp_all add: eq cong: measurable_cong if_cong)
   next
     fix x assume x: "x \<in> space N"
     { assume int_f: "integrable M (f x)"
       have int_2f: "integrable M (\<lambda>y. 2 * norm (f x y))"
         by (intro integrable_norm integrable_mult_right int_f)
       have "(\<lambda>i. integral\<^sup>L M (\<lambda>y. s i (x, y))) \<longlonglongrightarrow> integral\<^sup>L M (f x)"
       proof (rule integral_dominated_convergence)
         from int_f show "f x \<in> borel_measurable M" by auto
         show "\<And>i. (\<lambda>y. s i (x, y)) \<in> borel_measurable M"
           using x by simp
         show "AE xa in M. (\<lambda>i. s i (x, xa)) \<longlonglongrightarrow> f x xa"
           using x s(2) by auto
         show "\<And>i. AE xa in M. norm (s i (x, xa)) \<le> 2 * norm (f x xa)"
           using x s(3) by auto
       qed fact
       moreover
       { fix i
         have "simple_bochner_integrable M (\<lambda>y. s i (x, y))"
         proof (rule simple_bochner_integrableI_bounded)
           have "(\<lambda>y. s i (x, y)) ` space M \<subseteq> s i ` (space N \<times> space M)"
             using x by auto
           then show "simple_function M (\<lambda>y. s i (x, y))"
             using simple_functionD(1)[OF s(1), of i] x
             by (intro simple_function_borel_measurable)
                (auto simp: space_pair_measure dest: finite_subset)
           have "(\<integral>\<^sup>+ y. ennreal (norm (s i (x, y))) \<partial>M) \<le> (\<integral>\<^sup>+ y. 2 * norm (f x y) \<partial>M)"
             using x s by (intro nn_integral_mono) auto
           also have "(\<integral>\<^sup>+ y. 2 * norm (f x y) \<partial>M) < \<infinity>"
             using int_2f unfolding integrable_iff_bounded by simp
           finally show "(\<integral>\<^sup>+ xa. ennreal (norm (s i (x, xa))) \<partial>M) < \<infinity>" .
         qed
         then have "integral\<^sup>L M (\<lambda>y. s i (x, y)) = simple_bochner_integral M (\<lambda>y. s i (x, y))"
           by (rule simple_bochner_integrable_eq_integral[symmetric]) }
       ultimately have "(\<lambda>i. simple_bochner_integral M (\<lambda>y. s i (x, y))) \<longlonglongrightarrow> integral\<^sup>L M (f x)"
         by simp }
     then
     show "(\<lambda>i. f' i x) \<longlonglongrightarrow> integral\<^sup>L M (f x)"
       unfolding f'_def
       by (cases "integrable M (f x)") (simp_all add: not_integrable_integral_eq)
   qed
 qed
 
 lemma (in pair_sigma_finite) integrable_product_swap:
   fixes f :: "_ \<Rightarrow> _::{banach, second_countable_topology}"
   assumes "integrable (M1 \<Otimes>\<^sub>M M2) f"
   shows "integrable (M2 \<Otimes>\<^sub>M M1) (\<lambda>(x,y). f (y,x))"
 proof -
   interpret Q: pair_sigma_finite M2 M1 ..
   have *: "(\<lambda>(x,y). f (y,x)) = (\<lambda>x. f (case x of (x,y)\<Rightarrow>(y,x)))" by (auto simp: fun_eq_iff)
   show ?thesis unfolding *
     by (rule integrable_distr[OF measurable_pair_swap'])
        (simp add: distr_pair_swap[symmetric] assms)
 qed
 
 lemma (in pair_sigma_finite) integrable_product_swap_iff:
   fixes f :: "_ \<Rightarrow> _::{banach, second_countable_topology}"
   shows "integrable (M2 \<Otimes>\<^sub>M M1) (\<lambda>(x,y). f (y,x)) \<longleftrightarrow> integrable (M1 \<Otimes>\<^sub>M M2) f"
 proof -
   interpret Q: pair_sigma_finite M2 M1 ..
   from Q.integrable_product_swap[of "\<lambda>(x,y). f (y,x)"] integrable_product_swap[of f]
   show ?thesis by auto
 qed
 
 lemma (in pair_sigma_finite) integral_product_swap:
   fixes f :: "_ \<Rightarrow> _::{banach, second_countable_topology}"
   assumes f: "f \<in> borel_measurable (M1 \<Otimes>\<^sub>M M2)"
   shows "(\<integral>(x,y). f (y,x) \<partial>(M2 \<Otimes>\<^sub>M M1)) = integral\<^sup>L (M1 \<Otimes>\<^sub>M M2) f"
 proof -
   have *: "(\<lambda>(x,y). f (y,x)) = (\<lambda>x. f (case x of (x,y)\<Rightarrow>(y,x)))" by (auto simp: fun_eq_iff)
   show ?thesis unfolding *
     by (simp add: integral_distr[symmetric, OF measurable_pair_swap' f] distr_pair_swap[symmetric])
 qed
 
 theorem (in pair_sigma_finite) Fubini_integrable:
   fixes f :: "_ \<Rightarrow> _::{banach, second_countable_topology}"
   assumes f[measurable]: "f \<in> borel_measurable (M1 \<Otimes>\<^sub>M M2)"
     and integ1: "integrable M1 (\<lambda>x. \<integral> y. norm (f (x, y)) \<partial>M2)"
     and integ2: "AE x in M1. integrable M2 (\<lambda>y. f (x, y))"
   shows "integrable (M1 \<Otimes>\<^sub>M M2) f"
 proof (rule integrableI_bounded)
   have "(\<integral>\<^sup>+ p. norm (f p) \<partial>(M1 \<Otimes>\<^sub>M M2)) = (\<integral>\<^sup>+ x. (\<integral>\<^sup>+ y. norm (f (x, y)) \<partial>M2) \<partial>M1)"
     by (simp add: M2.nn_integral_fst [symmetric])
   also have "\<dots> = (\<integral>\<^sup>+ x. \<bar>\<integral>y. norm (f (x, y)) \<partial>M2\<bar> \<partial>M1)"
     apply (intro nn_integral_cong_AE)
     using integ2
   proof eventually_elim
     fix x assume "integrable M2 (\<lambda>y. f (x, y))"
     then have f: "integrable M2 (\<lambda>y. norm (f (x, y)))"
       by simp
     then have "(\<integral>\<^sup>+y. ennreal (norm (f (x, y))) \<partial>M2) = ennreal (LINT y|M2. norm (f (x, y)))"
       by (rule nn_integral_eq_integral) simp
     also have "\<dots> = ennreal \<bar>LINT y|M2. norm (f (x, y))\<bar>"
       using f by simp
     finally show "(\<integral>\<^sup>+y. ennreal (norm (f (x, y))) \<partial>M2) = ennreal \<bar>LINT y|M2. norm (f (x, y))\<bar>" .
   qed
   also have "\<dots> < \<infinity>"
     using integ1 by (simp add: integrable_iff_bounded integral_nonneg_AE)
   finally show "(\<integral>\<^sup>+ p. norm (f p) \<partial>(M1 \<Otimes>\<^sub>M M2)) < \<infinity>" .
 qed fact
 
 lemma (in pair_sigma_finite) emeasure_pair_measure_finite:
   assumes A: "A \<in> sets (M1 \<Otimes>\<^sub>M M2)" and finite: "emeasure (M1 \<Otimes>\<^sub>M M2) A < \<infinity>"
   shows "AE x in M1. emeasure M2 {y\<in>space M2. (x, y) \<in> A} < \<infinity>"
 proof -
   from M2.emeasure_pair_measure_alt[OF A] finite
   have "(\<integral>\<^sup>+ x. emeasure M2 (Pair x -` A) \<partial>M1) \<noteq> \<infinity>"
     by simp
   then have "AE x in M1. emeasure M2 (Pair x -` A) \<noteq> \<infinity>"
     by (rule nn_integral_PInf_AE[rotated]) (intro M2.measurable_emeasure_Pair A)
   moreover have "\<And>x. x \<in> space M1 \<Longrightarrow> Pair x -` A = {y\<in>space M2. (x, y) \<in> A}"
     using sets.sets_into_space[OF A] by (auto simp: space_pair_measure)
   ultimately show ?thesis by (auto simp: less_top)
 qed
 
 lemma (in pair_sigma_finite) AE_integrable_fst':
   fixes f :: "_ \<Rightarrow> _::{banach, second_countable_topology}"
   assumes f[measurable]: "integrable (M1 \<Otimes>\<^sub>M M2) f"
   shows "AE x in M1. integrable M2 (\<lambda>y. f (x, y))"
 proof -
   have "(\<integral>\<^sup>+x. (\<integral>\<^sup>+y. norm (f (x, y)) \<partial>M2) \<partial>M1) = (\<integral>\<^sup>+x. norm (f x) \<partial>(M1 \<Otimes>\<^sub>M M2))"
     by (rule M2.nn_integral_fst) simp
   also have "(\<integral>\<^sup>+x. norm (f x) \<partial>(M1 \<Otimes>\<^sub>M M2)) \<noteq> \<infinity>"
     using f unfolding integrable_iff_bounded by simp
   finally have "AE x in M1. (\<integral>\<^sup>+y. norm (f (x, y)) \<partial>M2) \<noteq> \<infinity>"
     by (intro nn_integral_PInf_AE M2.borel_measurable_nn_integral )
        (auto simp: measurable_split_conv)
   with AE_space show ?thesis
     by eventually_elim
        (auto simp: integrable_iff_bounded measurable_compose[OF _ borel_measurable_integrable[OF f]] less_top)
 qed
 
 lemma (in pair_sigma_finite) integrable_fst':
   fixes f :: "_ \<Rightarrow> _::{banach, second_countable_topology}"
   assumes f[measurable]: "integrable (M1 \<Otimes>\<^sub>M M2) f"
   shows "integrable M1 (\<lambda>x. \<integral>y. f (x, y) \<partial>M2)"
   unfolding integrable_iff_bounded
 proof
   show "(\<lambda>x. \<integral> y. f (x, y) \<partial>M2) \<in> borel_measurable M1"
     by (rule M2.borel_measurable_lebesgue_integral) simp
   have "(\<integral>\<^sup>+ x. ennreal (norm (\<integral> y. f (x, y) \<partial>M2)) \<partial>M1) \<le> (\<integral>\<^sup>+x. (\<integral>\<^sup>+y. norm (f (x, y)) \<partial>M2) \<partial>M1)"
     using AE_integrable_fst'[OF f] by (auto intro!: nn_integral_mono_AE integral_norm_bound_ennreal)
   also have "(\<integral>\<^sup>+x. (\<integral>\<^sup>+y. norm (f (x, y)) \<partial>M2) \<partial>M1) = (\<integral>\<^sup>+x. norm (f x) \<partial>(M1 \<Otimes>\<^sub>M M2))"
     by (rule M2.nn_integral_fst) simp
   also have "(\<integral>\<^sup>+x. norm (f x) \<partial>(M1 \<Otimes>\<^sub>M M2)) < \<infinity>"
     using f unfolding integrable_iff_bounded by simp
   finally show "(\<integral>\<^sup>+ x. ennreal (norm (\<integral> y. f (x, y) \<partial>M2)) \<partial>M1) < \<infinity>" .
 qed
 
 proposition (in pair_sigma_finite) integral_fst':
   fixes f :: "_ \<Rightarrow> _::{banach, second_countable_topology}"
   assumes f: "integrable (M1 \<Otimes>\<^sub>M M2) f"
   shows "(\<integral>x. (\<integral>y. f (x, y) \<partial>M2) \<partial>M1) = integral\<^sup>L (M1 \<Otimes>\<^sub>M M2) f"
 using f proof induct
   case (base A c)
   have A[measurable]: "A \<in> sets (M1 \<Otimes>\<^sub>M M2)" by fact
 
   have eq: "\<And>x y. x \<in> space M1 \<Longrightarrow> indicator A (x, y) = indicator {y\<in>space M2. (x, y) \<in> A} y"
     using sets.sets_into_space[OF A] by (auto split: split_indicator simp: space_pair_measure)
 
   have int_A: "integrable (M1 \<Otimes>\<^sub>M M2) (indicator A :: _ \<Rightarrow> real)"
     using base by (rule integrable_real_indicator)
 
   have "(\<integral> x. \<integral> y. indicator A (x, y) *\<^sub>R c \<partial>M2 \<partial>M1) = (\<integral>x. measure M2 {y\<in>space M2. (x, y) \<in> A} *\<^sub>R c \<partial>M1)"
   proof (intro integral_cong_AE, simp, simp)
     from AE_integrable_fst'[OF int_A] AE_space
     show "AE x in M1. (\<integral>y. indicator A (x, y) *\<^sub>R c \<partial>M2) = measure M2 {y\<in>space M2. (x, y) \<in> A} *\<^sub>R c"
       by eventually_elim (simp add: eq integrable_indicator_iff)
   qed
   also have "\<dots> = measure (M1 \<Otimes>\<^sub>M M2) A *\<^sub>R c"
   proof (subst integral_scaleR_left)
     have "(\<integral>\<^sup>+x. ennreal (measure M2 {y \<in> space M2. (x, y) \<in> A}) \<partial>M1) =
       (\<integral>\<^sup>+x. emeasure M2 {y \<in> space M2. (x, y) \<in> A} \<partial>M1)"
       using emeasure_pair_measure_finite[OF base]
       by (intro nn_integral_cong_AE, eventually_elim) (simp add: emeasure_eq_ennreal_measure)
     also have "\<dots> = emeasure (M1 \<Otimes>\<^sub>M M2) A"
       using sets.sets_into_space[OF A]
       by (subst M2.emeasure_pair_measure_alt)
          (auto intro!: nn_integral_cong arg_cong[where f="emeasure M2"] simp: space_pair_measure)
     finally have *: "(\<integral>\<^sup>+x. ennreal (measure M2 {y \<in> space M2. (x, y) \<in> A}) \<partial>M1) = emeasure (M1 \<Otimes>\<^sub>M M2) A" .
 
     from base * show "integrable M1 (\<lambda>x. measure M2 {y \<in> space M2. (x, y) \<in> A})"
       by (simp add: integrable_iff_bounded)
     then have "(\<integral>x. measure M2 {y \<in> space M2. (x, y) \<in> A} \<partial>M1) =
       (\<integral>\<^sup>+x. ennreal (measure M2 {y \<in> space M2. (x, y) \<in> A}) \<partial>M1)"
       by (rule nn_integral_eq_integral[symmetric]) simp
     also note *
     finally show "(\<integral>x. measure M2 {y \<in> space M2. (x, y) \<in> A} \<partial>M1) *\<^sub>R c = measure (M1 \<Otimes>\<^sub>M M2) A *\<^sub>R c"
       using base by (simp add: emeasure_eq_ennreal_measure)
   qed
   also have "\<dots> = (\<integral> a. indicator A a *\<^sub>R c \<partial>(M1 \<Otimes>\<^sub>M M2))"
     using base by simp
   finally show ?case .
 next
   case (add f g)
   then have [measurable]: "f \<in> borel_measurable (M1 \<Otimes>\<^sub>M M2)" "g \<in> borel_measurable (M1 \<Otimes>\<^sub>M M2)"
     by auto
   have "(\<integral> x. \<integral> y. f (x, y) + g (x, y) \<partial>M2 \<partial>M1) =
     (\<integral> x. (\<integral> y. f (x, y) \<partial>M2) + (\<integral> y. g (x, y) \<partial>M2) \<partial>M1)"
     apply (rule integral_cong_AE)
     apply simp_all
     using AE_integrable_fst'[OF add(1)] AE_integrable_fst'[OF add(3)]
     apply eventually_elim
     apply simp
     done
   also have "\<dots> = (\<integral> x. f x \<partial>(M1 \<Otimes>\<^sub>M M2)) + (\<integral> x. g x \<partial>(M1 \<Otimes>\<^sub>M M2))"
     using integrable_fst'[OF add(1)] integrable_fst'[OF add(3)] add(2,4) by simp
   finally show ?case
     using add by simp
 next
   case (lim f s)
   then have [measurable]: "f \<in> borel_measurable (M1 \<Otimes>\<^sub>M M2)" "\<And>i. s i \<in> borel_measurable (M1 \<Otimes>\<^sub>M M2)"
     by auto
 
   show ?case
   proof (rule LIMSEQ_unique)
     show "(\<lambda>i. integral\<^sup>L (M1 \<Otimes>\<^sub>M M2) (s i)) \<longlonglongrightarrow> integral\<^sup>L (M1 \<Otimes>\<^sub>M M2) f"
     proof (rule integral_dominated_convergence)
       show "integrable (M1 \<Otimes>\<^sub>M M2) (\<lambda>x. 2 * norm (f x))"
         using lim(5) by auto
     qed (insert lim, auto)
     have "(\<lambda>i. \<integral> x. \<integral> y. s i (x, y) \<partial>M2 \<partial>M1) \<longlonglongrightarrow> \<integral> x. \<integral> y. f (x, y) \<partial>M2 \<partial>M1"
     proof (rule integral_dominated_convergence)
       have "AE x in M1. \<forall>i. integrable M2 (\<lambda>y. s i (x, y))"
         unfolding AE_all_countable using AE_integrable_fst'[OF lim(1)] ..
       with AE_space AE_integrable_fst'[OF lim(5)]
       show "AE x in M1. (\<lambda>i. \<integral> y. s i (x, y) \<partial>M2) \<longlonglongrightarrow> \<integral> y. f (x, y) \<partial>M2"
       proof eventually_elim
         fix x assume x: "x \<in> space M1" and
           s: "\<forall>i. integrable M2 (\<lambda>y. s i (x, y))" and f: "integrable M2 (\<lambda>y. f (x, y))"
         show "(\<lambda>i. \<integral> y. s i (x, y) \<partial>M2) \<longlonglongrightarrow> \<integral> y. f (x, y) \<partial>M2"
         proof (rule integral_dominated_convergence)
           show "integrable M2 (\<lambda>y. 2 * norm (f (x, y)))"
              using f by auto
           show "AE xa in M2. (\<lambda>i. s i (x, xa)) \<longlonglongrightarrow> f (x, xa)"
             using x lim(3) by (auto simp: space_pair_measure)
           show "\<And>i. AE xa in M2. norm (s i (x, xa)) \<le> 2 * norm (f (x, xa))"
             using x lim(4) by (auto simp: space_pair_measure)
         qed (insert x, measurable)
       qed
       show "integrable M1 (\<lambda>x. (\<integral> y. 2 * norm (f (x, y)) \<partial>M2))"
         by (intro integrable_mult_right integrable_norm integrable_fst' lim)
       fix i show "AE x in M1. norm (\<integral> y. s i (x, y) \<partial>M2) \<le> (\<integral> y. 2 * norm (f (x, y)) \<partial>M2)"
         using AE_space AE_integrable_fst'[OF lim(1), of i] AE_integrable_fst'[OF lim(5)]
       proof eventually_elim
         fix x assume x: "x \<in> space M1"
           and s: "integrable M2 (\<lambda>y. s i (x, y))" and f: "integrable M2 (\<lambda>y. f (x, y))"
         from s have "norm (\<integral> y. s i (x, y) \<partial>M2) \<le> (\<integral>\<^sup>+y. norm (s i (x, y)) \<partial>M2)"
           by (rule integral_norm_bound_ennreal)
         also have "\<dots> \<le> (\<integral>\<^sup>+y. 2 * norm (f (x, y)) \<partial>M2)"
           using x lim by (auto intro!: nn_integral_mono simp: space_pair_measure)
         also have "\<dots> = (\<integral>y. 2 * norm (f (x, y)) \<partial>M2)"
           using f by (intro nn_integral_eq_integral) auto
         finally show "norm (\<integral> y. s i (x, y) \<partial>M2) \<le> (\<integral> y. 2 * norm (f (x, y)) \<partial>M2)"
           by simp
       qed
     qed simp_all
     then show "(\<lambda>i. integral\<^sup>L (M1 \<Otimes>\<^sub>M M2) (s i)) \<longlonglongrightarrow> \<integral> x. \<integral> y. f (x, y) \<partial>M2 \<partial>M1"
       using lim by simp
   qed
 qed
 
 lemma (in pair_sigma_finite)
   fixes f :: "_ \<Rightarrow> _ \<Rightarrow> _::{banach, second_countable_topology}"
   assumes f: "integrable (M1 \<Otimes>\<^sub>M M2) (case_prod f)"
   shows AE_integrable_fst: "AE x in M1. integrable M2 (\<lambda>y. f x y)" (is "?AE")
     and integrable_fst: "integrable M1 (\<lambda>x. \<integral>y. f x y \<partial>M2)" (is "?INT")
     and integral_fst: "(\<integral>x. (\<integral>y. f x y \<partial>M2) \<partial>M1) = integral\<^sup>L (M1 \<Otimes>\<^sub>M M2) (\<lambda>(x, y). f x y)" (is "?EQ")
   using AE_integrable_fst'[OF f] integrable_fst'[OF f] integral_fst'[OF f] by auto
 
 lemma (in pair_sigma_finite)
   fixes f :: "_ \<Rightarrow> _ \<Rightarrow> _::{banach, second_countable_topology}"
   assumes f[measurable]: "integrable (M1 \<Otimes>\<^sub>M M2) (case_prod f)"
   shows AE_integrable_snd: "AE y in M2. integrable M1 (\<lambda>x. f x y)" (is "?AE")
     and integrable_snd: "integrable M2 (\<lambda>y. \<integral>x. f x y \<partial>M1)" (is "?INT")
     and integral_snd: "(\<integral>y. (\<integral>x. f x y \<partial>M1) \<partial>M2) = integral\<^sup>L (M1 \<Otimes>\<^sub>M M2) (case_prod f)" (is "?EQ")
 proof -
   interpret Q: pair_sigma_finite M2 M1 ..
   have Q_int: "integrable (M2 \<Otimes>\<^sub>M M1) (\<lambda>(x, y). f y x)"
     using f unfolding integrable_product_swap_iff[symmetric] by simp
   show ?AE  using Q.AE_integrable_fst'[OF Q_int] by simp
   show ?INT using Q.integrable_fst'[OF Q_int] by simp
   show ?EQ using Q.integral_fst'[OF Q_int]
     using integral_product_swap[of "case_prod f"] by simp
 qed
 
 proposition (in pair_sigma_finite) Fubini_integral:
   fixes f :: "_ \<Rightarrow> _ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes f: "integrable (M1 \<Otimes>\<^sub>M M2) (case_prod f)"
   shows "(\<integral>y. (\<integral>x. f x y \<partial>M1) \<partial>M2) = (\<integral>x. (\<integral>y. f x y \<partial>M2) \<partial>M1)"
   unfolding integral_snd[OF assms] integral_fst[OF assms] ..
 
 lemma (in product_sigma_finite) product_integral_singleton:
   fixes f :: "_ \<Rightarrow> _::{banach, second_countable_topology}"
   shows "f \<in> borel_measurable (M i) \<Longrightarrow> (\<integral>x. f (x i) \<partial>Pi\<^sub>M {i} M) = integral\<^sup>L (M i) f"
   apply (subst distr_singleton[symmetric])
   apply (subst integral_distr)
   apply simp_all
   done
 
 lemma (in product_sigma_finite) product_integral_fold:
   fixes f :: "_ \<Rightarrow> _::{banach, second_countable_topology}"
   assumes IJ[simp]: "I \<inter> J = {}" and fin: "finite I" "finite J"
   and f: "integrable (Pi\<^sub>M (I \<union> J) M) f"
   shows "integral\<^sup>L (Pi\<^sub>M (I \<union> J) M) f = (\<integral>x. (\<integral>y. f (merge I J (x, y)) \<partial>Pi\<^sub>M J M) \<partial>Pi\<^sub>M I M)"
 proof -
   interpret I: finite_product_sigma_finite M I by standard fact
   interpret J: finite_product_sigma_finite M J by standard fact
   have "finite (I \<union> J)" using fin by auto
   interpret IJ: finite_product_sigma_finite M "I \<union> J" by standard fact
   interpret P: pair_sigma_finite "Pi\<^sub>M I M" "Pi\<^sub>M J M" ..
   let ?M = "merge I J"
   let ?f = "\<lambda>x. f (?M x)"
   from f have f_borel: "f \<in> borel_measurable (Pi\<^sub>M (I \<union> J) M)"
     by auto
   have P_borel: "(\<lambda>x. f (merge I J x)) \<in> borel_measurable (Pi\<^sub>M I M \<Otimes>\<^sub>M Pi\<^sub>M J M)"
     using measurable_comp[OF measurable_merge f_borel] by (simp add: comp_def)
   have f_int: "integrable (Pi\<^sub>M I M \<Otimes>\<^sub>M Pi\<^sub>M J M) ?f"
     by (rule integrable_distr[OF measurable_merge]) (simp add: distr_merge[OF IJ fin] f)
   show ?thesis
     apply (subst distr_merge[symmetric, OF IJ fin])
     apply (subst integral_distr[OF measurable_merge f_borel])
     apply (subst P.integral_fst'[symmetric, OF f_int])
     apply simp
     done
 qed
 
 lemma (in product_sigma_finite) product_integral_insert:
   fixes f :: "_ \<Rightarrow> _::{banach, second_countable_topology}"
   assumes I: "finite I" "i \<notin> I"
     and f: "integrable (Pi\<^sub>M (insert i I) M) f"
   shows "integral\<^sup>L (Pi\<^sub>M (insert i I) M) f = (\<integral>x. (\<integral>y. f (x(i:=y)) \<partial>M i) \<partial>Pi\<^sub>M I M)"
 proof -
   have "integral\<^sup>L (Pi\<^sub>M (insert i I) M) f = integral\<^sup>L (Pi\<^sub>M (I \<union> {i}) M) f"
     by simp
   also have "\<dots> = (\<integral>x. (\<integral>y. f (merge I {i} (x,y)) \<partial>Pi\<^sub>M {i} M) \<partial>Pi\<^sub>M I M)"
     using f I by (intro product_integral_fold) auto
   also have "\<dots> = (\<integral>x. (\<integral>y. f (x(i := y)) \<partial>M i) \<partial>Pi\<^sub>M I M)"
   proof (rule integral_cong[OF refl], subst product_integral_singleton[symmetric])
     fix x assume x: "x \<in> space (Pi\<^sub>M I M)"
     have f_borel: "f \<in> borel_measurable (Pi\<^sub>M (insert i I) M)"
       using f by auto
     show "(\<lambda>y. f (x(i := y))) \<in> borel_measurable (M i)"
       using measurable_comp[OF measurable_component_update f_borel, OF x \<open>i \<notin> I\<close>]
       unfolding comp_def .
     from x I show "(\<integral> y. f (merge I {i} (x,y)) \<partial>Pi\<^sub>M {i} M) = (\<integral> xa. f (x(i := xa i)) \<partial>Pi\<^sub>M {i} M)"
       by (auto intro!: integral_cong arg_cong[where f=f] simp: merge_def space_PiM extensional_def PiE_def)
   qed
   finally show ?thesis .
 qed
 
 lemma (in product_sigma_finite) product_integrable_prod:
   fixes f :: "'i \<Rightarrow> 'a \<Rightarrow> _::{real_normed_field,banach,second_countable_topology}"
   assumes [simp]: "finite I" and integrable: "\<And>i. i \<in> I \<Longrightarrow> integrable (M i) (f i)"
   shows "integrable (Pi\<^sub>M I M) (\<lambda>x. (\<Prod>i\<in>I. f i (x i)))" (is "integrable _ ?f")
 proof (unfold integrable_iff_bounded, intro conjI)
   interpret finite_product_sigma_finite M I by standard fact
 
   show "?f \<in> borel_measurable (Pi\<^sub>M I M)"
     using assms by simp
   have "(\<integral>\<^sup>+ x. ennreal (norm (\<Prod>i\<in>I. f i (x i))) \<partial>Pi\<^sub>M I M) =
       (\<integral>\<^sup>+ x. (\<Prod>i\<in>I. ennreal (norm (f i (x i)))) \<partial>Pi\<^sub>M I M)"
     by (simp add: prod_norm prod_ennreal)
   also have "\<dots> = (\<Prod>i\<in>I. \<integral>\<^sup>+ x. ennreal (norm (f i x)) \<partial>M i)"
     using assms by (intro product_nn_integral_prod) auto
   also have "\<dots> < \<infinity>"
     using integrable by (simp add: less_top[symmetric] ennreal_prod_eq_top integrable_iff_bounded)
   finally show "(\<integral>\<^sup>+ x. ennreal (norm (\<Prod>i\<in>I. f i (x i))) \<partial>Pi\<^sub>M I M) < \<infinity>" .
 qed
 
 lemma (in product_sigma_finite) product_integral_prod:
   fixes f :: "'i \<Rightarrow> 'a \<Rightarrow> _::{real_normed_field,banach,second_countable_topology}"
   assumes "finite I" and integrable: "\<And>i. i \<in> I \<Longrightarrow> integrable (M i) (f i)"
   shows "(\<integral>x. (\<Prod>i\<in>I. f i (x i)) \<partial>Pi\<^sub>M I M) = (\<Prod>i\<in>I. integral\<^sup>L (M i) (f i))"
 using assms proof induct
   case empty
   interpret finite_measure "Pi\<^sub>M {} M"
     by rule (simp add: space_PiM)
   show ?case by (simp add: space_PiM measure_def)
 next
   case (insert i I)
   then have iI: "finite (insert i I)" by auto
   then have prod: "\<And>J. J \<subseteq> insert i I \<Longrightarrow>
     integrable (Pi\<^sub>M J M) (\<lambda>x. (\<Prod>i\<in>J. f i (x i)))"
     by (intro product_integrable_prod insert(4)) (auto intro: finite_subset)
   interpret I: finite_product_sigma_finite M I by standard fact
   have *: "\<And>x y. (\<Prod>j\<in>I. f j (if j = i then y else x j)) = (\<Prod>j\<in>I. f j (x j))"
     using \<open>i \<notin> I\<close> by (auto intro!: prod.cong)
   show ?case
     unfolding product_integral_insert[OF insert(1,2) prod[OF subset_refl]]
     by (simp add: * insert prod subset_insertI)
 qed
 
 lemma integrable_subalgebra:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes borel: "f \<in> borel_measurable N"
   and N: "sets N \<subseteq> sets M" "space N = space M" "\<And>A. A \<in> sets N \<Longrightarrow> emeasure N A = emeasure M A"
   shows "integrable N f \<longleftrightarrow> integrable M f" (is ?P)
 proof -
   have "f \<in> borel_measurable M"
     using assms by (auto simp: measurable_def)
   with assms show ?thesis
     using assms by (auto simp: integrable_iff_bounded nn_integral_subalgebra)
 qed
 
 lemma integral_subalgebra:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes borel: "f \<in> borel_measurable N"
   and N: "sets N \<subseteq> sets M" "space N = space M" "\<And>A. A \<in> sets N \<Longrightarrow> emeasure N A = emeasure M A"
   shows "integral\<^sup>L N f = integral\<^sup>L M f"
 proof cases
   assume "integrable N f"
   then show ?thesis
   proof induct
     case base with assms show ?case by (auto simp: subset_eq measure_def)
   next
     case (add f g)
     then have "(\<integral> a. f a + g a \<partial>N) = integral\<^sup>L M f + integral\<^sup>L M g"
       by simp
     also have "\<dots> = (\<integral> a. f a + g a \<partial>M)"
       using add integrable_subalgebra[OF _ N, of f] integrable_subalgebra[OF _ N, of g] by simp
     finally show ?case .
   next
     case (lim f s)
     then have M: "\<And>i. integrable M (s i)" "integrable M f"
       using integrable_subalgebra[OF _ N, of f] integrable_subalgebra[OF _ N, of "s i" for i] by simp_all
     show ?case
     proof (intro LIMSEQ_unique)
       show "(\<lambda>i. integral\<^sup>L N (s i)) \<longlonglongrightarrow> integral\<^sup>L N f"
         apply (rule integral_dominated_convergence[where w="\<lambda>x. 2 * norm (f x)"])
         using lim
         apply auto
         done
       show "(\<lambda>i. integral\<^sup>L N (s i)) \<longlonglongrightarrow> integral\<^sup>L M f"
         unfolding lim
         apply (rule integral_dominated_convergence[where w="\<lambda>x. 2 * norm (f x)"])
         using lim M N(2)
         apply auto
         done
     qed
   qed
 qed (simp add: not_integrable_integral_eq integrable_subalgebra[OF assms])
 
 hide_const (open) simple_bochner_integral
 hide_const (open) simple_bochner_integrable
 
 end
diff --git a/src/HOL/Analysis/Borel_Space.thy b/src/HOL/Analysis/Borel_Space.thy
--- a/src/HOL/Analysis/Borel_Space.thy
+++ b/src/HOL/Analysis/Borel_Space.thy
@@ -1,2086 +1,2086 @@
 (*  Title:      HOL/Analysis/Borel_Space.thy
     Author:     Johannes Hölzl, TU München
     Author:     Armin Heller, TU München
 *)
 
 section \<open>Borel Space\<close>
 
 theory Borel_Space
 imports
   Measurable Derivative Ordered_Euclidean_Space Extended_Real_Limits
 begin
 
 lemma is_interval_real_ereal_oo: "is_interval (real_of_ereal ` {N<..<M::ereal})"
   by (auto simp: real_atLeastGreaterThan_eq)
 
 lemma sets_Collect_eventually_sequentially[measurable]:
   "(\<And>i. {x\<in>space M. P x i} \<in> sets M) \<Longrightarrow> {x\<in>space M. eventually (P x) sequentially} \<in> sets M"
   unfolding eventually_sequentially by simp
 
 lemma topological_basis_trivial: "topological_basis {A. open A}"
   by (auto simp: topological_basis_def)
 
 proposition open_prod_generated: "open = generate_topology {A \<times> B | A B. open A \<and> open B}"
 proof -
   have "{A \<times> B :: ('a \<times> 'b) set | A B. open A \<and> open B} = ((\<lambda>(a, b). a \<times> b) ` ({A. open A} \<times> {A. open A}))"
     by auto
   then show ?thesis
     by (auto intro: topological_basis_prod topological_basis_trivial topological_basis_imp_subbasis)
 qed
 
 proposition mono_on_imp_deriv_nonneg:
   assumes mono: "mono_on f A" and deriv: "(f has_real_derivative D) (at x)"
   assumes "x \<in> interior A"
   shows "D \<ge> 0"
 proof (rule tendsto_lowerbound)
   let ?A' = "(\<lambda>y. y - x) ` interior A"
   from deriv show "((\<lambda>h. (f (x + h) - f x) / h) \<longlongrightarrow> D) (at 0)"
       by (simp add: field_has_derivative_at has_field_derivative_def)
   from mono have mono': "mono_on f (interior A)" by (rule mono_on_subset) (rule interior_subset)
 
   show "eventually (\<lambda>h. (f (x + h) - f x) / h \<ge> 0) (at 0)"
   proof (subst eventually_at_topological, intro exI conjI ballI impI)
     have "open (interior A)" by simp
     hence "open ((+) (-x) ` interior A)" by (rule open_translation)
     also have "((+) (-x) ` interior A) = ?A'" by auto
     finally show "open ?A'" .
   next
     from \<open>x \<in> interior A\<close> show "0 \<in> ?A'" by auto
   next
     fix h assume "h \<in> ?A'"
     hence "x + h \<in> interior A" by auto
     with mono' and \<open>x \<in> interior A\<close> show "(f (x + h) - f x) / h \<ge> 0"
       by (cases h rule: linorder_cases[of _ 0])
          (simp_all add: divide_nonpos_neg divide_nonneg_pos mono_onD field_simps)
   qed
 qed simp
 
 proposition mono_on_ctble_discont:
   fixes f :: "real \<Rightarrow> real"
   fixes A :: "real set"
   assumes "mono_on f A"
   shows "countable {a\<in>A. \<not> continuous (at a within A) f}"
 proof -
   have mono: "\<And>x y. x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> x \<le> y \<Longrightarrow> f x \<le> f y"
     using \<open>mono_on f A\<close> by (simp add: mono_on_def)
   have "\<forall>a \<in> {a\<in>A. \<not> continuous (at a within A) f}. \<exists>q :: nat \<times> rat.
       (fst q = 0 \<and> of_rat (snd q) < f a \<and> (\<forall>x \<in> A. x < a \<longrightarrow> f x < of_rat (snd q))) \<or>
       (fst q = 1 \<and> of_rat (snd q) > f a \<and> (\<forall>x \<in> A. x > a \<longrightarrow> f x > of_rat (snd q)))"
   proof (clarsimp simp del: One_nat_def)
     fix a assume "a \<in> A" assume "\<not> continuous (at a within A) f"
     thus "\<exists>q1 q2.
             q1 = 0 \<and> real_of_rat q2 < f a \<and> (\<forall>x\<in>A. x < a \<longrightarrow> f x < real_of_rat q2) \<or>
             q1 = 1 \<and> f a < real_of_rat q2 \<and> (\<forall>x\<in>A. a < x \<longrightarrow> real_of_rat q2 < f x)"
     proof (auto simp add: continuous_within order_tendsto_iff eventually_at)
       fix l assume "l < f a"
       then obtain q2 where q2: "l < of_rat q2" "of_rat q2 < f a"
         using of_rat_dense by blast
       assume * [rule_format]: "\<forall>d>0. \<exists>x\<in>A. x \<noteq> a \<and> dist x a < d \<and> \<not> l < f x"
       from q2 have "real_of_rat q2 < f a \<and> (\<forall>x\<in>A. x < a \<longrightarrow> f x < real_of_rat q2)"
       proof auto
         fix x assume "x \<in> A" "x < a"
         with q2 *[of "a - x"] show "f x < real_of_rat q2"
           apply (auto simp add: dist_real_def not_less)
           apply (subgoal_tac "f x \<le> f xa")
           by (auto intro: mono)
       qed
       thus ?thesis by auto
     next
       fix u assume "u > f a"
       then obtain q2 where q2: "f a < of_rat q2" "of_rat q2 < u"
         using of_rat_dense by blast
       assume *[rule_format]: "\<forall>d>0. \<exists>x\<in>A. x \<noteq> a \<and> dist x a < d \<and> \<not> u > f x"
       from q2 have "real_of_rat q2 > f a \<and> (\<forall>x\<in>A. x > a \<longrightarrow> f x > real_of_rat q2)"
       proof auto
         fix x assume "x \<in> A" "x > a"
         with q2 *[of "x - a"] show "f x > real_of_rat q2"
           apply (auto simp add: dist_real_def)
           apply (subgoal_tac "f x \<ge> f xa")
           by (auto intro: mono)
       qed
       thus ?thesis by auto
     qed
   qed
   hence "\<exists>g :: real \<Rightarrow> nat \<times> rat . \<forall>a \<in> {a\<in>A. \<not> continuous (at a within A) f}.
       (fst (g a) = 0 \<and> of_rat (snd (g a)) < f a \<and> (\<forall>x \<in> A. x < a \<longrightarrow> f x < of_rat (snd (g a)))) |
       (fst (g a) = 1 \<and> of_rat (snd (g a)) > f a \<and> (\<forall>x \<in> A. x > a \<longrightarrow> f x > of_rat (snd (g a))))"
     by (rule bchoice)
   then guess g ..
   hence g: "\<And>a x. a \<in> A \<Longrightarrow> \<not> continuous (at a within A) f \<Longrightarrow> x \<in> A \<Longrightarrow>
       (fst (g a) = 0 \<and> of_rat (snd (g a)) < f a \<and> (x < a \<longrightarrow> f x < of_rat (snd (g a)))) |
       (fst (g a) = 1 \<and> of_rat (snd (g a)) > f a \<and> (x > a \<longrightarrow> f x > of_rat (snd (g a))))"
     by auto
   have "inj_on g {a\<in>A. \<not> continuous (at a within A) f}"
   proof (auto simp add: inj_on_def)
     fix w z
     assume 1: "w \<in> A" and 2: "\<not> continuous (at w within A) f" and
            3: "z \<in> A" and 4: "\<not> continuous (at z within A) f" and
            5: "g w = g z"
     from g [OF 1 2 3] g [OF 3 4 1] 5
     show "w = z" by auto
   qed
   thus ?thesis
     by (rule countableI')
 qed
 
 lemma mono_on_ctble_discont_open:
   fixes f :: "real \<Rightarrow> real"
   fixes A :: "real set"
   assumes "open A" "mono_on f A"
   shows "countable {a\<in>A. \<not>isCont f a}"
 proof -
   have "{a\<in>A. \<not>isCont f a} = {a\<in>A. \<not>(continuous (at a within A) f)}"
     by (auto simp add: continuous_within_open [OF _ \<open>open A\<close>])
   thus ?thesis
     apply (elim ssubst)
     by (rule mono_on_ctble_discont, rule assms)
 qed
 
 lemma mono_ctble_discont:
   fixes f :: "real \<Rightarrow> real"
   assumes "mono f"
   shows "countable {a. \<not> isCont f a}"
   using assms mono_on_ctble_discont [of f UNIV] unfolding mono_on_def mono_def by auto
 
 lemma has_real_derivative_imp_continuous_on:
   assumes "\<And>x. x \<in> A \<Longrightarrow> (f has_real_derivative f' x) (at x)"
   shows "continuous_on A f"
   apply (intro differentiable_imp_continuous_on, unfold differentiable_on_def)
   using assms differentiable_at_withinI real_differentiable_def by blast
 
 lemma continuous_interval_vimage_Int:
   assumes "continuous_on {a::real..b} g" and mono: "\<And>x y. a \<le> x \<Longrightarrow> x \<le> y \<Longrightarrow> y \<le> b \<Longrightarrow> g x \<le> g y"
   assumes "a \<le> b" "(c::real) \<le> d" "{c..d} \<subseteq> {g a..g b}"
   obtains c' d' where "{a..b} \<inter> g -` {c..d} = {c'..d'}" "c' \<le> d'" "g c' = c" "g d' = d"
 proof-
   let ?A = "{a..b} \<inter> g -` {c..d}"
   from IVT'[of g a c b, OF _ _ \<open>a \<le> b\<close> assms(1)] assms(4,5)
   obtain c'' where c'': "c'' \<in> ?A" "g c'' = c" by auto
   from IVT'[of g a d b, OF _ _ \<open>a \<le> b\<close> assms(1)] assms(4,5)
   obtain d'' where d'': "d'' \<in> ?A" "g d'' = d" by auto
   hence [simp]: "?A \<noteq> {}" by blast
 
   define c' where "c' = Inf ?A"
   define d' where "d' = Sup ?A"
   have "?A \<subseteq> {c'..d'}" unfolding c'_def d'_def
     by (intro subsetI) (auto intro: cInf_lower cSup_upper)
   moreover from assms have "closed ?A"
     using continuous_on_closed_vimage[of "{a..b}" g] by (subst Int_commute) simp
   hence c'd'_in_set: "c' \<in> ?A" "d' \<in> ?A" unfolding c'_def d'_def
     by ((intro closed_contains_Inf closed_contains_Sup, simp_all)[])+
   hence "{c'..d'} \<subseteq> ?A" using assms
     by (intro subsetI)
        (auto intro!: order_trans[of c "g c'" "g x" for x] order_trans[of "g x" "g d'" d for x]
              intro!: mono)
   moreover have "c' \<le> d'" using c'd'_in_set(2) unfolding c'_def by (intro cInf_lower) auto
   moreover have "g c' \<le> c" "g d' \<ge> d"
     apply (insert c'' d'' c'd'_in_set)
     apply (subst c''(2)[symmetric])
     apply (auto simp: c'_def intro!: mono cInf_lower c'') []
     apply (subst d''(2)[symmetric])
     apply (auto simp: d'_def intro!: mono cSup_upper d'') []
     done
   with c'd'_in_set have "g c' = c" "g d' = d" by auto
   ultimately show ?thesis using that by blast
 qed
 
 subsection \<open>Generic Borel spaces\<close>
 
 definition\<^marker>\<open>tag important\<close> (in topological_space) borel :: "'a measure" where
   "borel = sigma UNIV {S. open S}"
 
 abbreviation "borel_measurable M \<equiv> measurable M borel"
 
 lemma in_borel_measurable:
    "f \<in> borel_measurable M \<longleftrightarrow>
     (\<forall>S \<in> sigma_sets UNIV {S. open S}. f -` S \<inter> space M \<in> sets M)"
   by (auto simp add: measurable_def borel_def)
 
 lemma in_borel_measurable_borel:
    "f \<in> borel_measurable M \<longleftrightarrow>
     (\<forall>S \<in> sets borel.
       f -` S \<inter> space M \<in> sets M)"
   by (auto simp add: measurable_def borel_def)
 
 lemma space_borel[simp]: "space borel = UNIV"
   unfolding borel_def by auto
 
 lemma space_in_borel[measurable]: "UNIV \<in> sets borel"
   unfolding borel_def by auto
 
 lemma sets_borel: "sets borel = sigma_sets UNIV {S. open S}"
   unfolding borel_def by (rule sets_measure_of) simp
 
 lemma measurable_sets_borel:
     "\<lbrakk>f \<in> measurable borel M; A \<in> sets M\<rbrakk> \<Longrightarrow> f -` A \<in> sets borel"
   by (drule (1) measurable_sets) simp
 
 lemma pred_Collect_borel[measurable (raw)]: "Measurable.pred borel P \<Longrightarrow> {x. P x} \<in> sets borel"
   unfolding borel_def pred_def by auto
 
 lemma borel_open[measurable (raw generic)]:
   assumes "open A" shows "A \<in> sets borel"
 proof -
   have "A \<in> {S. open S}" unfolding mem_Collect_eq using assms .
   thus ?thesis unfolding borel_def by auto
 qed
 
 lemma borel_closed[measurable (raw generic)]:
   assumes "closed A" shows "A \<in> sets borel"
 proof -
   have "space borel - (- A) \<in> sets borel"
     using assms unfolding closed_def by (blast intro: borel_open)
   thus ?thesis by simp
 qed
 
 lemma borel_singleton[measurable]:
   "A \<in> sets borel \<Longrightarrow> insert x A \<in> sets (borel :: 'a::t1_space measure)"
   unfolding insert_def by (rule sets.Un) auto
 
 lemma sets_borel_eq_count_space: "sets (borel :: 'a::{countable, t2_space} measure) = count_space UNIV"
 proof -
   have "(\<Union>a\<in>A. {a}) \<in> sets borel" for A :: "'a set"
     by (intro sets.countable_UN') auto
   then show ?thesis
     by auto
 qed
 
 lemma borel_comp[measurable]: "A \<in> sets borel \<Longrightarrow> - A \<in> sets borel"
   unfolding Compl_eq_Diff_UNIV by simp
 
 lemma borel_measurable_vimage:
   fixes f :: "'a \<Rightarrow> 'x::t2_space"
   assumes borel[measurable]: "f \<in> borel_measurable M"
   shows "f -` {x} \<inter> space M \<in> sets M"
   by simp
 
 lemma borel_measurableI:
   fixes f :: "'a \<Rightarrow> 'x::topological_space"
   assumes "\<And>S. open S \<Longrightarrow> f -` S \<inter> space M \<in> sets M"
   shows "f \<in> borel_measurable M"
   unfolding borel_def
 proof (rule measurable_measure_of, simp_all)
   fix S :: "'x set" assume "open S" thus "f -` S \<inter> space M \<in> sets M"
     using assms[of S] by simp
 qed
 
 lemma borel_measurable_const:
   "(\<lambda>x. c) \<in> borel_measurable M"
   by auto
 
 lemma borel_measurable_indicator:
   assumes A: "A \<in> sets M"
   shows "indicator A \<in> borel_measurable M"
   unfolding indicator_def [abs_def] using A
   by (auto intro!: measurable_If_set)
 
 lemma borel_measurable_count_space[measurable (raw)]:
   "f \<in> borel_measurable (count_space S)"
   unfolding measurable_def by auto
 
 lemma borel_measurable_indicator'[measurable (raw)]:
   assumes [measurable]: "{x\<in>space M. f x \<in> A x} \<in> sets M"
   shows "(\<lambda>x. indicator (A x) (f x)) \<in> borel_measurable M"
   unfolding indicator_def[abs_def]
   by (auto intro!: measurable_If)
 
 lemma borel_measurable_indicator_iff:
   "(indicator A :: 'a \<Rightarrow> 'x::{t1_space, zero_neq_one}) \<in> borel_measurable M \<longleftrightarrow> A \<inter> space M \<in> sets M"
     (is "?I \<in> borel_measurable M \<longleftrightarrow> _")
 proof
   assume "?I \<in> borel_measurable M"
   then have "?I -` {1} \<inter> space M \<in> sets M"
     unfolding measurable_def by auto
   also have "?I -` {1} \<inter> space M = A \<inter> space M"
     unfolding indicator_def [abs_def] by auto
   finally show "A \<inter> space M \<in> sets M" .
 next
   assume "A \<inter> space M \<in> sets M"
   moreover have "?I \<in> borel_measurable M \<longleftrightarrow>
     (indicator (A \<inter> space M) :: 'a \<Rightarrow> 'x) \<in> borel_measurable M"
     by (intro measurable_cong) (auto simp: indicator_def)
   ultimately show "?I \<in> borel_measurable M" by auto
 qed
 
 lemma borel_measurable_subalgebra:
   assumes "sets N \<subseteq> sets M" "space N = space M" "f \<in> borel_measurable N"
   shows "f \<in> borel_measurable M"
   using assms unfolding measurable_def by auto
 
 lemma borel_measurable_restrict_space_iff_ereal:
   fixes f :: "'a \<Rightarrow> ereal"
   assumes \<Omega>[measurable, simp]: "\<Omega> \<inter> space M \<in> sets M"
   shows "f \<in> borel_measurable (restrict_space M \<Omega>) \<longleftrightarrow>
     (\<lambda>x. f x * indicator \<Omega> x) \<in> borel_measurable M"
   by (subst measurable_restrict_space_iff)
-     (auto simp: indicator_def if_distrib[where f="\<lambda>x. a * x" for a] cong del: if_weak_cong)
+     (auto simp: indicator_def of_bool_def if_distrib[where f="\<lambda>x. a * x" for a] cong del: if_weak_cong)
 
 lemma borel_measurable_restrict_space_iff_ennreal:
   fixes f :: "'a \<Rightarrow> ennreal"
   assumes \<Omega>[measurable, simp]: "\<Omega> \<inter> space M \<in> sets M"
   shows "f \<in> borel_measurable (restrict_space M \<Omega>) \<longleftrightarrow>
     (\<lambda>x. f x * indicator \<Omega> x) \<in> borel_measurable M"
   by (subst measurable_restrict_space_iff)
-     (auto simp: indicator_def if_distrib[where f="\<lambda>x. a * x" for a] cong del: if_weak_cong)
+     (auto simp: indicator_def of_bool_def if_distrib[where f="\<lambda>x. a * x" for a] cong del: if_weak_cong)
 
 lemma borel_measurable_restrict_space_iff:
   fixes f :: "'a \<Rightarrow> 'b::real_normed_vector"
   assumes \<Omega>[measurable, simp]: "\<Omega> \<inter> space M \<in> sets M"
   shows "f \<in> borel_measurable (restrict_space M \<Omega>) \<longleftrightarrow>
     (\<lambda>x. indicator \<Omega> x *\<^sub>R f x) \<in> borel_measurable M"
   by (subst measurable_restrict_space_iff)
-     (auto simp: indicator_def if_distrib[where f="\<lambda>x. x *\<^sub>R a" for a] ac_simps
+     (auto simp: indicator_def of_bool_def if_distrib[where f="\<lambda>x. x *\<^sub>R a" for a] ac_simps
        cong del: if_weak_cong)
 
 lemma cbox_borel[measurable]: "cbox a b \<in> sets borel"
   by (auto intro: borel_closed)
 
 lemma box_borel[measurable]: "box a b \<in> sets borel"
   by (auto intro: borel_open)
 
 lemma borel_compact: "compact (A::'a::t2_space set) \<Longrightarrow> A \<in> sets borel"
   by (auto intro: borel_closed dest!: compact_imp_closed)
 
 lemma borel_sigma_sets_subset:
   "A \<subseteq> sets borel \<Longrightarrow> sigma_sets UNIV A \<subseteq> sets borel"
   using sets.sigma_sets_subset[of A borel] by simp
 
 lemma borel_eq_sigmaI1:
   fixes F :: "'i \<Rightarrow> 'a::topological_space set" and X :: "'a::topological_space set set"
   assumes borel_eq: "borel = sigma UNIV X"
   assumes X: "\<And>x. x \<in> X \<Longrightarrow> x \<in> sets (sigma UNIV (F ` A))"
   assumes F: "\<And>i. i \<in> A \<Longrightarrow> F i \<in> sets borel"
   shows "borel = sigma UNIV (F ` A)"
   unfolding borel_def
 proof (intro sigma_eqI antisym)
   have borel_rev_eq: "sigma_sets UNIV {S::'a set. open S} = sets borel"
     unfolding borel_def by simp
   also have "\<dots> = sigma_sets UNIV X"
     unfolding borel_eq by simp
   also have "\<dots> \<subseteq> sigma_sets UNIV (F`A)"
     using X by (intro sigma_algebra.sigma_sets_subset[OF sigma_algebra_sigma_sets]) auto
   finally show "sigma_sets UNIV {S. open S} \<subseteq> sigma_sets UNIV (F`A)" .
   show "sigma_sets UNIV (F`A) \<subseteq> sigma_sets UNIV {S. open S}"
     unfolding borel_rev_eq using F by (intro borel_sigma_sets_subset) auto
 qed auto
 
 lemma borel_eq_sigmaI2:
   fixes F :: "'i \<Rightarrow> 'j \<Rightarrow> 'a::topological_space set"
     and G :: "'l \<Rightarrow> 'k \<Rightarrow> 'a::topological_space set"
   assumes borel_eq: "borel = sigma UNIV ((\<lambda>(i, j). G i j)`B)"
   assumes X: "\<And>i j. (i, j) \<in> B \<Longrightarrow> G i j \<in> sets (sigma UNIV ((\<lambda>(i, j). F i j) ` A))"
   assumes F: "\<And>i j. (i, j) \<in> A \<Longrightarrow> F i j \<in> sets borel"
   shows "borel = sigma UNIV ((\<lambda>(i, j). F i j) ` A)"
   using assms
   by (intro borel_eq_sigmaI1[where X="(\<lambda>(i, j). G i j) ` B" and F="(\<lambda>(i, j). F i j)"]) auto
 
 lemma borel_eq_sigmaI3:
   fixes F :: "'i \<Rightarrow> 'j \<Rightarrow> 'a::topological_space set" and X :: "'a::topological_space set set"
   assumes borel_eq: "borel = sigma UNIV X"
   assumes X: "\<And>x. x \<in> X \<Longrightarrow> x \<in> sets (sigma UNIV ((\<lambda>(i, j). F i j) ` A))"
   assumes F: "\<And>i j. (i, j) \<in> A \<Longrightarrow> F i j \<in> sets borel"
   shows "borel = sigma UNIV ((\<lambda>(i, j). F i j) ` A)"
   using assms by (intro borel_eq_sigmaI1[where X=X and F="(\<lambda>(i, j). F i j)"]) auto
 
 lemma borel_eq_sigmaI4:
   fixes F :: "'i \<Rightarrow> 'a::topological_space set"
     and G :: "'l \<Rightarrow> 'k \<Rightarrow> 'a::topological_space set"
   assumes borel_eq: "borel = sigma UNIV ((\<lambda>(i, j). G i j)`A)"
   assumes X: "\<And>i j. (i, j) \<in> A \<Longrightarrow> G i j \<in> sets (sigma UNIV (range F))"
   assumes F: "\<And>i. F i \<in> sets borel"
   shows "borel = sigma UNIV (range F)"
   using assms by (intro borel_eq_sigmaI1[where X="(\<lambda>(i, j). G i j) ` A" and F=F]) auto
 
 lemma borel_eq_sigmaI5:
   fixes F :: "'i \<Rightarrow> 'j \<Rightarrow> 'a::topological_space set" and G :: "'l \<Rightarrow> 'a::topological_space set"
   assumes borel_eq: "borel = sigma UNIV (range G)"
   assumes X: "\<And>i. G i \<in> sets (sigma UNIV (range (\<lambda>(i, j). F i j)))"
   assumes F: "\<And>i j. F i j \<in> sets borel"
   shows "borel = sigma UNIV (range (\<lambda>(i, j). F i j))"
   using assms by (intro borel_eq_sigmaI1[where X="range G" and F="(\<lambda>(i, j). F i j)"]) auto
 
 theorem second_countable_borel_measurable:
   fixes X :: "'a::second_countable_topology set set"
   assumes eq: "open = generate_topology X"
   shows "borel = sigma UNIV X"
   unfolding borel_def
 proof (intro sigma_eqI sigma_sets_eqI)
   interpret X: sigma_algebra UNIV "sigma_sets UNIV X"
     by (rule sigma_algebra_sigma_sets) simp
 
   fix S :: "'a set" assume "S \<in> Collect open"
   then have "generate_topology X S"
     by (auto simp: eq)
   then show "S \<in> sigma_sets UNIV X"
   proof induction
     case (UN K)
     then have K: "\<And>k. k \<in> K \<Longrightarrow> open k"
       unfolding eq by auto
     from ex_countable_basis obtain B :: "'a set set" where
       B:  "\<And>b. b \<in> B \<Longrightarrow> open b" "\<And>X. open X \<Longrightarrow> \<exists>b\<subseteq>B. (\<Union>b) = X" and "countable B"
       by (auto simp: topological_basis_def)
     from B(2)[OF K] obtain m where m: "\<And>k. k \<in> K \<Longrightarrow> m k \<subseteq> B" "\<And>k. k \<in> K \<Longrightarrow> \<Union>(m k) = k"
       by metis
     define U where "U = (\<Union>k\<in>K. m k)"
     with m have "countable U"
       by (intro countable_subset[OF _ \<open>countable B\<close>]) auto
     have "\<Union>U = (\<Union>A\<in>U. A)" by simp
     also have "\<dots> = \<Union>K"
       unfolding U_def UN_simps by (simp add: m)
     finally have "\<Union>U = \<Union>K" .
 
     have "\<forall>b\<in>U. \<exists>k\<in>K. b \<subseteq> k"
       using m by (auto simp: U_def)
     then obtain u where u: "\<And>b. b \<in> U \<Longrightarrow> u b \<in> K" and "\<And>b. b \<in> U \<Longrightarrow> b \<subseteq> u b"
       by metis
     then have "(\<Union>b\<in>U. u b) \<subseteq> \<Union>K" "\<Union>U \<subseteq> (\<Union>b\<in>U. u b)"
       by auto
     then have "\<Union>K = (\<Union>b\<in>U. u b)"
       unfolding \<open>\<Union>U = \<Union>K\<close> by auto
     also have "\<dots> \<in> sigma_sets UNIV X"
       using u UN by (intro X.countable_UN' \<open>countable U\<close>) auto
     finally show "\<Union>K \<in> sigma_sets UNIV X" .
   qed auto
 qed (auto simp: eq intro: generate_topology.Basis)
 
 lemma borel_eq_closed: "borel = sigma UNIV (Collect closed)"
   unfolding borel_def
 proof (intro sigma_eqI sigma_sets_eqI, safe)
   fix x :: "'a set" assume "open x"
   hence "x = UNIV - (UNIV - x)" by auto
   also have "\<dots> \<in> sigma_sets UNIV (Collect closed)"
     by (force intro: sigma_sets.Compl simp: \<open>open x\<close>)
   finally show "x \<in> sigma_sets UNIV (Collect closed)" by simp
 next
   fix x :: "'a set" assume "closed x"
   hence "x = UNIV - (UNIV - x)" by auto
   also have "\<dots> \<in> sigma_sets UNIV (Collect open)"
     by (force intro: sigma_sets.Compl simp: \<open>closed x\<close>)
   finally show "x \<in> sigma_sets UNIV (Collect open)" by simp
 qed simp_all
 
 proposition borel_eq_countable_basis:
   fixes B::"'a::topological_space set set"
   assumes "countable B"
   assumes "topological_basis B"
   shows "borel = sigma UNIV B"
   unfolding borel_def
 proof (intro sigma_eqI sigma_sets_eqI, safe)
   interpret countable_basis "open" B using assms by (rule countable_basis_openI)
   fix X::"'a set" assume "open X"
   from open_countable_basisE[OF this] obtain B' where B': "B' \<subseteq> B" "X = \<Union> B'" .
   then show "X \<in> sigma_sets UNIV B"
     by (blast intro: sigma_sets_UNION \<open>countable B\<close> countable_subset)
 next
   fix b assume "b \<in> B"
   hence "open b" by (rule topological_basis_open[OF assms(2)])
   thus "b \<in> sigma_sets UNIV (Collect open)" by auto
 qed simp_all
 
 lemma borel_measurable_continuous_on_restrict:
   fixes f :: "'a::topological_space \<Rightarrow> 'b::topological_space"
   assumes f: "continuous_on A f"
   shows "f \<in> borel_measurable (restrict_space borel A)"
 proof (rule borel_measurableI)
   fix S :: "'b set" assume "open S"
   with f obtain T where "f -` S \<inter> A = T \<inter> A" "open T"
     by (metis continuous_on_open_invariant)
   then show "f -` S \<inter> space (restrict_space borel A) \<in> sets (restrict_space borel A)"
     by (force simp add: sets_restrict_space space_restrict_space)
 qed
 
 lemma borel_measurable_continuous_onI: "continuous_on UNIV f \<Longrightarrow> f \<in> borel_measurable borel"
   by (drule borel_measurable_continuous_on_restrict) simp
 
 lemma borel_measurable_continuous_on_if:
   "A \<in> sets borel \<Longrightarrow> continuous_on A f \<Longrightarrow> continuous_on (- A) g \<Longrightarrow>
     (\<lambda>x. if x \<in> A then f x else g x) \<in> borel_measurable borel"
   by (auto simp add: measurable_If_restrict_space_iff Collect_neg_eq
            intro!: borel_measurable_continuous_on_restrict)
 
 lemma borel_measurable_continuous_countable_exceptions:
   fixes f :: "'a::t1_space \<Rightarrow> 'b::topological_space"
   assumes X: "countable X"
   assumes "continuous_on (- X) f"
   shows "f \<in> borel_measurable borel"
 proof (rule measurable_discrete_difference[OF _ X])
   have "X \<in> sets borel"
     by (rule sets.countable[OF _ X]) auto
   then show "(\<lambda>x. if x \<in> X then undefined else f x) \<in> borel_measurable borel"
     by (intro borel_measurable_continuous_on_if assms continuous_intros)
 qed auto
 
 lemma borel_measurable_continuous_on:
   assumes f: "continuous_on UNIV f" and g: "g \<in> borel_measurable M"
   shows "(\<lambda>x. f (g x)) \<in> borel_measurable M"
   using measurable_comp[OF g borel_measurable_continuous_onI[OF f]] by (simp add: comp_def)
 
 lemma borel_measurable_continuous_on_indicator:
   fixes f g :: "'a::topological_space \<Rightarrow> 'b::real_normed_vector"
   shows "A \<in> sets borel \<Longrightarrow> continuous_on A f \<Longrightarrow> (\<lambda>x. indicator A x *\<^sub>R f x) \<in> borel_measurable borel"
   by (subst borel_measurable_restrict_space_iff[symmetric])
      (auto intro: borel_measurable_continuous_on_restrict)
 
 lemma borel_measurable_Pair[measurable (raw)]:
   fixes f :: "'a \<Rightarrow> 'b::second_countable_topology" and g :: "'a \<Rightarrow> 'c::second_countable_topology"
   assumes f[measurable]: "f \<in> borel_measurable M"
   assumes g[measurable]: "g \<in> borel_measurable M"
   shows "(\<lambda>x. (f x, g x)) \<in> borel_measurable M"
 proof (subst borel_eq_countable_basis)
   let ?B = "SOME B::'b set set. countable B \<and> topological_basis B"
   let ?C = "SOME B::'c set set. countable B \<and> topological_basis B"
   let ?P = "(\<lambda>(b, c). b \<times> c) ` (?B \<times> ?C)"
   show "countable ?P" "topological_basis ?P"
     by (auto intro!: countable_basis topological_basis_prod is_basis)
 
   show "(\<lambda>x. (f x, g x)) \<in> measurable M (sigma UNIV ?P)"
   proof (rule measurable_measure_of)
     fix S assume "S \<in> ?P"
     then obtain b c where "b \<in> ?B" "c \<in> ?C" and S: "S = b \<times> c" by auto
     then have borel: "open b" "open c"
       by (auto intro: is_basis topological_basis_open)
     have "(\<lambda>x. (f x, g x)) -` S \<inter> space M = (f -` b \<inter> space M) \<inter> (g -` c \<inter> space M)"
       unfolding S by auto
     also have "\<dots> \<in> sets M"
       using borel by simp
     finally show "(\<lambda>x. (f x, g x)) -` S \<inter> space M \<in> sets M" .
   qed auto
 qed
 
 lemma borel_measurable_continuous_Pair:
   fixes f :: "'a \<Rightarrow> 'b::second_countable_topology" and g :: "'a \<Rightarrow> 'c::second_countable_topology"
   assumes [measurable]: "f \<in> borel_measurable M"
   assumes [measurable]: "g \<in> borel_measurable M"
   assumes H: "continuous_on UNIV (\<lambda>x. H (fst x) (snd x))"
   shows "(\<lambda>x. H (f x) (g x)) \<in> borel_measurable M"
 proof -
   have eq: "(\<lambda>x. H (f x) (g x)) = (\<lambda>x. (\<lambda>x. H (fst x) (snd x)) (f x, g x))" by auto
   show ?thesis
     unfolding eq by (rule borel_measurable_continuous_on[OF H]) auto
 qed
 
 subsection \<open>Borel spaces on order topologies\<close>
 
 lemma [measurable]:
   fixes a b :: "'a::linorder_topology"
   shows lessThan_borel: "{..< a} \<in> sets borel"
     and greaterThan_borel: "{a <..} \<in> sets borel"
     and greaterThanLessThan_borel: "{a<..<b} \<in> sets borel"
     and atMost_borel: "{..a} \<in> sets borel"
     and atLeast_borel: "{a..} \<in> sets borel"
     and atLeastAtMost_borel: "{a..b} \<in> sets borel"
     and greaterThanAtMost_borel: "{a<..b} \<in> sets borel"
     and atLeastLessThan_borel: "{a..<b} \<in> sets borel"
   unfolding greaterThanAtMost_def atLeastLessThan_def
   by (blast intro: borel_open borel_closed open_lessThan open_greaterThan open_greaterThanLessThan
                    closed_atMost closed_atLeast closed_atLeastAtMost)+
 
 lemma borel_Iio:
   "borel = sigma UNIV (range lessThan :: 'a::{linorder_topology, second_countable_topology} set set)"
   unfolding second_countable_borel_measurable[OF open_generated_order]
 proof (intro sigma_eqI sigma_sets_eqI)
   from countable_dense_setE guess D :: "'a set" . note D = this
 
   interpret L: sigma_algebra UNIV "sigma_sets UNIV (range lessThan)"
     by (rule sigma_algebra_sigma_sets) simp
 
   fix A :: "'a set" assume "A \<in> range lessThan \<union> range greaterThan"
   then obtain y where "A = {y <..} \<or> A = {..< y}"
     by blast
   then show "A \<in> sigma_sets UNIV (range lessThan)"
   proof
     assume A: "A = {y <..}"
     show ?thesis
     proof cases
       assume "\<forall>x>y. \<exists>d. y < d \<and> d < x"
       with D(2)[of "{y <..< x}" for x] have "\<forall>x>y. \<exists>d\<in>D. y < d \<and> d < x"
         by (auto simp: set_eq_iff)
       then have "A = UNIV - (\<Inter>d\<in>{d\<in>D. y < d}. {..< d})"
         by (auto simp: A) (metis less_asym)
       also have "\<dots> \<in> sigma_sets UNIV (range lessThan)"
         using D(1) by (intro L.Diff L.top L.countable_INT'') auto
       finally show ?thesis .
     next
       assume "\<not> (\<forall>x>y. \<exists>d. y < d \<and> d < x)"
       then obtain x where "y < x"  "\<And>d. y < d \<Longrightarrow> \<not> d < x"
         by auto
       then have "A = UNIV - {..< x}"
         unfolding A by (auto simp: not_less[symmetric])
       also have "\<dots> \<in> sigma_sets UNIV (range lessThan)"
         by auto
       finally show ?thesis .
     qed
   qed auto
 qed auto
 
 lemma borel_Ioi:
   "borel = sigma UNIV (range greaterThan :: 'a::{linorder_topology, second_countable_topology} set set)"
   unfolding second_countable_borel_measurable[OF open_generated_order]
 proof (intro sigma_eqI sigma_sets_eqI)
   from countable_dense_setE guess D :: "'a set" . note D = this
 
   interpret L: sigma_algebra UNIV "sigma_sets UNIV (range greaterThan)"
     by (rule sigma_algebra_sigma_sets) simp
 
   fix A :: "'a set" assume "A \<in> range lessThan \<union> range greaterThan"
   then obtain y where "A = {y <..} \<or> A = {..< y}"
     by blast
   then show "A \<in> sigma_sets UNIV (range greaterThan)"
   proof
     assume A: "A = {..< y}"
     show ?thesis
     proof cases
       assume "\<forall>x<y. \<exists>d. x < d \<and> d < y"
       with D(2)[of "{x <..< y}" for x] have "\<forall>x<y. \<exists>d\<in>D. x < d \<and> d < y"
         by (auto simp: set_eq_iff)
       then have "A = UNIV - (\<Inter>d\<in>{d\<in>D. d < y}. {d <..})"
         by (auto simp: A) (metis less_asym)
       also have "\<dots> \<in> sigma_sets UNIV (range greaterThan)"
         using D(1) by (intro L.Diff L.top L.countable_INT'') auto
       finally show ?thesis .
     next
       assume "\<not> (\<forall>x<y. \<exists>d. x < d \<and> d < y)"
       then obtain x where "x < y"  "\<And>d. y > d \<Longrightarrow> x \<ge> d"
         by (auto simp: not_less[symmetric])
       then have "A = UNIV - {x <..}"
         unfolding A Compl_eq_Diff_UNIV[symmetric] by auto
       also have "\<dots> \<in> sigma_sets UNIV (range greaterThan)"
         by auto
       finally show ?thesis .
     qed
   qed auto
 qed auto
 
 lemma borel_measurableI_less:
   fixes f :: "'a \<Rightarrow> 'b::{linorder_topology, second_countable_topology}"
   shows "(\<And>y. {x\<in>space M. f x < y} \<in> sets M) \<Longrightarrow> f \<in> borel_measurable M"
   unfolding borel_Iio
   by (rule measurable_measure_of) (auto simp: Int_def conj_commute)
 
 lemma borel_measurableI_greater:
   fixes f :: "'a \<Rightarrow> 'b::{linorder_topology, second_countable_topology}"
   shows "(\<And>y. {x\<in>space M. y < f x} \<in> sets M) \<Longrightarrow> f \<in> borel_measurable M"
   unfolding borel_Ioi
   by (rule measurable_measure_of) (auto simp: Int_def conj_commute)
 
 lemma borel_measurableI_le:
   fixes f :: "'a \<Rightarrow> 'b::{linorder_topology, second_countable_topology}"
   shows "(\<And>y. {x\<in>space M. f x \<le> y} \<in> sets M) \<Longrightarrow> f \<in> borel_measurable M"
   by (rule borel_measurableI_greater) (auto simp: not_le[symmetric])
 
 lemma borel_measurableI_ge:
   fixes f :: "'a \<Rightarrow> 'b::{linorder_topology, second_countable_topology}"
   shows "(\<And>y. {x\<in>space M. y \<le> f x} \<in> sets M) \<Longrightarrow> f \<in> borel_measurable M"
   by (rule borel_measurableI_less) (auto simp: not_le[symmetric])
 
 lemma borel_measurable_less[measurable]:
   fixes f :: "'a \<Rightarrow> 'b::{second_countable_topology, linorder_topology}"
   assumes "f \<in> borel_measurable M"
   assumes "g \<in> borel_measurable M"
   shows "{w \<in> space M. f w < g w} \<in> sets M"
 proof -
   have "{w \<in> space M. f w < g w} = (\<lambda>x. (f x, g x)) -` {x. fst x < snd x} \<inter> space M"
     by auto
   also have "\<dots> \<in> sets M"
     by (intro measurable_sets[OF borel_measurable_Pair borel_open, OF assms open_Collect_less]
               continuous_intros)
   finally show ?thesis .
 qed
 
 lemma
   fixes f :: "'a \<Rightarrow> 'b::{second_countable_topology, linorder_topology}"
   assumes f[measurable]: "f \<in> borel_measurable M"
   assumes g[measurable]: "g \<in> borel_measurable M"
   shows borel_measurable_le[measurable]: "{w \<in> space M. f w \<le> g w} \<in> sets M"
     and borel_measurable_eq[measurable]: "{w \<in> space M. f w = g w} \<in> sets M"
     and borel_measurable_neq: "{w \<in> space M. f w \<noteq> g w} \<in> sets M"
   unfolding eq_iff not_less[symmetric]
   by measurable
 
 lemma borel_measurable_SUP[measurable (raw)]:
   fixes F :: "_ \<Rightarrow> _ \<Rightarrow> _::{complete_linorder, linorder_topology, second_countable_topology}"
   assumes [simp]: "countable I"
   assumes [measurable]: "\<And>i. i \<in> I \<Longrightarrow> F i \<in> borel_measurable M"
   shows "(\<lambda>x. SUP i\<in>I. F i x) \<in> borel_measurable M"
   by (rule borel_measurableI_greater) (simp add: less_SUP_iff)
 
 lemma borel_measurable_INF[measurable (raw)]:
   fixes F :: "_ \<Rightarrow> _ \<Rightarrow> _::{complete_linorder, linorder_topology, second_countable_topology}"
   assumes [simp]: "countable I"
   assumes [measurable]: "\<And>i. i \<in> I \<Longrightarrow> F i \<in> borel_measurable M"
   shows "(\<lambda>x. INF i\<in>I. F i x) \<in> borel_measurable M"
   by (rule borel_measurableI_less) (simp add: INF_less_iff)
 
 lemma borel_measurable_cSUP[measurable (raw)]:
   fixes F :: "_ \<Rightarrow> _ \<Rightarrow> 'a::{conditionally_complete_linorder, linorder_topology, second_countable_topology}"
   assumes [simp]: "countable I"
   assumes [measurable]: "\<And>i. i \<in> I \<Longrightarrow> F i \<in> borel_measurable M"
   assumes bdd: "\<And>x. x \<in> space M \<Longrightarrow> bdd_above ((\<lambda>i. F i x) ` I)"
   shows "(\<lambda>x. SUP i\<in>I. F i x) \<in> borel_measurable M"
 proof cases
   assume "I = {}" then show ?thesis
     unfolding \<open>I = {}\<close> image_empty by simp
 next
   assume "I \<noteq> {}"
   show ?thesis
   proof (rule borel_measurableI_le)
     fix y
     have "{x \<in> space M. \<forall>i\<in>I. F i x \<le> y} \<in> sets M"
       by measurable
     also have "{x \<in> space M. \<forall>i\<in>I. F i x \<le> y} = {x \<in> space M. (SUP i\<in>I. F i x) \<le> y}"
       by (simp add: cSUP_le_iff \<open>I \<noteq> {}\<close> bdd cong: conj_cong)
     finally show "{x \<in> space M. (SUP i\<in>I. F i x) \<le>  y} \<in> sets M"  .
   qed
 qed
 
 lemma borel_measurable_cINF[measurable (raw)]:
   fixes F :: "_ \<Rightarrow> _ \<Rightarrow> 'a::{conditionally_complete_linorder, linorder_topology, second_countable_topology}"
   assumes [simp]: "countable I"
   assumes [measurable]: "\<And>i. i \<in> I \<Longrightarrow> F i \<in> borel_measurable M"
   assumes bdd: "\<And>x. x \<in> space M \<Longrightarrow> bdd_below ((\<lambda>i. F i x) ` I)"
   shows "(\<lambda>x. INF i\<in>I. F i x) \<in> borel_measurable M"
 proof cases
   assume "I = {}" then show ?thesis
     unfolding \<open>I = {}\<close> image_empty by simp
 next
   assume "I \<noteq> {}"
   show ?thesis
   proof (rule borel_measurableI_ge)
     fix y
     have "{x \<in> space M. \<forall>i\<in>I. y \<le> F i x} \<in> sets M"
       by measurable
     also have "{x \<in> space M. \<forall>i\<in>I. y \<le> F i x} = {x \<in> space M. y \<le> (INF i\<in>I. F i x)}"
       by (simp add: le_cINF_iff \<open>I \<noteq> {}\<close> bdd cong: conj_cong)
     finally show "{x \<in> space M. y \<le> (INF i\<in>I. F i x)} \<in> sets M"  .
   qed
 qed
 
 lemma borel_measurable_lfp[consumes 1, case_names continuity step]:
   fixes F :: "('a \<Rightarrow> 'b) \<Rightarrow> ('a \<Rightarrow> 'b::{complete_linorder, linorder_topology, second_countable_topology})"
   assumes "sup_continuous F"
   assumes *: "\<And>f. f \<in> borel_measurable M \<Longrightarrow> F f \<in> borel_measurable M"
   shows "lfp F \<in> borel_measurable M"
 proof -
   { fix i have "((F ^^ i) bot) \<in> borel_measurable M"
       by (induct i) (auto intro!: *) }
   then have "(\<lambda>x. SUP i. (F ^^ i) bot x) \<in> borel_measurable M"
     by measurable
   also have "(\<lambda>x. SUP i. (F ^^ i) bot x) = (SUP i. (F ^^ i) bot)"
     by (auto simp add: image_comp)
   also have "(SUP i. (F ^^ i) bot) = lfp F"
     by (rule sup_continuous_lfp[symmetric]) fact
   finally show ?thesis .
 qed
 
 lemma borel_measurable_gfp[consumes 1, case_names continuity step]:
   fixes F :: "('a \<Rightarrow> 'b) \<Rightarrow> ('a \<Rightarrow> 'b::{complete_linorder, linorder_topology, second_countable_topology})"
   assumes "inf_continuous F"
   assumes *: "\<And>f. f \<in> borel_measurable M \<Longrightarrow> F f \<in> borel_measurable M"
   shows "gfp F \<in> borel_measurable M"
 proof -
   { fix i have "((F ^^ i) top) \<in> borel_measurable M"
       by (induct i) (auto intro!: * simp: bot_fun_def) }
   then have "(\<lambda>x. INF i. (F ^^ i) top x) \<in> borel_measurable M"
     by measurable
   also have "(\<lambda>x. INF i. (F ^^ i) top x) = (INF i. (F ^^ i) top)"
     by (auto simp add: image_comp)
   also have "\<dots> = gfp F"
     by (rule inf_continuous_gfp[symmetric]) fact
   finally show ?thesis .
 qed
 
 lemma borel_measurable_max[measurable (raw)]:
   "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow> (\<lambda>x. max (g x) (f x) :: 'b::{second_countable_topology, linorder_topology}) \<in> borel_measurable M"
   by (rule borel_measurableI_less) simp
 
 lemma borel_measurable_min[measurable (raw)]:
   "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow> (\<lambda>x. min (g x) (f x) :: 'b::{second_countable_topology, linorder_topology}) \<in> borel_measurable M"
   by (rule borel_measurableI_greater) simp
 
 lemma borel_measurable_Min[measurable (raw)]:
   "finite I \<Longrightarrow> (\<And>i. i \<in> I \<Longrightarrow> f i \<in> borel_measurable M) \<Longrightarrow> (\<lambda>x. Min ((\<lambda>i. f i x)`I) :: 'b::{second_countable_topology, linorder_topology}) \<in> borel_measurable M"
 proof (induct I rule: finite_induct)
   case (insert i I) then show ?case
     by (cases "I = {}") auto
 qed auto
 
 lemma borel_measurable_Max[measurable (raw)]:
   "finite I \<Longrightarrow> (\<And>i. i \<in> I \<Longrightarrow> f i \<in> borel_measurable M) \<Longrightarrow> (\<lambda>x. Max ((\<lambda>i. f i x)`I) :: 'b::{second_countable_topology, linorder_topology}) \<in> borel_measurable M"
 proof (induct I rule: finite_induct)
   case (insert i I) then show ?case
     by (cases "I = {}") auto
 qed auto
 
 lemma borel_measurable_sup[measurable (raw)]:
   "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow> (\<lambda>x. sup (g x) (f x) :: 'b::{lattice, second_countable_topology, linorder_topology}) \<in> borel_measurable M"
   unfolding sup_max by measurable
 
 lemma borel_measurable_inf[measurable (raw)]:
   "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow> (\<lambda>x. inf (g x) (f x) :: 'b::{lattice, second_countable_topology, linorder_topology}) \<in> borel_measurable M"
   unfolding inf_min by measurable
 
 lemma [measurable (raw)]:
   fixes f :: "nat \<Rightarrow> 'a \<Rightarrow> 'b::{complete_linorder, second_countable_topology, linorder_topology}"
   assumes "\<And>i. f i \<in> borel_measurable M"
   shows borel_measurable_liminf: "(\<lambda>x. liminf (\<lambda>i. f i x)) \<in> borel_measurable M"
     and borel_measurable_limsup: "(\<lambda>x. limsup (\<lambda>i. f i x)) \<in> borel_measurable M"
   unfolding liminf_SUP_INF limsup_INF_SUP using assms by auto
 
 lemma measurable_convergent[measurable (raw)]:
   fixes f :: "nat \<Rightarrow> 'a \<Rightarrow> 'b::{complete_linorder, second_countable_topology, linorder_topology}"
   assumes [measurable]: "\<And>i. f i \<in> borel_measurable M"
   shows "Measurable.pred M (\<lambda>x. convergent (\<lambda>i. f i x))"
   unfolding convergent_ereal by measurable
 
 lemma sets_Collect_convergent[measurable]:
   fixes f :: "nat \<Rightarrow> 'a \<Rightarrow> 'b::{complete_linorder, second_countable_topology, linorder_topology}"
   assumes f[measurable]: "\<And>i. f i \<in> borel_measurable M"
   shows "{x\<in>space M. convergent (\<lambda>i. f i x)} \<in> sets M"
   by measurable
 
 lemma borel_measurable_lim[measurable (raw)]:
   fixes f :: "nat \<Rightarrow> 'a \<Rightarrow> 'b::{complete_linorder, second_countable_topology, linorder_topology}"
   assumes [measurable]: "\<And>i. f i \<in> borel_measurable M"
   shows "(\<lambda>x. lim (\<lambda>i. f i x)) \<in> borel_measurable M"
 proof -
   have "\<And>x. lim (\<lambda>i. f i x) = (if convergent (\<lambda>i. f i x) then limsup (\<lambda>i. f i x) else (THE i. False))"
     by (simp add: lim_def convergent_def convergent_limsup_cl)
   then show ?thesis
     by simp
 qed
 
 lemma borel_measurable_LIMSEQ_order:
   fixes u :: "nat \<Rightarrow> 'a \<Rightarrow> 'b::{complete_linorder, second_countable_topology, linorder_topology}"
   assumes u': "\<And>x. x \<in> space M \<Longrightarrow> (\<lambda>i. u i x) \<longlonglongrightarrow> u' x"
   and u: "\<And>i. u i \<in> borel_measurable M"
   shows "u' \<in> borel_measurable M"
 proof -
   have "\<And>x. x \<in> space M \<Longrightarrow> u' x = liminf (\<lambda>n. u n x)"
     using u' by (simp add: lim_imp_Liminf[symmetric])
   with u show ?thesis by (simp cong: measurable_cong)
 qed
 
 subsection \<open>Borel spaces on topological monoids\<close>
 
 lemma borel_measurable_add[measurable (raw)]:
   fixes f g :: "'a \<Rightarrow> 'b::{second_countable_topology, topological_monoid_add}"
   assumes f: "f \<in> borel_measurable M"
   assumes g: "g \<in> borel_measurable M"
   shows "(\<lambda>x. f x + g x) \<in> borel_measurable M"
   using f g by (rule borel_measurable_continuous_Pair) (intro continuous_intros)
 
 lemma borel_measurable_sum[measurable (raw)]:
   fixes f :: "'c \<Rightarrow> 'a \<Rightarrow> 'b::{second_countable_topology, topological_comm_monoid_add}"
   assumes "\<And>i. i \<in> S \<Longrightarrow> f i \<in> borel_measurable M"
   shows "(\<lambda>x. \<Sum>i\<in>S. f i x) \<in> borel_measurable M"
 proof cases
   assume "finite S"
   thus ?thesis using assms by induct auto
 qed simp
 
 lemma borel_measurable_suminf_order[measurable (raw)]:
   fixes f :: "nat \<Rightarrow> 'a \<Rightarrow> 'b::{complete_linorder, second_countable_topology, linorder_topology, topological_comm_monoid_add}"
   assumes f[measurable]: "\<And>i. f i \<in> borel_measurable M"
   shows "(\<lambda>x. suminf (\<lambda>i. f i x)) \<in> borel_measurable M"
   unfolding suminf_def sums_def[abs_def] lim_def[symmetric] by simp
 
 subsection \<open>Borel spaces on Euclidean spaces\<close>
 
 lemma borel_measurable_inner[measurable (raw)]:
   fixes f g :: "'a \<Rightarrow> 'b::{second_countable_topology, real_inner}"
   assumes "f \<in> borel_measurable M"
   assumes "g \<in> borel_measurable M"
   shows "(\<lambda>x. f x \<bullet> g x) \<in> borel_measurable M"
   using assms
   by (rule borel_measurable_continuous_Pair) (intro continuous_intros)
 
 notation
   eucl_less (infix "<e" 50)
 
 lemma box_oc: "{x. a <e x \<and> x \<le> b} = {x. a <e x} \<inter> {..b}"
   and box_co: "{x. a \<le> x \<and> x <e b} = {a..} \<inter> {x. x <e b}"
   by auto
 
 lemma eucl_ivals[measurable]:
   fixes a b :: "'a::ordered_euclidean_space"
   shows "{x. x <e a} \<in> sets borel"
     and "{x. a <e x} \<in> sets borel"
     and "{..a} \<in> sets borel"
     and "{a..} \<in> sets borel"
     and "{a..b} \<in> sets borel"
     and  "{x. a <e x \<and> x \<le> b} \<in> sets borel"
     and "{x. a \<le> x \<and>  x <e b} \<in> sets borel"
   unfolding box_oc box_co
   by (auto intro: borel_open borel_closed)
 
 lemma
   fixes i :: "'a::{second_countable_topology, real_inner}"
   shows hafspace_less_borel: "{x. a < x \<bullet> i} \<in> sets borel"
     and hafspace_greater_borel: "{x. x \<bullet> i < a} \<in> sets borel"
     and hafspace_less_eq_borel: "{x. a \<le> x \<bullet> i} \<in> sets borel"
     and hafspace_greater_eq_borel: "{x. x \<bullet> i \<le> a} \<in> sets borel"
   by simp_all
 
 lemma borel_eq_box:
   "borel = sigma UNIV (range (\<lambda> (a, b). box a b :: 'a :: euclidean_space set))"
     (is "_ = ?SIGMA")
 proof (rule borel_eq_sigmaI1[OF borel_def])
   fix M :: "'a set" assume "M \<in> {S. open S}"
   then have "open M" by simp
   show "M \<in> ?SIGMA"
     apply (subst open_UNION_box[OF \<open>open M\<close>])
     apply (safe intro!: sets.countable_UN' countable_PiE countable_Collect)
     apply (auto intro: countable_rat)
     done
 qed (auto simp: box_def)
 
 lemma halfspace_gt_in_halfspace:
   assumes i: "i \<in> A"
   shows "{x::'a. a < x \<bullet> i} \<in>
     sigma_sets UNIV ((\<lambda> (a, i). {x::'a::euclidean_space. x \<bullet> i < a}) ` (UNIV \<times> A))"
   (is "?set \<in> ?SIGMA")
 proof -
   interpret sigma_algebra UNIV ?SIGMA
     by (intro sigma_algebra_sigma_sets) simp_all
   have *: "?set = (\<Union>n. UNIV - {x::'a. x \<bullet> i < a + 1 / real (Suc n)})"
   proof (safe, simp_all add: not_less del: of_nat_Suc)
     fix x :: 'a assume "a < x \<bullet> i"
     with reals_Archimedean[of "x \<bullet> i - a"]
     obtain n where "a + 1 / real (Suc n) < x \<bullet> i"
       by (auto simp: field_simps)
     then show "\<exists>n. a + 1 / real (Suc n) \<le> x \<bullet> i"
       by (blast intro: less_imp_le)
   next
     fix x n
     have "a < a + 1 / real (Suc n)" by auto
     also assume "\<dots> \<le> x"
     finally show "a < x" .
   qed
   show "?set \<in> ?SIGMA" unfolding *
     by (auto intro!: Diff sigma_sets_Inter i)
 qed
 
 lemma borel_eq_halfspace_less:
   "borel = sigma UNIV ((\<lambda>(a, i). {x::'a::euclidean_space. x \<bullet> i < a}) ` (UNIV \<times> Basis))"
   (is "_ = ?SIGMA")
 proof (rule borel_eq_sigmaI2[OF borel_eq_box])
   fix a b :: 'a
   have "box a b = {x\<in>space ?SIGMA. \<forall>i\<in>Basis. a \<bullet> i < x \<bullet> i \<and> x \<bullet> i < b \<bullet> i}"
     by (auto simp: box_def)
   also have "\<dots> \<in> sets ?SIGMA"
     by (intro sets.sets_Collect_conj sets.sets_Collect_finite_All sets.sets_Collect_const)
        (auto intro!: halfspace_gt_in_halfspace countable_PiE countable_rat)
   finally show "box a b \<in> sets ?SIGMA" .
 qed auto
 
 lemma borel_eq_halfspace_le:
   "borel = sigma UNIV ((\<lambda> (a, i). {x::'a::euclidean_space. x \<bullet> i \<le> a}) ` (UNIV \<times> Basis))"
   (is "_ = ?SIGMA")
 proof (rule borel_eq_sigmaI2[OF borel_eq_halfspace_less])
   fix a :: real and i :: 'a assume "(a, i) \<in> UNIV \<times> Basis"
   then have i: "i \<in> Basis" by auto
   have *: "{x::'a. x\<bullet>i < a} = (\<Union>n. {x. x\<bullet>i \<le> a - 1/real (Suc n)})"
   proof (safe, simp_all del: of_nat_Suc)
     fix x::'a assume *: "x\<bullet>i < a"
     with reals_Archimedean[of "a - x\<bullet>i"]
     obtain n where "x \<bullet> i < a - 1 / (real (Suc n))"
       by (auto simp: field_simps)
     then show "\<exists>n. x \<bullet> i \<le> a - 1 / (real (Suc n))"
       by (blast intro: less_imp_le)
   next
     fix x::'a and n
     assume "x\<bullet>i \<le> a - 1 / real (Suc n)"
     also have "\<dots> < a" by auto
     finally show "x\<bullet>i < a" .
   qed
   show "{x. x\<bullet>i < a} \<in> ?SIGMA" unfolding *
     by (intro sets.countable_UN) (auto intro: i)
 qed auto
 
 lemma borel_eq_halfspace_ge:
   "borel = sigma UNIV ((\<lambda> (a, i). {x::'a::euclidean_space. a \<le> x \<bullet> i}) ` (UNIV \<times> Basis))"
   (is "_ = ?SIGMA")
 proof (rule borel_eq_sigmaI2[OF borel_eq_halfspace_less])
   fix a :: real and i :: 'a assume i: "(a, i) \<in> UNIV \<times> Basis"
   have *: "{x::'a. x\<bullet>i < a} = space ?SIGMA - {x::'a. a \<le> x\<bullet>i}" by auto
   show "{x. x\<bullet>i < a} \<in> ?SIGMA" unfolding *
     using i by (intro sets.compl_sets) auto
 qed auto
 
 lemma borel_eq_halfspace_greater:
   "borel = sigma UNIV ((\<lambda> (a, i). {x::'a::euclidean_space. a < x \<bullet> i}) ` (UNIV \<times> Basis))"
   (is "_ = ?SIGMA")
 proof (rule borel_eq_sigmaI2[OF borel_eq_halfspace_le])
   fix a :: real and i :: 'a assume "(a, i) \<in> (UNIV \<times> Basis)"
   then have i: "i \<in> Basis" by auto
   have *: "{x::'a. x\<bullet>i \<le> a} = space ?SIGMA - {x::'a. a < x\<bullet>i}" by auto
   show "{x. x\<bullet>i \<le> a} \<in> ?SIGMA" unfolding *
     by (intro sets.compl_sets) (auto intro: i)
 qed auto
 
 lemma borel_eq_atMost:
   "borel = sigma UNIV (range (\<lambda>a. {..a::'a::ordered_euclidean_space}))"
   (is "_ = ?SIGMA")
 proof (rule borel_eq_sigmaI4[OF borel_eq_halfspace_le])
   fix a :: real and i :: 'a assume "(a, i) \<in> UNIV \<times> Basis"
   then have "i \<in> Basis" by auto
   then have *: "{x::'a. x\<bullet>i \<le> a} = (\<Union>k::nat. {.. (\<Sum>n\<in>Basis. (if n = i then a else real k)*\<^sub>R n)})"
   proof (safe, simp_all add: eucl_le[where 'a='a] split: if_split_asm)
     fix x :: 'a
     from real_arch_simple[of "Max ((\<lambda>i. x\<bullet>i)`Basis)"] guess k::nat ..
     then have "\<And>i. i \<in> Basis \<Longrightarrow> x\<bullet>i \<le> real k"
       by (subst (asm) Max_le_iff) auto
     then show "\<exists>k::nat. \<forall>ia\<in>Basis. ia \<noteq> i \<longrightarrow> x \<bullet> ia \<le> real k"
       by (auto intro!: exI[of _ k])
   qed
   show "{x. x\<bullet>i \<le> a} \<in> ?SIGMA" unfolding *
     by (intro sets.countable_UN) auto
 qed auto
 
 lemma borel_eq_greaterThan:
   "borel = sigma UNIV (range (\<lambda>a::'a::ordered_euclidean_space. {x. a <e x}))"
   (is "_ = ?SIGMA")
 proof (rule borel_eq_sigmaI4[OF borel_eq_halfspace_le])
   fix a :: real and i :: 'a assume "(a, i) \<in> UNIV \<times> Basis"
   then have i: "i \<in> Basis" by auto
   have "{x::'a. x\<bullet>i \<le> a} = UNIV - {x::'a. a < x\<bullet>i}" by auto
   also have *: "{x::'a. a < x\<bullet>i} =
       (\<Union>k::nat. {x. (\<Sum>n\<in>Basis. (if n = i then a else -real k) *\<^sub>R n) <e x})" using i
   proof (safe, simp_all add: eucl_less_def split: if_split_asm)
     fix x :: 'a
     from reals_Archimedean2[of "Max ((\<lambda>i. -x\<bullet>i)`Basis)"]
     guess k::nat .. note k = this
     { fix i :: 'a assume "i \<in> Basis"
       then have "-x\<bullet>i < real k"
         using k by (subst (asm) Max_less_iff) auto
       then have "- real k < x\<bullet>i" by simp }
     then show "\<exists>k::nat. \<forall>ia\<in>Basis. ia \<noteq> i \<longrightarrow> -real k < x \<bullet> ia"
       by (auto intro!: exI[of _ k])
   qed
   finally show "{x. x\<bullet>i \<le> a} \<in> ?SIGMA"
     apply (simp only:)
     apply (intro sets.countable_UN sets.Diff)
     apply (auto intro: sigma_sets_top)
     done
 qed auto
 
 lemma borel_eq_lessThan:
   "borel = sigma UNIV (range (\<lambda>a::'a::ordered_euclidean_space. {x. x <e a}))"
   (is "_ = ?SIGMA")
 proof (rule borel_eq_sigmaI4[OF borel_eq_halfspace_ge])
   fix a :: real and i :: 'a assume "(a, i) \<in> UNIV \<times> Basis"
   then have i: "i \<in> Basis" by auto
   have "{x::'a. a \<le> x\<bullet>i} = UNIV - {x::'a. x\<bullet>i < a}" by auto
   also have *: "{x::'a. x\<bullet>i < a} = (\<Union>k::nat. {x. x <e (\<Sum>n\<in>Basis. (if n = i then a else real k) *\<^sub>R n)})" using \<open>i\<in> Basis\<close>
   proof (safe, simp_all add: eucl_less_def split: if_split_asm)
     fix x :: 'a
     from reals_Archimedean2[of "Max ((\<lambda>i. x\<bullet>i)`Basis)"]
     guess k::nat .. note k = this
     { fix i :: 'a assume "i \<in> Basis"
       then have "x\<bullet>i < real k"
         using k by (subst (asm) Max_less_iff) auto
       then have "x\<bullet>i < real k" by simp }
     then show "\<exists>k::nat. \<forall>ia\<in>Basis. ia \<noteq> i \<longrightarrow> x \<bullet> ia < real k"
       by (auto intro!: exI[of _ k])
   qed
   finally show "{x. a \<le> x\<bullet>i} \<in> ?SIGMA"
     apply (simp only:)
     apply (intro sets.countable_UN sets.Diff)
     apply (auto intro: sigma_sets_top )
     done
 qed auto
 
 lemma borel_eq_atLeastAtMost:
   "borel = sigma UNIV (range (\<lambda>(a,b). {a..b} ::'a::ordered_euclidean_space set))"
   (is "_ = ?SIGMA")
 proof (rule borel_eq_sigmaI5[OF borel_eq_atMost])
   fix a::'a
   have *: "{..a} = (\<Union>n::nat. {- real n *\<^sub>R One .. a})"
   proof (safe, simp_all add: eucl_le[where 'a='a])
     fix x :: 'a
     from real_arch_simple[of "Max ((\<lambda>i. - x\<bullet>i)`Basis)"]
     guess k::nat .. note k = this
     { fix i :: 'a assume "i \<in> Basis"
       with k have "- x\<bullet>i \<le> real k"
         by (subst (asm) Max_le_iff) (auto simp: field_simps)
       then have "- real k \<le> x\<bullet>i" by simp }
     then show "\<exists>n::nat. \<forall>i\<in>Basis. - real n \<le> x \<bullet> i"
       by (auto intro!: exI[of _ k])
   qed
   show "{..a} \<in> ?SIGMA" unfolding *
     by (intro sets.countable_UN)
        (auto intro!: sigma_sets_top)
 qed auto
 
 lemma borel_set_induct[consumes 1, case_names empty interval compl union]:
   assumes "A \<in> sets borel"
   assumes empty: "P {}" and int: "\<And>a b. a \<le> b \<Longrightarrow> P {a..b}" and compl: "\<And>A. A \<in> sets borel \<Longrightarrow> P A \<Longrightarrow> P (-A)" and
           un: "\<And>f. disjoint_family f \<Longrightarrow> (\<And>i. f i \<in> sets borel) \<Longrightarrow>  (\<And>i. P (f i)) \<Longrightarrow> P (\<Union>i::nat. f i)"
   shows "P (A::real set)"
 proof -
   let ?G = "range (\<lambda>(a,b). {a..b::real})"
   have "Int_stable ?G" "?G \<subseteq> Pow UNIV" "A \<in> sigma_sets UNIV ?G"
       using assms(1) by (auto simp add: borel_eq_atLeastAtMost Int_stable_def)
   thus ?thesis
   proof (induction rule: sigma_sets_induct_disjoint)
     case (union f)
       from union.hyps(2) have "\<And>i. f i \<in> sets borel" by (auto simp: borel_eq_atLeastAtMost)
       with union show ?case by (auto intro: un)
   next
     case (basic A)
     then obtain a b where "A = {a .. b}" by auto
     then show ?case
       by (cases "a \<le> b") (auto intro: int empty)
   qed (auto intro: empty compl simp: Compl_eq_Diff_UNIV[symmetric] borel_eq_atLeastAtMost)
 qed
 
 lemma borel_sigma_sets_Ioc: "borel = sigma UNIV (range (\<lambda>(a, b). {a <.. b::real}))"
 proof (rule borel_eq_sigmaI5[OF borel_eq_atMost])
   fix i :: real
   have "{..i} = (\<Union>j::nat. {-j <.. i})"
     by (auto simp: minus_less_iff reals_Archimedean2)
   also have "\<dots> \<in> sets (sigma UNIV (range (\<lambda>(i, j). {i<..j})))"
     by (intro sets.countable_nat_UN) auto
   finally show "{..i} \<in> sets (sigma UNIV (range (\<lambda>(i, j). {i<..j})))" .
 qed simp
 
 lemma eucl_lessThan: "{x::real. x <e a} = lessThan a"
   by (simp add: eucl_less_def lessThan_def)
 
 lemma borel_eq_atLeastLessThan:
   "borel = sigma UNIV (range (\<lambda>(a, b). {a ..< b :: real}))" (is "_ = ?SIGMA")
 proof (rule borel_eq_sigmaI5[OF borel_eq_lessThan])
   have move_uminus: "\<And>x y::real. -x \<le> y \<longleftrightarrow> -y \<le> x" by auto
   fix x :: real
   have "{..<x} = (\<Union>i::nat. {-real i ..< x})"
     by (auto simp: move_uminus real_arch_simple)
   then show "{y. y <e x} \<in> ?SIGMA"
     by (auto intro: sigma_sets.intros(2-) simp: eucl_lessThan)
 qed auto
 
 lemma borel_measurable_halfspacesI:
   fixes f :: "'a \<Rightarrow> 'c::euclidean_space"
   assumes F: "borel = sigma UNIV (F ` (UNIV \<times> Basis))"
   and S_eq: "\<And>a i. S a i = f -` F (a,i) \<inter> space M"
   shows "f \<in> borel_measurable M = (\<forall>i\<in>Basis. \<forall>a::real. S a i \<in> sets M)"
 proof safe
   fix a :: real and i :: 'b assume i: "i \<in> Basis" and f: "f \<in> borel_measurable M"
   then show "S a i \<in> sets M" unfolding assms
     by (auto intro!: measurable_sets simp: assms(1))
 next
   assume a: "\<forall>i\<in>Basis. \<forall>a. S a i \<in> sets M"
   then show "f \<in> borel_measurable M"
     by (auto intro!: measurable_measure_of simp: S_eq F)
 qed
 
 lemma borel_measurable_iff_halfspace_le:
   fixes f :: "'a \<Rightarrow> 'c::euclidean_space"
   shows "f \<in> borel_measurable M = (\<forall>i\<in>Basis. \<forall>a. {w \<in> space M. f w \<bullet> i \<le> a} \<in> sets M)"
   by (rule borel_measurable_halfspacesI[OF borel_eq_halfspace_le]) auto
 
 lemma borel_measurable_iff_halfspace_less:
   fixes f :: "'a \<Rightarrow> 'c::euclidean_space"
   shows "f \<in> borel_measurable M \<longleftrightarrow> (\<forall>i\<in>Basis. \<forall>a. {w \<in> space M. f w \<bullet> i < a} \<in> sets M)"
   by (rule borel_measurable_halfspacesI[OF borel_eq_halfspace_less]) auto
 
 lemma borel_measurable_iff_halfspace_ge:
   fixes f :: "'a \<Rightarrow> 'c::euclidean_space"
   shows "f \<in> borel_measurable M = (\<forall>i\<in>Basis. \<forall>a. {w \<in> space M. a \<le> f w \<bullet> i} \<in> sets M)"
   by (rule borel_measurable_halfspacesI[OF borel_eq_halfspace_ge]) auto
 
 lemma borel_measurable_iff_halfspace_greater:
   fixes f :: "'a \<Rightarrow> 'c::euclidean_space"
   shows "f \<in> borel_measurable M \<longleftrightarrow> (\<forall>i\<in>Basis. \<forall>a. {w \<in> space M. a < f w \<bullet> i} \<in> sets M)"
   by (rule borel_measurable_halfspacesI[OF borel_eq_halfspace_greater]) auto
 
 lemma borel_measurable_iff_le:
   "(f::'a \<Rightarrow> real) \<in> borel_measurable M = (\<forall>a. {w \<in> space M. f w \<le> a} \<in> sets M)"
   using borel_measurable_iff_halfspace_le[where 'c=real] by simp
 
 lemma borel_measurable_iff_less:
   "(f::'a \<Rightarrow> real) \<in> borel_measurable M = (\<forall>a. {w \<in> space M. f w < a} \<in> sets M)"
   using borel_measurable_iff_halfspace_less[where 'c=real] by simp
 
 lemma borel_measurable_iff_ge:
   "(f::'a \<Rightarrow> real) \<in> borel_measurable M = (\<forall>a. {w \<in> space M. a \<le> f w} \<in> sets M)"
   using borel_measurable_iff_halfspace_ge[where 'c=real]
   by simp
 
 lemma borel_measurable_iff_greater:
   "(f::'a \<Rightarrow> real) \<in> borel_measurable M = (\<forall>a. {w \<in> space M. a < f w} \<in> sets M)"
   using borel_measurable_iff_halfspace_greater[where 'c=real] by simp
 
 lemma borel_measurable_euclidean_space:
   fixes f :: "'a \<Rightarrow> 'c::euclidean_space"
   shows "f \<in> borel_measurable M \<longleftrightarrow> (\<forall>i\<in>Basis. (\<lambda>x. f x \<bullet> i) \<in> borel_measurable M)"
 proof safe
   assume f: "\<forall>i\<in>Basis. (\<lambda>x. f x \<bullet> i) \<in> borel_measurable M"
   then show "f \<in> borel_measurable M"
     by (subst borel_measurable_iff_halfspace_le) auto
 qed auto
 
 subsection "Borel measurable operators"
 
 lemma borel_measurable_norm[measurable]: "norm \<in> borel_measurable borel"
   by (intro borel_measurable_continuous_onI continuous_intros)
 
 lemma borel_measurable_sgn [measurable]: "(sgn::'a::real_normed_vector \<Rightarrow> 'a) \<in> borel_measurable borel"
   by (rule borel_measurable_continuous_countable_exceptions[where X="{0}"])
      (auto intro!: continuous_on_sgn continuous_on_id)
 
 lemma borel_measurable_uminus[measurable (raw)]:
   fixes g :: "'a \<Rightarrow> 'b::{second_countable_topology, real_normed_vector}"
   assumes g: "g \<in> borel_measurable M"
   shows "(\<lambda>x. - g x) \<in> borel_measurable M"
   by (rule borel_measurable_continuous_on[OF _ g]) (intro continuous_intros)
 
 lemma borel_measurable_diff[measurable (raw)]:
   fixes f :: "'a \<Rightarrow> 'b::{second_countable_topology, real_normed_vector}"
   assumes f: "f \<in> borel_measurable M"
   assumes g: "g \<in> borel_measurable M"
   shows "(\<lambda>x. f x - g x) \<in> borel_measurable M"
   using borel_measurable_add [of f M "- g"] assms by (simp add: fun_Compl_def)
 
 lemma borel_measurable_times[measurable (raw)]:
   fixes f :: "'a \<Rightarrow> 'b::{second_countable_topology, real_normed_algebra}"
   assumes f: "f \<in> borel_measurable M"
   assumes g: "g \<in> borel_measurable M"
   shows "(\<lambda>x. f x * g x) \<in> borel_measurable M"
   using f g by (rule borel_measurable_continuous_Pair) (intro continuous_intros)
 
 lemma borel_measurable_prod[measurable (raw)]:
   fixes f :: "'c \<Rightarrow> 'a \<Rightarrow> 'b::{second_countable_topology, real_normed_field}"
   assumes "\<And>i. i \<in> S \<Longrightarrow> f i \<in> borel_measurable M"
   shows "(\<lambda>x. \<Prod>i\<in>S. f i x) \<in> borel_measurable M"
 proof cases
   assume "finite S"
   thus ?thesis using assms by induct auto
 qed simp
 
 lemma borel_measurable_dist[measurable (raw)]:
   fixes g f :: "'a \<Rightarrow> 'b::{second_countable_topology, metric_space}"
   assumes f: "f \<in> borel_measurable M"
   assumes g: "g \<in> borel_measurable M"
   shows "(\<lambda>x. dist (f x) (g x)) \<in> borel_measurable M"
   using f g by (rule borel_measurable_continuous_Pair) (intro continuous_intros)
 
 lemma borel_measurable_scaleR[measurable (raw)]:
   fixes g :: "'a \<Rightarrow> 'b::{second_countable_topology, real_normed_vector}"
   assumes f: "f \<in> borel_measurable M"
   assumes g: "g \<in> borel_measurable M"
   shows "(\<lambda>x. f x *\<^sub>R g x) \<in> borel_measurable M"
   using f g by (rule borel_measurable_continuous_Pair) (intro continuous_intros)
 
 lemma borel_measurable_uminus_eq [simp]:
   fixes f :: "'a \<Rightarrow> 'b::{second_countable_topology, real_normed_vector}"
   shows "(\<lambda>x. - f x) \<in> borel_measurable M \<longleftrightarrow> f \<in> borel_measurable M" (is "?l = ?r")
 proof
   assume ?l from borel_measurable_uminus[OF this] show ?r by simp
 qed auto
 
 lemma affine_borel_measurable_vector:
   fixes f :: "'a \<Rightarrow> 'x::real_normed_vector"
   assumes "f \<in> borel_measurable M"
   shows "(\<lambda>x. a + b *\<^sub>R f x) \<in> borel_measurable M"
 proof (rule borel_measurableI)
   fix S :: "'x set" assume "open S"
   show "(\<lambda>x. a + b *\<^sub>R f x) -` S \<inter> space M \<in> sets M"
   proof cases
     assume "b \<noteq> 0"
     with \<open>open S\<close> have "open ((\<lambda>x. (- a + x) /\<^sub>R b) ` S)" (is "open ?S")
       using open_affinity [of S "inverse b" "- a /\<^sub>R b"]
       by (auto simp: algebra_simps)
     hence "?S \<in> sets borel" by auto
     moreover
     from \<open>b \<noteq> 0\<close> have "(\<lambda>x. a + b *\<^sub>R f x) -` S = f -` ?S"
       apply auto by (rule_tac x="a + b *\<^sub>R f x" in image_eqI, simp_all)
     ultimately show ?thesis using assms unfolding in_borel_measurable_borel
       by auto
   qed simp
 qed
 
 lemma borel_measurable_const_scaleR[measurable (raw)]:
   "f \<in> borel_measurable M \<Longrightarrow> (\<lambda>x. b *\<^sub>R f x ::'a::real_normed_vector) \<in> borel_measurable M"
   using affine_borel_measurable_vector[of f M 0 b] by simp
 
 lemma borel_measurable_const_add[measurable (raw)]:
   "f \<in> borel_measurable M \<Longrightarrow> (\<lambda>x. a + f x ::'a::real_normed_vector) \<in> borel_measurable M"
   using affine_borel_measurable_vector[of f M a 1] by simp
 
 lemma borel_measurable_inverse[measurable (raw)]:
   fixes f :: "'a \<Rightarrow> 'b::real_normed_div_algebra"
   assumes f: "f \<in> borel_measurable M"
   shows "(\<lambda>x. inverse (f x)) \<in> borel_measurable M"
   apply (rule measurable_compose[OF f])
   apply (rule borel_measurable_continuous_countable_exceptions[of "{0}"])
   apply (auto intro!: continuous_on_inverse continuous_on_id)
   done
 
 lemma borel_measurable_divide[measurable (raw)]:
   "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow>
     (\<lambda>x. f x / g x::'b::{second_countable_topology, real_normed_div_algebra}) \<in> borel_measurable M"
   by (simp add: divide_inverse)
 
 lemma borel_measurable_abs[measurable (raw)]:
   "f \<in> borel_measurable M \<Longrightarrow> (\<lambda>x. \<bar>f x :: real\<bar>) \<in> borel_measurable M"
   unfolding abs_real_def by simp
 
 lemma borel_measurable_nth[measurable (raw)]:
   "(\<lambda>x::real^'n. x $ i) \<in> borel_measurable borel"
   by (simp add: cart_eq_inner_axis)
 
 lemma convex_measurable:
   fixes A :: "'a :: euclidean_space set"
   shows "X \<in> borel_measurable M \<Longrightarrow> X ` space M \<subseteq> A \<Longrightarrow> open A \<Longrightarrow> convex_on A q \<Longrightarrow>
     (\<lambda>x. q (X x)) \<in> borel_measurable M"
   by (rule measurable_compose[where f=X and N="restrict_space borel A"])
      (auto intro!: borel_measurable_continuous_on_restrict convex_on_continuous measurable_restrict_space2)
 
 lemma borel_measurable_ln[measurable (raw)]:
   assumes f: "f \<in> borel_measurable M"
   shows "(\<lambda>x. ln (f x :: real)) \<in> borel_measurable M"
   apply (rule measurable_compose[OF f])
   apply (rule borel_measurable_continuous_countable_exceptions[of "{0}"])
   apply (auto intro!: continuous_on_ln continuous_on_id)
   done
 
 lemma borel_measurable_log[measurable (raw)]:
   "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow> (\<lambda>x. log (g x) (f x)) \<in> borel_measurable M"
   unfolding log_def by auto
 
 lemma borel_measurable_exp[measurable]:
   "(exp::'a::{real_normed_field,banach}\<Rightarrow>'a) \<in> borel_measurable borel"
   by (intro borel_measurable_continuous_onI continuous_at_imp_continuous_on ballI isCont_exp)
 
 lemma measurable_real_floor[measurable]:
   "(floor :: real \<Rightarrow> int) \<in> measurable borel (count_space UNIV)"
 proof -
   have "\<And>a x. \<lfloor>x\<rfloor> = a \<longleftrightarrow> (real_of_int a \<le> x \<and> x < real_of_int (a + 1))"
     by (auto intro: floor_eq2)
   then show ?thesis
     by (auto simp: vimage_def measurable_count_space_eq2_countable)
 qed
 
 lemma measurable_real_ceiling[measurable]:
   "(ceiling :: real \<Rightarrow> int) \<in> measurable borel (count_space UNIV)"
   unfolding ceiling_def[abs_def] by simp
 
 lemma borel_measurable_real_floor: "(\<lambda>x::real. real_of_int \<lfloor>x\<rfloor>) \<in> borel_measurable borel"
   by simp
 
 lemma borel_measurable_root [measurable]: "root n \<in> borel_measurable borel"
   by (intro borel_measurable_continuous_onI continuous_intros)
 
 lemma borel_measurable_sqrt [measurable]: "sqrt \<in> borel_measurable borel"
   by (intro borel_measurable_continuous_onI continuous_intros)
 
 lemma borel_measurable_power [measurable (raw)]:
   fixes f :: "_ \<Rightarrow> 'b::{power,real_normed_algebra}"
   assumes f: "f \<in> borel_measurable M"
   shows "(\<lambda>x. (f x) ^ n) \<in> borel_measurable M"
   by (intro borel_measurable_continuous_on [OF _ f] continuous_intros)
 
 lemma borel_measurable_Re [measurable]: "Re \<in> borel_measurable borel"
   by (intro borel_measurable_continuous_onI continuous_intros)
 
 lemma borel_measurable_Im [measurable]: "Im \<in> borel_measurable borel"
   by (intro borel_measurable_continuous_onI continuous_intros)
 
 lemma borel_measurable_of_real [measurable]: "(of_real :: _ \<Rightarrow> (_::real_normed_algebra)) \<in> borel_measurable borel"
   by (intro borel_measurable_continuous_onI continuous_intros)
 
 lemma borel_measurable_sin [measurable]: "(sin :: _ \<Rightarrow> (_::{real_normed_field,banach})) \<in> borel_measurable borel"
   by (intro borel_measurable_continuous_onI continuous_intros)
 
 lemma borel_measurable_cos [measurable]: "(cos :: _ \<Rightarrow> (_::{real_normed_field,banach})) \<in> borel_measurable borel"
   by (intro borel_measurable_continuous_onI continuous_intros)
 
 lemma borel_measurable_arctan [measurable]: "arctan \<in> borel_measurable borel"
   by (intro borel_measurable_continuous_onI continuous_intros)
 
 lemma\<^marker>\<open>tag important\<close> borel_measurable_complex_iff:
   "f \<in> borel_measurable M \<longleftrightarrow>
     (\<lambda>x. Re (f x)) \<in> borel_measurable M \<and> (\<lambda>x. Im (f x)) \<in> borel_measurable M"
   apply auto
   apply (subst fun_complex_eq)
   apply (intro borel_measurable_add)
   apply auto
   done
 
 lemma powr_real_measurable [measurable]:
   assumes "f \<in> measurable M borel" "g \<in> measurable M borel"
   shows   "(\<lambda>x. f x powr g x :: real) \<in> measurable M borel"
   using assms by (simp_all add: powr_def)
 
 lemma measurable_of_bool[measurable]: "of_bool \<in> count_space UNIV \<rightarrow>\<^sub>M borel"
   by simp
 
 subsection "Borel space on the extended reals"
 
 lemma borel_measurable_ereal[measurable (raw)]:
   assumes f: "f \<in> borel_measurable M" shows "(\<lambda>x. ereal (f x)) \<in> borel_measurable M"
   using continuous_on_ereal f by (rule borel_measurable_continuous_on) (rule continuous_on_id)
 
 lemma borel_measurable_real_of_ereal[measurable (raw)]:
   fixes f :: "'a \<Rightarrow> ereal"
   assumes f: "f \<in> borel_measurable M"
   shows "(\<lambda>x. real_of_ereal (f x)) \<in> borel_measurable M"
   apply (rule measurable_compose[OF f])
   apply (rule borel_measurable_continuous_countable_exceptions[of "{\<infinity>, -\<infinity> }"])
   apply (auto intro: continuous_on_real simp: Compl_eq_Diff_UNIV)
   done
 
 lemma borel_measurable_ereal_cases:
   fixes f :: "'a \<Rightarrow> ereal"
   assumes f: "f \<in> borel_measurable M"
   assumes H: "(\<lambda>x. H (ereal (real_of_ereal (f x)))) \<in> borel_measurable M"
   shows "(\<lambda>x. H (f x)) \<in> borel_measurable M"
 proof -
   let ?F = "\<lambda>x. if f x = \<infinity> then H \<infinity> else if f x = - \<infinity> then H (-\<infinity>) else H (ereal (real_of_ereal (f x)))"
   { fix x have "H (f x) = ?F x" by (cases "f x") auto }
   with f H show ?thesis by simp
 qed
 
 lemma
   fixes f :: "'a \<Rightarrow> ereal" assumes f[measurable]: "f \<in> borel_measurable M"
   shows borel_measurable_ereal_abs[measurable(raw)]: "(\<lambda>x. \<bar>f x\<bar>) \<in> borel_measurable M"
     and borel_measurable_ereal_inverse[measurable(raw)]: "(\<lambda>x. inverse (f x) :: ereal) \<in> borel_measurable M"
     and borel_measurable_uminus_ereal[measurable(raw)]: "(\<lambda>x. - f x :: ereal) \<in> borel_measurable M"
   by (auto simp del: abs_real_of_ereal simp: borel_measurable_ereal_cases[OF f] measurable_If)
 
 lemma borel_measurable_uminus_eq_ereal[simp]:
   "(\<lambda>x. - f x :: ereal) \<in> borel_measurable M \<longleftrightarrow> f \<in> borel_measurable M" (is "?l = ?r")
 proof
   assume ?l from borel_measurable_uminus_ereal[OF this] show ?r by simp
 qed auto
 
 lemma set_Collect_ereal2:
   fixes f g :: "'a \<Rightarrow> ereal"
   assumes f: "f \<in> borel_measurable M"
   assumes g: "g \<in> borel_measurable M"
   assumes H: "{x \<in> space M. H (ereal (real_of_ereal (f x))) (ereal (real_of_ereal (g x)))} \<in> sets M"
     "{x \<in> space borel. H (-\<infinity>) (ereal x)} \<in> sets borel"
     "{x \<in> space borel. H (\<infinity>) (ereal x)} \<in> sets borel"
     "{x \<in> space borel. H (ereal x) (-\<infinity>)} \<in> sets borel"
     "{x \<in> space borel. H (ereal x) (\<infinity>)} \<in> sets borel"
   shows "{x \<in> space M. H (f x) (g x)} \<in> sets M"
 proof -
   let ?G = "\<lambda>y x. if g x = \<infinity> then H y \<infinity> else if g x = -\<infinity> then H y (-\<infinity>) else H y (ereal (real_of_ereal (g x)))"
   let ?F = "\<lambda>x. if f x = \<infinity> then ?G \<infinity> x else if f x = -\<infinity> then ?G (-\<infinity>) x else ?G (ereal (real_of_ereal (f x))) x"
   { fix x have "H (f x) (g x) = ?F x" by (cases "f x" "g x" rule: ereal2_cases) auto }
   note * = this
   from assms show ?thesis
     by (subst *) (simp del: space_borel split del: if_split)
 qed
 
 lemma borel_measurable_ereal_iff:
   shows "(\<lambda>x. ereal (f x)) \<in> borel_measurable M \<longleftrightarrow> f \<in> borel_measurable M"
 proof
   assume "(\<lambda>x. ereal (f x)) \<in> borel_measurable M"
   from borel_measurable_real_of_ereal[OF this]
   show "f \<in> borel_measurable M" by auto
 qed auto
 
 lemma borel_measurable_erealD[measurable_dest]:
   "(\<lambda>x. ereal (f x)) \<in> borel_measurable M \<Longrightarrow> g \<in> measurable N M \<Longrightarrow> (\<lambda>x. f (g x)) \<in> borel_measurable N"
   unfolding borel_measurable_ereal_iff by simp
 
 theorem borel_measurable_ereal_iff_real:
   fixes f :: "'a \<Rightarrow> ereal"
   shows "f \<in> borel_measurable M \<longleftrightarrow>
     ((\<lambda>x. real_of_ereal (f x)) \<in> borel_measurable M \<and> f -` {\<infinity>} \<inter> space M \<in> sets M \<and> f -` {-\<infinity>} \<inter> space M \<in> sets M)"
 proof safe
   assume *: "(\<lambda>x. real_of_ereal (f x)) \<in> borel_measurable M" "f -` {\<infinity>} \<inter> space M \<in> sets M" "f -` {-\<infinity>} \<inter> space M \<in> sets M"
   have "f -` {\<infinity>} \<inter> space M = {x\<in>space M. f x = \<infinity>}" "f -` {-\<infinity>} \<inter> space M = {x\<in>space M. f x = -\<infinity>}" by auto
   with * have **: "{x\<in>space M. f x = \<infinity>} \<in> sets M" "{x\<in>space M. f x = -\<infinity>} \<in> sets M" by simp_all
   let ?f = "\<lambda>x. if f x = \<infinity> then \<infinity> else if f x = -\<infinity> then -\<infinity> else ereal (real_of_ereal (f x))"
   have "?f \<in> borel_measurable M" using * ** by (intro measurable_If) auto
   also have "?f = f" by (auto simp: fun_eq_iff ereal_real)
   finally show "f \<in> borel_measurable M" .
 qed simp_all
 
 lemma borel_measurable_ereal_iff_Iio:
   "(f::'a \<Rightarrow> ereal) \<in> borel_measurable M \<longleftrightarrow> (\<forall>a. f -` {..< a} \<inter> space M \<in> sets M)"
   by (auto simp: borel_Iio measurable_iff_measure_of)
 
 lemma borel_measurable_ereal_iff_Ioi:
   "(f::'a \<Rightarrow> ereal) \<in> borel_measurable M \<longleftrightarrow> (\<forall>a. f -` {a <..} \<inter> space M \<in> sets M)"
   by (auto simp: borel_Ioi measurable_iff_measure_of)
 
 lemma vimage_sets_compl_iff:
   "f -` A \<inter> space M \<in> sets M \<longleftrightarrow> f -` (- A) \<inter> space M \<in> sets M"
 proof -
   { fix A assume "f -` A \<inter> space M \<in> sets M"
     moreover have "f -` (- A) \<inter> space M = space M - f -` A \<inter> space M" by auto
     ultimately have "f -` (- A) \<inter> space M \<in> sets M" by auto }
   from this[of A] this[of "-A"] show ?thesis
     by (metis double_complement)
 qed
 
 lemma borel_measurable_iff_Iic_ereal:
   "(f::'a\<Rightarrow>ereal) \<in> borel_measurable M \<longleftrightarrow> (\<forall>a. f -` {..a} \<inter> space M \<in> sets M)"
   unfolding borel_measurable_ereal_iff_Ioi vimage_sets_compl_iff[where A="{a <..}" for a] by simp
 
 lemma borel_measurable_iff_Ici_ereal:
   "(f::'a \<Rightarrow> ereal) \<in> borel_measurable M \<longleftrightarrow> (\<forall>a. f -` {a..} \<inter> space M \<in> sets M)"
   unfolding borel_measurable_ereal_iff_Iio vimage_sets_compl_iff[where A="{..< a}" for a] by simp
 
 lemma borel_measurable_ereal2:
   fixes f g :: "'a \<Rightarrow> ereal"
   assumes f: "f \<in> borel_measurable M"
   assumes g: "g \<in> borel_measurable M"
   assumes H: "(\<lambda>x. H (ereal (real_of_ereal (f x))) (ereal (real_of_ereal (g x)))) \<in> borel_measurable M"
     "(\<lambda>x. H (-\<infinity>) (ereal (real_of_ereal (g x)))) \<in> borel_measurable M"
     "(\<lambda>x. H (\<infinity>) (ereal (real_of_ereal (g x)))) \<in> borel_measurable M"
     "(\<lambda>x. H (ereal (real_of_ereal (f x))) (-\<infinity>)) \<in> borel_measurable M"
     "(\<lambda>x. H (ereal (real_of_ereal (f x))) (\<infinity>)) \<in> borel_measurable M"
   shows "(\<lambda>x. H (f x) (g x)) \<in> borel_measurable M"
 proof -
   let ?G = "\<lambda>y x. if g x = \<infinity> then H y \<infinity> else if g x = - \<infinity> then H y (-\<infinity>) else H y (ereal (real_of_ereal (g x)))"
   let ?F = "\<lambda>x. if f x = \<infinity> then ?G \<infinity> x else if f x = - \<infinity> then ?G (-\<infinity>) x else ?G (ereal (real_of_ereal (f x))) x"
   { fix x have "H (f x) (g x) = ?F x" by (cases "f x" "g x" rule: ereal2_cases) auto }
   note * = this
   from assms show ?thesis unfolding * by simp
 qed
 
 lemma [measurable(raw)]:
   fixes f :: "'a \<Rightarrow> ereal"
   assumes [measurable]: "f \<in> borel_measurable M" "g \<in> borel_measurable M"
   shows borel_measurable_ereal_add: "(\<lambda>x. f x + g x) \<in> borel_measurable M"
     and borel_measurable_ereal_times: "(\<lambda>x. f x * g x) \<in> borel_measurable M"
   by (simp_all add: borel_measurable_ereal2)
 
 lemma [measurable(raw)]:
   fixes f g :: "'a \<Rightarrow> ereal"
   assumes "f \<in> borel_measurable M"
   assumes "g \<in> borel_measurable M"
   shows borel_measurable_ereal_diff: "(\<lambda>x. f x - g x) \<in> borel_measurable M"
     and borel_measurable_ereal_divide: "(\<lambda>x. f x / g x) \<in> borel_measurable M"
   using assms by (simp_all add: minus_ereal_def divide_ereal_def)
 
 lemma borel_measurable_ereal_sum[measurable (raw)]:
   fixes f :: "'c \<Rightarrow> 'a \<Rightarrow> ereal"
   assumes "\<And>i. i \<in> S \<Longrightarrow> f i \<in> borel_measurable M"
   shows "(\<lambda>x. \<Sum>i\<in>S. f i x) \<in> borel_measurable M"
   using assms by (induction S rule: infinite_finite_induct) auto
 
 lemma borel_measurable_ereal_prod[measurable (raw)]:
   fixes f :: "'c \<Rightarrow> 'a \<Rightarrow> ereal"
   assumes "\<And>i. i \<in> S \<Longrightarrow> f i \<in> borel_measurable M"
   shows "(\<lambda>x. \<Prod>i\<in>S. f i x) \<in> borel_measurable M"
   using assms by (induction S rule: infinite_finite_induct) auto
 
 lemma borel_measurable_extreal_suminf[measurable (raw)]:
   fixes f :: "nat \<Rightarrow> 'a \<Rightarrow> ereal"
   assumes [measurable]: "\<And>i. f i \<in> borel_measurable M"
   shows "(\<lambda>x. (\<Sum>i. f i x)) \<in> borel_measurable M"
   unfolding suminf_def sums_def[abs_def] lim_def[symmetric] by simp
 
 subsection "Borel space on the extended non-negative reals"
 
 text \<open> \<^type>\<open>ennreal\<close> is a topological monoid, so no rules for plus are required, also all order
   statements are usually done on type classes. \<close>
 
 lemma measurable_enn2ereal[measurable]: "enn2ereal \<in> borel \<rightarrow>\<^sub>M borel"
   by (intro borel_measurable_continuous_onI continuous_on_enn2ereal)
 
 lemma measurable_e2ennreal[measurable]: "e2ennreal \<in> borel \<rightarrow>\<^sub>M borel"
   by (intro borel_measurable_continuous_onI continuous_on_e2ennreal)
 
 lemma borel_measurable_enn2real[measurable (raw)]:
   "f \<in> M \<rightarrow>\<^sub>M borel \<Longrightarrow> (\<lambda>x. enn2real (f x)) \<in> M \<rightarrow>\<^sub>M borel"
   unfolding enn2real_def[abs_def] by measurable
 
 definition\<^marker>\<open>tag important\<close> [simp]: "is_borel f M \<longleftrightarrow> f \<in> borel_measurable M"
 
 lemma is_borel_transfer[transfer_rule]: "rel_fun (rel_fun (=) pcr_ennreal) (=) is_borel is_borel"
   unfolding is_borel_def[abs_def]
 proof (safe intro!: rel_funI ext dest!: rel_fun_eq_pcr_ennreal[THEN iffD1])
   fix f and M :: "'a measure"
   show "f \<in> borel_measurable M" if f: "enn2ereal \<circ> f \<in> borel_measurable M"
     using measurable_compose[OF f measurable_e2ennreal] by simp
 qed simp
 
 context
   includes ennreal.lifting
 begin
 
 lemma measurable_ennreal[measurable]: "ennreal \<in> borel \<rightarrow>\<^sub>M borel"
   unfolding is_borel_def[symmetric]
   by transfer simp
 
 lemma borel_measurable_ennreal_iff[simp]:
   assumes [simp]: "\<And>x. x \<in> space M \<Longrightarrow> 0 \<le> f x"
   shows "(\<lambda>x. ennreal (f x)) \<in> M \<rightarrow>\<^sub>M borel \<longleftrightarrow> f \<in> M \<rightarrow>\<^sub>M borel"
 proof safe
   assume "(\<lambda>x. ennreal (f x)) \<in> M \<rightarrow>\<^sub>M borel"
   then have "(\<lambda>x. enn2real (ennreal (f x))) \<in> M \<rightarrow>\<^sub>M borel"
     by measurable
   then show "f \<in> M \<rightarrow>\<^sub>M borel"
     by (rule measurable_cong[THEN iffD1, rotated]) auto
 qed measurable
 
 lemma borel_measurable_times_ennreal[measurable (raw)]:
   fixes f g :: "'a \<Rightarrow> ennreal"
   shows "f \<in> M \<rightarrow>\<^sub>M borel \<Longrightarrow> g \<in> M \<rightarrow>\<^sub>M borel \<Longrightarrow> (\<lambda>x. f x * g x) \<in> M \<rightarrow>\<^sub>M borel"
   unfolding is_borel_def[symmetric] by transfer simp
 
 lemma borel_measurable_inverse_ennreal[measurable (raw)]:
   fixes f :: "'a \<Rightarrow> ennreal"
   shows "f \<in> M \<rightarrow>\<^sub>M borel \<Longrightarrow> (\<lambda>x. inverse (f x)) \<in> M \<rightarrow>\<^sub>M borel"
   unfolding is_borel_def[symmetric] by transfer simp
 
 lemma borel_measurable_divide_ennreal[measurable (raw)]:
   fixes f :: "'a \<Rightarrow> ennreal"
   shows "f \<in> M \<rightarrow>\<^sub>M borel \<Longrightarrow> g \<in> M \<rightarrow>\<^sub>M borel \<Longrightarrow> (\<lambda>x. f x / g x) \<in> M \<rightarrow>\<^sub>M borel"
   unfolding divide_ennreal_def by simp
 
 lemma borel_measurable_minus_ennreal[measurable (raw)]:
   fixes f :: "'a \<Rightarrow> ennreal"
   shows "f \<in> M \<rightarrow>\<^sub>M borel \<Longrightarrow> g \<in> M \<rightarrow>\<^sub>M borel \<Longrightarrow> (\<lambda>x. f x - g x) \<in> M \<rightarrow>\<^sub>M borel"
   unfolding is_borel_def[symmetric] by transfer simp
 
 lemma borel_measurable_power_ennreal [measurable (raw)]:
   fixes f :: "_ \<Rightarrow> ennreal"
   assumes f: "f \<in> borel_measurable M"
   shows "(\<lambda>x. (f x) ^ n) \<in> borel_measurable M"
   by (induction n) (use f in auto)
 
 lemma borel_measurable_prod_ennreal[measurable (raw)]:
   fixes f :: "'c \<Rightarrow> 'a \<Rightarrow> ennreal"
   assumes "\<And>i. i \<in> S \<Longrightarrow> f i \<in> borel_measurable M"
   shows "(\<lambda>x. \<Prod>i\<in>S. f i x) \<in> borel_measurable M"
   using assms by (induction S rule: infinite_finite_induct) auto
 
 end
 
 hide_const (open) is_borel
 
 subsection \<open>LIMSEQ is borel measurable\<close>
 
 lemma borel_measurable_LIMSEQ_real:
   fixes u :: "nat \<Rightarrow> 'a \<Rightarrow> real"
   assumes u': "\<And>x. x \<in> space M \<Longrightarrow> (\<lambda>i. u i x) \<longlonglongrightarrow> u' x"
   and u: "\<And>i. u i \<in> borel_measurable M"
   shows "u' \<in> borel_measurable M"
 proof -
   have "\<And>x. x \<in> space M \<Longrightarrow> liminf (\<lambda>n. ereal (u n x)) = ereal (u' x)"
     using u' by (simp add: lim_imp_Liminf)
   moreover from u have "(\<lambda>x. liminf (\<lambda>n. ereal (u n x))) \<in> borel_measurable M"
     by auto
   ultimately show ?thesis by (simp cong: measurable_cong add: borel_measurable_ereal_iff)
 qed
 
 lemma borel_measurable_LIMSEQ_metric:
   fixes f :: "nat \<Rightarrow> 'a \<Rightarrow> 'b :: metric_space"
   assumes [measurable]: "\<And>i. f i \<in> borel_measurable M"
   assumes lim: "\<And>x. x \<in> space M \<Longrightarrow> (\<lambda>i. f i x) \<longlonglongrightarrow> g x"
   shows "g \<in> borel_measurable M"
   unfolding borel_eq_closed
 proof (safe intro!: measurable_measure_of)
   fix A :: "'b set" assume "closed A"
 
   have [measurable]: "(\<lambda>x. infdist (g x) A) \<in> borel_measurable M"
   proof (rule borel_measurable_LIMSEQ_real)
     show "\<And>x. x \<in> space M \<Longrightarrow> (\<lambda>i. infdist (f i x) A) \<longlonglongrightarrow> infdist (g x) A"
       by (intro tendsto_infdist lim)
     show "\<And>i. (\<lambda>x. infdist (f i x) A) \<in> borel_measurable M"
       by (intro borel_measurable_continuous_on[where f="\<lambda>x. infdist x A"]
         continuous_at_imp_continuous_on ballI continuous_infdist continuous_ident) auto
   qed
 
   show "g -` A \<inter> space M \<in> sets M"
   proof cases
     assume "A \<noteq> {}"
     then have "\<And>x. infdist x A = 0 \<longleftrightarrow> x \<in> A"
       using \<open>closed A\<close> by (simp add: in_closed_iff_infdist_zero)
     then have "g -` A \<inter> space M = {x\<in>space M. infdist (g x) A = 0}"
       by auto
     also have "\<dots> \<in> sets M"
       by measurable
     finally show ?thesis .
   qed simp
 qed auto
 
 lemma sets_Collect_Cauchy[measurable]:
   fixes f :: "nat \<Rightarrow> 'a => 'b::{metric_space, second_countable_topology}"
   assumes f[measurable]: "\<And>i. f i \<in> borel_measurable M"
   shows "{x\<in>space M. Cauchy (\<lambda>i. f i x)} \<in> sets M"
   unfolding metric_Cauchy_iff2 using f by auto
 
 lemma borel_measurable_lim_metric[measurable (raw)]:
   fixes f :: "nat \<Rightarrow> 'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes f[measurable]: "\<And>i. f i \<in> borel_measurable M"
   shows "(\<lambda>x. lim (\<lambda>i. f i x)) \<in> borel_measurable M"
 proof -
   define u' where "u' x = lim (\<lambda>i. if Cauchy (\<lambda>i. f i x) then f i x else 0)" for x
   then have *: "\<And>x. lim (\<lambda>i. f i x) = (if Cauchy (\<lambda>i. f i x) then u' x else (THE x. False))"
     by (auto simp: lim_def convergent_eq_Cauchy[symmetric])
   have "u' \<in> borel_measurable M"
   proof (rule borel_measurable_LIMSEQ_metric)
     fix x
     have "convergent (\<lambda>i. if Cauchy (\<lambda>i. f i x) then f i x else 0)"
       by (cases "Cauchy (\<lambda>i. f i x)")
          (auto simp add: convergent_eq_Cauchy[symmetric] convergent_def)
     then show "(\<lambda>i. if Cauchy (\<lambda>i. f i x) then f i x else 0) \<longlonglongrightarrow> u' x"
       unfolding u'_def
       by (rule convergent_LIMSEQ_iff[THEN iffD1])
   qed measurable
   then show ?thesis
     unfolding * by measurable
 qed
 
 lemma borel_measurable_suminf[measurable (raw)]:
   fixes f :: "nat \<Rightarrow> 'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes f[measurable]: "\<And>i. f i \<in> borel_measurable M"
   shows "(\<lambda>x. suminf (\<lambda>i. f i x)) \<in> borel_measurable M"
   unfolding suminf_def sums_def[abs_def] lim_def[symmetric] by simp
 
 lemma Collect_closed_imp_pred_borel: "closed {x. P x} \<Longrightarrow> Measurable.pred borel P"
   by (simp add: pred_def)
 
 (* Proof by Jeremy Avigad and Luke Serafin *)
 lemma isCont_borel_pred[measurable]:
   fixes f :: "'b::metric_space \<Rightarrow> 'a::metric_space"
   shows "Measurable.pred borel (isCont f)"
 proof (subst measurable_cong)
   let ?I = "\<lambda>j. inverse(real (Suc j))"
   show "isCont f x = (\<forall>i. \<exists>j. \<forall>y z. dist x y < ?I j \<and> dist x z < ?I j \<longrightarrow> dist (f y) (f z) \<le> ?I i)" for x
     unfolding continuous_at_eps_delta
   proof safe
     fix i assume "\<forall>e>0. \<exists>d>0. \<forall>y. dist y x < d \<longrightarrow> dist (f y) (f x) < e"
     moreover have "0 < ?I i / 2"
       by simp
     ultimately obtain d where d: "0 < d" "\<And>y. dist x y < d \<Longrightarrow> dist (f y) (f x) < ?I i / 2"
       by (metis dist_commute)
     then obtain j where j: "?I j < d"
       by (metis reals_Archimedean)
 
     show "\<exists>j. \<forall>y z. dist x y < ?I j \<and> dist x z < ?I j \<longrightarrow> dist (f y) (f z) \<le> ?I i"
     proof (safe intro!: exI[where x=j])
       fix y z assume *: "dist x y < ?I j" "dist x z < ?I j"
       have "dist (f y) (f z) \<le> dist (f y) (f x) + dist (f z) (f x)"
         by (rule dist_triangle2)
       also have "\<dots> < ?I i / 2 + ?I i / 2"
         by (intro add_strict_mono d less_trans[OF _ j] *)
       also have "\<dots> \<le> ?I i"
         by (simp add: field_simps)
       finally show "dist (f y) (f z) \<le> ?I i"
         by simp
     qed
   next
     fix e::real assume "0 < e"
     then obtain n where n: "?I n < e"
       by (metis reals_Archimedean)
     assume "\<forall>i. \<exists>j. \<forall>y z. dist x y < ?I j \<and> dist x z < ?I j \<longrightarrow> dist (f y) (f z) \<le> ?I i"
     from this[THEN spec, of "Suc n"]
     obtain j where j: "\<And>y z. dist x y < ?I j \<Longrightarrow> dist x z < ?I j \<Longrightarrow> dist (f y) (f z) \<le> ?I (Suc n)"
       by auto
 
     show "\<exists>d>0. \<forall>y. dist y x < d \<longrightarrow> dist (f y) (f x) < e"
     proof (safe intro!: exI[of _ "?I j"])
       fix y assume "dist y x < ?I j"
       then have "dist (f y) (f x) \<le> ?I (Suc n)"
         by (intro j) (auto simp: dist_commute)
       also have "?I (Suc n) < ?I n"
         by simp
       also note n
       finally show "dist (f y) (f x) < e" .
     qed simp
   qed
 qed (intro pred_intros_countable closed_Collect_all closed_Collect_le open_Collect_less
            Collect_closed_imp_pred_borel closed_Collect_imp open_Collect_conj continuous_intros)
 
 lemma isCont_borel:
   fixes f :: "'b::metric_space \<Rightarrow> 'a::metric_space"
   shows "{x. isCont f x} \<in> sets borel"
   by simp
 
 lemma is_real_interval:
   assumes S: "is_interval S"
   shows "\<exists>a b::real. S = {} \<or> S = UNIV \<or> S = {..<b} \<or> S = {..b} \<or> S = {a<..} \<or> S = {a..} \<or>
     S = {a<..<b} \<or> S = {a<..b} \<or> S = {a..<b} \<or> S = {a..b}"
   using S unfolding is_interval_1 by (blast intro: interval_cases)
 
 lemma real_interval_borel_measurable:
   assumes "is_interval (S::real set)"
   shows "S \<in> sets borel"
 proof -
   from assms is_real_interval have "\<exists>a b::real. S = {} \<or> S = UNIV \<or> S = {..<b} \<or> S = {..b} \<or>
     S = {a<..} \<or> S = {a..} \<or> S = {a<..<b} \<or> S = {a<..b} \<or> S = {a..<b} \<or> S = {a..b}" by auto
   then guess a ..
   then guess b ..
   thus ?thesis
     by auto
 qed
 
 text \<open>The next lemmas hold in any second countable linorder (including ennreal or ereal for instance),
 but in the current state they are restricted to reals.\<close>
 
 lemma borel_measurable_mono_on_fnc:
   fixes f :: "real \<Rightarrow> real" and A :: "real set"
   assumes "mono_on f A"
   shows "f \<in> borel_measurable (restrict_space borel A)"
   apply (rule measurable_restrict_countable[OF mono_on_ctble_discont[OF assms]])
   apply (auto intro!: image_eqI[where x="{x}" for x] simp: sets_restrict_space)
   apply (auto simp add: sets_restrict_restrict_space continuous_on_eq_continuous_within
               cong: measurable_cong_sets
               intro!: borel_measurable_continuous_on_restrict intro: continuous_within_subset)
   done
 
 lemma borel_measurable_piecewise_mono:
   fixes f::"real \<Rightarrow> real" and C::"real set set"
   assumes "countable C" "\<And>c. c \<in> C \<Longrightarrow> c \<in> sets borel" "\<And>c. c \<in> C \<Longrightarrow> mono_on f c" "(\<Union>C) = UNIV"
   shows "f \<in> borel_measurable borel"
   by (rule measurable_piecewise_restrict[of C], auto intro: borel_measurable_mono_on_fnc simp: assms)
 
 lemma borel_measurable_mono:
   fixes f :: "real \<Rightarrow> real"
   shows "mono f \<Longrightarrow> f \<in> borel_measurable borel"
   using borel_measurable_mono_on_fnc[of f UNIV] by (simp add: mono_def mono_on_def)
 
 lemma measurable_bdd_below_real[measurable (raw)]:
   fixes F :: "'a \<Rightarrow> 'i \<Rightarrow> real"
   assumes [simp]: "countable I" and [measurable]: "\<And>i. i \<in> I \<Longrightarrow> F i \<in> M \<rightarrow>\<^sub>M borel"
   shows "Measurable.pred M (\<lambda>x. bdd_below ((\<lambda>i. F i x)`I))"
 proof (subst measurable_cong)
   show "bdd_below ((\<lambda>i. F i x)`I) \<longleftrightarrow> (\<exists>q\<in>\<int>. \<forall>i\<in>I. q \<le> F i x)" for x
     by (auto simp: bdd_below_def intro!: bexI[of _ "of_int (floor _)"] intro: order_trans of_int_floor_le)
   show "Measurable.pred M (\<lambda>w. \<exists>q\<in>\<int>. \<forall>i\<in>I. q \<le> F i w)"
     using countable_int by measurable
 qed
 
 lemma borel_measurable_cINF_real[measurable (raw)]:
   fixes F :: "_ \<Rightarrow> _ \<Rightarrow> real"
   assumes [simp]: "countable I"
   assumes F[measurable]: "\<And>i. i \<in> I \<Longrightarrow> F i \<in> borel_measurable M"
   shows "(\<lambda>x. INF i\<in>I. F i x) \<in> borel_measurable M"
 proof (rule measurable_piecewise_restrict)
   let ?\<Omega> = "{x\<in>space M. bdd_below ((\<lambda>i. F i x)`I)}"
   show "countable {?\<Omega>, - ?\<Omega>}" "space M \<subseteq> \<Union>{?\<Omega>, - ?\<Omega>}" "\<And>X. X \<in> {?\<Omega>, - ?\<Omega>} \<Longrightarrow> X \<inter> space M \<in> sets M"
     by auto
   fix X assume "X \<in> {?\<Omega>, - ?\<Omega>}" then show "(\<lambda>x. INF i\<in>I. F i x) \<in> borel_measurable (restrict_space M X)"
   proof safe
     show "(\<lambda>x. INF i\<in>I. F i x) \<in> borel_measurable (restrict_space M ?\<Omega>)"
       by (intro borel_measurable_cINF measurable_restrict_space1 F)
          (auto simp: space_restrict_space)
     show "(\<lambda>x. INF i\<in>I. F i x) \<in> borel_measurable (restrict_space M (-?\<Omega>))"
     proof (subst measurable_cong)
       fix x assume "x \<in> space (restrict_space M (-?\<Omega>))"
       then have "\<not> (\<forall>i\<in>I. - F i x \<le> y)" for y
         by (auto simp: space_restrict_space bdd_above_def bdd_above_uminus[symmetric])
       then show "(INF i\<in>I. F i x) = - (THE x. False)"
         by (auto simp: space_restrict_space Inf_real_def Sup_real_def Least_def simp del: Set.ball_simps(10))
     qed simp
   qed
 qed
 
 lemma borel_Ici: "borel = sigma UNIV (range (\<lambda>x::real. {x ..}))"
 proof (safe intro!: borel_eq_sigmaI1[OF borel_Iio])
   fix x :: real
   have eq: "{..<x} = space (sigma UNIV (range atLeast)) - {x ..}"
     by auto
   show "{..<x} \<in> sets (sigma UNIV (range atLeast))"
     unfolding eq by (intro sets.compl_sets) auto
 qed auto
 
 lemma borel_measurable_pred_less[measurable (raw)]:
   fixes f :: "'a \<Rightarrow> 'b::{second_countable_topology, linorder_topology}"
   shows "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow> Measurable.pred M (\<lambda>w. f w < g w)"
   unfolding Measurable.pred_def by (rule borel_measurable_less)
 
 no_notation
   eucl_less (infix "<e" 50)
 
 lemma borel_measurable_Max2[measurable (raw)]:
   fixes f::"_ \<Rightarrow> _ \<Rightarrow> 'a::{second_countable_topology, dense_linorder, linorder_topology}"
   assumes "finite I"
     and [measurable]: "\<And>i. f i \<in> borel_measurable M"
   shows "(\<lambda>x. Max{f i x |i. i \<in> I}) \<in> borel_measurable M"
   by (simp add: borel_measurable_Max[OF assms(1), where ?f=f and ?M=M] Setcompr_eq_image)
 
 lemma measurable_compose_n [measurable (raw)]:
   assumes "T \<in> measurable M M"
   shows "(T^^n) \<in> measurable M M"
 by (induction n, auto simp add: measurable_compose[OF _ assms])
 
 lemma measurable_real_imp_nat:
   fixes f::"'a \<Rightarrow> nat"
   assumes [measurable]: "(\<lambda>x. real(f x)) \<in> borel_measurable M"
   shows "f \<in> measurable M (count_space UNIV)"
 proof -
   let ?g = "(\<lambda>x. real(f x))"
   have "\<And>(n::nat). ?g-`({real n}) \<inter> space M = f-`{n} \<inter> space M" by auto
   moreover have "\<And>(n::nat). ?g-`({real n}) \<inter> space M \<in> sets M" using assms by measurable
   ultimately have "\<And>(n::nat). f-`{n} \<inter> space M \<in> sets M" by simp
   then show ?thesis using measurable_count_space_eq2_countable by blast
 qed
 
 lemma measurable_equality_set [measurable]:
   fixes f g::"_\<Rightarrow> 'a::{second_countable_topology, t2_space}"
   assumes [measurable]: "f \<in> borel_measurable M" "g \<in> borel_measurable M"
   shows "{x \<in> space M. f x = g x} \<in> sets M"
 
 proof -
   define A where "A = {x \<in> space M. f x = g x}"
   define B where "B = {y. \<exists>x::'a. y = (x,x)}"
   have "A = (\<lambda>x. (f x, g x))-`B \<inter> space M" unfolding A_def B_def by auto
   moreover have "(\<lambda>x. (f x, g x)) \<in> borel_measurable M" by simp
   moreover have "B \<in> sets borel" unfolding B_def by (simp add: closed_diagonal)
   ultimately have "A \<in> sets M" by simp
   then show ?thesis unfolding A_def by simp
 qed
 
 lemma measurable_inequality_set [measurable]:
   fixes f g::"_ \<Rightarrow> 'a::{second_countable_topology, linorder_topology}"
   assumes [measurable]: "f \<in> borel_measurable M" "g \<in> borel_measurable M"
   shows "{x \<in> space M. f x \<le> g x} \<in> sets M"
         "{x \<in> space M. f x < g x} \<in> sets M"
         "{x \<in> space M. f x \<ge> g x} \<in> sets M"
         "{x \<in> space M. f x > g x} \<in> sets M"
 proof -
   define F where "F = (\<lambda>x. (f x, g x))"
   have * [measurable]: "F \<in> borel_measurable M" unfolding F_def by simp
 
   have "{x \<in> space M. f x \<le> g x} = F-`{(x, y) | x y. x \<le> y} \<inter> space M" unfolding F_def by auto
   moreover have "{(x, y) | x y. x \<le> (y::'a)} \<in> sets borel" using closed_subdiagonal borel_closed by blast
   ultimately show "{x \<in> space M. f x \<le> g x} \<in> sets M" using * by (metis (mono_tags, lifting) measurable_sets)
 
   have "{x \<in> space M. f x < g x} = F-`{(x, y) | x y. x < y} \<inter> space M" unfolding F_def by auto
   moreover have "{(x, y) | x y. x < (y::'a)} \<in> sets borel" using open_subdiagonal borel_open by blast
   ultimately show "{x \<in> space M. f x < g x} \<in> sets M" using * by (metis (mono_tags, lifting) measurable_sets)
 
   have "{x \<in> space M. f x \<ge> g x} = F-`{(x, y) | x y. x \<ge> y} \<inter> space M" unfolding F_def by auto
   moreover have "{(x, y) | x y. x \<ge> (y::'a)} \<in> sets borel" using closed_superdiagonal borel_closed by blast
   ultimately show "{x \<in> space M. f x \<ge> g x} \<in> sets M" using * by (metis (mono_tags, lifting) measurable_sets)
 
   have "{x \<in> space M. f x > g x} = F-`{(x, y) | x y. x > y} \<inter> space M" unfolding F_def by auto
   moreover have "{(x, y) | x y. x > (y::'a)} \<in> sets borel" using open_superdiagonal borel_open by blast
   ultimately show "{x \<in> space M. f x > g x} \<in> sets M" using * by (metis (mono_tags, lifting) measurable_sets)
 qed
 
 proposition measurable_limit [measurable]:
   fixes f::"nat \<Rightarrow> 'a \<Rightarrow> 'b::first_countable_topology"
   assumes [measurable]: "\<And>n::nat. f n \<in> borel_measurable M"
   shows "Measurable.pred M (\<lambda>x. (\<lambda>n. f n x) \<longlonglongrightarrow> c)"
 proof -
   obtain A :: "nat \<Rightarrow> 'b set" where A:
     "\<And>i. open (A i)"
     "\<And>i. c \<in> A i"
     "\<And>S. open S \<Longrightarrow> c \<in> S \<Longrightarrow> eventually (\<lambda>i. A i \<subseteq> S) sequentially"
   by (rule countable_basis_at_decseq) blast
 
   have [measurable]: "\<And>N i. (f N)-`(A i) \<inter> space M \<in> sets M" using A(1) by auto
   then have mes: "(\<Inter>i. \<Union>n. \<Inter>N\<in>{n..}. (f N)-`(A i) \<inter> space M) \<in> sets M" by blast
 
   have "(u \<longlonglongrightarrow> c) \<longleftrightarrow> (\<forall>i. eventually (\<lambda>n. u n \<in> A i) sequentially)" for u::"nat \<Rightarrow> 'b"
   proof
     assume "u \<longlonglongrightarrow> c"
     then have "eventually (\<lambda>n. u n \<in> A i) sequentially" for i using A(1)[of i] A(2)[of i]
       by (simp add: topological_tendstoD)
     then show "(\<forall>i. eventually (\<lambda>n. u n \<in> A i) sequentially)" by auto
   next
     assume H: "(\<forall>i. eventually (\<lambda>n. u n \<in> A i) sequentially)"
     show "(u \<longlonglongrightarrow> c)"
     proof (rule topological_tendstoI)
       fix S assume "open S" "c \<in> S"
       with A(3)[OF this] obtain i where "A i \<subseteq> S"
         using eventually_False_sequentially eventually_mono by blast
       moreover have "eventually (\<lambda>n. u n \<in> A i) sequentially" using H by simp
       ultimately show "\<forall>\<^sub>F n in sequentially. u n \<in> S"
         by (simp add: eventually_mono subset_eq)
     qed
   qed
   then have "{x. (\<lambda>n. f n x) \<longlonglongrightarrow> c} = (\<Inter>i. \<Union>n. \<Inter>N\<in>{n..}. (f N)-`(A i))"
     by (auto simp add: atLeast_def eventually_at_top_linorder)
   then have "{x \<in> space M. (\<lambda>n. f n x) \<longlonglongrightarrow> c} = (\<Inter>i. \<Union>n. \<Inter>N\<in>{n..}. (f N)-`(A i) \<inter> space M)"
     by auto
   then have "{x \<in> space M. (\<lambda>n. f n x) \<longlonglongrightarrow> c} \<in> sets M" using mes by simp
   then show ?thesis by auto
 qed
 
 lemma measurable_limit2 [measurable]:
   fixes u::"nat \<Rightarrow> 'a \<Rightarrow> real"
   assumes [measurable]: "\<And>n. u n \<in> borel_measurable M" "v \<in> borel_measurable M"
   shows "Measurable.pred M (\<lambda>x. (\<lambda>n. u n x) \<longlonglongrightarrow> v x)"
 proof -
   define w where "w = (\<lambda>n x. u n x - v x)"
   have [measurable]: "w n \<in> borel_measurable M" for n unfolding w_def by auto
   have "((\<lambda>n. u n x) \<longlonglongrightarrow> v x) \<longleftrightarrow> ((\<lambda>n. w n x) \<longlonglongrightarrow> 0)" for x
     unfolding w_def using Lim_null by auto
   then show ?thesis using measurable_limit by auto
 qed
 
 lemma measurable_P_restriction [measurable (raw)]:
   assumes [measurable]: "Measurable.pred M P" "A \<in> sets M"
   shows "{x \<in> A. P x} \<in> sets M"
 proof -
   have "A \<subseteq> space M" using sets.sets_into_space[OF assms(2)].
   then have "{x \<in> A. P x} = A \<inter> {x \<in> space M. P x}" by blast
   then show ?thesis by auto
 qed
 
 lemma measurable_sum_nat [measurable (raw)]:
   fixes f :: "'c \<Rightarrow> 'a \<Rightarrow> nat"
   assumes "\<And>i. i \<in> S \<Longrightarrow> f i \<in> measurable M (count_space UNIV)"
   shows "(\<lambda>x. \<Sum>i\<in>S. f i x) \<in> measurable M (count_space UNIV)"
 proof cases
   assume "finite S"
   then show ?thesis using assms by induct auto
 qed simp
 
 
 lemma measurable_abs_powr [measurable]:
   fixes p::real
   assumes [measurable]: "f \<in> borel_measurable M"
   shows "(\<lambda>x. \<bar>f x\<bar> powr p) \<in> borel_measurable M"
   by simp
 
 text \<open>The next one is a variation around \<open>measurable_restrict_space\<close>.\<close>
 
 lemma measurable_restrict_space3:
   assumes "f \<in> measurable M N" and
           "f \<in> A \<rightarrow> B"
   shows "f \<in> measurable (restrict_space M A) (restrict_space N B)"
 proof -
   have "f \<in> measurable (restrict_space M A) N" using assms(1) measurable_restrict_space1 by auto
   then show ?thesis by (metis Int_iff funcsetI funcset_mem
       measurable_restrict_space2[of f, of "restrict_space M A", of B, of N] assms(2) space_restrict_space)
 qed
 
 lemma measurable_restrict_mono:
   assumes f: "f \<in> restrict_space M A \<rightarrow>\<^sub>M N" and "B \<subseteq> A"
   shows "f \<in> restrict_space M B \<rightarrow>\<^sub>M N"
 by (rule measurable_compose[OF measurable_restrict_space3 f])
    (insert \<open>B \<subseteq> A\<close>, auto)
 
 text \<open>The next one is a variation around \<open>measurable_piecewise_restrict\<close>.\<close>
 
 lemma measurable_piecewise_restrict2:
   assumes [measurable]: "\<And>n. A n \<in> sets M"
       and "space M = (\<Union>(n::nat). A n)"
           "\<And>n. \<exists>h \<in> measurable M N. (\<forall>x \<in> A n. f x = h x)"
   shows "f \<in> measurable M N"
 proof (rule measurableI)
   fix B assume [measurable]: "B \<in> sets N"
   {
     fix n::nat
     obtain h where [measurable]: "h \<in> measurable M N" and "\<forall>x \<in> A n. f x = h x" using assms(3) by blast
     then have *: "f-`B \<inter> A n = h-`B \<inter> A n" by auto
     have "h-`B \<inter> A n = h-`B \<inter> space M \<inter> A n" using assms(2) sets.sets_into_space by auto
     then have "h-`B \<inter> A n \<in> sets M" by simp
     then have "f-`B \<inter> A n \<in> sets M" using * by simp
   }
   then have "(\<Union>n. f-`B \<inter> A n) \<in> sets M" by measurable
   moreover have "f-`B \<inter> space M = (\<Union>n. f-`B \<inter> A n)" using assms(2) by blast
   ultimately show "f-`B \<inter> space M \<in> sets M" by simp
 next
   fix x assume "x \<in> space M"
   then obtain n where "x \<in> A n" using assms(2) by blast
   obtain h where [measurable]: "h \<in> measurable M N" and "\<forall>x \<in> A n. f x = h x" using assms(3) by blast
   then have "f x = h x" using \<open>x \<in> A n\<close> by blast
   moreover have "h x \<in> space N" by (metis measurable_space \<open>x \<in> space M\<close> \<open>h \<in> measurable M N\<close>)
   ultimately show "f x \<in> space N" by simp
 qed
 
 end
diff --git a/src/HOL/Analysis/Change_Of_Vars.thy b/src/HOL/Analysis/Change_Of_Vars.thy
--- a/src/HOL/Analysis/Change_Of_Vars.thy
+++ b/src/HOL/Analysis/Change_Of_Vars.thy
@@ -1,3478 +1,3478 @@
 (*  Title:      HOL/Analysis/Change_Of_Vars.thy
     Authors:    LC Paulson, based on material from HOL Light
 *)
 
 section\<open>Change of Variables Theorems\<close>
 
 theory Change_Of_Vars
   imports Vitali_Covering_Theorem Determinants
 
 begin
 
 subsection \<open>Measurable Shear and Stretch\<close>
 
 proposition
   fixes a :: "real^'n"
   assumes "m \<noteq> n" and ab_ne: "cbox a b \<noteq> {}" and an: "0 \<le> a$n"
   shows measurable_shear_interval: "(\<lambda>x. \<chi> i. if i = m then x$m + x$n else x$i) ` (cbox a b) \<in> lmeasurable"
        (is  "?f ` _ \<in> _")
    and measure_shear_interval: "measure lebesgue ((\<lambda>x. \<chi> i. if i = m then x$m + x$n else x$i) ` cbox a b)
                = measure lebesgue (cbox a b)" (is "?Q")
 proof -
   have lin: "linear ?f"
     by (rule linearI) (auto simp: plus_vec_def scaleR_vec_def algebra_simps)
   show fab: "?f ` cbox a b \<in> lmeasurable"
     by (simp add: lin measurable_linear_image_interval)
   let ?c = "\<chi> i. if i = m then b$m + b$n else b$i"
   let ?mn = "axis m 1 - axis n (1::real)"
   have eq1: "measure lebesgue (cbox a ?c)
             = measure lebesgue (?f ` cbox a b)
             + measure lebesgue (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a$m})
             + measure lebesgue (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m})"
   proof (rule measure_Un3_negligible)
     show "cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a$m} \<in> lmeasurable" "cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m} \<in> lmeasurable"
       by (auto simp: convex_Int convex_halfspace_le convex_halfspace_ge bounded_Int measurable_convex)
     have "negligible {x. ?mn \<bullet> x = a$m}"
       by (metis \<open>m \<noteq> n\<close> axis_index_axis eq_iff_diff_eq_0 negligible_hyperplane)
     moreover have "?f ` cbox a b \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m}) \<subseteq> {x. ?mn \<bullet> x = a$m}"
       using \<open>m \<noteq> n\<close> antisym_conv by (fastforce simp: algebra_simps mem_box_cart inner_axis')
     ultimately show "negligible ((?f ` cbox a b) \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m}))"
       by (rule negligible_subset)
     have "negligible {x. ?mn \<bullet> x = b$m}"
       by (metis \<open>m \<noteq> n\<close> axis_index_axis eq_iff_diff_eq_0 negligible_hyperplane)
     moreover have "(?f ` cbox a b) \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m}) \<subseteq> {x. ?mn \<bullet> x = b$m}"
       using \<open>m \<noteq> n\<close> antisym_conv by (fastforce simp: algebra_simps mem_box_cart inner_axis')
     ultimately show "negligible (?f ` cbox a b \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m}))"
       by (rule negligible_subset)
     have "negligible {x. ?mn \<bullet> x = b$m}"
       by (metis \<open>m \<noteq> n\<close> axis_index_axis eq_iff_diff_eq_0 negligible_hyperplane)
     moreover have "(cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m})) \<subseteq> {x. ?mn \<bullet> x = b$m}"
       using \<open>m \<noteq> n\<close> ab_ne
       apply (auto simp: algebra_simps mem_box_cart inner_axis')
       apply (drule_tac x=m in spec)+
       apply simp
       done
     ultimately show "negligible (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m}))"
       by (rule negligible_subset)
     show "?f ` cbox a b \<union> cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<union> cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m} = cbox a ?c" (is "?lhs = _")
     proof
       show "?lhs \<subseteq> cbox a ?c"
         by (auto simp: mem_box_cart add_mono) (meson add_increasing2 an order_trans)
       show "cbox a ?c \<subseteq> ?lhs"
         apply (auto simp: algebra_simps image_iff inner_axis' lambda_add_Galois [OF \<open>m \<noteq> n\<close>])
         apply (auto simp: mem_box_cart split: if_split_asm)
         done
     qed
   qed (fact fab)
   let ?d = "\<chi> i. if i = m then a $ m - b $ m else 0"
   have eq2: "measure lebesgue (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m}) + measure lebesgue (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m})
            = measure lebesgue (cbox a (\<chi> i. if i = m then a $ m + b $ n else b $ i))"
   proof (rule measure_translate_add[of "cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a$m}" "cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m}"
      "(\<chi> i. if i = m then a$m - b$m else 0)" "cbox a (\<chi> i. if i = m then a$m + b$n else b$i)"])
     show "(cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a$m}) \<in> lmeasurable"
       "cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m} \<in> lmeasurable"
       by (auto simp: convex_Int convex_halfspace_le convex_halfspace_ge bounded_Int measurable_convex)
     have "\<And>x. \<lbrakk>x $ n + a $ m \<le> x $ m\<rbrakk>
          \<Longrightarrow> x \<in> (+) (\<chi> i. if i = m then a $ m - b $ m else 0) ` {x. x $ n + b $ m \<le> x $ m}"
       using \<open>m \<noteq> n\<close>
       by (rule_tac x="x - (\<chi> i. if i = m then a$m - b$m else 0)" in image_eqI)
          (simp_all add: mem_box_cart)
     then have imeq: "(+) ?d ` {x. b $ m \<le> ?mn \<bullet> x} = {x. a $ m \<le> ?mn \<bullet> x}"
       using \<open>m \<noteq> n\<close> by (auto simp: mem_box_cart inner_axis' algebra_simps)
     have "\<And>x. \<lbrakk>0 \<le> a $ n; x $ n + a $ m \<le> x $ m;
                 \<forall>i. i \<noteq> m \<longrightarrow> a $ i \<le> x $ i \<and> x $ i \<le> b $ i\<rbrakk>
          \<Longrightarrow> a $ m \<le> x $ m"
       using \<open>m \<noteq> n\<close>  by force
     then have "(+) ?d ` (cbox a ?c \<inter> {x. b $ m \<le> ?mn \<bullet> x})
             = cbox a (\<chi> i. if i = m then a $ m + b $ n else b $ i) \<inter> {x. a $ m \<le> ?mn \<bullet> x}"
       using an ab_ne
       apply (simp add: cbox_translation [symmetric] translation_Int interval_ne_empty_cart imeq)
       apply (auto simp: mem_box_cart inner_axis' algebra_simps if_distrib all_if_distrib)
       by (metis (full_types) add_mono mult_2_right)
     then show "cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<union>
           (+) ?d ` (cbox a ?c \<inter> {x. b $ m \<le> ?mn \<bullet> x}) =
           cbox a (\<chi> i. if i = m then a $ m + b $ n else b $ i)"  (is "?lhs = ?rhs")
       using an \<open>m \<noteq> n\<close>
       apply (auto simp: mem_box_cart inner_axis' algebra_simps if_distrib all_if_distrib, force)
         apply (drule_tac x=n in spec)+
       by (meson ab_ne add_mono_thms_linordered_semiring(3) dual_order.trans interval_ne_empty_cart(1))
     have "negligible{x. ?mn \<bullet> x = a$m}"
       by (metis \<open>m \<noteq> n\<close> axis_index_axis eq_iff_diff_eq_0 negligible_hyperplane)
     moreover have "(cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<inter>
                                  (+) ?d ` (cbox a ?c \<inter> {x. b $ m \<le> ?mn \<bullet> x})) \<subseteq> {x. ?mn \<bullet> x = a$m}"
       using \<open>m \<noteq> n\<close> antisym_conv by (fastforce simp: algebra_simps mem_box_cart inner_axis')
     ultimately show "negligible (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<inter>
                                  (+) ?d ` (cbox a ?c \<inter> {x. b $ m \<le> ?mn \<bullet> x}))"
       by (rule negligible_subset)
   qed
   have ac_ne: "cbox a ?c \<noteq> {}"
     using ab_ne an
     by (clarsimp simp: interval_eq_empty_cart) (meson add_less_same_cancel1 le_less_linear less_le_trans)
   have ax_ne: "cbox a (\<chi> i. if i = m then a $ m + b $ n else b $ i) \<noteq> {}"
     using ab_ne an
     by (clarsimp simp: interval_eq_empty_cart) (meson add_less_same_cancel1 le_less_linear less_le_trans)
   have eq3: "measure lebesgue (cbox a ?c) = measure lebesgue (cbox a (\<chi> i. if i = m then a$m + b$n else b$i)) + measure lebesgue (cbox a b)"
     by (simp add: content_cbox_if_cart ab_ne ac_ne ax_ne algebra_simps prod.delta_remove
              if_distrib [of "\<lambda>u. u - z" for z] prod.remove)
   show ?Q
     using eq1 eq2 eq3
     by (simp add: algebra_simps)
 qed
 
 
 proposition
   fixes S :: "(real^'n) set"
   assumes "S \<in> lmeasurable"
   shows measurable_stretch: "((\<lambda>x. \<chi> k. m k * x$k) ` S) \<in> lmeasurable" (is  "?f ` S \<in> _")
     and measure_stretch: "measure lebesgue ((\<lambda>x. \<chi> k. m k * x$k) ` S) = \<bar>prod m UNIV\<bar> * measure lebesgue S"
     (is "?MEQ")
 proof -
   have "(?f ` S) \<in> lmeasurable \<and> ?MEQ"
   proof (cases "\<forall>k. m k \<noteq> 0")
     case True
     have m0: "0 < \<bar>prod m UNIV\<bar>"
       using True by simp
     have "(indicat_real (?f ` S) has_integral \<bar>prod m UNIV\<bar> * measure lebesgue S) UNIV"
     proof (clarsimp simp add: has_integral_alt [where i=UNIV])
       fix e :: "real"
       assume "e > 0"
       have "(indicat_real S has_integral (measure lebesgue S)) UNIV"
         using assms lmeasurable_iff_has_integral by blast
       then obtain B where "B>0"
         and B: "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow>
                         \<exists>z. (indicat_real S has_integral z) (cbox a b) \<and>
                             \<bar>z - measure lebesgue S\<bar> < e / \<bar>prod m UNIV\<bar>"
         by (simp add: has_integral_alt [where i=UNIV]) (metis (full_types) divide_pos_pos m0  m0 \<open>e > 0\<close>)
       show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
                   (\<exists>z. (indicat_real (?f ` S) has_integral z) (cbox a b) \<and>
                        \<bar>z - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar> < e)"
       proof (intro exI conjI allI)
         let ?C = "Max (range (\<lambda>k. \<bar>m k\<bar>)) * B"
         show "?C > 0"
           using True \<open>B > 0\<close> by (simp add: Max_gr_iff)
         show "ball 0 ?C \<subseteq> cbox u v \<longrightarrow>
                   (\<exists>z. (indicat_real (?f ` S) has_integral z) (cbox u v) \<and>
                        \<bar>z - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar> < e)" for u v
         proof
           assume uv: "ball 0 ?C \<subseteq> cbox u v"
           with \<open>?C > 0\<close> have cbox_ne: "cbox u v \<noteq> {}"
             using centre_in_ball by blast
           let ?\<alpha> = "\<lambda>k. u$k / m k"
           let ?\<beta> = "\<lambda>k. v$k / m k"
           have invm0: "\<And>k. inverse (m k) \<noteq> 0"
             using True by auto
           have "ball 0 B \<subseteq> (\<lambda>x. \<chi> k. x $ k / m k) ` ball 0 ?C"
           proof clarsimp
             fix x :: "real^'n"
             assume x: "norm x < B"
             have [simp]: "\<bar>Max (range (\<lambda>k. \<bar>m k\<bar>))\<bar> = Max (range (\<lambda>k. \<bar>m k\<bar>))"
               by (meson Max_ge abs_ge_zero abs_of_nonneg finite finite_imageI order_trans rangeI)
             have "norm (\<chi> k. m k * x $ k) \<le> norm (Max (range (\<lambda>k. \<bar>m k\<bar>)) *\<^sub>R x)"
               by (rule norm_le_componentwise_cart) (auto simp: abs_mult intro: mult_right_mono)
             also have "\<dots> < ?C"
               using x \<open>0 < (MAX k. \<bar>m k\<bar>) * B\<close> \<open>0 < B\<close> zero_less_mult_pos2 by fastforce
             finally have "norm (\<chi> k. m k * x $ k) < ?C" .
             then show "x \<in> (\<lambda>x. \<chi> k. x $ k / m k) ` ball 0 ?C"
               using stretch_Galois [of "inverse \<circ> m"] True by (auto simp: image_iff field_simps)
           qed
           then have Bsub: "ball 0 B \<subseteq> cbox (\<chi> k. min (?\<alpha> k) (?\<beta> k)) (\<chi> k. max (?\<alpha> k) (?\<beta> k))"
             using cbox_ne uv image_stretch_interval_cart [of "inverse \<circ> m" u v, symmetric]
             by (force simp: field_simps)
           obtain z where zint: "(indicat_real S has_integral z) (cbox (\<chi> k. min (?\<alpha> k) (?\<beta> k)) (\<chi> k. max (?\<alpha> k) (?\<beta> k)))"
                    and zless: "\<bar>z - measure lebesgue S\<bar> < e / \<bar>prod m UNIV\<bar>"
             using B [OF Bsub] by blast
           have ind: "indicat_real (?f ` S) = (\<lambda>x. indicator S (\<chi> k. x$k / m k))"
             using True stretch_Galois [of m] by (force simp: indicator_def)
           show "\<exists>z. (indicat_real (?f ` S) has_integral z) (cbox u v) \<and>
                        \<bar>z - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar> < e"
           proof (simp add: ind, intro conjI exI)
             have "((\<lambda>x. indicat_real S (\<chi> k. x $ k/ m k)) has_integral z *\<^sub>R \<bar>prod m UNIV\<bar>)
                 ((\<lambda>x. \<chi> k. x $ k * m k) ` cbox (\<chi> k. min (?\<alpha> k) (?\<beta> k)) (\<chi> k. max (?\<alpha> k) (?\<beta> k)))"
               using True has_integral_stretch_cart [OF zint, of "inverse \<circ> m"]
               by (simp add: field_simps prod_dividef)
             moreover have "((\<lambda>x. \<chi> k. x $ k * m k) ` cbox (\<chi> k. min (?\<alpha> k) (?\<beta> k)) (\<chi> k. max (?\<alpha> k) (?\<beta> k))) = cbox u v"
               using True image_stretch_interval_cart [of "inverse \<circ> m" u v, symmetric]
                 image_stretch_interval_cart [of "\<lambda>k. 1" u v, symmetric] \<open>cbox u v \<noteq> {}\<close>
               by (simp add: field_simps image_comp o_def)
             ultimately show "((\<lambda>x. indicat_real S (\<chi> k. x $ k/ m k)) has_integral z *\<^sub>R \<bar>prod m UNIV\<bar>) (cbox u v)"
               by simp
             have "\<bar>z *\<^sub>R \<bar>prod m UNIV\<bar> - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar>
                  = \<bar>prod m UNIV\<bar> * \<bar>z - measure lebesgue S\<bar>"
               by (metis (no_types, hide_lams) abs_abs abs_scaleR mult.commute real_scaleR_def right_diff_distrib')
             also have "\<dots> < e"
               using zless True by (simp add: field_simps)
             finally show "\<bar>z *\<^sub>R \<bar>prod m UNIV\<bar> - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar> < e" .
           qed
         qed
       qed
     qed
     then show ?thesis
       by (auto simp: has_integral_integrable integral_unique lmeasure_integral_UNIV measurable_integrable)
   next
     case False
     then obtain k where "m k = 0" and prm: "prod m UNIV = 0"
       by auto
     have nfS: "negligible (?f ` S)"
       by (rule negligible_subset [OF negligible_standard_hyperplane_cart]) (use \<open>m k = 0\<close> in auto)
     then have "(?f ` S) \<in> lmeasurable"
       by (simp add: negligible_iff_measure)
     with nfS show ?thesis
       by (simp add: prm negligible_iff_measure0)
   qed
   then show "(?f ` S) \<in> lmeasurable" ?MEQ
     by metis+
 qed
 
 
 proposition
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes "linear f" "S \<in> lmeasurable"
   shows measurable_linear_image: "(f ` S) \<in> lmeasurable"
     and measure_linear_image: "measure lebesgue (f ` S) = \<bar>det (matrix f)\<bar> * measure lebesgue S" (is "?Q f S")
 proof -
   have "\<forall>S \<in> lmeasurable. (f ` S) \<in> lmeasurable \<and> ?Q f S"
   proof (rule induct_linear_elementary [OF \<open>linear f\<close>]; intro ballI)
     fix f g and S :: "(real,'n) vec set"
     assume "linear f" and "linear g"
       and f [rule_format]: "\<forall>S \<in> lmeasurable. f ` S \<in> lmeasurable \<and> ?Q f S"
       and g [rule_format]: "\<forall>S \<in> lmeasurable. g ` S \<in> lmeasurable \<and> ?Q g S"
       and S: "S \<in> lmeasurable"
     then have gS: "g ` S \<in> lmeasurable"
       by blast
     show "(f \<circ> g) ` S \<in> lmeasurable \<and> ?Q (f \<circ> g) S"
       using f [OF gS] g [OF S] matrix_compose [OF \<open>linear g\<close> \<open>linear f\<close>]
       by (simp add: o_def image_comp abs_mult det_mul)
   next
     fix f :: "real^'n::_ \<Rightarrow> real^'n::_" and i and S :: "(real^'n::_) set"
     assume "linear f" and 0: "\<And>x. f x $ i = 0" and "S \<in> lmeasurable"
     then have "\<not> inj f"
       by (metis (full_types) linear_injective_imp_surjective one_neq_zero surjE vec_component)
     have detf: "det (matrix f) = 0"
       using \<open>\<not> inj f\<close> det_nz_iff_inj[OF \<open>linear f\<close>] by blast
     show "f ` S \<in> lmeasurable \<and> ?Q f S"
     proof
       show "f ` S \<in> lmeasurable"
         using lmeasurable_iff_indicator_has_integral \<open>linear f\<close> \<open>\<not> inj f\<close> negligible_UNIV negligible_linear_singular_image by blast
       have "measure lebesgue (f ` S) = 0"
         by (meson \<open>\<not> inj f\<close> \<open>linear f\<close> negligible_imp_measure0 negligible_linear_singular_image)
       also have "\<dots> = \<bar>det (matrix f)\<bar> * measure lebesgue S"
         by (simp add: detf)
       finally show "?Q f S" .
     qed
   next
     fix c and S :: "(real^'n::_) set"
     assume "S \<in> lmeasurable"
     show "(\<lambda>a. \<chi> i. c i * a $ i) ` S \<in> lmeasurable \<and> ?Q (\<lambda>a. \<chi> i. c i * a $ i) S"
     proof
       show "(\<lambda>a. \<chi> i. c i * a $ i) ` S \<in> lmeasurable"
         by (simp add: \<open>S \<in> lmeasurable\<close> measurable_stretch)
       show "?Q (\<lambda>a. \<chi> i. c i * a $ i) S"
         by (simp add: measure_stretch [OF \<open>S \<in> lmeasurable\<close>, of c] axis_def matrix_def det_diagonal)
     qed
   next
     fix m :: "'n" and n :: "'n" and S :: "(real, 'n) vec set"
     assume "m \<noteq> n" and "S \<in> lmeasurable"
     let ?h = "\<lambda>v::(real, 'n) vec. \<chi> i. v $ Fun.swap m n id i"
     have lin: "linear ?h"
       by (rule linearI) (simp_all add: plus_vec_def scaleR_vec_def)
     have meq: "measure lebesgue ((\<lambda>v::(real, 'n) vec. \<chi> i. v $ Fun.swap m n id i) ` cbox a b)
              = measure lebesgue (cbox a b)" for a b
     proof (cases "cbox a b = {}")
       case True then show ?thesis
         by simp
     next
       case False
       then have him: "?h ` (cbox a b) \<noteq> {}"
         by blast
       have eq: "?h ` (cbox a b) = cbox (?h a) (?h b)"
         by (auto simp: image_iff lambda_swap_Galois mem_box_cart) (metis swap_id_eq)+
       show ?thesis
         using him prod.permute [OF permutes_swap_id, where S=UNIV and g="\<lambda>i. (b - a)$i", symmetric]
         by (simp add: eq content_cbox_cart False)
     qed
     have "(\<chi> i j. if Fun.swap m n id i = j then 1 else 0) = (\<chi> i j. if j = Fun.swap m n id i then 1 else (0::real))"
       by (auto intro!: Cart_lambda_cong)
     then have "matrix ?h = transpose(\<chi> i j. mat 1 $ i $ Fun.swap m n id j)"
       by (auto simp: matrix_eq transpose_def axis_def mat_def matrix_def)
     then have 1: "\<bar>det (matrix ?h)\<bar> = 1"
       by (simp add: det_permute_columns permutes_swap_id sign_swap_id abs_mult)
     show "?h ` S \<in> lmeasurable \<and> ?Q ?h S"
     proof
       show "?h ` S \<in> lmeasurable" "?Q ?h S"
         using measure_linear_sufficient [OF lin \<open>S \<in> lmeasurable\<close>] meq 1 by force+
     qed
   next
     fix m n :: "'n" and S :: "(real, 'n) vec set"
     assume "m \<noteq> n" and "S \<in> lmeasurable"
     let ?h = "\<lambda>v::(real, 'n) vec. \<chi> i. if i = m then v $ m + v $ n else v $ i"
     have lin: "linear ?h"
       by (rule linearI) (auto simp: algebra_simps plus_vec_def scaleR_vec_def vec_eq_iff)
     consider "m < n" | " n < m"
       using \<open>m \<noteq> n\<close> less_linear by blast
     then have 1: "det(matrix ?h) = 1"
     proof cases
       assume "m < n"
       have *: "matrix ?h $ i $ j = (0::real)" if "j < i" for i j :: 'n
       proof -
         have "axis j 1 = (\<chi> n. if n = j then 1 else (0::real))"
           using axis_def by blast
         then have "(\<chi> p q. if p = m then axis q 1 $ m + axis q 1 $ n else axis q 1 $ p) $ i $ j = (0::real)"
           using \<open>j < i\<close> axis_def \<open>m < n\<close> by auto
         with \<open>m < n\<close> show ?thesis
           by (auto simp: matrix_def axis_def cong: if_cong)
       qed
       show ?thesis
         using \<open>m \<noteq> n\<close> by (subst det_upperdiagonal [OF *]) (auto simp: matrix_def axis_def cong: if_cong)
     next
       assume "n < m"
       have *: "matrix ?h $ i $ j = (0::real)" if "j > i" for i j :: 'n
       proof -
         have "axis j 1 = (\<chi> n. if n = j then 1 else (0::real))"
           using axis_def by blast
         then have "(\<chi> p q. if p = m then axis q 1 $ m + axis q 1 $ n else axis q 1 $ p) $ i $ j = (0::real)"
           using \<open>j > i\<close> axis_def \<open>m > n\<close> by auto
         with \<open>m > n\<close> show ?thesis
           by (auto simp: matrix_def axis_def cong: if_cong)
       qed
       show ?thesis
         using \<open>m \<noteq> n\<close>
         by (subst det_lowerdiagonal [OF *]) (auto simp: matrix_def axis_def cong: if_cong)
     qed
     have meq: "measure lebesgue (?h ` (cbox a b)) = measure lebesgue (cbox a b)" for a b
     proof (cases "cbox a b = {}")
       case True then show ?thesis by simp
     next
       case False
       then have ne: "(+) (\<chi> i. if i = n then - a $ n else 0) ` cbox a b \<noteq> {}"
         by auto
       let ?v = "\<chi> i. if i = n then - a $ n else 0"
       have "?h ` cbox a b
             = (+) (\<chi> i. if i = m \<or> i = n then a $ n else 0) ` ?h ` (+) ?v ` (cbox a b)"
         using \<open>m \<noteq> n\<close> unfolding image_comp o_def by (force simp: vec_eq_iff)
       then have "measure lebesgue (?h ` (cbox a b))
                = measure lebesgue ((\<lambda>v. \<chi> i. if i = m then v $ m + v $ n else v $ i) `
                                    (+) ?v ` cbox a b)"
         by (rule ssubst) (rule measure_translation)
       also have "\<dots> = measure lebesgue ((\<lambda>v. \<chi> i. if i = m then v $ m + v $ n else v $ i) ` cbox (?v +a) (?v + b))"
         by (metis (no_types, lifting) cbox_translation)
       also have "\<dots> = measure lebesgue ((+) (\<chi> i. if i = n then - a $ n else 0) ` cbox a b)"
         apply (subst measure_shear_interval)
         using \<open>m \<noteq> n\<close> ne apply auto
         apply (simp add: cbox_translation)
         by (metis cbox_borel cbox_translation measure_completion sets_lborel)
       also have "\<dots> = measure lebesgue (cbox a b)"
         by (rule measure_translation)
         finally show ?thesis .
       qed
     show "?h ` S \<in> lmeasurable \<and> ?Q ?h S"
       using measure_linear_sufficient [OF lin \<open>S \<in> lmeasurable\<close>] meq 1 by force
   qed
   with assms show "(f ` S) \<in> lmeasurable" "?Q f S"
     by metis+
 qed
 
 
 lemma
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes f: "orthogonal_transformation f" and S: "S \<in> lmeasurable"
   shows measurable_orthogonal_image: "f ` S \<in> lmeasurable"
     and measure_orthogonal_image: "measure lebesgue (f ` S) = measure lebesgue S"
 proof -
   have "linear f"
     by (simp add: f orthogonal_transformation_linear)
   then show "f ` S \<in> lmeasurable"
     by (metis S measurable_linear_image)
   show "measure lebesgue (f ` S) = measure lebesgue S"
     by (simp add: measure_linear_image \<open>linear f\<close> S f)
 qed
 
 proposition measure_semicontinuous_with_hausdist_explicit:
   assumes "bounded S" and neg: "negligible(frontier S)" and "e > 0"
   obtains d where "d > 0"
                   "\<And>T. \<lbrakk>T \<in> lmeasurable; \<And>y. y \<in> T \<Longrightarrow> \<exists>x. x \<in> S \<and> dist x y < d\<rbrakk>
                         \<Longrightarrow> measure lebesgue T < measure lebesgue S + e"
 proof (cases "S = {}")
   case True
   with that \<open>e > 0\<close> show ?thesis by force
 next
   case False
   then have frS: "frontier S \<noteq> {}"
     using \<open>bounded S\<close> frontier_eq_empty not_bounded_UNIV by blast
   have "S \<in> lmeasurable"
     by (simp add: \<open>bounded S\<close> measurable_Jordan neg)
   have null: "(frontier S) \<in> null_sets lebesgue"
     by (metis neg negligible_iff_null_sets)
   have "frontier S \<in> lmeasurable" and mS0: "measure lebesgue (frontier S) = 0"
     using neg negligible_imp_measurable negligible_iff_measure by blast+
   with \<open>e > 0\<close> sets_lebesgue_outer_open
   obtain U where "open U"
     and U: "frontier S \<subseteq> U" "U - frontier S \<in> lmeasurable" "emeasure lebesgue (U - frontier S) < e"
     by (metis fmeasurableD)
   with null have "U \<in> lmeasurable"
     by (metis borel_open measurable_Diff_null_set sets_completionI_sets sets_lborel)
   have "measure lebesgue (U - frontier S) = measure lebesgue U"
     using mS0 by (simp add: \<open>U \<in> lmeasurable\<close> fmeasurableD measure_Diff_null_set null)
   with U have mU: "measure lebesgue U < e"
     by (simp add: emeasure_eq_measure2 ennreal_less_iff)
   show ?thesis
   proof
     have "U \<noteq> UNIV"
       using \<open>U \<in> lmeasurable\<close> by auto
     then have "- U \<noteq> {}"
       by blast
     with \<open>open U\<close> \<open>frontier S \<subseteq> U\<close> show "setdist (frontier S) (- U) > 0"
       by (auto simp: \<open>bounded S\<close> open_closed compact_frontier_bounded setdist_gt_0_compact_closed frS)
     fix T
     assume "T \<in> lmeasurable"
       and T: "\<And>t. t \<in> T \<Longrightarrow> \<exists>y. y \<in> S \<and> dist y t < setdist (frontier S) (- U)"
     then have "measure lebesgue T - measure lebesgue S \<le> measure lebesgue (T - S)"
       by (simp add: \<open>S \<in> lmeasurable\<close> measure_diff_le_measure_setdiff)
     also have "\<dots>  \<le> measure lebesgue U"
     proof -
       have "T - S \<subseteq> U"
       proof clarify
         fix x
         assume "x \<in> T" and "x \<notin> S"
         then obtain y where "y \<in> S" and y: "dist y x < setdist (frontier S) (- U)"
           using T by blast
         have "closed_segment x y \<inter> frontier S \<noteq> {}"
           using connected_Int_frontier \<open>x \<notin> S\<close> \<open>y \<in> S\<close> by blast
         then obtain z where z: "z \<in> closed_segment x y" "z \<in> frontier S"
           by auto
         with y have "dist z x < setdist(frontier S) (- U)"
           by (auto simp: dist_commute dest!: dist_in_closed_segment)
         with z have False if "x \<in> -U"
           using setdist_le_dist [OF \<open>z \<in> frontier S\<close> that] by auto
         then show "x \<in> U"
           by blast
       qed
       then show ?thesis
         by (simp add: \<open>S \<in> lmeasurable\<close> \<open>T \<in> lmeasurable\<close> \<open>U \<in> lmeasurable\<close> fmeasurableD measure_mono_fmeasurable sets.Diff)
     qed
     finally have "measure lebesgue T - measure lebesgue S \<le> measure lebesgue U" .
     with mU show "measure lebesgue T < measure lebesgue S + e"
       by linarith
   qed
 qed
 
 proposition
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> lmeasurable"
   and deriv: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   and int: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   and bounded: "\<And>x. x \<in> S \<Longrightarrow> \<bar>det (matrix (f' x))\<bar> \<le> B"
   shows measurable_bounded_differentiable_image:
        "f ` S \<in> lmeasurable"
     and measure_bounded_differentiable_image:
        "measure lebesgue (f ` S) \<le> B * measure lebesgue S" (is "?M")
 proof -
   have "f ` S \<in> lmeasurable \<and> measure lebesgue (f ` S) \<le> B * measure lebesgue S"
   proof (cases "B < 0")
     case True
     then have "S = {}"
       by (meson abs_ge_zero bounded empty_iff equalityI less_le_trans linorder_not_less subsetI)
     then show ?thesis
       by auto
   next
     case False
     then have "B \<ge> 0"
       by arith
     let ?\<mu> = "measure lebesgue"
     have f_diff: "f differentiable_on S"
       using deriv by (auto simp: differentiable_on_def differentiable_def)
     have eps: "f ` S \<in> lmeasurable" "?\<mu> (f ` S) \<le> (B+e) * ?\<mu> S" (is "?ME")
               if "e > 0" for e
     proof -
       have eps_d: "f ` S \<in> lmeasurable"  "?\<mu> (f ` S) \<le> (B+e) * (?\<mu> S + d)" (is "?MD")
                   if "d > 0" for d
       proof -
         obtain T where T: "open T" "S \<subseteq> T" and TS: "(T-S) \<in> lmeasurable" and "emeasure lebesgue (T-S) < ennreal d"
           using S \<open>d > 0\<close> sets_lebesgue_outer_open by blast
         then have "?\<mu> (T-S) < d"
           by (metis emeasure_eq_measure2 ennreal_leI not_less)
         with S T TS have "T \<in> lmeasurable" and Tless: "?\<mu> T < ?\<mu> S + d"
           by (auto simp: measurable_measure_Diff dest!: fmeasurable_Diff_D)
         have "\<exists>r. 0 < r \<and> r < d \<and> ball x r \<subseteq> T \<and> f ` (S \<inter> ball x r) \<in> lmeasurable \<and>
                   ?\<mu> (f ` (S \<inter> ball x r)) \<le> (B + e) * ?\<mu> (ball x r)"
           if "x \<in> S" "d > 0" for x d
         proof -
           have lin: "linear (f' x)"
             and lim0: "((\<lambda>y. (f y - (f x + f' x (y - x))) /\<^sub>R norm(y - x)) \<longlongrightarrow> 0) (at x within S)"
             using deriv \<open>x \<in> S\<close> by (auto simp: has_derivative_within bounded_linear.linear field_simps)
           have bo: "bounded (f' x ` ball 0 1)"
             by (simp add: bounded_linear_image linear_linear lin)
           have neg: "negligible (frontier (f' x ` ball 0 1))"
             using deriv has_derivative_linear \<open>x \<in> S\<close>
             by (auto intro!: negligible_convex_frontier [OF convex_linear_image])
           let ?unit_vol = "content (ball (0 :: real ^ 'n :: {finite, wellorder}) 1)"
           have 0: "0 < e * ?unit_vol"
             using \<open>e > 0\<close> by (simp add: content_ball_pos)
           obtain k where "k > 0" and k:
                   "\<And>U. \<lbrakk>U \<in> lmeasurable; \<And>y. y \<in> U \<Longrightarrow> \<exists>z. z \<in> f' x ` ball 0 1 \<and> dist z y < k\<rbrakk>
                         \<Longrightarrow> ?\<mu> U < ?\<mu> (f' x ` ball 0 1) + e * ?unit_vol"
             using measure_semicontinuous_with_hausdist_explicit [OF bo neg 0] by blast
           obtain l where "l > 0" and l: "ball x l \<subseteq> T"
             using \<open>x \<in> S\<close> \<open>open T\<close> \<open>S \<subseteq> T\<close> openE by blast
           obtain \<zeta> where "0 < \<zeta>"
             and \<zeta>: "\<And>y. \<lbrakk>y \<in> S; y \<noteq> x; dist y x < \<zeta>\<rbrakk>
                         \<Longrightarrow> norm (f y - (f x + f' x (y - x))) / norm (y - x) < k"
             using lim0 \<open>k > 0\<close> by (simp add: Lim_within) (auto simp add: field_simps)
           define r where "r \<equiv> min (min l (\<zeta>/2)) (min 1 (d/2))"
           show ?thesis
           proof (intro exI conjI)
             show "r > 0" "r < d"
               using \<open>l > 0\<close> \<open>\<zeta> > 0\<close> \<open>d > 0\<close> by (auto simp: r_def)
             have "r \<le> l"
               by (auto simp: r_def)
             with l show "ball x r \<subseteq> T"
               by auto
             have ex_lessK: "\<exists>x' \<in> ball 0 1. dist (f' x x') ((f y - f x) /\<^sub>R r) < k"
               if "y \<in> S" and "dist x y < r" for y
             proof (cases "y = x")
               case True
               with lin linear_0 \<open>k > 0\<close> that show ?thesis
                 by (rule_tac x=0 in bexI) (auto simp: linear_0)
             next
               case False
               then show ?thesis
               proof (rule_tac x="(y - x) /\<^sub>R r" in bexI)
                 have "f' x ((y - x) /\<^sub>R r) = f' x (y - x) /\<^sub>R r"
                   by (simp add: lin linear_scale)
                 then have "dist (f' x ((y - x) /\<^sub>R r)) ((f y - f x) /\<^sub>R r) = norm (f' x (y - x) /\<^sub>R r - (f y - f x) /\<^sub>R r)"
                   by (simp add: dist_norm)
                 also have "\<dots> = norm (f' x (y - x) - (f y - f x)) / r"
                   using \<open>r > 0\<close> by (simp add: divide_simps scale_right_diff_distrib [symmetric])
                 also have "\<dots> \<le> norm (f y - (f x + f' x (y - x))) / norm (y - x)"
                   using that \<open>r > 0\<close> False by (simp add: field_split_simps dist_norm norm_minus_commute mult_right_mono)
                 also have "\<dots> < k"
                   using that \<open>0 < \<zeta>\<close> by (simp add: dist_commute r_def  \<zeta> [OF \<open>y \<in> S\<close> False])
                 finally show "dist (f' x ((y - x) /\<^sub>R r)) ((f y - f x) /\<^sub>R r) < k" .
                 show "(y - x) /\<^sub>R r \<in> ball 0 1"
                   using that \<open>r > 0\<close> by (simp add: dist_norm divide_simps norm_minus_commute)
               qed
             qed
             let ?rfs = "(\<lambda>x. x /\<^sub>R r) ` (+) (- f x) ` f ` (S \<inter> ball x r)"
             have rfs_mble: "?rfs \<in> lmeasurable"
             proof (rule bounded_set_imp_lmeasurable)
               have "f differentiable_on S \<inter> ball x r"
                 using f_diff by (auto simp: fmeasurableD differentiable_on_subset)
               with S show "?rfs \<in> sets lebesgue"
                 by (auto simp: sets.Int intro!: lebesgue_sets_translation differentiable_image_in_sets_lebesgue)
               let ?B = "(\<lambda>(x, y). x + y) ` (f' x ` ball 0 1 \<times> ball 0 k)"
               have "bounded ?B"
                 by (simp add: bounded_plus [OF bo])
               moreover have "?rfs \<subseteq> ?B"
                 apply (auto simp: dist_norm image_iff dest!: ex_lessK)
                 by (metis (no_types, hide_lams) add.commute diff_add_cancel dist_0_norm dist_commute dist_norm mem_ball)
               ultimately show "bounded (?rfs)"
                 by (rule bounded_subset)
             qed
             then have "(\<lambda>x. r *\<^sub>R x) ` ?rfs \<in> lmeasurable"
               by (simp add: measurable_linear_image)
             with \<open>r > 0\<close> have "(+) (- f x) ` f ` (S \<inter> ball x r) \<in> lmeasurable"
               by (simp add: image_comp o_def)
             then have "(+) (f x) ` (+) (- f x) ` f ` (S \<inter> ball x r) \<in> lmeasurable"
               using  measurable_translation by blast
             then show fsb: "f ` (S \<inter> ball x r) \<in> lmeasurable"
               by (simp add: image_comp o_def)
             have "?\<mu> (f ` (S \<inter> ball x r)) = ?\<mu> (?rfs) * r ^ CARD('n)"
               using \<open>r > 0\<close> fsb
               by (simp add: measure_linear_image measure_translation_subtract measurable_translation_subtract field_simps cong: image_cong_simp)
             also have "\<dots> \<le> (\<bar>det (matrix (f' x))\<bar> * ?unit_vol + e * ?unit_vol) * r ^ CARD('n)"
             proof -
               have "?\<mu> (?rfs) < ?\<mu> (f' x ` ball 0 1) + e * ?unit_vol"
                 using rfs_mble by (force intro: k dest!: ex_lessK)
               then have "?\<mu> (?rfs) < \<bar>det (matrix (f' x))\<bar> * ?unit_vol + e * ?unit_vol"
                 by (simp add: lin measure_linear_image [of "f' x"])
               with \<open>r > 0\<close> show ?thesis
                 by auto
             qed
             also have "\<dots> \<le> (B + e) * ?\<mu> (ball x r)"
               using bounded [OF \<open>x \<in> S\<close>] \<open>r > 0\<close>
               by (simp add: algebra_simps content_ball_conv_unit_ball[of r] content_ball_pos)
             finally show "?\<mu> (f ` (S \<inter> ball x r)) \<le> (B + e) * ?\<mu> (ball x r)" .
           qed
         qed
         then obtain r where
           r0d: "\<And>x d. \<lbrakk>x \<in> S; d > 0\<rbrakk> \<Longrightarrow> 0 < r x d \<and> r x d < d"
           and rT: "\<And>x d. \<lbrakk>x \<in> S; d > 0\<rbrakk> \<Longrightarrow> ball x (r x d) \<subseteq> T"
           and r: "\<And>x d. \<lbrakk>x \<in> S; d > 0\<rbrakk> \<Longrightarrow>
                   (f ` (S \<inter> ball x (r x d))) \<in> lmeasurable \<and>
                   ?\<mu> (f ` (S \<inter> ball x (r x d))) \<le> (B + e) * ?\<mu> (ball x (r x d))"
           by metis
         obtain C where "countable C" and Csub: "C \<subseteq> {(x,r x t) |x t. x \<in> S \<and> 0 < t}"
           and pwC: "pairwise (\<lambda>i j. disjnt (ball (fst i) (snd i)) (ball (fst j) (snd j))) C"
           and negC: "negligible(S - (\<Union>i \<in> C. ball (fst i) (snd i)))"
           apply (rule Vitali_covering_theorem_balls [of S "{(x,r x t) |x t. x \<in> S \<and> 0 < t}" fst snd])
            apply auto
           by (metis dist_eq_0_iff r0d)
         let ?UB = "(\<Union>(x,s) \<in> C. ball x s)"
         have eq: "f ` (S \<inter> ?UB) = (\<Union>(x,s) \<in> C. f ` (S \<inter> ball x s))"
           by auto
         have mle: "?\<mu> (\<Union>(x,s) \<in> K. f ` (S \<inter> ball x s)) \<le> (B + e) * (?\<mu> S + d)"  (is "?l \<le> ?r")
           if "K \<subseteq> C" and "finite K" for K
         proof -
           have gt0: "b > 0" if "(a, b) \<in> K" for a b
             using Csub that \<open>K \<subseteq> C\<close> r0d by auto
           have inj: "inj_on (\<lambda>(x, y). ball x y) K"
             by (force simp: inj_on_def ball_eq_ball_iff dest: gt0)
           have disjnt: "disjoint ((\<lambda>(x, y). ball x y) ` K)"
             using pwC that
             apply (clarsimp simp: pairwise_def case_prod_unfold ball_eq_ball_iff)
             by (metis subsetD fst_conv snd_conv)
           have "?l \<le> (\<Sum>i\<in>K. ?\<mu> (case i of (x, s) \<Rightarrow> f ` (S \<inter> ball x s)))"
           proof (rule measure_UNION_le [OF \<open>finite K\<close>], clarify)
             fix x r
             assume "(x,r) \<in> K"
             then have "x \<in> S"
               using Csub \<open>K \<subseteq> C\<close> by auto
             show "f ` (S \<inter> ball x r) \<in> sets lebesgue"
               by (meson Int_lower1 S differentiable_on_subset f_diff fmeasurableD lmeasurable_ball order_refl sets.Int differentiable_image_in_sets_lebesgue)
           qed
           also have "\<dots> \<le> (\<Sum>(x,s) \<in> K. (B + e) * ?\<mu> (ball x s))"
             apply (rule sum_mono)
             using Csub r \<open>K \<subseteq> C\<close> by auto
           also have "\<dots> = (B + e) * (\<Sum>(x,s) \<in> K. ?\<mu> (ball x s))"
             by (simp add: prod.case_distrib sum_distrib_left)
           also have "\<dots> = (B + e) * sum ?\<mu> ((\<lambda>(x, y). ball x y) ` K)"
             using \<open>B \<ge> 0\<close> \<open>e > 0\<close> by (simp add: inj sum.reindex prod.case_distrib)
           also have "\<dots> = (B + e) * ?\<mu> (\<Union>(x,s) \<in> K. ball x s)"
             using \<open>B \<ge> 0\<close> \<open>e > 0\<close> that
             by (subst measure_Union') (auto simp: disjnt measure_Union')
           also have "\<dots> \<le> (B + e) * ?\<mu> T"
             using \<open>B \<ge> 0\<close> \<open>e > 0\<close> that apply simp
             apply (rule measure_mono_fmeasurable [OF _ _ \<open>T \<in> lmeasurable\<close>])
             using Csub rT by force+
           also have "\<dots> \<le> (B + e) * (?\<mu> S + d)"
             using \<open>B \<ge> 0\<close> \<open>e > 0\<close> Tless by simp
           finally show ?thesis .
         qed
         have fSUB_mble: "(f ` (S \<inter> ?UB)) \<in> lmeasurable"
           unfolding eq using Csub r False \<open>e > 0\<close> that
           by (auto simp: intro!: fmeasurable_UN_bound [OF \<open>countable C\<close> _ mle])
         have fSUB_meas: "?\<mu> (f ` (S \<inter> ?UB)) \<le> (B + e) * (?\<mu> S + d)"  (is "?MUB")
           unfolding eq using Csub r False \<open>e > 0\<close> that
           by (auto simp: intro!: measure_UN_bound [OF \<open>countable C\<close> _ mle])
         have neg: "negligible ((f ` (S \<inter> ?UB) - f ` S) \<union> (f ` S - f ` (S \<inter> ?UB)))"
         proof (rule negligible_subset [OF negligible_differentiable_image_negligible [OF order_refl negC, where f=f]])
           show "f differentiable_on S - (\<Union>i\<in>C. ball (fst i) (snd i))"
             by (meson DiffE differentiable_on_subset subsetI f_diff)
         qed force
         show "f ` S \<in> lmeasurable"
           by (rule lmeasurable_negligible_symdiff [OF fSUB_mble neg])
         show ?MD
           using fSUB_meas measure_negligible_symdiff [OF fSUB_mble neg] by simp
       qed
       show "f ` S \<in> lmeasurable"
         using eps_d [of 1] by simp
       show ?ME
       proof (rule field_le_epsilon)
         fix \<delta> :: real
         assume "0 < \<delta>"
         then show "?\<mu> (f ` S) \<le> (B + e) * ?\<mu> S + \<delta>"
           using eps_d [of "\<delta> / (B+e)"] \<open>e > 0\<close> \<open>B \<ge> 0\<close> by (auto simp: divide_simps mult_ac)
       qed
     qed
     show ?thesis
     proof (cases "?\<mu> S = 0")
       case True
       with eps have "?\<mu> (f ` S) = 0"
         by (metis mult_zero_right not_le zero_less_measure_iff)
       then show ?thesis
         using eps [of 1] by (simp add: True)
     next
       case False
       have "?\<mu> (f ` S) \<le> B * ?\<mu> S"
       proof (rule field_le_epsilon)
         fix e :: real
         assume "e > 0"
         then show "?\<mu> (f ` S) \<le> B * ?\<mu> S + e"
           using eps [of "e / ?\<mu> S"] False by (auto simp: algebra_simps zero_less_measure_iff)
       qed
       with eps [of 1] show ?thesis by auto
     qed
   qed
   then show "f ` S \<in> lmeasurable" ?M by blast+
 qed
 
 lemma m_diff_image_weak:
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> lmeasurable"
     and deriv: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and int: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   shows "f ` S \<in> lmeasurable \<and> measure lebesgue (f ` S) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
 proof -
   let ?\<mu> = "measure lebesgue"
   have aint_S: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on S"
     using int unfolding absolutely_integrable_on_def by auto
   define m where "m \<equiv> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
   have *: "f ` S \<in> lmeasurable" "?\<mu> (f ` S) \<le> m + e * ?\<mu> S"
     if "e > 0" for e
   proof -
     define T where "T \<equiv> \<lambda>n. {x \<in> S. n * e \<le> \<bar>det (matrix (f' x))\<bar> \<and>
                                      \<bar>det (matrix (f' x))\<bar> < (Suc n) * e}"
     have meas_t: "T n \<in> lmeasurable" for n
     proof -
       have *: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) \<in> borel_measurable (lebesgue_on S)"
         using aint_S by (simp add: S borel_measurable_restrict_space_iff fmeasurableD set_integrable_def)
       have [intro]: "x \<in> sets (lebesgue_on S) \<Longrightarrow> x \<in> sets lebesgue" for x
         using S sets_restrict_space_subset by blast
       have "{x \<in> S. real n * e \<le> \<bar>det (matrix (f' x))\<bar>} \<in> sets lebesgue"
         using * by (auto simp: borel_measurable_iff_halfspace_ge space_restrict_space)
       then have 1: "{x \<in> S. real n * e \<le> \<bar>det (matrix (f' x))\<bar>} \<in> lmeasurable"
         using S by (simp add: fmeasurableI2)
       have "{x \<in> S. \<bar>det (matrix (f' x))\<bar> < (1 + real n) * e} \<in> sets lebesgue"
         using * by (auto simp: borel_measurable_iff_halfspace_less space_restrict_space)
       then have 2: "{x \<in> S. \<bar>det (matrix (f' x))\<bar> < (1 + real n) * e} \<in> lmeasurable"
         using S by (simp add: fmeasurableI2)
       show ?thesis
         using fmeasurable.Int [OF 1 2] by (simp add: T_def Int_def cong: conj_cong)
     qed
     have aint_T: "\<And>k. (\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on T k"
       using set_integrable_subset [OF aint_S] meas_t T_def by blast
     have Seq: "S = (\<Union>n. T n)"
       apply (auto simp: T_def)
       apply (rule_tac x="nat(floor(abs(det(matrix(f' x))) / e))" in exI)
       using that apply auto
       using of_int_floor_le pos_le_divide_eq apply blast
       by (metis add.commute pos_divide_less_eq real_of_int_floor_add_one_gt)
     have meas_ft: "f ` T n \<in> lmeasurable" for n
     proof (rule measurable_bounded_differentiable_image)
       show "T n \<in> lmeasurable"
         by (simp add: meas_t)
     next
       fix x :: "(real,'n) vec"
       assume "x \<in> T n"
       show "(f has_derivative f' x) (at x within T n)"
         by (metis (no_types, lifting) \<open>x \<in> T n\<close> deriv has_derivative_subset mem_Collect_eq subsetI T_def)
       show "\<bar>det (matrix (f' x))\<bar> \<le> (Suc n) * e"
         using \<open>x \<in> T n\<close> T_def by auto
     next
       show "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on T n"
         using aint_T absolutely_integrable_on_def by blast
     qed
     have disT: "disjoint (range T)"
       unfolding disjoint_def
     proof clarsimp
       show "T m \<inter> T n = {}" if "T m \<noteq> T n" for m n
         using that
       proof (induction m n rule: linorder_less_wlog)
         case (less m n)
         with \<open>e > 0\<close> show ?case
           unfolding T_def
           proof (clarsimp simp add: Collect_conj_eq [symmetric])
             fix x
             assume "e > 0"  "m < n"  "n * e \<le> \<bar>det (matrix (f' x))\<bar>"  "\<bar>det (matrix (f' x))\<bar> < (1 + real m) * e"
             then have "n < 1 + real m"
               by (metis (no_types, hide_lams) less_le_trans mult.commute not_le mult_le_cancel_iff2)
             then show "False"
               using less.hyps by linarith
           qed
       qed auto
     qed
     have injT: "inj_on T ({n. T n \<noteq> {}})"
       unfolding inj_on_def
     proof clarsimp
       show "m = n" if "T m = T n" "T n \<noteq> {}" for m n
         using that
       proof (induction m n rule: linorder_less_wlog)
         case (less m n)
         have False if "T n \<subseteq> T m" "x \<in> T n" for x
           using \<open>e > 0\<close> \<open>m < n\<close> that
           apply (auto simp: T_def  mult.commute intro: less_le_trans dest!: subsetD)
           by (metis add.commute less_le_trans nat_less_real_le not_le mult_le_cancel_iff2)
         then show ?case
           using less.prems by blast
       qed auto
     qed
     have sum_eq_Tim: "(\<Sum>k\<le>n. f (T k)) = sum f (T ` {..n})" if "f {} = 0" for f :: "_ \<Rightarrow> real" and n
     proof (subst sum.reindex_nontrivial)
       fix i j  assume "i \<in> {..n}" "j \<in> {..n}" "i \<noteq> j" "T i = T j"
       with that  injT [unfolded inj_on_def] show "f (T i) = 0"
         by simp metis
     qed (use atMost_atLeast0 in auto)
     let ?B = "m + e * ?\<mu> S"
     have "(\<Sum>k\<le>n. ?\<mu> (f ` T k)) \<le> ?B" for n
     proof -
       have "(\<Sum>k\<le>n. ?\<mu> (f ` T k)) \<le> (\<Sum>k\<le>n. ((k+1) * e) * ?\<mu>(T k))"
       proof (rule sum_mono [OF measure_bounded_differentiable_image])
         show "(f has_derivative f' x) (at x within T k)" if "x \<in> T k" for k x
           using that unfolding T_def by (blast intro: deriv has_derivative_subset)
         show "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on T k" for k
           using absolutely_integrable_on_def aint_T by blast
         show "\<bar>det (matrix (f' x))\<bar> \<le> real (k + 1) * e" if "x \<in> T k" for k x
           using T_def that by auto
       qed (use meas_t in auto)
       also have "\<dots> \<le> (\<Sum>k\<le>n. (k * e) * ?\<mu>(T k)) + (\<Sum>k\<le>n. e * ?\<mu>(T k))"
         by (simp add: algebra_simps sum.distrib)
       also have "\<dots> \<le> ?B"
       proof (rule add_mono)
         have "(\<Sum>k\<le>n. real k * e * ?\<mu> (T k)) = (\<Sum>k\<le>n. integral (T k) (\<lambda>x. k * e))"
           by (simp add: lmeasure_integral [OF meas_t]
                    flip: integral_mult_right integral_mult_left)
         also have "\<dots> \<le> (\<Sum>k\<le>n. integral (T k) (\<lambda>x.  (abs (det (matrix (f' x))))))"
         proof (rule sum_mono)
           fix k
           assume "k \<in> {..n}"
           show "integral (T k) (\<lambda>x. k * e) \<le> integral (T k) (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
           proof (rule integral_le [OF integrable_on_const [OF meas_t]])
             show "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on T k"
               using absolutely_integrable_on_def aint_T by blast
           next
             fix x assume "x \<in> T k"
             show "k * e \<le> \<bar>det (matrix (f' x))\<bar>"
               using \<open>x \<in> T k\<close> T_def by blast
           qed
         qed
         also have "\<dots> = sum (\<lambda>T. integral T (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)) (T ` {..n})"
           by (auto intro: sum_eq_Tim)
         also have "\<dots> = integral (\<Union>k\<le>n. T k) (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
         proof (rule integral_unique [OF has_integral_Union, symmetric])
           fix S  assume "S \<in> T ` {..n}"
           then show "((\<lambda>x. \<bar>det (matrix (f' x))\<bar>) has_integral integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)) S"
           using absolutely_integrable_on_def aint_T by blast
         next
           show "pairwise (\<lambda>S S'. negligible (S \<inter> S')) (T ` {..n})"
             using disT unfolding disjnt_iff by (auto simp: pairwise_def intro!: empty_imp_negligible)
         qed auto
         also have "\<dots> \<le> m"
           unfolding m_def
         proof (rule integral_subset_le)
           have "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on (\<Union>k\<le>n. T k)"
             apply (rule set_integrable_subset [OF aint_S])
              apply (intro measurable meas_t fmeasurableD)
             apply (force simp: Seq)
             done
           then show "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on (\<Union>k\<le>n. T k)"
             using absolutely_integrable_on_def by blast
         qed (use Seq int in auto)
         finally show "(\<Sum>k\<le>n. real k * e * ?\<mu> (T k)) \<le> m" .
       next
         have "(\<Sum>k\<le>n. ?\<mu> (T k)) = sum ?\<mu> (T ` {..n})"
           by (auto intro: sum_eq_Tim)
         also have "\<dots> = ?\<mu> (\<Union>k\<le>n. T k)"
           using S disT by (auto simp: pairwise_def meas_t intro: measure_Union' [symmetric])
         also have "\<dots> \<le> ?\<mu> S"
           using S by (auto simp: Seq intro: meas_t fmeasurableD measure_mono_fmeasurable)
         finally have "(\<Sum>k\<le>n. ?\<mu> (T k)) \<le> ?\<mu> S" .
         then show "(\<Sum>k\<le>n. e * ?\<mu> (T k)) \<le> e * ?\<mu> S"
           by (metis less_eq_real_def ordered_comm_semiring_class.comm_mult_left_mono sum_distrib_left that)
       qed
       finally show "(\<Sum>k\<le>n. ?\<mu> (f ` T k)) \<le> ?B" .
     qed
     moreover have "measure lebesgue (\<Union>k\<le>n. f ` T k) \<le> (\<Sum>k\<le>n. ?\<mu> (f ` T k))" for n
       by (simp add: fmeasurableD meas_ft measure_UNION_le)
     ultimately have B_ge_m: "?\<mu> (\<Union>k\<le>n. (f ` T k)) \<le> ?B" for n
       by (meson order_trans)
     have "(\<Union>n. f ` T n) \<in> lmeasurable"
       by (rule fmeasurable_countable_Union [OF meas_ft B_ge_m])
     moreover have "?\<mu> (\<Union>n. f ` T n) \<le> m + e * ?\<mu> S"
       by (rule measure_countable_Union_le [OF meas_ft B_ge_m])
     ultimately show "f ` S \<in> lmeasurable" "?\<mu> (f ` S) \<le> m + e * ?\<mu> S"
       by (auto simp: Seq image_Union)
   qed
   show ?thesis
   proof
     show "f ` S \<in> lmeasurable"
       using * linordered_field_no_ub by blast
     let ?x = "m - ?\<mu> (f ` S)"
     have False if "?\<mu> (f ` S) > integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
     proof -
       have ml: "m < ?\<mu> (f ` S)"
         using m_def that by blast
       then have "?\<mu> S \<noteq> 0"
         using "*"(2) bgauge_existence_lemma by fastforce
       with ml have 0: "0 < - (m - ?\<mu> (f ` S))/2 / ?\<mu> S"
         using that zero_less_measure_iff by force
       then show ?thesis
         using * [OF 0] that by (auto simp: field_split_simps m_def split: if_split_asm)
     qed
     then show "?\<mu> (f ` S) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
       by fastforce
   qed
 qed
 
 
 theorem
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> sets lebesgue"
     and deriv: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and int: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   shows measurable_differentiable_image: "f ` S \<in> lmeasurable"
     and measure_differentiable_image:
        "measure lebesgue (f ` S) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)" (is "?M")
 proof -
   let ?I = "\<lambda>n::nat. cbox (vec (-n)) (vec n) \<inter> S"
   let ?\<mu> = "measure lebesgue"
   have "x \<in> cbox (vec (- real (nat \<lceil>norm x\<rceil>))) (vec (real (nat \<lceil>norm x\<rceil>)))" for x :: "real^'n::_"
     apply (auto simp: mem_box_cart)
     apply (metis abs_le_iff component_le_norm_cart minus_le_iff of_nat_ceiling order.trans)
     by (meson abs_le_D1 norm_bound_component_le_cart real_nat_ceiling_ge)
   then have Seq: "S = (\<Union>n. ?I n)"
     by auto
   have fIn: "f ` ?I n \<in> lmeasurable"
        and mfIn: "?\<mu> (f ` ?I n) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)" (is ?MN) for n
   proof -
     have In: "?I n \<in> lmeasurable"
       by (simp add: S bounded_Int bounded_set_imp_lmeasurable sets.Int)
     moreover have "\<And>x. x \<in> ?I n \<Longrightarrow> (f has_derivative f' x) (at x within ?I n)"
       by (meson Int_iff deriv has_derivative_subset subsetI)
     moreover have int_In: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on ?I n"
     proof -
       have "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on S"
         using int absolutely_integrable_integrable_bound by force
       then have "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on ?I n"
         by (metis (no_types) Int_lower1 In fmeasurableD inf_commute set_integrable_subset)
       then show ?thesis
         using absolutely_integrable_on_def by blast
     qed
     ultimately have "f ` ?I n \<in> lmeasurable" "?\<mu> (f ` ?I n) \<le> integral (?I n) (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
       using m_diff_image_weak by metis+
     moreover have "integral (?I n) (\<lambda>x. \<bar>det (matrix (f' x))\<bar>) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
       by (simp add: int_In int integral_subset_le)
     ultimately show "f ` ?I n \<in> lmeasurable" ?MN
       by auto
   qed
   have "?I k \<subseteq> ?I n" if "k \<le> n" for k n
     by (rule Int_mono) (use that in \<open>auto simp: subset_interval_imp_cart\<close>)
   then have "(\<Union>k\<le>n. f ` ?I k) = f ` ?I n" for n
     by (fastforce simp add:)
   with mfIn have "?\<mu> (\<Union>k\<le>n. f ` ?I k) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)" for n
     by simp
   then have "(\<Union>n. f ` ?I n) \<in> lmeasurable" "?\<mu> (\<Union>n. f ` ?I n) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
     by (rule fmeasurable_countable_Union [OF fIn] measure_countable_Union_le [OF fIn])+
   then show "f ` S \<in> lmeasurable" ?M
     by (metis Seq image_UN)+
 qed
 
 
 lemma borel_measurable_simple_function_limit_increasing:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   shows "(f \<in> borel_measurable lebesgue \<and> (\<forall>x. 0 \<le> f x)) \<longleftrightarrow>
          (\<exists>g. (\<forall>n x. 0 \<le> g n x \<and> g n x \<le> f x) \<and> (\<forall>n x. g n x \<le> (g(Suc n) x)) \<and>
               (\<forall>n. g n \<in> borel_measurable lebesgue) \<and> (\<forall>n. finite(range (g n))) \<and>
               (\<forall>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x))"
          (is "?lhs = ?rhs")
 proof
   assume f: ?lhs
   have leb_f: "{x. a \<le> f x \<and> f x < b} \<in> sets lebesgue" for a b
   proof -
     have "{x. a \<le> f x \<and> f x < b} = {x. f x < b} - {x. f x < a}"
       by auto
     also have "\<dots> \<in> sets lebesgue"
       using borel_measurable_vimage_halfspace_component_lt [of f UNIV] f by auto
     finally show ?thesis .
   qed
   have "g n x \<le> f x"
         if inc_g: "\<And>n x. 0 \<le> g n x \<and> g n x \<le> g (Suc n) x"
            and meas_g: "\<And>n. g n \<in> borel_measurable lebesgue"
            and fin: "\<And>n. finite(range (g n))" and lim: "\<And>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x" for g n x
   proof -
     have "\<exists>r>0. \<forall>N. \<exists>n\<ge>N. dist (g n x) (f x) \<ge> r" if "g n x > f x"
     proof -
       have g: "g n x \<le> g (N + n) x" for N
         by (rule transitive_stepwise_le) (use inc_g in auto)
       have "\<exists>na\<ge>N. g n x - f x \<le> dist (g na x) (f x)" for N
         apply (rule_tac x="N+n" in exI)
         using g [of N] by (auto simp: dist_norm)
       with that show ?thesis
         using diff_gt_0_iff_gt by blast
     qed
     with lim show ?thesis
       apply (auto simp: lim_sequentially)
       by (meson less_le_not_le not_le_imp_less)
   qed
   moreover
   let ?\<Omega> = "\<lambda>n k. indicator {y. k/2^n \<le> f y \<and> f y < (k+1)/2^n}"
   let ?g = "\<lambda>n x. (\<Sum>k::real | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x)"
   have "\<exists>g. (\<forall>n x. 0 \<le> g n x \<and> g n x \<le> (g(Suc n) x)) \<and>
              (\<forall>n. g n \<in> borel_measurable lebesgue) \<and> (\<forall>n. finite(range (g n))) \<and>(\<forall>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x)"
   proof (intro exI allI conjI)
     show "0 \<le> ?g n x" for n x
     proof (clarify intro!: ordered_comm_monoid_add_class.sum_nonneg)
       fix k::real
       assume "k \<in> \<int>" and k: "\<bar>k\<bar> \<le> 2 ^ (2*n)"
       show "0 \<le> k/2^n * ?\<Omega> n k x"
         using f \<open>k \<in> \<int>\<close> apply (auto simp: indicator_def field_split_simps Ints_def)
         apply (drule spec [where x=x])
         using zero_le_power [of "2::real" n] mult_nonneg_nonneg [of "f x" "2^n"]
         by linarith
     qed
     show "?g n x \<le> ?g (Suc n) x" for n x
     proof -
       have "?g n x =
             (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n).
               k/2^n * (indicator {y. k/2^n \<le> f y \<and> f y < (k+1/2)/2^n} x +
               indicator {y. (k+1/2)/2^n \<le> f y \<and> f y < (k+1)/2^n} x))"
         by (rule sum.cong [OF refl]) (simp add: indicator_def field_split_simps)
       also have "\<dots> = (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * indicator {y. k/2^n \<le> f y \<and> f y < (k+1/2)/2^n} x) +
                        (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * indicator {y. (k+1/2)/2^n \<le> f y \<and> f y < (k+1)/2^n} x)"
         by (simp add:  comm_monoid_add_class.sum.distrib algebra_simps)
       also have "\<dots> = (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). (2 * k)/2 ^ Suc n * indicator {y. (2 * k)/2 ^ Suc n \<le> f y \<and> f y < (2 * k+1)/2 ^ Suc n} x) +
                        (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). (2 * k)/2 ^ Suc n * indicator {y. (2 * k+1)/2 ^ Suc n \<le> f y \<and> f y < ((2 * k+1) + 1)/2 ^ Suc n} x)"
         by (force simp: field_simps indicator_def intro: sum.cong)
       also have "\<dots> \<le> (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2 * Suc n). k/2 ^ Suc n * (indicator {y. k/2 ^ Suc n \<le> f y \<and> f y < (k+1)/2 ^ Suc n} x))"
                 (is "?a + _ \<le> ?b")
       proof -
         have *: "\<lbrakk>sum f I \<le> sum h I; a + sum h I \<le> b\<rbrakk> \<Longrightarrow> a + sum f I \<le> b" for I a b f and h :: "real\<Rightarrow>real"
           by linarith
         let ?h = "\<lambda>k. (2*k+1)/2 ^ Suc n *
                       (indicator {y. (2 * k+1)/2 ^ Suc n \<le> f y \<and> f y < ((2*k+1) + 1)/2 ^ Suc n} x)"
         show ?thesis
         proof (rule *)
           show "(\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n).
                   2 * k/2 ^ Suc n * indicator {y. (2 * k+1)/2 ^ Suc n \<le> f y \<and> f y < (2 * k+1 + 1)/2 ^ Suc n} x)
                 \<le> sum ?h {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}"
             by (rule sum_mono) (simp add: indicator_def field_split_simps)
         next
           have \<alpha>: "?a = (\<Sum>k \<in> (*)2 ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}.
                          k/2 ^ Suc n * indicator {y. k/2 ^ Suc n \<le> f y \<and> f y < (k+1)/2 ^ Suc n} x)"
             by (auto simp: inj_on_def field_simps comm_monoid_add_class.sum.reindex)
           have \<beta>: "sum ?h {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}
                    = (\<Sum>k \<in> (\<lambda>x. 2*x + 1) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}.
                       k/2 ^ Suc n * indicator {y. k/2 ^ Suc n \<le> f y \<and> f y < (k+1)/2 ^ Suc n} x)"
             by (auto simp: inj_on_def field_simps comm_monoid_add_class.sum.reindex)
           have 0: "(*) 2 ` {k \<in> \<int>. P k} \<inter> (\<lambda>x. 2 * x + 1) ` {k \<in> \<int>. P k} = {}" for P :: "real \<Rightarrow> bool"
           proof -
             have "2 * i \<noteq> 2 * j + 1" for i j :: int by arith
             thus ?thesis
               unfolding Ints_def by auto (use of_int_eq_iff in fastforce)
           qed
           have "?a + sum ?h {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}
                 = (\<Sum>k \<in> (*)2 ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)} \<union> (\<lambda>x. 2*x + 1) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}.
                   k/2 ^ Suc n * indicator {y. k/2 ^ Suc n \<le> f y \<and> f y < (k+1)/2 ^ Suc n} x)"
             unfolding \<alpha> \<beta>
             using finite_abs_int_segment [of "2 ^ (2*n)"]
             by (subst sum_Un) (auto simp: 0)
           also have "\<dots> \<le> ?b"
           proof (rule sum_mono2)
             show "finite {k::real. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2 * Suc n)}"
               by (rule finite_abs_int_segment)
             show "(*) 2 ` {k::real. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2^(2*n)} \<union> (\<lambda>x. 2*x + 1) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2^(2*n)} \<subseteq> {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2 * Suc n)}"
               apply auto
               using one_le_power [of "2::real" "2*n"]  by linarith
             have *: "\<lbrakk>x \<in> (S \<union> T) - U; \<And>x. x \<in> S \<Longrightarrow> x \<in> U; \<And>x. x \<in> T \<Longrightarrow> x \<in> U\<rbrakk> \<Longrightarrow> P x" for S T U P
               by blast
             have "0 \<le> b" if "b \<in> \<int>" "f x * (2 * 2^n) < b + 1" for b
             proof -
               have "0 \<le> f x * (2 * 2^n)"
                 by (simp add: f)
               also have "\<dots> < b+1"
                 by (simp add: that)
               finally show "0 \<le> b"
                 using \<open>b \<in> \<int>\<close> by (auto simp: elim!: Ints_cases)
             qed
             then show "0 \<le> b/2 ^ Suc n * indicator {y. b/2 ^ Suc n \<le> f y \<and> f y < (b + 1)/2 ^ Suc n} x"
                   if "b \<in> {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2 * Suc n)} -
                           ((*) 2 ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)} \<union> (\<lambda>x. 2*x + 1) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)})" for b
               using that by (simp add: indicator_def divide_simps)
           qed
           finally show "?a + sum ?h {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)} \<le> ?b" .
         qed
       qed
       finally show ?thesis .
     qed
     show "?g n \<in> borel_measurable lebesgue" for n
       apply (intro borel_measurable_indicator borel_measurable_times borel_measurable_sum)
       using leb_f sets_restrict_UNIV by auto
     show "finite (range (?g n))" for n
     proof -
       have "(\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x)
               \<in> (\<lambda>k. k/2^n) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}" for x
       proof (cases "\<exists>k. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n) \<and> k/2^n \<le> f x \<and> f x < (k+1)/2^n")
         case True
         then show ?thesis
           by (blast intro: indicator_sum_eq)
       next
         case False
         then have "(\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x) = 0"
           by auto
         then show ?thesis by force
       qed
       then have "range (?g n) \<subseteq> ((\<lambda>k. (k/2^n)) ` {k. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n)})"
         by auto
       moreover have "finite ((\<lambda>k::real. (k/2^n)) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)})"
         by (intro finite_imageI finite_abs_int_segment)
       ultimately show ?thesis
         by (rule finite_subset)
     qed
     show "(\<lambda>n. ?g n x) \<longlonglongrightarrow> f x" for x
     proof (clarsimp simp add: lim_sequentially)
       fix e::real
       assume "e > 0"
       obtain N1 where N1: "2 ^ N1 > abs(f x)"
         using real_arch_pow by fastforce
       obtain N2 where N2: "(1/2) ^ N2 < e"
         using real_arch_pow_inv \<open>e > 0\<close> by fastforce
       have "dist (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x) (f x) < e" if "N1 + N2 \<le> n" for n
       proof -
         let ?m = "real_of_int \<lfloor>2^n * f x\<rfloor>"
         have "\<bar>?m\<bar> \<le> 2^n * 2^N1"
           using N1 apply (simp add: f)
           by (meson floor_mono le_floor_iff less_le_not_le mult_le_cancel_left_pos zero_less_numeral zero_less_power)
         also have "\<dots> \<le> 2 ^ (2*n)"
           by (metis that add_leD1 add_le_cancel_left mult.commute mult_2_right one_less_numeral_iff
                     power_add power_increasing_iff semiring_norm(76))
         finally have m_le: "\<bar>?m\<bar> \<le> 2 ^ (2*n)" .
         have "?m/2^n \<le> f x" "f x < (?m + 1)/2^n"
           by (auto simp: mult.commute pos_divide_le_eq mult_imp_less_div_pos)
         then have eq: "dist (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x) (f x)
                      = dist (?m/2^n) (f x)"
           by (subst indicator_sum_eq [of ?m]) (auto simp: m_le)
         have "\<bar>2^n\<bar> * \<bar>?m/2^n - f x\<bar> = \<bar>2^n * (?m/2^n - f x)\<bar>"
           by (simp add: abs_mult)
         also have "\<dots> < 2 ^ N2 * e"
           using N2 by (simp add: divide_simps mult.commute) linarith
         also have "\<dots> \<le> \<bar>2^n\<bar> * e"
           using that \<open>e > 0\<close> by auto
         finally have "dist (?m/2^n) (f x) < e"
           by (simp add: dist_norm)
         then show ?thesis
           using eq by linarith
       qed
       then show "\<exists>no. \<forall>n\<ge>no. dist (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k * ?\<Omega> n k x/2^n) (f x) < e"
         by force
     qed
   qed
   ultimately show ?rhs
     by metis
 next
   assume RHS: ?rhs
   with borel_measurable_simple_function_limit [of f UNIV, unfolded lebesgue_on_UNIV_eq]
   show ?lhs
     by (blast intro: order_trans)
 qed
 
 subsection\<open>Borel measurable Jacobian determinant\<close>
 
 lemma lemma_partial_derivatives0:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "linear f" and lim0: "((\<lambda>x. f x /\<^sub>R norm x) \<longlongrightarrow> 0) (at 0 within S)"
     and lb: "\<And>v. v \<noteq> 0 \<Longrightarrow> (\<exists>k>0. \<forall>e>0. \<exists>x. x \<in> S - {0} \<and> norm x < e \<and> k * norm x \<le> \<bar>v \<bullet> x\<bar>)"
   shows "f x = 0"
 proof -
   interpret linear f by fact
   have "dim {x. f x = 0} \<le> DIM('a)"
     by (rule dim_subset_UNIV)
   moreover have False if less: "dim {x. f x = 0} < DIM('a)"
   proof -
     obtain d where "d \<noteq> 0" and d: "\<And>y. f y = 0 \<Longrightarrow> d \<bullet> y = 0"
       using orthogonal_to_subspace_exists [OF less] orthogonal_def
       by (metis (mono_tags, lifting) mem_Collect_eq span_base)
     then obtain k where "k > 0"
       and k: "\<And>e. e > 0 \<Longrightarrow> \<exists>y. y \<in> S - {0} \<and> norm y < e \<and> k * norm y \<le> \<bar>d \<bullet> y\<bar>"
       using lb by blast
     have "\<exists>h. \<forall>n. ((h n \<in> S \<and> h n \<noteq> 0 \<and> k * norm (h n) \<le> \<bar>d \<bullet> h n\<bar>) \<and> norm (h n) < 1 / real (Suc n)) \<and>
                norm (h (Suc n)) < norm (h n)"
     proof (rule dependent_nat_choice)
       show "\<exists>y. (y \<in> S \<and> y \<noteq> 0 \<and> k * norm y \<le> \<bar>d \<bullet> y\<bar>) \<and> norm y < 1 / real (Suc 0)"
         by simp (metis DiffE insertCI k not_less not_one_le_zero)
     qed (use k [of "min (norm x) (1/(Suc n + 1))" for x n] in auto)
     then obtain \<alpha> where \<alpha>: "\<And>n. \<alpha> n \<in> S - {0}" and kd: "\<And>n. k * norm(\<alpha> n) \<le> \<bar>d \<bullet> \<alpha> n\<bar>"
          and norm_lt: "\<And>n. norm(\<alpha> n) < 1/(Suc n)"
       by force
     let ?\<beta> = "\<lambda>n. \<alpha> n /\<^sub>R norm (\<alpha> n)"
     have com: "\<And>g. (\<forall>n. g n \<in> sphere (0::'a) 1)
               \<Longrightarrow> \<exists>l \<in> sphere 0 1. \<exists>\<rho>::nat\<Rightarrow>nat. strict_mono \<rho> \<and> (g \<circ> \<rho>) \<longlonglongrightarrow> l"
       using compact_sphere compact_def by metis
     moreover have "\<forall>n. ?\<beta> n \<in> sphere 0 1"
       using \<alpha> by auto
     ultimately obtain l::'a and \<rho>::"nat\<Rightarrow>nat"
        where l: "l \<in> sphere 0 1" and "strict_mono \<rho>" and to_l: "(?\<beta> \<circ> \<rho>) \<longlonglongrightarrow> l"
       by meson
     moreover have "continuous (at l) (\<lambda>x. (\<bar>d \<bullet> x\<bar> - k))"
       by (intro continuous_intros)
     ultimately have lim_dl: "((\<lambda>x. (\<bar>d \<bullet> x\<bar> - k)) \<circ> (?\<beta> \<circ> \<rho>)) \<longlonglongrightarrow> (\<bar>d \<bullet> l\<bar> - k)"
       by (meson continuous_imp_tendsto)
     have "\<forall>\<^sub>F i in sequentially. 0 \<le> ((\<lambda>x. \<bar>d \<bullet> x\<bar> - k) \<circ> ((\<lambda>n. \<alpha> n /\<^sub>R norm (\<alpha> n)) \<circ> \<rho>)) i"
       using \<alpha> kd by (auto simp: field_split_simps)
     then have "k \<le> \<bar>d \<bullet> l\<bar>"
       using tendsto_lowerbound [OF lim_dl, of 0] by auto
     moreover have "d \<bullet> l = 0"
     proof (rule d)
       show "f l = 0"
       proof (rule LIMSEQ_unique [of "f \<circ> ?\<beta> \<circ> \<rho>"])
         have "isCont f l"
           using \<open>linear f\<close> linear_continuous_at linear_conv_bounded_linear by blast
         then show "(f \<circ> (\<lambda>n. \<alpha> n /\<^sub>R norm (\<alpha> n)) \<circ> \<rho>) \<longlonglongrightarrow> f l"
           unfolding comp_assoc
           using to_l continuous_imp_tendsto by blast
         have "\<alpha> \<longlonglongrightarrow> 0"
           using norm_lt LIMSEQ_norm_0 by metis
         with \<open>strict_mono \<rho>\<close> have "(\<alpha> \<circ> \<rho>) \<longlonglongrightarrow> 0"
           by (metis LIMSEQ_subseq_LIMSEQ)
         with lim0 \<alpha> have "((\<lambda>x. f x /\<^sub>R norm x) \<circ> (\<alpha> \<circ> \<rho>)) \<longlonglongrightarrow> 0"
           by (force simp: tendsto_at_iff_sequentially)
         then show "(f \<circ> (\<lambda>n. \<alpha> n /\<^sub>R norm (\<alpha> n)) \<circ> \<rho>) \<longlonglongrightarrow> 0"
           by (simp add: o_def scale)
       qed
     qed
     ultimately show False
       using \<open>k > 0\<close> by auto
   qed
   ultimately have dim: "dim {x. f x = 0} = DIM('a)"
     by force
   then show ?thesis
     using dim_eq_full
     by (metis (mono_tags, lifting) eq_0_on_span eucl.span_Basis linear_axioms linear_eq_stdbasis
         mem_Collect_eq module_hom_zero span_base span_raw_def)
 qed
 
 lemma lemma_partial_derivatives:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "linear f" and lim: "((\<lambda>x. f (x - a) /\<^sub>R norm (x - a)) \<longlongrightarrow> 0) (at a within S)"
     and lb: "\<And>v. v \<noteq> 0 \<Longrightarrow> (\<exists>k>0.  \<forall>e>0. \<exists>x \<in> S - {a}. norm(a - x) < e \<and> k * norm(a - x) \<le> \<bar>v \<bullet> (x - a)\<bar>)"
   shows "f x = 0"
 proof -
   have "((\<lambda>x. f x /\<^sub>R norm x) \<longlongrightarrow> 0) (at 0 within (\<lambda>x. x-a) ` S)"
     using lim by (simp add: Lim_within dist_norm)
   then show ?thesis
   proof (rule lemma_partial_derivatives0 [OF \<open>linear f\<close>])
     fix v :: "'a"
     assume v: "v \<noteq> 0"
     show "\<exists>k>0. \<forall>e>0. \<exists>x. x \<in> (\<lambda>x. x - a) ` S - {0} \<and> norm x < e \<and> k * norm x \<le> \<bar>v \<bullet> x\<bar>"
       using lb [OF v] by (force simp:  norm_minus_commute)
   qed
 qed
 
 
 proposition borel_measurable_partial_derivatives:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n"
   assumes S: "S \<in> sets lebesgue"
     and f: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   shows "(\<lambda>x. (matrix(f' x)$m$n)) \<in> borel_measurable (lebesgue_on S)"
 proof -
   have contf: "continuous_on S f"
     using continuous_on_eq_continuous_within f has_derivative_continuous by blast
   have "{x \<in> S.  (matrix (f' x)$m$n) \<le> b} \<in> sets lebesgue" for b
   proof (rule sets_negligible_symdiff)
     let ?T = "{x \<in> S. \<forall>e>0. \<exists>d>0. \<exists>A. A$m$n < b \<and> (\<forall>i j. A$i$j \<in> \<rat>) \<and>
                        (\<forall>y \<in> S. norm(y - x) < d \<longrightarrow> norm(f y - f x - A *v (y - x)) \<le> e * norm(y - x))}"
     let ?U = "S \<inter>
               (\<Inter>e \<in> {e \<in> \<rat>. e > 0}.
                 \<Union>A \<in> {A. A$m$n < b \<and> (\<forall>i j. A$i$j \<in> \<rat>)}.
                   \<Union>d \<in> {d \<in> \<rat>. 0 < d}.
                      S \<inter> (\<Inter>y \<in> S. {x \<in> S. norm(y - x) < d \<longrightarrow> norm(f y - f x - A *v (y - x)) \<le> e * norm(y - x)}))"
     have "?T = ?U"
     proof (intro set_eqI iffI)
       fix x
       assume xT: "x \<in> ?T"
       then show "x \<in> ?U"
       proof (clarsimp simp add:)
         fix q :: real
         assume "q \<in> \<rat>" "q > 0"
         then obtain d A where "d > 0" and A: "A $ m $ n < b" "\<And>i j. A $ i $ j \<in> \<rat>"
           "\<And>y. \<lbrakk>y\<in>S;  norm (y - x) < d\<rbrakk> \<Longrightarrow> norm (f y - f x - A *v (y - x)) \<le> q * norm (y - x)"
           using xT by auto
         then obtain \<delta> where "d > \<delta>" "\<delta> > 0" "\<delta> \<in> \<rat>"
           using Rats_dense_in_real by blast
         with A show "\<exists>A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>) \<and>
                          (\<exists>s. s \<in> \<rat> \<and> 0 < s \<and> (\<forall>y\<in>S. norm (y - x) < s \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> q * norm (y - x)))"
           by force
       qed
     next
       fix x
       assume xU: "x \<in> ?U"
       then show "x \<in> ?T"
       proof clarsimp
         fix e :: "real"
         assume "e > 0"
         then obtain \<epsilon> where \<epsilon>: "e > \<epsilon>" "\<epsilon> > 0" "\<epsilon> \<in> \<rat>"
           using Rats_dense_in_real by blast
         with xU obtain A r where "x \<in> S" and Ar: "A $ m $ n < b" "\<forall>i j. A $ i $ j \<in> \<rat>" "r \<in> \<rat>" "r > 0"
           and "\<forall>y\<in>S. norm (y - x) < r \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> \<epsilon> * norm (y - x)"
           by (auto simp: split: if_split_asm)
         then have "\<forall>y\<in>S. norm (y - x) < r \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x)"
           by (meson \<open>e > \<epsilon>\<close> less_eq_real_def mult_right_mono norm_ge_zero order_trans)
         then show "\<exists>d>0. \<exists>A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>) \<and> (\<forall>y\<in>S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x))"
           using \<open>x \<in> S\<close> Ar by blast
       qed
     qed
     moreover have "?U \<in> sets lebesgue"
     proof -
       have coQ: "countable {e \<in> \<rat>. 0 < e}"
         using countable_Collect countable_rat by blast
       have ne: "{e \<in> \<rat>. (0::real) < e} \<noteq> {}"
         using zero_less_one Rats_1 by blast
       have coA: "countable {A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>)}"
       proof (rule countable_subset)
         show "countable {A. \<forall>i j. A $ i $ j \<in> \<rat>}"
           using countable_vector [OF countable_vector, of "\<lambda>i j. \<rat>"] by (simp add: countable_rat)
       qed blast
       have *: "\<lbrakk>U \<noteq> {} \<Longrightarrow> closedin (top_of_set S) (S \<inter> \<Inter> U)\<rbrakk>
                \<Longrightarrow> closedin (top_of_set S) (S \<inter> \<Inter> U)" for U
         by fastforce
       have eq: "{x::(real,'m)vec. P x \<and> (Q x \<longrightarrow> R x)} = {x. P x \<and> \<not> Q x} \<union> {x. P x \<and> R x}" for P Q R
         by auto
       have sets: "S \<inter> (\<Inter>y\<in>S. {x \<in> S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x)})
                   \<in> sets lebesgue" for e A d
       proof -
         have clo: "closedin (top_of_set S)
                      {x \<in> S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x)}"
           for y
         proof -
           have cont1: "continuous_on S (\<lambda>x. norm (y - x))"
           and  cont2: "continuous_on S (\<lambda>x. e * norm (y - x) - norm (f y - f x - (A *v y - A *v x)))"
             by (force intro: contf continuous_intros)+
           have clo1: "closedin (top_of_set S) {x \<in> S. d \<le> norm (y - x)}"
             using continuous_closedin_preimage [OF cont1, of "{d..}"] by (simp add: vimage_def Int_def)
           have clo2: "closedin (top_of_set S)
                        {x \<in> S. norm (f y - f x - (A *v y - A *v x)) \<le> e * norm (y - x)}"
             using continuous_closedin_preimage [OF cont2, of "{0..}"] by (simp add: vimage_def Int_def)
           show ?thesis
             by (auto simp: eq not_less matrix_vector_mult_diff_distrib intro: clo1 clo2)
         qed
         show ?thesis
           by (rule lebesgue_closedin [of S]) (force intro: * S clo)+
       qed
       show ?thesis
         by (intro sets sets.Int S sets.countable_UN'' sets.countable_INT'' coQ coA) auto
     qed
     ultimately show "?T \<in> sets lebesgue"
       by simp
     let ?M = "(?T - {x \<in> S. matrix (f' x) $ m $ n \<le> b} \<union> ({x \<in> S. matrix (f' x) $ m $ n \<le> b} - ?T))"
     let ?\<Theta> = "\<lambda>x v. \<forall>\<xi>>0. \<exists>e>0. \<forall>y \<in> S-{x}. norm (x - y) < e \<longrightarrow> \<bar>v \<bullet> (y - x)\<bar> < \<xi> * norm (x - y)"
     have nN: "negligible {x \<in> S. \<exists>v\<noteq>0. ?\<Theta> x v}"
       unfolding negligible_eq_zero_density
     proof clarsimp
       fix x v and r e :: "real"
       assume "x \<in> S" "v \<noteq> 0" "r > 0" "e > 0"
       and Theta [rule_format]: "?\<Theta> x v"
       moreover have "(norm v * e / 2) / CARD('m) ^ CARD('m) > 0"
         by (simp add: \<open>v \<noteq> 0\<close> \<open>e > 0\<close>)
       ultimately obtain d where "d > 0"
          and dless: "\<And>y. \<lbrakk>y \<in> S - {x}; norm (x - y) < d\<rbrakk> \<Longrightarrow>
                         \<bar>v \<bullet> (y - x)\<bar> < ((norm v * e / 2) / CARD('m) ^ CARD('m)) * norm (x - y)"
         by metis
       let ?W = "ball x (min d r) \<inter> {y. \<bar>v \<bullet> (y - x)\<bar> < (norm v * e/2 * min d r) / CARD('m) ^ CARD('m)}"
       have "open {x. \<bar>v \<bullet> (x - a)\<bar> < b}" for a b
         by (intro open_Collect_less continuous_intros)
       show "\<exists>d>0. d \<le> r \<and>
             (\<exists>U. {x' \<in> S. \<exists>v\<noteq>0. ?\<Theta> x' v} \<inter> ball x d \<subseteq> U \<and>
                  U \<in> lmeasurable \<and> measure lebesgue U < e * content (ball x d))"
       proof (intro exI conjI)
         show "0 < min d r" "min d r \<le> r"
           using \<open>r > 0\<close> \<open>d > 0\<close> by auto
         show "{x' \<in> S. \<exists>v. v \<noteq> 0 \<and> (\<forall>\<xi>>0. \<exists>e>0. \<forall>z\<in>S - {x'}. norm (x' - z) < e \<longrightarrow> \<bar>v \<bullet> (z - x')\<bar> < \<xi> * norm (x' - z))} \<inter> ball x (min d r) \<subseteq> ?W"
           proof (clarsimp simp: dist_norm norm_minus_commute)
             fix y w
             assume "y \<in> S" "w \<noteq> 0"
               and less [rule_format]:
                     "\<forall>\<xi>>0. \<exists>e>0. \<forall>z\<in>S - {y}. norm (y - z) < e \<longrightarrow> \<bar>w \<bullet> (z - y)\<bar> < \<xi> * norm (y - z)"
               and d: "norm (y - x) < d" and r: "norm (y - x) < r"
             show "\<bar>v \<bullet> (y - x)\<bar> < norm v * e * min d r / (2 * real CARD('m) ^ CARD('m))"
             proof (cases "y = x")
               case True
               with \<open>r > 0\<close> \<open>d > 0\<close> \<open>e > 0\<close> \<open>v \<noteq> 0\<close> show ?thesis
                 by simp
             next
               case False
               have "\<bar>v \<bullet> (y - x)\<bar> < norm v * e / 2 / real (CARD('m) ^ CARD('m)) * norm (x - y)"
                 apply (rule dless)
                 using False \<open>y \<in> S\<close> d by (auto simp: norm_minus_commute)
               also have "\<dots> \<le> norm v * e * min d r / (2 * real CARD('m) ^ CARD('m))"
                 using d r \<open>e > 0\<close> by (simp add: field_simps norm_minus_commute mult_left_mono)
               finally show ?thesis .
             qed
           qed
           show "?W \<in> lmeasurable"
             by (simp add: fmeasurable_Int_fmeasurable borel_open)
           obtain k::'m where True
             by metis
           obtain T where T: "orthogonal_transformation T" and v: "v = T(norm v *\<^sub>R axis k (1::real))"
             using rotation_rightward_line by metis
           define b where "b \<equiv> norm v"
           have "b > 0"
             using \<open>v \<noteq> 0\<close> by (auto simp: b_def)
           obtain eqb: "inv T v = b *\<^sub>R axis k (1::real)" and "inj T" "bij T" and invT: "orthogonal_transformation (inv T)"
             by (metis UNIV_I b_def  T v bij_betw_inv_into_left orthogonal_transformation_inj orthogonal_transformation_bij orthogonal_transformation_inv)
           let ?v = "\<chi> i. min d r / CARD('m)"
           let ?v' = "\<chi> i. if i = k then (e/2 * min d r) / CARD('m) ^ CARD('m) else min d r"
           let ?x' = "inv T x"
           let ?W' = "(ball ?x' (min d r) \<inter> {y. \<bar>(y - ?x')$k\<bar> < e * min d r / (2 * CARD('m) ^ CARD('m))})"
           have abs: "x - e \<le> y \<and> y \<le> x + e \<longleftrightarrow> abs(y - x) \<le> e" for x y e::real
             by auto
           have "?W = T ` ?W'"
           proof -
             have 1: "T ` (ball (inv T x) (min d r)) = ball x (min d r)"
               by (simp add: T image_orthogonal_transformation_ball orthogonal_transformation_surj surj_f_inv_f)
             have 2: "{y. \<bar>v \<bullet> (y - x)\<bar> < b * e * min d r / (2 * real CARD('m) ^ CARD('m))} =
                       T ` {y. \<bar>y $ k - ?x' $ k\<bar> < e * min d r / (2 * real CARD('m) ^ CARD('m))}"
             proof -
               have *: "\<bar>T (b *\<^sub>R axis k 1) \<bullet> (y - x)\<bar> = b * \<bar>inv T y $ k - ?x' $ k\<bar>" for y
               proof -
                 have "\<bar>T (b *\<^sub>R axis k 1) \<bullet> (y - x)\<bar> = \<bar>(b *\<^sub>R axis k 1) \<bullet> inv T (y - x)\<bar>"
                   by (metis (no_types, hide_lams) b_def eqb invT orthogonal_transformation_def v)
                 also have "\<dots> = b * \<bar>(axis k 1) \<bullet> inv T (y - x)\<bar>"
                   using \<open>b > 0\<close> by (simp add: abs_mult)
                 also have "\<dots> = b * \<bar>inv T y $ k - ?x' $ k\<bar>"
                   using orthogonal_transformation_linear [OF invT]
                   by (simp add: inner_axis' linear_diff)
                 finally show ?thesis
                   by simp
               qed
               show ?thesis
                 using v b_def [symmetric]
                 using \<open>b > 0\<close> by (simp add: * bij_image_Collect_eq [OF \<open>bij T\<close>] mult_less_cancel_left_pos times_divide_eq_right [symmetric] del: times_divide_eq_right)
             qed
             show ?thesis
               using \<open>b > 0\<close> by (simp add: image_Int \<open>inj T\<close> 1 2 b_def [symmetric])
           qed
           moreover have "?W' \<in> lmeasurable"
             by (auto intro: fmeasurable_Int_fmeasurable)
           ultimately have "measure lebesgue ?W = measure lebesgue ?W'"
             by (metis measure_orthogonal_image T)
           also have "\<dots> \<le> measure lebesgue (cbox (?x' - ?v') (?x' + ?v'))"
           proof (rule measure_mono_fmeasurable)
             show "?W' \<subseteq> cbox (?x' - ?v') (?x' + ?v')"
               apply (clarsimp simp add: mem_box_cart abs dist_norm norm_minus_commute simp del: min_less_iff_conj min.bounded_iff)
               by (metis component_le_norm_cart less_eq_real_def le_less_trans vector_minus_component)
           qed auto
           also have "\<dots> \<le> e/2 * measure lebesgue (cbox (?x' - ?v) (?x' + ?v))"
           proof -
             have "cbox (?x' - ?v) (?x' + ?v) \<noteq> {}"
               using \<open>r > 0\<close> \<open>d > 0\<close> by (auto simp: interval_eq_empty_cart divide_less_0_iff)
             with \<open>r > 0\<close> \<open>d > 0\<close> \<open>e > 0\<close> show ?thesis
               apply (simp add: content_cbox_if_cart mem_box_cart)
               apply (auto simp: prod_nonneg)
               apply (simp add: abs if_distrib prod.delta_remove field_simps power_diff split: if_split_asm)
               done
           qed
           also have "\<dots> \<le> e/2 * measure lebesgue (cball ?x' (min d r))"
           proof (rule mult_left_mono [OF measure_mono_fmeasurable])
             have *: "norm (?x' - y) \<le> min d r"
               if y: "\<And>i. \<bar>?x' $ i - y $ i\<bar> \<le> min d r / real CARD('m)" for y
             proof -
               have "norm (?x' - y) \<le> (\<Sum>i\<in>UNIV. \<bar>(?x' - y) $ i\<bar>)"
                 by (rule norm_le_l1_cart)
               also have "\<dots> \<le> real CARD('m) * (min d r / real CARD('m))"
                 by (rule sum_bounded_above) (use y in auto)
               finally show ?thesis
                 by simp
             qed
             show "cbox (?x' - ?v) (?x' + ?v) \<subseteq> cball ?x' (min d r)"
               apply (clarsimp simp only: mem_box_cart dist_norm mem_cball intro!: *)
               by (simp add: abs_diff_le_iff abs_minus_commute)
           qed (use \<open>e > 0\<close> in auto)
           also have "\<dots> < e * content (cball ?x' (min d r))"
             using \<open>r > 0\<close> \<open>d > 0\<close> \<open>e > 0\<close> by (auto intro: content_cball_pos)
           also have "\<dots> = e * content (ball x (min d r))"
             using \<open>r > 0\<close> \<open>d > 0\<close> content_ball_conv_unit_ball[of "min d r" "inv T x"]
                   content_ball_conv_unit_ball[of "min d r" x]
             by (simp add: content_cball_conv_ball)
           finally show "measure lebesgue ?W < e * content (ball x (min d r))" .
       qed
     qed
     have *: "(\<And>x. (x \<notin> S) \<Longrightarrow> (x \<in> T \<longleftrightarrow> x \<in> U)) \<Longrightarrow> (T - U) \<union> (U - T) \<subseteq> S" for S T U :: "(real,'m) vec set"
       by blast
     have MN: "?M \<subseteq> {x \<in> S. \<exists>v\<noteq>0. ?\<Theta> x v}"
     proof (rule *)
       fix x
       assume x: "x \<notin> {x \<in> S. \<exists>v\<noteq>0. ?\<Theta> x v}"
       show "(x \<in> ?T) \<longleftrightarrow> (x \<in> {x \<in> S. matrix (f' x) $ m $ n \<le> b})"
       proof (cases "x \<in> S")
         case True
         then have x: "\<not> ?\<Theta> x v" if "v \<noteq> 0" for v
           using x that by force
         show ?thesis
         proof (rule iffI; clarsimp)
           assume b: "\<forall>e>0. \<exists>d>0. \<exists>A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>) \<and>
                                     (\<forall>y\<in>S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x))"
                      (is "\<forall>e>0. \<exists>d>0. \<exists>A. ?\<Phi> e d A")
           then have "\<forall>k. \<exists>d>0. \<exists>A. ?\<Phi> (1 / Suc k) d A"
             by (metis (no_types, hide_lams) less_Suc_eq_0_disj of_nat_0_less_iff zero_less_divide_1_iff)
           then obtain \<delta> A where \<delta>: "\<And>k. \<delta> k > 0"
                            and Ab: "\<And>k. A k $ m $ n < b"
                            and A: "\<And>k y. \<lbrakk>y \<in> S; norm (y - x) < \<delta> k\<rbrakk> \<Longrightarrow>
                                           norm (f y - f x - A k *v (y - x)) \<le> 1/(Suc k) * norm (y - x)"
             by metis
           have "\<forall>i j. \<exists>a. (\<lambda>n. A n $ i $ j) \<longlonglongrightarrow> a"
           proof (intro allI)
             fix i j
             have vax: "(A n *v axis j 1) $ i = A n $ i $ j" for n
               by (metis cart_eq_inner_axis matrix_vector_mul_component)
             let ?CA = "{x. Cauchy (\<lambda>n. (A n) *v x)}"
             have "subspace ?CA"
               unfolding subspace_def convergent_eq_Cauchy [symmetric]
                 by (force simp: algebra_simps intro: tendsto_intros)
             then have CA_eq: "?CA = span ?CA"
               by (metis span_eq_iff)
             also have "\<dots> = UNIV"
             proof -
               have "dim ?CA \<le> CARD('m)"
                 using dim_subset_UNIV[of ?CA]
                 by auto
               moreover have "False" if less: "dim ?CA < CARD('m)"
               proof -
                 obtain d where "d \<noteq> 0" and d: "\<And>y. y \<in> span ?CA \<Longrightarrow> orthogonal d y"
                   using less by (force intro: orthogonal_to_subspace_exists [of ?CA])
                 with x [OF \<open>d \<noteq> 0\<close>] obtain \<xi> where "\<xi> > 0"
                   and \<xi>: "\<And>e. e > 0 \<Longrightarrow> \<exists>y \<in> S - {x}. norm (x - y) < e \<and> \<xi> * norm (x - y) \<le> \<bar>d \<bullet> (y - x)\<bar>"
                   by (fastforce simp: not_le Bex_def)
                 obtain \<gamma> z where \<gamma>Sx: "\<And>i. \<gamma> i \<in> S - {x}"
                            and \<gamma>le:   "\<And>i. \<xi> * norm(\<gamma> i - x) \<le> \<bar>d \<bullet> (\<gamma> i - x)\<bar>"
                            and \<gamma>x:    "\<gamma> \<longlonglongrightarrow> x"
                            and z:     "(\<lambda>n. (\<gamma> n - x) /\<^sub>R norm (\<gamma> n - x)) \<longlonglongrightarrow> z"
                 proof -
                   have "\<exists>\<gamma>. (\<forall>i. (\<gamma> i \<in> S - {x} \<and>
                                   \<xi> * norm(\<gamma> i - x) \<le> \<bar>d \<bullet> (\<gamma> i - x)\<bar> \<and> norm(\<gamma> i - x) < 1/Suc i) \<and>
                                  norm(\<gamma>(Suc i) - x) < norm(\<gamma> i - x))"
                   proof (rule dependent_nat_choice)
                     show "\<exists>y. y \<in> S - {x} \<and> \<xi> * norm (y - x) \<le> \<bar>d \<bullet> (y - x)\<bar> \<and> norm (y - x) < 1 / Suc 0"
                       using \<xi> [of 1] by (auto simp: dist_norm norm_minus_commute)
                   next
                     fix y i
                     assume "y \<in> S - {x} \<and> \<xi> * norm (y - x) \<le> \<bar>d \<bullet> (y - x)\<bar> \<and> norm (y - x) < 1/Suc i"
                     then have "min (norm(y - x)) (1/((Suc i) + 1)) > 0"
                       by auto
                     then obtain y' where "y' \<in> S - {x}" and y': "norm (x - y') < min (norm (y - x)) (1/((Suc i) + 1))"
                                          "\<xi> * norm (x - y') \<le> \<bar>d \<bullet> (y' - x)\<bar>"
                       using \<xi> by metis
                     with \<xi> show "\<exists>y'. (y' \<in> S - {x} \<and> \<xi> * norm (y' - x) \<le> \<bar>d \<bullet> (y' - x)\<bar> \<and>
                               norm (y' - x) < 1/(Suc (Suc i))) \<and> norm (y' - x) < norm (y - x)"
                       by (auto simp: dist_norm norm_minus_commute)
                   qed
                   then obtain \<gamma> where
                         \<gamma>Sx: "\<And>i. \<gamma> i \<in> S - {x}"
                         and \<gamma>le: "\<And>i. \<xi> * norm(\<gamma> i - x) \<le> \<bar>d \<bullet> (\<gamma> i - x)\<bar>"
                         and \<gamma>conv: "\<And>i. norm(\<gamma> i - x) < 1/(Suc i)"
                     by blast
                   let ?f = "\<lambda>i. (\<gamma> i - x) /\<^sub>R norm (\<gamma> i - x)"
                   have "?f i \<in> sphere 0 1" for i
                     using \<gamma>Sx by auto
                   then obtain l \<rho> where "l \<in> sphere 0 1" "strict_mono \<rho>" and l: "(?f \<circ> \<rho>) \<longlonglongrightarrow> l"
                     using compact_sphere [of "0::(real,'m) vec" 1]  unfolding compact_def by meson
                   show thesis
                   proof
                     show "(\<gamma> \<circ> \<rho>) i \<in> S - {x}" "\<xi> * norm ((\<gamma> \<circ> \<rho>) i - x) \<le> \<bar>d \<bullet> ((\<gamma> \<circ> \<rho>) i - x)\<bar>" for i
                       using \<gamma>Sx \<gamma>le by auto
                     have "\<gamma> \<longlonglongrightarrow> x"
                     proof (clarsimp simp add: LIMSEQ_def dist_norm)
                       fix r :: "real"
                       assume "r > 0"
                       with real_arch_invD obtain no where "no \<noteq> 0" "real no > 1/r"
                         by (metis divide_less_0_1_iff not_less_iff_gr_or_eq of_nat_0_eq_iff reals_Archimedean2)
                       with \<gamma>conv show "\<exists>no. \<forall>n\<ge>no. norm (\<gamma> n - x) < r"
                         by (metis \<open>r > 0\<close> add.commute divide_inverse inverse_inverse_eq inverse_less_imp_less less_trans mult.left_neutral nat_le_real_less of_nat_Suc)
                     qed
                     with \<open>strict_mono \<rho>\<close> show "(\<gamma> \<circ> \<rho>) \<longlonglongrightarrow> x"
                       by (metis LIMSEQ_subseq_LIMSEQ)
                     show "(\<lambda>n. ((\<gamma> \<circ> \<rho>) n - x) /\<^sub>R norm ((\<gamma> \<circ> \<rho>) n - x)) \<longlonglongrightarrow> l"
                       using l by (auto simp: o_def)
                   qed
                 qed
                 have "isCont (\<lambda>x. (\<bar>d \<bullet> x\<bar> - \<xi>)) z"
                   by (intro continuous_intros)
                 from isCont_tendsto_compose [OF this z]
                 have lim: "(\<lambda>y. \<bar>d \<bullet> ((\<gamma> y - x) /\<^sub>R norm (\<gamma> y - x))\<bar> - \<xi>) \<longlonglongrightarrow> \<bar>d \<bullet> z\<bar> - \<xi>"
                   by auto
                 moreover have "\<forall>\<^sub>F i in sequentially. 0 \<le> \<bar>d \<bullet> ((\<gamma> i - x) /\<^sub>R norm (\<gamma> i - x))\<bar> - \<xi>"
                 proof (rule eventuallyI)
                   fix n
                   show "0 \<le> \<bar>d \<bullet> ((\<gamma> n - x) /\<^sub>R norm (\<gamma> n - x))\<bar> - \<xi>"
                   using \<gamma>le [of n] \<gamma>Sx by (auto simp: abs_mult divide_simps)
                 qed
                 ultimately have "\<xi> \<le> \<bar>d \<bullet> z\<bar>"
                   using tendsto_lowerbound [where a=0] by fastforce
                 have "Cauchy (\<lambda>n. (A n) *v z)"
                 proof (clarsimp simp add: Cauchy_def)
                   fix \<epsilon> :: "real"
                   assume "0 < \<epsilon>"
                   then obtain N::nat where "N > 0" and N: "\<epsilon>/2 > 1/N"
                     by (metis half_gt_zero inverse_eq_divide neq0_conv real_arch_inverse)
                   show "\<exists>M. \<forall>m\<ge>M. \<forall>n\<ge>M. dist (A m *v z) (A n *v z) < \<epsilon>"
                   proof (intro exI allI impI)
                     fix i j
                     assume ij: "N \<le> i" "N \<le> j"
                     let ?V = "\<lambda>i k. A i *v ((\<gamma> k - x) /\<^sub>R norm (\<gamma> k - x))"
                     have "\<forall>\<^sub>F k in sequentially. dist (\<gamma> k) x < min (\<delta> i) (\<delta> j)"
                       using \<gamma>x [unfolded tendsto_iff] by (meson min_less_iff_conj \<delta>)
                     then have even: "\<forall>\<^sub>F k in sequentially. norm (?V i k - ?V j k) - 2 / N \<le> 0"
                     proof (rule eventually_mono, clarsimp)
                       fix p
                       assume p: "dist (\<gamma> p) x < \<delta> i" "dist (\<gamma> p) x < \<delta> j"
                       let ?C = "\<lambda>k. f (\<gamma> p) - f x - A k *v (\<gamma> p - x)"
                       have "norm ((A i - A j) *v (\<gamma> p - x)) = norm (?C j - ?C i)"
                         by (simp add: algebra_simps)
                       also have "\<dots> \<le> norm (?C j) + norm (?C i)"
                         using norm_triangle_ineq4 by blast
                       also have "\<dots> \<le> 1/(Suc j) * norm (\<gamma> p - x) + 1/(Suc i) * norm (\<gamma> p - x)"
                         by (metis A Diff_iff \<gamma>Sx dist_norm p add_mono)
                       also have "\<dots> \<le> 1/N * norm (\<gamma> p - x) + 1/N * norm (\<gamma> p - x)"
                         apply (intro add_mono mult_right_mono)
                         using ij \<open>N > 0\<close> by (auto simp: field_simps)
                       also have "\<dots> = 2 / N * norm (\<gamma> p - x)"
                         by simp
                       finally have no_le: "norm ((A i - A j) *v (\<gamma> p - x)) \<le> 2 / N * norm (\<gamma> p - x)" .
                       have "norm (?V i p - ?V j p) =
                             norm ((A i - A j) *v ((\<gamma> p - x) /\<^sub>R norm (\<gamma> p - x)))"
                         by (simp add: algebra_simps)
                       also have "\<dots> = norm ((A i - A j) *v (\<gamma> p - x)) / norm (\<gamma> p - x)"
                         by (simp add: divide_inverse matrix_vector_mult_scaleR)
                       also have "\<dots> \<le> 2 / N"
                         using no_le by (auto simp: field_split_simps)
                       finally show "norm (?V i p - ?V j p) \<le> 2 / N" .
                     qed
                     have "isCont (\<lambda>w. (norm(A i *v w - A j *v w) - 2 / N)) z"
                       by (intro continuous_intros)
                     from isCont_tendsto_compose [OF this z]
                     have lim: "(\<lambda>w. norm (A i *v ((\<gamma> w - x) /\<^sub>R norm (\<gamma> w - x)) -
                                     A j *v ((\<gamma> w - x) /\<^sub>R norm (\<gamma> w - x))) - 2 / N)
                                \<longlonglongrightarrow> norm (A i *v z - A j *v z) - 2 / N"
                       by auto
                     have "dist (A i *v z) (A j *v z) \<le> 2 / N"
                       using tendsto_upperbound [OF lim even] by (auto simp: dist_norm)
                     with N show "dist (A i *v z) (A j *v z) < \<epsilon>"
                       by linarith
                   qed
                 qed
                 then have "d \<bullet> z = 0"
                   using CA_eq d orthogonal_def by auto
                 then show False
                   using \<open>0 < \<xi>\<close> \<open>\<xi> \<le> \<bar>d \<bullet> z\<bar>\<close> by auto
               qed
               ultimately show ?thesis
                 using dim_eq_full by fastforce
             qed
             finally have "?CA = UNIV" .
             then have "Cauchy (\<lambda>n. (A n) *v axis j 1)"
               by auto
             then obtain L where "(\<lambda>n. A n *v axis j 1) \<longlonglongrightarrow> L"
               by (auto simp: Cauchy_convergent_iff convergent_def)
             then have "(\<lambda>x. (A x *v axis j 1) $ i) \<longlonglongrightarrow> L $ i"
               by (rule tendsto_vec_nth)
             then show "\<exists>a. (\<lambda>n. A n $ i $ j) \<longlonglongrightarrow> a"
               by (force simp: vax)
           qed
           then obtain B where B: "\<And>i j. (\<lambda>n. A n $ i $ j) \<longlonglongrightarrow> B $ i $ j"
             by (auto simp: lambda_skolem)
           have lin_df: "linear (f' x)"
                and lim_df: "((\<lambda>y. (1 / norm (y - x)) *\<^sub>R (f y - (f x + f' x (y - x)))) \<longlongrightarrow> 0) (at x within S)"
             using \<open>x \<in> S\<close> assms by (auto simp: has_derivative_within linear_linear)
           moreover
           interpret linear "f' x" by fact
           have "(matrix (f' x) - B) *v w = 0" for w
           proof (rule lemma_partial_derivatives [of "(*v) (matrix (f' x) - B)"])
             show "linear ((*v) (matrix (f' x) - B))"
               by (rule matrix_vector_mul_linear)
             have "((\<lambda>y. ((f x + f' x (y - x)) - f y) /\<^sub>R norm (y - x)) \<longlongrightarrow> 0) (at x within S)"
               using tendsto_minus [OF lim_df] by (simp add: field_split_simps)
             then show "((\<lambda>y. (matrix (f' x) - B) *v (y - x) /\<^sub>R norm (y - x)) \<longlongrightarrow> 0) (at x within S)"
             proof (rule Lim_transform)
               have "((\<lambda>y. ((f y + B *v x - (f x + B *v y)) /\<^sub>R norm (y - x))) \<longlongrightarrow> 0) (at x within S)"
               proof (clarsimp simp add: Lim_within dist_norm)
                 fix e :: "real"
                 assume "e > 0"
                 then obtain q::nat where "q \<noteq> 0" and qe2: "1/q < e/2"
                   by (metis divide_pos_pos inverse_eq_divide real_arch_inverse zero_less_numeral)
                 let ?g = "\<lambda>p. sum  (\<lambda>i. sum (\<lambda>j. abs((A p - B)$i$j)) UNIV) UNIV"
                 have "(\<lambda>k. onorm (\<lambda>y. (A k - B) *v y)) \<longlonglongrightarrow> 0"
                 proof (rule Lim_null_comparison)
                   show "\<forall>\<^sub>F k in sequentially. norm (onorm (\<lambda>y. (A k - B) *v y)) \<le> ?g k"
                   proof (rule eventually_sequentiallyI)
                     fix k :: "nat"
                     assume "0 \<le> k"
                     have "0 \<le> onorm ((*v) (A k - B))"
                       using matrix_vector_mul_bounded_linear
                       by (rule onorm_pos_le)
                     then show "norm (onorm ((*v) (A k - B))) \<le> (\<Sum>i\<in>UNIV. \<Sum>j\<in>UNIV. \<bar>(A k - B) $ i $ j\<bar>)"
                       by (simp add: onorm_le_matrix_component_sum del: vector_minus_component)
                   qed
                 next
                   show "?g \<longlonglongrightarrow> 0"
                     using B Lim_null tendsto_rabs_zero_iff by (fastforce intro!: tendsto_null_sum)
                 qed
                 with \<open>e > 0\<close> obtain p where "\<And>n. n \<ge> p \<Longrightarrow> \<bar>onorm ((*v) (A n - B))\<bar> < e/2"
                   unfolding lim_sequentially by (metis diff_zero dist_real_def divide_pos_pos zero_less_numeral)
                 then have pqe2: "\<bar>onorm ((*v) (A (p + q) - B))\<bar> < e/2" (*17 [`abs (onorm (\y. A (p + q) ** y - B ** y)) < e / &2`]*)
                   using le_add1 by blast
                 show "\<exists>d>0. \<forall>y\<in>S. y \<noteq> x \<and> norm (y - x) < d \<longrightarrow>
                            inverse (norm (y - x)) * norm (f y + B *v x - (f x + B *v y)) < e"
                 proof (intro exI, safe)
                   show "0 < \<delta>(p + q)"
                     by (simp add: \<delta>)
                 next
                   fix y
                   assume y: "y \<in> S" "norm (y - x) < \<delta>(p + q)" and "y \<noteq> x"
                   have *: "\<lbrakk>norm(b - c) < e - d; norm(y - x - b) \<le> d\<rbrakk> \<Longrightarrow> norm(y - x - c) < e"
                     for b c d e x and y:: "real^'n"
                     using norm_triangle_ineq2 [of "y - x - c" "y - x - b"] by simp
                   have "norm (f y - f x - B *v (y - x)) < e * norm (y - x)"
                   proof (rule *)
                     show "norm (f y - f x - A (p + q) *v (y - x)) \<le> norm (y - x) / (Suc (p + q))"
                       using A [OF y] by simp
                     have "norm (A (p + q) *v (y - x) - B *v (y - x)) \<le> onorm(\<lambda>x. (A(p + q) - B) *v x) * norm(y - x)"
                       by (metis linear_linear matrix_vector_mul_linear matrix_vector_mult_diff_rdistrib onorm)
                     also have "\<dots> < (e/2) * norm (y - x)"
                       using \<open>y \<noteq> x\<close> pqe2 by auto
                     also have "\<dots> \<le> (e - 1 / (Suc (p + q))) * norm (y - x)"
                     proof (rule mult_right_mono)
                       have "1 / Suc (p + q) \<le> 1 / q"
                         using \<open>q \<noteq> 0\<close> by (auto simp: field_split_simps)
                       also have "\<dots> < e/2"
                         using qe2 by auto
                       finally show "e / 2 \<le> e - 1 / real (Suc (p + q))"
                         by linarith
                     qed auto
                     finally show "norm (A (p + q) *v (y - x) - B *v (y - x)) < e * norm (y - x) - norm (y - x) / real (Suc (p + q))"
                       by (simp add: algebra_simps)
                   qed
                   then show "inverse (norm (y - x)) * norm (f y + B *v x - (f x + B *v y)) < e"
                     using \<open>y \<noteq> x\<close> by (simp add: field_split_simps algebra_simps)
                 qed
               qed
               then show "((\<lambda>y. (matrix (f' x) - B) *v (y - x) /\<^sub>R
                            norm (y - x) - (f x + f' x (y - x) - f y) /\<^sub>R norm (y - x)) \<longlongrightarrow> 0)
                           (at x within S)"
                 by (simp add: algebra_simps diff lin_df scalar_mult_eq_scaleR)
             qed
           qed (use x in \<open>simp; auto simp: not_less\<close>)
           ultimately have "f' x = (*v) B"
             by (force simp: algebra_simps scalar_mult_eq_scaleR)
           show "matrix (f' x) $ m $ n \<le> b"
           proof (rule tendsto_upperbound [of "\<lambda>i. (A i $ m $ n)" _ sequentially])
             show "(\<lambda>i. A i $ m $ n) \<longlonglongrightarrow> matrix (f' x) $ m $ n"
               by (simp add: B \<open>f' x = (*v) B\<close>)
             show "\<forall>\<^sub>F i in sequentially. A i $ m $ n \<le> b"
               by (simp add: Ab less_eq_real_def)
           qed auto
         next
           fix e :: "real"
           assume "x \<in> S" and b: "matrix (f' x) $ m $ n \<le> b" and "e > 0"
           then obtain d where "d>0"
             and d: "\<And>y. y\<in>S \<Longrightarrow> 0 < dist y x \<and> dist y x < d \<longrightarrow> norm (f y - f x - f' x (y - x)) / (norm (y - x))
                   < e/2"
             using f [OF \<open>x \<in> S\<close>]
             by (simp add: Deriv.has_derivative_at_within Lim_within)
               (auto simp add: field_simps dest: spec [of _ "e/2"])
           let ?A = "matrix(f' x) - (\<chi> i j. if i = m \<and> j = n then e / 4 else 0)"
           obtain B where BRats: "\<And>i j. B$i$j \<in> \<rat>" and Bo_e6: "onorm((*v) (?A - B)) < e/6"
             using matrix_rational_approximation \<open>e > 0\<close>
             by (metis zero_less_divide_iff zero_less_numeral)
           show "\<exists>d>0. \<exists>A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>) \<and>
                 (\<forall>y\<in>S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x))"
           proof (intro exI conjI ballI allI impI)
             show "d>0"
               by (rule \<open>d>0\<close>)
             show "B $ m $ n < b"
             proof -
               have "\<bar>matrix ((*v) (?A - B)) $ m $ n\<bar> \<le> onorm ((*v) (?A - B))"
                 using component_le_onorm [OF matrix_vector_mul_linear, of _ m n] by metis
               then show ?thesis
                 using b Bo_e6 by simp
             qed
             show "B $ i $ j \<in> \<rat>" for i j
               using BRats by auto
             show "norm (f y - f x - B *v (y - x)) \<le> e * norm (y - x)"
               if "y \<in> S" and y: "norm (y - x) < d" for y
             proof (cases "y = x")
               case True then show ?thesis
                 by simp
             next
               case False
               have *: "norm(d' - d) \<le> e/2 \<Longrightarrow> norm(y - (x + d')) < e/2 \<Longrightarrow> norm(y - x - d) \<le> e" for d d' e and x y::"real^'n"
                 using norm_triangle_le [of "d' - d" "y - (x + d')"] by simp
               show ?thesis
               proof (rule *)
                 have split246: "\<lbrakk>norm y \<le> e / 6; norm(x - y) \<le> e / 4\<rbrakk> \<Longrightarrow> norm x \<le> e/2" if "e > 0" for e and x y :: "real^'n"
                   using norm_triangle_le [of y "x-y" "e/2"] \<open>e > 0\<close> by simp
                 have "linear (f' x)"
                   using True f has_derivative_linear by blast
                 then have "norm (f' x (y - x) - B *v (y - x)) = norm ((matrix (f' x) - B) *v (y - x))"
                   by (simp add: matrix_vector_mult_diff_rdistrib)
                 also have "\<dots> \<le> (e * norm (y - x)) / 2"
                 proof (rule split246)
                   have "norm ((?A - B) *v (y - x)) / norm (y - x) \<le> onorm(\<lambda>x. (?A - B) *v x)"
                     by (rule le_onorm) auto
                   also have  "\<dots> < e/6"
                     by (rule Bo_e6)
                   finally have "norm ((?A - B) *v (y - x)) / norm (y - x) < e / 6" .
                   then show "norm ((?A - B) *v (y - x)) \<le> e * norm (y - x) / 6"
                     by (simp add: field_split_simps False)
                   have "norm ((matrix (f' x) - B) *v (y - x) - ((?A - B) *v (y - x))) = norm ((\<chi> i j. if i = m \<and> j = n then e / 4 else 0) *v (y - x))"
                     by (simp add: algebra_simps)
                   also have "\<dots> = norm((e/4) *\<^sub>R (y - x)$n *\<^sub>R axis m (1::real))"
                   proof -
                     have "(\<Sum>j\<in>UNIV. (if i = m \<and> j = n then e / 4 else 0) * (y $ j - x $ j)) * 4 = e * (y $ n - x $ n) * axis m 1 $ i" for i
                     proof (cases "i=m")
                       case True then show ?thesis
                         by (auto simp: if_distrib [of "\<lambda>z. z * _"] cong: if_cong)
                     next
                       case False then show ?thesis
                         by (simp add: axis_def)
                     qed
                     then have "(\<chi> i j. if i = m \<and> j = n then e / 4 else 0) *v (y - x) = (e/4) *\<^sub>R (y - x)$n *\<^sub>R axis m (1::real)"
                       by (auto simp: vec_eq_iff matrix_vector_mult_def)
                     then show ?thesis
                       by metis
                   qed
                   also have "\<dots> \<le> e * norm (y - x) / 4"
                     using \<open>e > 0\<close> apply (simp add: norm_mult abs_mult)
                     by (metis component_le_norm_cart vector_minus_component)
                   finally show "norm ((matrix (f' x) - B) *v (y - x) - ((?A - B) *v (y - x))) \<le> e * norm (y - x) / 4" .
                   show "0 < e * norm (y - x)"
                     by (simp add: False \<open>e > 0\<close>)
                 qed
                 finally show "norm (f' x (y - x) - B *v (y - x)) \<le> (e * norm (y - x)) / 2" .
                 show "norm (f y - (f x + f' x (y - x))) < (e * norm (y - x)) / 2"
                   using False d [OF \<open>y \<in> S\<close>] y by (simp add: dist_norm field_simps)
               qed
             qed
           qed
         qed
       qed auto
     qed
     show "negligible ?M"
       using negligible_subset [OF nN MN] .
   qed
   then show ?thesis
     by (simp add: borel_measurable_vimage_halfspace_component_le sets_restrict_space_iff assms)
 qed
 
 
 theorem borel_measurable_det_Jacobian:
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> sets lebesgue" and f: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   shows "(\<lambda>x. det(matrix(f' x))) \<in> borel_measurable (lebesgue_on S)"
   unfolding det_def
   by (intro measurable) (auto intro: f borel_measurable_partial_derivatives [OF S])
 
 text\<open>The localisation wrt S uses the same argument for many similar results.\<close>
 (*See HOL Light's MEASURABLE_ON_LEBESGUE_MEASURABLE_PREIMAGE_BOREL, etc.*)
 theorem borel_measurable_lebesgue_on_preimage_borel:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue"
   shows "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<forall>T. T \<in> sets borel \<longrightarrow> {x \<in> S. f x \<in> T} \<in> sets lebesgue)"
 proof -
   have "{x. (if x \<in> S then f x else 0) \<in> T} \<in> sets lebesgue \<longleftrightarrow> {x \<in> S. f x \<in> T} \<in> sets lebesgue"
          if "T \<in> sets borel" for T
     proof (cases "0 \<in> T")
       case True
       then have "{x \<in> S. f x \<in> T} = {x. (if x \<in> S then f x else 0) \<in> T} \<inter> S"
                 "{x. (if x \<in> S then f x else 0) \<in> T} = {x \<in> S. f x \<in> T} \<union> -S"
         by auto
       then show ?thesis
         by (metis (no_types, lifting) Compl_in_sets_lebesgue assms sets.Int sets.Un)
     next
       case False
       then have "{x. (if x \<in> S then f x else 0) \<in> T} = {x \<in> S. f x \<in> T}"
         by auto
       then show ?thesis
         by auto
     qed
     then show ?thesis
       unfolding borel_measurable_lebesgue_preimage_borel borel_measurable_if [OF assms, symmetric]
       by blast
 qed
 
 lemma sets_lebesgue_almost_borel:
   assumes "S \<in> sets lebesgue"
   obtains B N where "B \<in> sets borel" "negligible N" "B \<union> N = S"
 proof -
   obtain T N N' where "S = T \<union> N" "N \<subseteq> N'" "N' \<in> null_sets lborel" "T \<in> sets borel"
     using sets_completionE [OF assms] by auto
   then show thesis
     by (metis negligible_iff_null_sets negligible_subset null_sets_completionI that)
 qed
 
 lemma double_lebesgue_sets:
  assumes S: "S \<in> sets lebesgue" and T: "T \<in> sets lebesgue" and fim: "f ` S \<subseteq> T"
  shows "(\<forall>U. U \<in> sets lebesgue \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue) \<longleftrightarrow>
           f \<in> borel_measurable (lebesgue_on S) \<and>
           (\<forall>U. negligible U \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue)"
          (is "?lhs \<longleftrightarrow> _ \<and> ?rhs")
   unfolding borel_measurable_lebesgue_on_preimage_borel [OF S]
 proof (intro iffI allI conjI impI, safe)
   fix V :: "'b set"
   assume *: "\<forall>U. U \<in> sets lebesgue \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue"
     and "V \<in> sets borel"
   then have V: "V \<in> sets lebesgue"
     by simp
   have "{x \<in> S. f x \<in> V} = {x \<in> S. f x \<in> T \<inter> V}"
     using fim by blast
   also have "{x \<in> S. f x \<in> T \<inter> V} \<in> sets lebesgue"
     using T V * le_inf_iff by blast
   finally show "{x \<in> S. f x \<in> V} \<in> sets lebesgue" .
 next
   fix U :: "'b set"
   assume "\<forall>U. U \<in> sets lebesgue \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue"
          "negligible U" "U \<subseteq> T"
   then show "{x \<in> S. f x \<in> U} \<in> sets lebesgue"
     using negligible_imp_sets by blast
 next
   fix U :: "'b set"
   assume 1 [rule_format]: "(\<forall>T. T \<in> sets borel \<longrightarrow> {x \<in> S. f x \<in> T} \<in> sets lebesgue)"
      and 2 [rule_format]: "\<forall>U. negligible U \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue"
      and "U \<in> sets lebesgue" "U \<subseteq> T"
   then obtain C N where C: "C \<in> sets borel \<and> negligible N \<and> C \<union> N = U"
     using sets_lebesgue_almost_borel
     by metis
   then have "{x \<in> S. f x \<in> C} \<in> sets lebesgue"
     by (blast intro: 1)
   moreover have "{x \<in> S. f x \<in> N} \<in> sets lebesgue"
     using C \<open>U \<subseteq> T\<close> by (blast intro: 2)
   moreover have "{x \<in> S. f x \<in> C \<union> N} = {x \<in> S. f x \<in> C} \<union> {x \<in> S. f x \<in> N}"
     by auto
   ultimately show "{x \<in> S. f x \<in> U} \<in> sets lebesgue"
     using C by auto
 qed
 
 
 subsection\<open>Simplest case of Sard's theorem (we don't need continuity of derivative)\<close>
 
 lemma Sard_lemma00:
   fixes P :: "'b::euclidean_space set"
   assumes "a \<ge> 0" and a: "a *\<^sub>R i \<noteq> 0" and i: "i \<in> Basis"
     and P: "P \<subseteq> {x. a *\<^sub>R i \<bullet> x = 0}"
     and "0 \<le> m" "0 \<le> e"
  obtains S where "S \<in> lmeasurable"
             and "{z. norm z \<le> m \<and> (\<exists>t \<in> P. norm(z - t) \<le> e)} \<subseteq> S"
             and "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (DIM('b) - 1)"
 proof -
   have "a > 0"
     using assms by simp
   let ?v = "(\<Sum>j\<in>Basis. (if j = i then e else m) *\<^sub>R j)"
   show thesis
   proof
     have "- e \<le> x \<bullet> i" "x \<bullet> i \<le> e"
       if "t \<in> P" "norm (x - t) \<le> e" for x t
       using \<open>a > 0\<close> that Basis_le_norm [of i "x-t"] P i
       by (auto simp: inner_commute algebra_simps)
     moreover have "- m \<le> x \<bullet> j" "x \<bullet> j \<le> m"
       if "norm x \<le> m" "t \<in> P" "norm (x - t) \<le> e" "j \<in> Basis" and "j \<noteq> i"
       for x t j
       using that Basis_le_norm [of j x] by auto
     ultimately
     show "{z. norm z \<le> m \<and> (\<exists>t\<in>P. norm (z - t) \<le> e)} \<subseteq> cbox (-?v) ?v"
       by (auto simp: mem_box)
     have *: "\<forall>k\<in>Basis. - ?v \<bullet> k \<le> ?v \<bullet> k"
       using \<open>0 \<le> m\<close> \<open>0 \<le> e\<close> by (auto simp: inner_Basis)
     have 2: "2 ^ DIM('b) = 2 * 2 ^ (DIM('b) - Suc 0)"
       by (metis DIM_positive Suc_pred power_Suc)
     show "measure lebesgue (cbox (-?v) ?v) \<le> 2 * e * (2 * m) ^ (DIM('b) - 1)"
       using \<open>i \<in> Basis\<close>
       by (simp add: content_cbox [OF *] prod.distrib prod.If_cases Diff_eq [symmetric] 2)
   qed blast
 qed
 
 text\<open>As above, but reorienting the vector (HOL Light's @text{GEOM\_BASIS\_MULTIPLE\_TAC})\<close>
 lemma Sard_lemma0:
   fixes P :: "(real^'n::{finite,wellorder}) set"
   assumes "a \<noteq> 0"
     and P: "P \<subseteq> {x. a \<bullet> x = 0}" and "0 \<le> m" "0 \<le> e"
   obtains S where "S \<in> lmeasurable"
     and "{z. norm z \<le> m \<and> (\<exists>t \<in> P. norm(z - t) \<le> e)} \<subseteq> S"
     and "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (CARD('n) - 1)"
 proof -
   obtain T and k::'n where T: "orthogonal_transformation T" and a: "a = T (norm a *\<^sub>R axis k (1::real))"
     using rotation_rightward_line by metis
   have Tinv [simp]: "T (inv T x) = x" for x
     by (simp add: T orthogonal_transformation_surj surj_f_inv_f)
   obtain S where S: "S \<in> lmeasurable"
     and subS: "{z. norm z \<le> m \<and> (\<exists>t \<in> T-`P. norm(z - t) \<le> e)} \<subseteq> S"
     and mS: "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (CARD('n) - 1)"
   proof (rule Sard_lemma00 [of "norm a" "axis k (1::real)" "T-`P" m e])
     have "norm a *\<^sub>R axis k 1 \<bullet> x = 0" if "T x \<in> P" for x
     proof -
       have "a \<bullet> T x = 0"
         using P that by blast
       then show ?thesis
         by (metis (no_types, lifting) T a orthogonal_orthogonal_transformation orthogonal_def)
     qed
     then show "T -` P \<subseteq> {x. norm a *\<^sub>R axis k 1 \<bullet> x = 0}"
       by auto
   qed (use assms T in auto)
   show thesis
   proof
     show "T ` S \<in> lmeasurable"
       using S measurable_orthogonal_image T by blast
     have "{z. norm z \<le> m \<and> (\<exists>t\<in>P. norm (z - t) \<le> e)} \<subseteq> T ` {z. norm z \<le> m \<and> (\<exists>t\<in>T -` P. norm (z - t) \<le> e)}"
     proof clarsimp
       fix x t
       assume "norm x \<le> m" "t \<in> P" "norm (x - t) \<le> e"
       then have "norm (inv T x) \<le> m"
         using orthogonal_transformation_inv [OF T] by (simp add: orthogonal_transformation_norm)
       moreover have "\<exists>t\<in>T -` P. norm (inv T x - t) \<le> e"
       proof
         have "T (inv T x - inv T t) = x - t"
           using T linear_diff orthogonal_transformation_def
           by (metis (no_types, hide_lams) Tinv)
         then have "norm (inv T x - inv T t) = norm (x - t)"
           by (metis T orthogonal_transformation_norm)
         then show "norm (inv T x - inv T t) \<le> e"
           using \<open>norm (x - t) \<le> e\<close> by linarith
        next
          show "inv T t \<in> T -` P"
            using \<open>t \<in> P\<close> by force
       qed
       ultimately show "x \<in> T ` {z. norm z \<le> m \<and> (\<exists>t\<in>T -` P. norm (z - t) \<le> e)}"
         by force
     qed
     then show "{z. norm z \<le> m \<and> (\<exists>t\<in>P. norm (z - t) \<le> e)} \<subseteq> T ` S"
       using image_mono [OF subS] by (rule order_trans)
     show "measure lebesgue (T ` S) \<le> 2 * e * (2 * m) ^ (CARD('n) - 1)"
       using mS T by (simp add: S measure_orthogonal_image)
   qed
 qed
 
 text\<open>As above, but translating the sets (HOL Light's @text{GEN\_GEOM\_ORIGIN\_TAC})\<close>
 lemma Sard_lemma1:
   fixes P :: "(real^'n::{finite,wellorder}) set"
    assumes P: "dim P < CARD('n)" and "0 \<le> m" "0 \<le> e"
  obtains S where "S \<in> lmeasurable"
             and "{z. norm(z - w) \<le> m \<and> (\<exists>t \<in> P. norm(z - w - t) \<le> e)} \<subseteq> S"
             and "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (CARD('n) - 1)"
 proof -
   obtain a where "a \<noteq> 0" "P \<subseteq> {x. a \<bullet> x = 0}"
     using lowdim_subset_hyperplane [of P] P span_base by auto
   then obtain S where S: "S \<in> lmeasurable"
     and subS: "{z. norm z \<le> m \<and> (\<exists>t \<in> P. norm(z - t) \<le> e)} \<subseteq> S"
     and mS: "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (CARD('n) - 1)"
     by (rule Sard_lemma0 [OF _ _ \<open>0 \<le> m\<close> \<open>0 \<le> e\<close>])
   show thesis
   proof
     show "(+)w ` S \<in> lmeasurable"
       by (metis measurable_translation S)
     show "{z. norm (z - w) \<le> m \<and> (\<exists>t\<in>P. norm (z - w - t) \<le> e)} \<subseteq> (+)w ` S"
       using subS by force
     show "measure lebesgue ((+)w ` S) \<le> 2 * e * (2 * m) ^ (CARD('n) - 1)"
       by (metis measure_translation mS)
   qed
 qed
 
 lemma Sard_lemma2:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n::{finite,wellorder}"
   assumes mlen: "CARD('m) \<le> CARD('n)" (is "?m \<le> ?n")
     and "B > 0" "bounded S"
     and derS: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and rank: "\<And>x. x \<in> S \<Longrightarrow> rank(matrix(f' x)) < CARD('n)"
     and B: "\<And>x. x \<in> S \<Longrightarrow> onorm(f' x) \<le> B"
   shows "negligible(f ` S)"
 proof -
   have lin_f': "\<And>x. x \<in> S \<Longrightarrow> linear(f' x)"
     using derS has_derivative_linear by blast
   show ?thesis
   proof (clarsimp simp add: negligible_outer_le)
     fix e :: "real"
     assume "e > 0"
     obtain c where csub: "S \<subseteq> cbox (- (vec c)) (vec c)" and "c > 0"
     proof -
       obtain b where b: "\<And>x. x \<in> S \<Longrightarrow> norm x \<le> b"
         using \<open>bounded S\<close> by (auto simp: bounded_iff)
       show thesis
       proof
         have "- \<bar>b\<bar> - 1 \<le> x $ i \<and> x $ i \<le> \<bar>b\<bar> + 1" if "x \<in> S" for x i
           using component_le_norm_cart [of x i] b [OF that] by auto
         then show "S \<subseteq> cbox (- vec (\<bar>b\<bar> + 1)) (vec (\<bar>b\<bar> + 1))"
           by (auto simp: mem_box_cart)
       qed auto
     qed
     then have box_cc: "box (- (vec c)) (vec c) \<noteq> {}" and cbox_cc: "cbox (- (vec c)) (vec c) \<noteq> {}"
       by (auto simp: interval_eq_empty_cart)
     obtain d where "d > 0" "d \<le> B"
              and d: "(d * 2) * (4 * B) ^ (?n - 1) \<le> e / (2*c) ^ ?m / ?m ^ ?m"
       apply (rule that [of "min B (e / (2*c) ^ ?m / ?m ^ ?m / (4 * B) ^ (?n - 1) / 2)"])
       using \<open>B > 0\<close> \<open>c > 0\<close> \<open>e > 0\<close>
       by (simp_all add: divide_simps min_mult_distrib_right)
     have "\<exists>r. 0 < r \<and> r \<le> 1/2 \<and>
               (x \<in> S
                \<longrightarrow> (\<forall>y. y \<in> S \<and> norm(y - x) < r
                        \<longrightarrow> norm(f y - f x - f' x (y - x)) \<le> d * norm(y - x)))" for x
     proof (cases "x \<in> S")
       case True
       then obtain r where "r > 0"
               and "\<And>y. \<lbrakk>y \<in> S; norm (y - x) < r\<rbrakk>
                        \<Longrightarrow> norm (f y - f x - f' x (y - x)) \<le> d * norm (y - x)"
         using derS \<open>d > 0\<close> by (force simp: has_derivative_within_alt)
       then show ?thesis
         by (rule_tac x="min r (1/2)" in exI) simp
     next
       case False
       then show ?thesis
         by (rule_tac x="1/2" in exI) simp
     qed
     then obtain r where r12: "\<And>x. 0 < r x \<and> r x \<le> 1/2"
             and r: "\<And>x y. \<lbrakk>x \<in> S; y \<in> S; norm(y - x) < r x\<rbrakk>
                           \<Longrightarrow> norm(f y - f x - f' x (y - x)) \<le> d * norm(y - x)"
       by metis
     then have ga: "gauge (\<lambda>x. ball x (r x))"
       by (auto simp: gauge_def)
     obtain \<D> where \<D>: "countable \<D>" and sub_cc: "\<Union>\<D> \<subseteq> cbox (- vec c) (vec c)"
       and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> interior K \<noteq> {} \<and> (\<exists>u v. K = cbox u v)"
       and djointish: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
       and covered: "\<And>K. K \<in> \<D> \<Longrightarrow> \<exists>x \<in> S \<inter> K. K \<subseteq> ball x (r x)"
       and close: "\<And>u v. cbox u v \<in> \<D> \<Longrightarrow> \<exists>n. \<forall>i::'m. v $ i - u $ i = 2*c / 2^n"
       and covers: "S \<subseteq> \<Union>\<D>"
       apply (rule covering_lemma [OF csub box_cc ga])
       apply (auto simp: Basis_vec_def cart_eq_inner_axis [symmetric])
       done
     let ?\<mu> = "measure lebesgue"
     have "\<exists>T. T \<in> lmeasurable \<and> f ` (K \<inter> S) \<subseteq> T \<and> ?\<mu> T \<le> e / (2*c) ^ ?m * ?\<mu> K"
       if "K \<in> \<D>" for K
     proof -
       obtain u v where uv: "K = cbox u v"
         using cbox \<open>K \<in> \<D>\<close> by blast
       then have uv_ne: "cbox u v \<noteq> {}"
         using cbox that by fastforce
       obtain x where x: "x \<in> S \<inter> cbox u v" "cbox u v \<subseteq> ball x (r x)"
         using \<open>K \<in> \<D>\<close> covered uv by blast
       then have "dim (range (f' x)) < ?n"
         using rank_dim_range [of "matrix (f' x)"] x rank[of x]
         by (auto simp: matrix_works scalar_mult_eq_scaleR lin_f')
       then obtain T where T: "T \<in> lmeasurable"
             and subT: "{z. norm(z - f x) \<le> (2 * B) * norm(v - u) \<and> (\<exists>t \<in> range (f' x). norm(z - f x - t) \<le> d * norm(v - u))} \<subseteq> T"
             and measT: "?\<mu> T \<le> (2 * (d * norm(v - u))) * (2 * ((2 * B) * norm(v - u))) ^ (?n - 1)"
                         (is "_ \<le> ?DVU")
         apply (rule Sard_lemma1 [of "range (f' x)" "(2 * B) * norm(v - u)" "d * norm(v - u)" "f x"])
         using \<open>B > 0\<close> \<open>d > 0\<close> by simp_all
       show ?thesis
       proof (intro exI conjI)
         have "f ` (K \<inter> S) \<subseteq> {z. norm(z - f x) \<le> (2 * B) * norm(v - u) \<and> (\<exists>t \<in> range (f' x). norm(z - f x - t) \<le> d * norm(v - u))}"
           unfolding uv
         proof (clarsimp simp: mult.assoc, intro conjI)
           fix y
           assume y: "y \<in> cbox u v" and "y \<in> S"
           then have "norm (y - x) < r x"
             by (metis dist_norm mem_ball norm_minus_commute subsetCE x(2))
           then have le_dyx: "norm (f y - f x - f' x (y - x)) \<le> d * norm (y - x)"
             using r [of x y] x \<open>y \<in> S\<close> by blast
           have yx_le: "norm (y - x) \<le> norm (v - u)"
           proof (rule norm_le_componentwise_cart)
             show "norm ((y - x) $ i) \<le> norm ((v - u) $ i)" for i
               using x y by (force simp: mem_box_cart dest!: spec [where x=i])
           qed
           have *: "\<lbrakk>norm(y - x - z) \<le> d; norm z \<le> B; d \<le> B\<rbrakk> \<Longrightarrow> norm(y - x) \<le> 2 * B"
             for x y z :: "real^'n::_" and d B
             using norm_triangle_ineq2 [of "y - x" z] by auto
           show "norm (f y - f x) \<le> 2 * (B * norm (v - u))"
           proof (rule * [OF le_dyx])
             have "norm (f' x (y - x)) \<le> onorm (f' x) * norm (y - x)"
               using onorm [of "f' x" "y-x"] by (meson IntE lin_f' linear_linear x(1))
             also have "\<dots> \<le> B * norm (v - u)"
             proof (rule mult_mono)
               show "onorm (f' x) \<le> B"
                 using B x by blast
             qed (use \<open>B > 0\<close> yx_le in auto)
             finally show "norm (f' x (y - x)) \<le> B * norm (v - u)" .
             show "d * norm (y - x) \<le> B * norm (v - u)"
               using \<open>B > 0\<close> by (auto intro: mult_mono [OF \<open>d \<le> B\<close> yx_le])
           qed
           show "\<exists>t. norm (f y - f x - f' x t) \<le> d * norm (v - u)"
             apply (rule_tac x="y-x" in exI)
             using \<open>d > 0\<close> yx_le le_dyx mult_left_mono [where c=d]
             by (meson order_trans mult_le_cancel_iff2)
         qed
         with subT show "f ` (K \<inter> S) \<subseteq> T" by blast
         show "?\<mu> T \<le> e / (2*c) ^ ?m * ?\<mu> K"
         proof (rule order_trans [OF measT])
           have "?DVU = (d * 2 * (4 * B) ^ (?n - 1)) * norm (v - u)^?n"
             using \<open>c > 0\<close>
             apply (simp add: algebra_simps)
             by (metis Suc_pred power_Suc zero_less_card_finite)
           also have "\<dots> \<le> (e / (2*c) ^ ?m / (?m ^ ?m)) * norm(v - u) ^ ?n"
             by (rule mult_right_mono [OF d]) auto
           also have "\<dots> \<le> e / (2*c) ^ ?m * ?\<mu> K"
           proof -
             have "u \<in> ball (x) (r x)" "v \<in> ball x (r x)"
               using box_ne_empty(1) contra_subsetD [OF x(2)] mem_box(2) uv_ne by fastforce+
             moreover have "r x \<le> 1/2"
               using r12 by auto
             ultimately have "norm (v - u) \<le> 1"
               using norm_triangle_half_r [of x u 1 v]
               by (metis (no_types, hide_lams) dist_commute dist_norm less_eq_real_def less_le_trans mem_ball)
             then have "norm (v - u) ^ ?n \<le> norm (v - u) ^ ?m"
               by (simp add: power_decreasing [OF mlen])
             also have "\<dots> \<le> ?\<mu> K * real (?m ^ ?m)"
             proof -
               obtain n where n: "\<And>i. v$i - u$i = 2 * c / 2^n"
                 using close [of u v] \<open>K \<in> \<D>\<close> uv by blast
               have "norm (v - u) ^ ?m \<le> (\<Sum>i\<in>UNIV. \<bar>(v - u) $ i\<bar>) ^ ?m"
                 by (intro norm_le_l1_cart power_mono) auto
               also have "\<dots> \<le> (\<Prod>i\<in>UNIV. v $ i - u $ i) * real CARD('m) ^ CARD('m)"
                 by (simp add: n field_simps \<open>c > 0\<close> less_eq_real_def)
               also have "\<dots> = ?\<mu> K * real (?m ^ ?m)"
                 by (simp add: uv uv_ne content_cbox_cart)
               finally show ?thesis .
             qed
             finally have *: "1 / real (?m ^ ?m) * norm (v - u) ^ ?n \<le> ?\<mu> K"
               by (simp add: field_split_simps)
             show ?thesis
               using mult_left_mono [OF *, of "e / (2*c) ^ ?m"] \<open>c > 0\<close> \<open>e > 0\<close> by auto
           qed
           finally show "?DVU \<le> e / (2*c) ^ ?m * ?\<mu> K" .
         qed
       qed (use T in auto)
     qed
     then obtain g where meas_g: "\<And>K. K \<in> \<D> \<Longrightarrow> g K \<in> lmeasurable"
                     and sub_g: "\<And>K. K \<in> \<D> \<Longrightarrow> f ` (K \<inter> S) \<subseteq> g K"
                     and le_g: "\<And>K. K \<in> \<D> \<Longrightarrow> ?\<mu> (g K) \<le> e / (2*c)^?m * ?\<mu> K"
       by metis
     have le_e: "?\<mu> (\<Union>i\<in>\<F>. g i) \<le> e"
       if "\<F> \<subseteq> \<D>" "finite \<F>" for \<F>
     proof -
       have "?\<mu> (\<Union>i\<in>\<F>. g i) \<le> (\<Sum>i\<in>\<F>. ?\<mu> (g i))"
         using meas_g \<open>\<F> \<subseteq> \<D>\<close> by (auto intro: measure_UNION_le [OF \<open>finite \<F>\<close>])
       also have "\<dots> \<le> (\<Sum>K\<in>\<F>. e / (2*c) ^ ?m * ?\<mu> K)"
         using \<open>\<F> \<subseteq> \<D>\<close> sum_mono [OF le_g] by (meson le_g subsetCE sum_mono)
       also have "\<dots> = e / (2*c) ^ ?m * (\<Sum>K\<in>\<F>. ?\<mu> K)"
         by (simp add: sum_distrib_left)
       also have "\<dots> \<le> e"
       proof -
         have "\<F> division_of \<Union>\<F>"
         proof (rule division_ofI)
           show "K \<subseteq> \<Union>\<F>"  "K \<noteq> {}" "\<exists>a b. K = cbox a b" if "K \<in> \<F>" for K
             using \<open>K \<in> \<F>\<close> covered cbox \<open>\<F> \<subseteq> \<D>\<close> by (auto simp: Union_upper)
           show "interior K \<inter> interior L = {}" if "K \<in> \<F>" and "L \<in> \<F>" and "K \<noteq> L" for K L
             by (metis (mono_tags, lifting) \<open>\<F> \<subseteq> \<D>\<close> pairwiseD djointish pairwise_subset that)
         qed (use that in auto)
         then have "sum ?\<mu> \<F> \<le> ?\<mu> (\<Union>\<F>)"
           by (simp add: content_division)
         also have "\<dots> \<le> ?\<mu> (cbox (- vec c) (vec c) :: (real, 'm) vec set)"
         proof (rule measure_mono_fmeasurable)
           show "\<Union>\<F> \<subseteq> cbox (- vec c) (vec c)"
             by (meson Sup_subset_mono sub_cc order_trans \<open>\<F> \<subseteq> \<D>\<close>)
         qed (use \<open>\<F> division_of \<Union>\<F>\<close> lmeasurable_division in auto)
         also have "\<dots> = content (cbox (- vec c) (vec c) :: (real, 'm) vec set)"
           by simp
         also have "\<dots> \<le> (2 ^ ?m * c ^ ?m)"
           using \<open>c > 0\<close> by (simp add: content_cbox_if_cart)
         finally have "sum ?\<mu> \<F> \<le> (2 ^ ?m * c ^ ?m)" .
         then show ?thesis
           using \<open>e > 0\<close> \<open>c > 0\<close> by (auto simp: field_split_simps)
       qed
       finally show ?thesis .
     qed
     show "\<exists>T. f ` S \<subseteq> T \<and> T \<in> lmeasurable \<and> ?\<mu> T \<le> e"
     proof (intro exI conjI)
       show "f ` S \<subseteq> \<Union> (g ` \<D>)"
         using covers sub_g by force
       show "\<Union> (g ` \<D>) \<in> lmeasurable"
         by (rule fmeasurable_UN_bound [OF \<open>countable \<D>\<close> meas_g le_e])
       show "?\<mu> (\<Union> (g ` \<D>)) \<le> e"
         by (rule measure_UN_bound [OF \<open>countable \<D>\<close> meas_g le_e])
     qed
   qed
 qed
 
 
 theorem baby_Sard:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n::{finite,wellorder}"
   assumes mlen: "CARD('m) \<le> CARD('n)"
     and der: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and rank: "\<And>x. x \<in> S \<Longrightarrow> rank(matrix(f' x)) < CARD('n)"
   shows "negligible(f ` S)"
 proof -
   let ?U = "\<lambda>n. {x \<in> S. norm(x) \<le> n \<and> onorm(f' x) \<le> real n}"
   have "\<And>x. x \<in> S \<Longrightarrow> \<exists>n. norm x \<le> real n \<and> onorm (f' x) \<le> real n"
     by (meson linear order_trans real_arch_simple)
   then have eq: "S = (\<Union>n. ?U n)"
     by auto
   have "negligible (f ` ?U n)" for n
   proof (rule Sard_lemma2 [OF mlen])
     show "0 < real n + 1"
       by auto
     show "bounded (?U n)"
       using bounded_iff by blast
     show "(f has_derivative f' x) (at x within ?U n)" if "x \<in> ?U n" for x
       using der that by (force intro: has_derivative_subset)
   qed (use rank in auto)
   then show ?thesis
     by (subst eq) (simp add: image_Union negligible_Union_nat)
 qed
 
 
 subsection\<open>A one-way version of change-of-variables not assuming injectivity. \<close>
 
 lemma integral_on_image_ubound_weak:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real"
   assumes S: "S \<in> sets lebesgue"
       and f: "f \<in> borel_measurable (lebesgue_on (g ` S))"
       and nonneg_fg:  "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f(g x)"
       and der_g:   "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and det_int_fg: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) integrable_on S"
       and meas_gim: "\<And>T. \<lbrakk>T \<subseteq> g ` S; T \<in> sets lebesgue\<rbrakk> \<Longrightarrow> {x \<in> S. g x \<in> T} \<in> sets lebesgue"
     shows "f integrable_on (g ` S) \<and>
            integral (g ` S) f \<le> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x))"
          (is "_ \<and> _ \<le> ?b")
 proof -
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar>"
   have cont_g: "continuous_on S g"
     using der_g has_derivative_continuous_on by blast
   have [simp]: "space (lebesgue_on S) = S"
     by (simp add: S)
   have gS_in_sets_leb: "g ` S \<in> sets lebesgue"
     apply (rule differentiable_image_in_sets_lebesgue)
     using der_g by (auto simp: S differentiable_def differentiable_on_def)
   obtain h where nonneg_h: "\<And>n x. 0 \<le> h n x"
     and h_le_f: "\<And>n x. x \<in> S \<Longrightarrow> h n (g x) \<le> f (g x)"
     and h_inc: "\<And>n x. h n x \<le> h (Suc n) x"
     and h_meas: "\<And>n. h n \<in> borel_measurable lebesgue"
     and fin_R: "\<And>n. finite(range (h n))"
     and lim: "\<And>x. x \<in> g ` S \<Longrightarrow> (\<lambda>n. h n x) \<longlonglongrightarrow> f x"
   proof -
     let ?f = "\<lambda>x. if x \<in> g ` S then f x else 0"
     have "?f \<in> borel_measurable lebesgue \<and> (\<forall>x. 0 \<le> ?f x)"
       by (auto simp: gS_in_sets_leb f nonneg_fg measurable_restrict_space_iff [symmetric])
     then show ?thesis
       apply (clarsimp simp add: borel_measurable_simple_function_limit_increasing)
       apply (rename_tac h)
       by (rule_tac h=h in that) (auto split: if_split_asm)
   qed
   have h_lmeas: "{t. h n (g t) = y} \<inter> S \<in> sets lebesgue" for y n
   proof -
     have "space (lebesgue_on (UNIV::(real,'n) vec set)) = UNIV"
       by simp
     then have "((h n) -`{y} \<inter> g ` S) \<in> sets (lebesgue_on (g ` S))"
       by (metis Int_commute borel_measurable_vimage h_meas image_eqI inf_top.right_neutral sets_restrict_space space_borel space_completion space_lborel)
     then have "({u. h n u = y} \<inter> g ` S) \<in> sets lebesgue"
       using gS_in_sets_leb
       by (simp add: integral_indicator fmeasurableI2 sets_restrict_space_iff vimage_def)
     then have "{x \<in> S. g x \<in> ({u. h n u = y} \<inter> g ` S)} \<in> sets lebesgue"
       using meas_gim[of "({u. h n u = y} \<inter> g ` S)"] by force
     moreover have "{t. h n (g t) = y} \<inter> S = {x \<in> S. g x \<in> ({u. h n u = y} \<inter> g ` S)}"
       by blast
     ultimately show ?thesis
       by auto
   qed
   have hint: "h n integrable_on g ` S \<and> integral (g ` S) (h n) \<le> integral S (\<lambda>x. ?D x * h n (g x))"
           (is "?INT \<and> ?lhs \<le> ?rhs")  for n
   proof -
     let ?R = "range (h n)"
     have hn_eq: "h n = (\<lambda>x. \<Sum>y\<in>?R. y * indicat_real {x. h n x = y} x)"
       by (simp add: indicator_def if_distrib fin_R cong: if_cong)
     have yind: "(\<lambda>t. y * indicator{x. h n x = y} t) integrable_on (g ` S) \<and>
                 (integral (g ` S) (\<lambda>t. y * indicator {x. h n x = y} t))
                  \<le> integral S (\<lambda>t. \<bar>det (matrix (g' t))\<bar> * y * indicator {x. h n x = y} (g t))"
        if y: "y \<in> ?R" for y::real
     proof (cases "y=0")
       case True
       then show ?thesis using gS_in_sets_leb integrable_0 by force
     next
       case False
       with that have "y > 0"
         using less_eq_real_def nonneg_h by fastforce
       have "(\<lambda>x. if x \<in> {t. h n (g t) = y} then ?D x else 0) integrable_on S"
       proof (rule measurable_bounded_by_integrable_imp_integrable)
         have "(\<lambda>x. ?D x) \<in> borel_measurable (lebesgue_on ({t. h n (g t) = y} \<inter> S))"
           apply (intro borel_measurable_abs borel_measurable_det_Jacobian [OF h_lmeas, where f=g])
           by (meson der_g IntD2 has_derivative_subset inf_le2)
         then have "(\<lambda>x. if x \<in> {t. h n (g t) = y} \<inter> S then ?D x else 0) \<in> borel_measurable lebesgue"
           by (rule borel_measurable_if_I [OF _ h_lmeas])
         then show "(\<lambda>x. if x \<in> {t. h n (g t) = y} then ?D x else 0) \<in> borel_measurable (lebesgue_on S)"
           by (simp add: if_if_eq_conj Int_commute borel_measurable_if [OF S, symmetric])
         show "(\<lambda>x. ?D x *\<^sub>R f (g x) /\<^sub>R y) integrable_on S"
           by (rule integrable_cmul) (use det_int_fg in auto)
         show "norm (if x \<in> {t. h n (g t) = y} then ?D x else 0) \<le> ?D x *\<^sub>R f (g x) /\<^sub>R y"
           if "x \<in> S" for x
           using nonneg_h [of n x] \<open>y > 0\<close> nonneg_fg [of x] h_le_f [of x n] that
           by (auto simp: divide_simps mult_left_mono)
       qed (use S in auto)
       then have int_det: "(\<lambda>t. \<bar>det (matrix (g' t))\<bar>) integrable_on ({t. h n (g t) = y} \<inter> S)"
         using integrable_restrict_Int by force
       have "(g ` ({t. h n (g t) = y} \<inter> S)) \<in> lmeasurable"
         apply (rule measurable_differentiable_image [OF h_lmeas])
          apply (blast intro: has_derivative_subset [OF der_g])
         apply (rule int_det)
         done
       moreover have "g ` ({t. h n (g t) = y} \<inter> S) = {x. h n x = y} \<inter> g ` S"
         by blast
       moreover have "measure lebesgue (g ` ({t. h n (g t) = y} \<inter> S))
                      \<le> integral ({t. h n (g t) = y} \<inter> S) (\<lambda>t. \<bar>det (matrix (g' t))\<bar>)"
         apply (rule measure_differentiable_image [OF h_lmeas _ int_det])
         apply (blast intro: has_derivative_subset [OF der_g])
         done
       ultimately show ?thesis
         using \<open>y > 0\<close> integral_restrict_Int [of S "{t. h n (g t) = y}" "\<lambda>t. \<bar>det (matrix (g' t))\<bar> * y"]
         apply (simp add: integrable_on_indicator integral_indicator)
-        apply (simp add: indicator_def if_distrib cong: if_cong)
+        apply (simp add: indicator_def of_bool_def if_distrib cong: if_cong)
         done
     qed
     have hn_int: "h n integrable_on g ` S"
       apply (subst hn_eq)
       using yind by (force intro: integrable_sum [OF fin_R])
     then show ?thesis
     proof
       have "?lhs = integral (g ` S) (\<lambda>x. \<Sum>y\<in>range (h n). y * indicat_real {x. h n x = y} x)"
         by (metis hn_eq)
       also have "\<dots> = (\<Sum>y\<in>range (h n). integral (g ` S) (\<lambda>x. y * indicat_real {x. h n x = y} x))"
         by (rule integral_sum [OF fin_R]) (use yind in blast)
       also have "\<dots> \<le> (\<Sum>y\<in>range (h n). integral S (\<lambda>u. \<bar>det (matrix (g' u))\<bar> * y * indicat_real {x. h n x = y} (g u)))"
         using yind by (force intro: sum_mono)
       also have "\<dots> = integral S (\<lambda>u. \<Sum>y\<in>range (h n). \<bar>det (matrix (g' u))\<bar> * y * indicat_real {x. h n x = y} (g u))"
       proof (rule integral_sum [OF fin_R, symmetric])
         fix y assume y: "y \<in> ?R"
         with nonneg_h have "y \<ge> 0"
           by auto
         show "(\<lambda>u. \<bar>det (matrix (g' u))\<bar> * y * indicat_real {x. h n x = y} (g u)) integrable_on S"
         proof (rule measurable_bounded_by_integrable_imp_integrable)
           have "(\<lambda>x. indicat_real {x. h n x = y} (g x)) \<in> borel_measurable (lebesgue_on S)"
             using h_lmeas S
             by (auto simp: indicator_vimage [symmetric] borel_measurable_indicator_iff sets_restrict_space_iff)
           then show "(\<lambda>u. \<bar>det (matrix (g' u))\<bar> * y * indicat_real {x. h n x = y} (g u)) \<in> borel_measurable (lebesgue_on S)"
             by (intro borel_measurable_times borel_measurable_abs borel_measurable_const borel_measurable_det_Jacobian [OF S der_g])
         next
           fix x
           assume "x \<in> S"
           have "y * indicat_real {x. h n x = y} (g x) \<le> f (g x)"
-            by (metis (full_types) \<open>x \<in> S\<close> h_le_f indicator_def mem_Collect_eq mult.right_neutral mult_zero_right nonneg_fg)
+            by (metis \<open>x \<in> S\<close> h_le_f indicator_simps(1) indicator_simps(2) mem_Collect_eq mult.commute mult.left_neutral mult_zero_left nonneg_fg)
           with \<open>y \<ge> 0\<close> show "norm (?D x * y * indicat_real {x. h n x = y} (g x)) \<le> ?D x * f(g x)"
             by (simp add: abs_mult mult.assoc mult_left_mono)
         qed (use S det_int_fg in auto)
       qed
       also have "\<dots> = integral S (\<lambda>T. \<bar>det (matrix (g' T))\<bar> *
                                         (\<Sum>y\<in>range (h n). y * indicat_real {x. h n x = y} (g T)))"
         by (simp add: sum_distrib_left mult.assoc)
       also have "\<dots> = ?rhs"
         by (metis hn_eq)
       finally show "integral (g ` S) (h n) \<le> ?rhs" .
     qed
   qed
   have le: "integral S (\<lambda>T. \<bar>det (matrix (g' T))\<bar> * h n (g T)) \<le> ?b" for n
   proof (rule integral_le)
     show "(\<lambda>T. \<bar>det (matrix (g' T))\<bar> * h n (g T)) integrable_on S"
     proof (rule measurable_bounded_by_integrable_imp_integrable)
       have "(\<lambda>T. \<bar>det (matrix (g' T))\<bar> *\<^sub>R h n (g T)) \<in> borel_measurable (lebesgue_on S)"
       proof (intro borel_measurable_scaleR borel_measurable_abs borel_measurable_det_Jacobian \<open>S \<in> sets lebesgue\<close>)
         have eq: "{x \<in> S. f x \<le> a} = (\<Union>b \<in> (f ` S) \<inter> atMost a. {x. f x = b} \<inter> S)" for f and a::real
           by auto
         have "finite ((\<lambda>x. h n (g x)) ` S \<inter> {..a})" for a
           by (force intro: finite_subset [OF _ fin_R])
         with h_lmeas [of n] show "(\<lambda>x. h n (g x)) \<in> borel_measurable (lebesgue_on S)"
           apply (simp add: borel_measurable_vimage_halfspace_component_le \<open>S \<in> sets lebesgue\<close> sets_restrict_space_iff eq)
           by (metis (mono_tags) SUP_inf sets.finite_UN)
       qed (use der_g in blast)
       then show "(\<lambda>T. \<bar>det (matrix (g' T))\<bar> * h n (g T)) \<in> borel_measurable (lebesgue_on S)"
         by simp
       show "norm (?D x * h n (g x)) \<le> ?D x *\<^sub>R f (g x)"
         if "x \<in> S" for x
         by (simp add: h_le_f mult_left_mono nonneg_h that)
     qed (use S det_int_fg in auto)
     show "?D x * h n (g x) \<le> ?D x * f (g x)" if "x \<in> S" for x
       by (simp add: \<open>x \<in> S\<close> h_le_f mult_left_mono)
     show "(\<lambda>x. ?D x * f (g x)) integrable_on S"
       using det_int_fg by blast
   qed
   have "f integrable_on g ` S \<and> (\<lambda>k. integral (g ` S) (h k)) \<longlonglongrightarrow> integral (g ` S) f"
   proof (rule monotone_convergence_increasing)
     have "\<bar>integral (g ` S) (h n)\<bar> \<le> integral S (\<lambda>x. ?D x * f (g x))" for n
     proof -
       have "\<bar>integral (g ` S) (h n)\<bar> = integral (g ` S) (h n)"
         using hint by (simp add: integral_nonneg nonneg_h)
       also have "\<dots> \<le> integral S (\<lambda>x. ?D x * f (g x))"
         using hint le by (meson order_trans)
       finally show ?thesis .
     qed
     then show "bounded (range (\<lambda>k. integral (g ` S) (h k)))"
       by (force simp: bounded_iff)
   qed (use h_inc lim hint in auto)
   moreover have "integral (g ` S) (h n) \<le> integral S (\<lambda>x. ?D x * f (g x))" for n
     using hint by (blast intro: le order_trans)
   ultimately show ?thesis
     by (auto intro: Lim_bounded)
 qed
 
 
 lemma integral_on_image_ubound_nonneg:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real"
   assumes nonneg_fg: "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f(g x)"
       and der_g:   "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and intS: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) integrable_on S"
   shows "f integrable_on (g ` S) \<and> integral (g ` S) f \<le> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x))"
          (is "_ \<and> _ \<le> ?b")
 proof -
   let ?D = "\<lambda>x. det (matrix (g' x))"
   define S' where "S' \<equiv> {x \<in> S. ?D x * f(g x) \<noteq> 0}"
   then have der_gS': "\<And>x. x \<in> S' \<Longrightarrow> (g has_derivative g' x) (at x within S')"
     by (metis (mono_tags, lifting) der_g has_derivative_subset mem_Collect_eq subset_iff)
   have "(\<lambda>x. if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0) integrable_on UNIV"
     by (simp add: integrable_restrict_UNIV intS)
   then have Df_borel: "(\<lambda>x. if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0) \<in> borel_measurable lebesgue"
     using integrable_imp_measurable lebesgue_on_UNIV_eq by force
   have S': "S' \<in> sets lebesgue"
   proof -
     from Df_borel borel_measurable_vimage_open [of _ UNIV]
     have "{x. (if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0) \<in> T} \<in> sets lebesgue"
       if "open T" for T
       using that unfolding lebesgue_on_UNIV_eq
       by (fastforce simp add: dest!: spec)
     then have "{x. (if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0) \<in> -{0}} \<in> sets lebesgue"
       using open_Compl by blast
     then show ?thesis
       by (simp add: S'_def conj_ac split: if_split_asm cong: conj_cong)
   qed
   then have gS': "g ` S' \<in> sets lebesgue"
   proof (rule differentiable_image_in_sets_lebesgue)
     show "g differentiable_on S'"
       using der_g unfolding S'_def differentiable_def differentiable_on_def
       by (blast intro: has_derivative_subset)
   qed auto
   have f: "f \<in> borel_measurable (lebesgue_on (g ` S'))"
   proof (clarsimp simp add: borel_measurable_vimage_open)
     fix T :: "real set"
     assume "open T"
     have "{x \<in> g ` S'. f x \<in> T} = g ` {x \<in> S'. f(g x) \<in> T}"
       by blast
     moreover have "g ` {x \<in> S'. f(g x) \<in> T} \<in> sets lebesgue"
     proof (rule differentiable_image_in_sets_lebesgue)
       let ?h = "\<lambda>x. \<bar>?D x\<bar> * f (g x) /\<^sub>R \<bar>?D x\<bar>"
       have "(\<lambda>x. if x \<in> S' then \<bar>?D x\<bar> * f (g x) else 0) = (\<lambda>x. if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0)"
         by (auto simp: S'_def)
       also have "\<dots> \<in> borel_measurable lebesgue"
         by (rule Df_borel)
       finally have *: "(\<lambda>x. \<bar>?D x\<bar> * f (g x)) \<in> borel_measurable (lebesgue_on S')"
         by (simp add: borel_measurable_if_D)
       have "?h \<in> borel_measurable (lebesgue_on S')"
         by (intro * S' der_gS' borel_measurable_det_Jacobian measurable) (blast intro: der_gS')
       moreover have "?h x = f(g x)" if "x \<in> S'" for x
         using that by (auto simp: S'_def)
       ultimately have "(\<lambda>x. f(g x)) \<in> borel_measurable (lebesgue_on S')"
         by (metis (no_types, lifting) measurable_lebesgue_cong)
       then show "{x \<in> S'. f (g x) \<in> T} \<in> sets lebesgue"
         by (simp add: \<open>S' \<in> sets lebesgue\<close> \<open>open T\<close> borel_measurable_vimage_open sets_restrict_space_iff)
       show "g differentiable_on {x \<in> S'. f (g x) \<in> T}"
         using der_g unfolding S'_def differentiable_def differentiable_on_def
         by (blast intro: has_derivative_subset)
     qed auto
     ultimately have "{x \<in> g ` S'. f x \<in> T} \<in> sets lebesgue"
       by metis
     then show "{x \<in> g ` S'. f x \<in> T} \<in> sets (lebesgue_on (g ` S'))"
       by (simp add: \<open>g ` S' \<in> sets lebesgue\<close> sets_restrict_space_iff)
   qed
   have intS': "(\<lambda>x. \<bar>?D x\<bar> * f (g x)) integrable_on S'"
     using intS
     by (rule integrable_spike_set) (auto simp: S'_def intro: empty_imp_negligible)
   have lebS': "{x \<in> S'. g x \<in> T} \<in> sets lebesgue" if "T \<subseteq> g ` S'" "T \<in> sets lebesgue" for T
   proof -
     have "g \<in> borel_measurable (lebesgue_on S')"
       using der_gS' has_derivative_continuous_on S'
       by (blast intro: continuous_imp_measurable_on_sets_lebesgue)
     moreover have "{x \<in> S'. g x \<in> U} \<in> sets lebesgue" if "negligible U" "U \<subseteq> g ` S'" for U
     proof (intro negligible_imp_sets negligible_differentiable_vimage that)
       fix x
       assume x: "x \<in> S'"
       then have "linear (g' x)"
         using der_gS' has_derivative_linear by blast
       with x show "inj (g' x)"
         by (auto simp: S'_def det_nz_iff_inj)
     qed (use der_gS' in auto)
     ultimately show ?thesis
       using double_lebesgue_sets [OF S' gS' order_refl] that by blast
   qed
   have int_gS': "f integrable_on g ` S' \<and> integral (g ` S') f \<le> integral S' (\<lambda>x. \<bar>?D x\<bar> * f(g x))"
     using integral_on_image_ubound_weak [OF S' f nonneg_fg der_gS' intS' lebS'] S'_def by blast
   have "negligible (g ` {x \<in> S. det(matrix(g' x)) = 0})"
   proof (rule baby_Sard, simp_all)
     fix x
     assume x: "x \<in> S \<and> det (matrix (g' x)) = 0"
     then show "(g has_derivative g' x) (at x within {x \<in> S. det (matrix (g' x)) = 0})"
       by (metis (no_types, lifting) der_g has_derivative_subset mem_Collect_eq subsetI)
     then show "rank (matrix (g' x)) < CARD('n)"
       using det_nz_iff_inj matrix_vector_mul_linear x
       by (fastforce simp add: less_rank_noninjective)
   qed
   then have negg: "negligible (g ` S - g ` {x \<in> S. ?D x \<noteq> 0})"
     by (rule negligible_subset) (auto simp: S'_def)
   have null: "g ` {x \<in> S. ?D x \<noteq> 0} - g ` S = {}"
     by (auto simp: S'_def)
   let ?F = "{x \<in> S. f (g x) \<noteq> 0}"
   have eq: "g ` S' = g ` ?F \<inter> g ` {x \<in> S. ?D x \<noteq> 0}"
     by (auto simp: S'_def image_iff)
   show ?thesis
   proof
     have "((\<lambda>x. if x \<in> g ` ?F then f x else 0) integrable_on g ` {x \<in> S. ?D x \<noteq> 0})"
       using int_gS' eq integrable_restrict_Int [where f=f]
       by simp
     then have "f integrable_on g ` {x \<in> S. ?D x \<noteq> 0}"
       by (auto simp: image_iff elim!: integrable_eq)
     then show "f integrable_on g ` S"
       apply (rule integrable_spike_set [OF _ empty_imp_negligible negligible_subset])
       using negg null by auto
     have "integral (g ` S) f = integral (g ` {x \<in> S. ?D x \<noteq> 0}) f"
       using negg by (auto intro: negligible_subset integral_spike_set)
     also have "\<dots> = integral (g ` {x \<in> S. ?D x \<noteq> 0}) (\<lambda>x. if x \<in> g ` ?F then f x else 0)"
       by (auto simp: image_iff intro!: integral_cong)
     also have "\<dots> = integral (g ` S') f"
       using  eq integral_restrict_Int by simp
     also have "\<dots> \<le> integral S' (\<lambda>x. \<bar>?D x\<bar> * f(g x))"
       by (metis int_gS')
     also have "\<dots> \<le> ?b"
       by (rule integral_subset_le [OF _ intS' intS]) (use nonneg_fg S'_def in auto)
     finally show "integral (g ` S) f \<le> ?b" .
   qed
 qed
 
 
 lemma absolutely_integrable_on_image_real:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and intS: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) absolutely_integrable_on S"
   shows "f absolutely_integrable_on (g ` S)"
 proof -
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f (g x)"
   let ?N = "{x \<in> S. f (g x) < 0}" and ?P = "{x \<in> S. f (g x) > 0}"
   have eq: "{x. (if x \<in> S then ?D x else 0) > 0} = {x \<in> S. ?D x > 0}"
            "{x. (if x \<in> S then ?D x else 0) < 0} = {x \<in> S. ?D x < 0}"
     by auto
   have "?D integrable_on S"
     using intS absolutely_integrable_on_def by blast
   then have "(\<lambda>x. if x \<in> S then ?D x else 0) integrable_on UNIV"
     by (simp add: integrable_restrict_UNIV)
   then have D_borel: "(\<lambda>x. if x \<in> S then ?D x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
     using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
   then have Dlt: "{x \<in> S. ?D x < 0} \<in> sets lebesgue"
     unfolding borel_measurable_vimage_halfspace_component_lt
     by (drule_tac x=0 in spec) (auto simp: eq)
   from D_borel have Dgt: "{x \<in> S. ?D x > 0} \<in> sets lebesgue"
     unfolding borel_measurable_vimage_halfspace_component_gt
     by (drule_tac x=0 in spec) (auto simp: eq)
 
   have dfgbm: "?D \<in> borel_measurable (lebesgue_on S)"
     using intS absolutely_integrable_on_def integrable_imp_measurable by blast
   have der_gN: "(g has_derivative g' x) (at x within ?N)" if "x \<in> ?N" for x
       using der_g has_derivative_subset that by force
   have "(\<lambda>x. - f x) integrable_on g ` ?N \<and>
          integral (g ` ?N) (\<lambda>x. - f x) \<le> integral ?N (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * - f (g x))"
   proof (rule integral_on_image_ubound_nonneg [OF _ der_gN])
     have 1: "?D integrable_on {x \<in> S. ?D x < 0}"
       using Dlt
       by (auto intro: set_lebesgue_integral_eq_integral [OF set_integrable_subset] intS)
     have "uminus \<circ> (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * - f (g x)) integrable_on ?N"
       by (simp add: o_def mult_less_0_iff empty_imp_negligible integrable_spike_set [OF 1])
     then show "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * - f (g x)) integrable_on ?N"
       by (simp add: integrable_neg_iff o_def)
   qed auto
   then have "f integrable_on g ` ?N"
     by (simp add: integrable_neg_iff)
   moreover have "g ` ?N = {y \<in> g ` S. f y < 0}"
     by auto
   ultimately have "f integrable_on {y \<in> g ` S. f y < 0}"
     by simp
   then have N: "f absolutely_integrable_on {y \<in> g ` S. f y < 0}"
     by (rule absolutely_integrable_absolutely_integrable_ubound) auto
 
   have der_gP: "(g has_derivative g' x) (at x within ?P)" if "x \<in> ?P" for x
       using der_g has_derivative_subset that by force
   have "f integrable_on g ` ?P \<and> integral (g ` ?P) f \<le> integral ?P ?D"
   proof (rule integral_on_image_ubound_nonneg [OF _ der_gP])
     have "?D integrable_on {x \<in> S. 0 < ?D x}"
       using Dgt
       by (auto intro: set_lebesgue_integral_eq_integral [OF set_integrable_subset] intS)
     then show "?D integrable_on ?P"
       apply (rule integrable_spike_set)
       by (auto simp: zero_less_mult_iff empty_imp_negligible)
   qed auto
   then have "f integrable_on g ` ?P"
     by metis
   moreover have "g ` ?P = {y \<in> g ` S. f y > 0}"
     by auto
   ultimately have "f integrable_on {y \<in> g ` S. f y > 0}"
     by simp
   then have P: "f absolutely_integrable_on {y \<in> g ` S. f y > 0}"
     by (rule absolutely_integrable_absolutely_integrable_lbound) auto
   have "(\<lambda>x. if x \<in> g ` S \<and> f x < 0 \<or> x \<in> g ` S \<and> 0 < f x then f x else 0) = (\<lambda>x. if x \<in> g ` S then f x else 0)"
     by auto
   then show ?thesis
     using absolutely_integrable_Un [OF N P] absolutely_integrable_restrict_UNIV [symmetric, where f=f]
     by simp
 qed
 
 
 proposition absolutely_integrable_on_image:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and intS: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S"
   shows "f absolutely_integrable_on (g ` S)"
   apply (rule absolutely_integrable_componentwise [OF absolutely_integrable_on_image_real [OF der_g]])
   using absolutely_integrable_component [OF intS]  by auto
 
 proposition integral_on_image_ubound:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes"\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f(g x)"
     and "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) integrable_on S"
   shows "integral (g ` S) f \<le> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x))"
   using integral_on_image_ubound_nonneg [OF assms] by simp
 
 
 subsection\<open>Change-of-variables theorem\<close>
 
 text\<open>The classic change-of-variables theorem. We have two versions with quite general hypotheses,
 the first that the transforming function has a continuous inverse, the second that the base set is
 Lebesgue measurable.\<close>
 lemma cov_invertible_nonneg_le:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and der_h: "\<And>y. y \<in> T \<Longrightarrow> (h has_derivative h' y) (at y within T)"
     and f0: "\<And>y. y \<in> T \<Longrightarrow> 0 \<le> f y"
     and hg: "\<And>x. x \<in> S \<Longrightarrow> g x \<in> T \<and> h(g x) = x"
     and gh: "\<And>y. y \<in> T \<Longrightarrow> h y \<in> S \<and> g(h y) = y"
     and id: "\<And>y. y \<in> T \<Longrightarrow> h' y \<circ> g'(h y) = id"
   shows "f integrable_on T \<and> (integral T f) \<le> b \<longleftrightarrow>
              (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) integrable_on S \<and>
              integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) \<le> b"
         (is "?lhs = ?rhs")
 proof -
   have Teq: "T = g`S" and Seq: "S = h`T"
     using hg gh image_iff by fastforce+
   have gS: "g differentiable_on S"
     by (meson der_g differentiable_def differentiable_on_def)
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f (g x)"
   show ?thesis
   proof
     assume ?lhs
     then have fT: "f integrable_on T" and intf: "integral T f \<le> b"
       by blast+
     show ?rhs
     proof
       let ?fgh = "\<lambda>x. \<bar>det (matrix (h' x))\<bar> * (\<bar>det (matrix (g' (h x)))\<bar> * f (g (h x)))"
       have ddf: "?fgh x = f x"
         if "x \<in> T" for x
       proof -
         have "matrix (h' x) ** matrix (g' (h x)) = mat 1"
           using that id[OF that] der_g[of "h x"] gh[OF that] left_inverse_linear has_derivative_linear
           by (subst matrix_compose[symmetric]) (force simp: matrix_id_mat_1 has_derivative_linear)+
         then have "\<bar>det (matrix (h' x))\<bar> * \<bar>det (matrix (g' (h x)))\<bar> = 1"
           by (metis abs_1 abs_mult det_I det_mul)
         then show ?thesis
           by (simp add: gh that)
       qed
       have "?D integrable_on (h ` T)"
       proof (intro set_lebesgue_integral_eq_integral absolutely_integrable_on_image_real)
         show "(\<lambda>x. ?fgh x) absolutely_integrable_on T"
         proof (subst absolutely_integrable_on_iff_nonneg)
           show "(\<lambda>x. ?fgh x) integrable_on T"
             using ddf fT integrable_eq by force
         qed (simp add: zero_le_mult_iff f0 gh)
       qed (use der_h in auto)
       with Seq show "(\<lambda>x. ?D x) integrable_on S"
         by simp
       have "integral S (\<lambda>x. ?D x) \<le> integral T (\<lambda>x. ?fgh x)"
         unfolding Seq
       proof (rule integral_on_image_ubound)
         show "(\<lambda>x. ?fgh x) integrable_on T"
         using ddf fT integrable_eq by force
       qed (use f0 gh der_h in auto)
       also have "\<dots> = integral T f"
         by (force simp: ddf intro: integral_cong)
       also have "\<dots> \<le> b"
         by (rule intf)
       finally show "integral S (\<lambda>x. ?D x) \<le> b" .
     qed
   next
     assume R: ?rhs
     then have "f integrable_on g ` S"
       using der_g f0 hg integral_on_image_ubound_nonneg by blast
     moreover have "integral (g ` S) f \<le> integral S (\<lambda>x. ?D x)"
       by (rule integral_on_image_ubound [OF f0 der_g]) (use R Teq in auto)
     ultimately show ?lhs
       using R by (simp add: Teq)
   qed
 qed
 
 
 lemma cov_invertible_nonneg_eq:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and "\<And>y. y \<in> T \<Longrightarrow> (h has_derivative h' y) (at y within T)"
       and "\<And>y. y \<in> T \<Longrightarrow> 0 \<le> f y"
       and "\<And>x. x \<in> S \<Longrightarrow> g x \<in> T \<and> h(g x) = x"
       and "\<And>y. y \<in> T \<Longrightarrow> h y \<in> S \<and> g(h y) = y"
       and "\<And>y. y \<in> T \<Longrightarrow> h' y \<circ> g'(h y) = id"
   shows "((\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) has_integral b) S \<longleftrightarrow> (f has_integral b) T"
   using cov_invertible_nonneg_le [OF assms]
   by (simp add: has_integral_iff) (meson eq_iff)
 
 
 lemma cov_invertible_real:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and der_h: "\<And>y. y \<in> T \<Longrightarrow> (h has_derivative h' y) (at y within T)"
       and hg: "\<And>x. x \<in> S \<Longrightarrow> g x \<in> T \<and> h(g x) = x"
       and gh: "\<And>y. y \<in> T \<Longrightarrow> h y \<in> S \<and> g(h y) = y"
       and id: "\<And>y. y \<in> T \<Longrightarrow> h' y \<circ> g'(h y) = id"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) = b \<longleftrightarrow>
          f absolutely_integrable_on T \<and> integral T f = b"
          (is "?lhs = ?rhs")
 proof -
   have Teq: "T = g`S" and Seq: "S = h`T"
     using hg gh image_iff by fastforce+
   let ?DP = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)" and ?DN = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> * -f(g x)"
   have "+": "(?DP has_integral b) {x \<in> S. f (g x) > 0} \<longleftrightarrow> (f has_integral b) {y \<in> T. f y > 0}" for b
   proof (rule cov_invertible_nonneg_eq)
     have *: "(\<lambda>x. f (g x)) -` Y \<inter> {x \<in> S. f (g x) > 0}
           = ((\<lambda>x. f (g x)) -` Y \<inter> S) \<inter> {x \<in> S. f (g x) > 0}" for Y
       by auto
     show "(g has_derivative g' x) (at x within {x \<in> S. f (g x) > 0})" if "x \<in> {x \<in> S. f (g x) > 0}" for x
       using that der_g has_derivative_subset by fastforce
     show "(h has_derivative h' y) (at y within {y \<in> T. f y > 0})" if "y \<in> {y \<in> T. f y > 0}" for y
       using that der_h has_derivative_subset by fastforce
   qed (use gh hg id in auto)
   have "-": "(?DN has_integral b) {x \<in> S. f (g x) < 0} \<longleftrightarrow> ((\<lambda>x. - f x) has_integral b) {y \<in> T. f y < 0}" for b
   proof (rule cov_invertible_nonneg_eq)
     have *: "(\<lambda>x. - f (g x)) -` y \<inter> {x \<in> S. f (g x) < 0}
           = ((\<lambda>x. f (g x)) -` uminus ` y \<inter> S) \<inter> {x \<in> S. f (g x) < 0}" for y
       using image_iff by fastforce
     show "(g has_derivative g' x) (at x within {x \<in> S. f (g x) < 0})" if "x \<in> {x \<in> S. f (g x) < 0}" for x
       using that der_g has_derivative_subset by fastforce
     show "(h has_derivative h' y) (at y within {y \<in> T. f y < 0})" if "y \<in> {y \<in> T. f y < 0}" for y
       using that der_h has_derivative_subset by fastforce
   qed (use gh hg id in auto)
   show ?thesis
   proof
     assume LHS: ?lhs
     have eq: "{x. (if x \<in> S then ?DP x else 0) > 0} = {x \<in> S. ?DP x > 0}"
       "{x. (if x \<in> S then ?DP x else 0) < 0} = {x \<in> S. ?DP x < 0}"
       by auto
     have "?DP integrable_on S"
       using LHS absolutely_integrable_on_def by blast
     then have "(\<lambda>x. if x \<in> S then ?DP x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have D_borel: "(\<lambda>x. if x \<in> S then ?DP x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
       using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
     then have SN: "{x \<in> S. ?DP x < 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_halfspace_component_lt
       by (drule_tac x=0 in spec) (auto simp: eq)
     from D_borel have SP: "{x \<in> S. ?DP x > 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_halfspace_component_gt
       by (drule_tac x=0 in spec) (auto simp: eq)
     have "?DP absolutely_integrable_on {x \<in> S. ?DP x > 0}"
       using LHS by (fast intro!: set_integrable_subset [OF _, of _ S] SP)
     then have aP: "?DP absolutely_integrable_on {x \<in> S. f (g x) > 0}"
       by (rule absolutely_integrable_spike_set) (auto simp: zero_less_mult_iff empty_imp_negligible)
     have "?DP absolutely_integrable_on {x \<in> S. ?DP x < 0}"
       using LHS by (fast intro!: set_integrable_subset [OF _, of _ S] SN)
     then have aN: "?DP absolutely_integrable_on {x \<in> S. f (g x) < 0}"
       by (rule absolutely_integrable_spike_set) (auto simp: mult_less_0_iff empty_imp_negligible)
     have fN: "f integrable_on {y \<in> T. f y < 0}"
              "integral {y \<in> T. f y < 0} f = integral {x \<in> S. f (g x) < 0} ?DP"
       using "-" [of "integral {x \<in> S. f(g x) < 0} ?DN"] aN
       by (auto simp: set_lebesgue_integral_eq_integral has_integral_iff integrable_neg_iff)
     have faN: "f absolutely_integrable_on {y \<in> T. f y < 0}"
       apply (rule absolutely_integrable_integrable_bound [where g = "\<lambda>x. - f x"])
       using fN by (auto simp: integrable_neg_iff)
     have fP: "f integrable_on {y \<in> T. f y > 0}"
              "integral {y \<in> T. f y > 0} f = integral {x \<in> S. f (g x) > 0} ?DP"
       using "+" [of "integral {x \<in> S. f(g x) > 0} ?DP"] aP
       by (auto simp: set_lebesgue_integral_eq_integral has_integral_iff integrable_neg_iff)
     have faP: "f absolutely_integrable_on {y \<in> T. f y > 0}"
       apply (rule absolutely_integrable_integrable_bound [where g = f])
       using fP by auto
     have fa: "f absolutely_integrable_on ({y \<in> T. f y < 0} \<union> {y \<in> T. f y > 0})"
       by (rule absolutely_integrable_Un [OF faN faP])
     show ?rhs
     proof
       have eq: "((if x \<in> T \<and> f x < 0 \<or> x \<in> T \<and> 0 < f x then 1 else 0) * f x)
               = (if x \<in> T then 1 else 0) * f x" for x
         by auto
       show "f absolutely_integrable_on T"
-        using fa by (simp add: indicator_def set_integrable_def eq)
+        using fa by (simp add: indicator_def of_bool_def set_integrable_def eq)
       have [simp]: "{y \<in> T. f y < 0} \<inter> {y \<in> T. 0 < f y} = {}" for T and f :: "(real^'n::_) \<Rightarrow> real"
         by auto
       have "integral T f = integral ({y \<in> T. f y < 0} \<union> {y \<in> T. f y > 0}) f"
         by (intro empty_imp_negligible integral_spike_set) (auto simp: eq)
       also have "\<dots> = integral {y \<in> T. f y < 0} f + integral {y \<in> T. f y > 0} f"
         using fN fP by simp
       also have "\<dots> = integral {x \<in> S. f (g x) < 0} ?DP + integral {x \<in> S. 0 < f (g x)} ?DP"
         by (simp add: fN fP)
       also have "\<dots> = integral ({x \<in> S. f (g x) < 0} \<union> {x \<in> S. 0 < f (g x)}) ?DP"
         using aP aN by (simp add: set_lebesgue_integral_eq_integral)
       also have "\<dots> = integral S ?DP"
         by (intro empty_imp_negligible integral_spike_set) auto
       also have "\<dots> = b"
         using LHS by simp
       finally show "integral T f = b" .
     qed
   next
     assume RHS: ?rhs
     have eq: "{x. (if x \<in> T then f x else 0) > 0} = {x \<in> T. f x > 0}"
              "{x. (if x \<in> T then f x else 0) < 0} = {x \<in> T. f x < 0}"
       by auto
     have "f integrable_on T"
       using RHS absolutely_integrable_on_def by blast
     then have "(\<lambda>x. if x \<in> T then f x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have D_borel: "(\<lambda>x. if x \<in> T then f x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
       using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
     then have TN: "{x \<in> T. f x < 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_halfspace_component_lt
       by (drule_tac x=0 in spec) (auto simp: eq)
     from D_borel have TP: "{x \<in> T. f x > 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_halfspace_component_gt
       by (drule_tac x=0 in spec) (auto simp: eq)
     have aint: "f absolutely_integrable_on {y. y \<in> T \<and> 0 < (f y)}"
                "f absolutely_integrable_on {y. y \<in> T \<and> (f y) < 0}"
          and intT: "integral T f = b"
       using set_integrable_subset [of _ T] TP TN RHS
       by blast+
     show ?lhs
     proof
       have fN: "f integrable_on {v \<in> T. f v < 0}"
         using absolutely_integrable_on_def aint by blast
       then have DN: "(?DN has_integral integral {y \<in> T. f y < 0} (\<lambda>x. - f x)) {x \<in> S. f (g x) < 0}"
         using "-" [of "integral {y \<in> T. f y < 0} (\<lambda>x. - f x)"]
         by (simp add: has_integral_neg_iff integrable_integral)
       have aDN: "?DP absolutely_integrable_on {x \<in> S. f (g x) < 0}"
         apply (rule absolutely_integrable_integrable_bound [where g = ?DN])
         using DN hg by (fastforce simp: abs_mult integrable_neg_iff)+
       have fP: "f integrable_on {v \<in> T. f v > 0}"
         using absolutely_integrable_on_def aint by blast
       then have DP: "(?DP has_integral integral {y \<in> T. f y > 0} f) {x \<in> S. f (g x) > 0}"
         using "+" [of "integral {y \<in> T. f y > 0} f"]
         by (simp add: has_integral_neg_iff integrable_integral)
       have aDP: "?DP absolutely_integrable_on {x \<in> S. f (g x) > 0}"
         apply (rule absolutely_integrable_integrable_bound [where g = ?DP])
         using DP hg by (fastforce simp: integrable_neg_iff)+
       have eq: "(if x \<in> S then 1 else 0) * ?DP x = (if x \<in> S \<and> f (g x) < 0 \<or> x \<in> S \<and> f (g x) > 0 then 1 else 0) * ?DP x" for x
         by force
       have "?DP absolutely_integrable_on ({x \<in> S. f (g x) < 0} \<union> {x \<in> S. f (g x) > 0})"
         by (rule absolutely_integrable_Un [OF aDN aDP])
       then show I: "?DP absolutely_integrable_on S"
-        by (simp add: indicator_def eq set_integrable_def)
+        by (simp add: indicator_def of_bool_def eq set_integrable_def)
       have [simp]: "{y \<in> S. f y < 0} \<inter> {y \<in> S. 0 < f y} = {}" for S and f :: "(real^'n::_) \<Rightarrow> real"
         by auto
       have "integral S ?DP = integral ({x \<in> S. f (g x) < 0} \<union> {x \<in> S. f (g x) > 0}) ?DP"
         by (intro empty_imp_negligible integral_spike_set) auto
       also have "\<dots> = integral {x \<in> S. f (g x) < 0} ?DP + integral {x \<in> S. 0 < f (g x)} ?DP"
         using aDN aDP by (simp add: set_lebesgue_integral_eq_integral)
       also have "\<dots> = - integral {y \<in> T. f y < 0} (\<lambda>x. - f x) + integral {y \<in> T. f y > 0} f"
         using DN DP by (auto simp: has_integral_iff)
       also have "\<dots> = integral ({x \<in> T. f x < 0} \<union> {x \<in> T. 0 < f x}) f"
         by (simp add: fN fP)
       also have "\<dots> = integral T f"
         by (intro empty_imp_negligible integral_spike_set) auto
       also have "\<dots> = b"
         using intT by simp
       finally show "integral S ?DP = b" .
     qed
   qed
 qed
 
 
 lemma cv_inv_version3:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and der_h: "\<And>y. y \<in> T \<Longrightarrow> (h has_derivative h' y) (at y within T)"
     and hg: "\<And>x. x \<in> S \<Longrightarrow> g x \<in> T \<and> h(g x) = x"
     and gh: "\<And>y. y \<in> T \<Longrightarrow> h y \<in> S \<and> g(h y) = y"
     and id: "\<And>y. y \<in> T \<Longrightarrow> h' y \<circ> g'(h y) = id"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
              integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
          \<longleftrightarrow> f absolutely_integrable_on T \<and> integral T f = b"
 proof -
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)"
   have "((\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x) $ i) absolutely_integrable_on S \<and> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * (f(g x) $ i)) = b $ i) \<longleftrightarrow>
         ((\<lambda>x. f x $ i) absolutely_integrable_on T \<and> integral T (\<lambda>x. f x $ i) = b $ i)" for i
     by (rule cov_invertible_real [OF der_g der_h hg gh id])
   then have "?D absolutely_integrable_on S \<and> (?D has_integral b) S \<longleftrightarrow>
         f absolutely_integrable_on T \<and> (f has_integral b) T"
     unfolding absolutely_integrable_componentwise_iff [where f=f] has_integral_componentwise_iff [of f]
               absolutely_integrable_componentwise_iff [where f="?D"] has_integral_componentwise_iff [of ?D]
     by (auto simp: all_conj_distrib Basis_vec_def cart_eq_inner_axis [symmetric]
            has_integral_iff set_lebesgue_integral_eq_integral)
   then show ?thesis
     using absolutely_integrable_on_def by blast
 qed
 
 
 lemma cv_inv_version4:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S) \<and> invertible(matrix(g' x))"
     and hg: "\<And>x. x \<in> S \<Longrightarrow> continuous_on (g ` S) h \<and> h(g x) = x"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
              integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
          \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
 proof -
   have "\<forall>x. \<exists>h'. x \<in> S
            \<longrightarrow> (g has_derivative g' x) (at x within S) \<and> linear h' \<and> g' x \<circ> h' = id \<and> h' \<circ> g' x = id"
     using der_g matrix_invertible has_derivative_linear by blast
   then obtain h' where h':
     "\<And>x. x \<in> S
            \<Longrightarrow> (g has_derivative g' x) (at x within S) \<and>
                linear (h' x) \<and> g' x \<circ> (h' x) = id \<and> (h' x) \<circ> g' x = id"
     by metis
   show ?thesis
   proof (rule cv_inv_version3)
     show "\<And>y. y \<in> g ` S \<Longrightarrow> (h has_derivative h' (h y)) (at y within g ` S)"
       using h' hg
       by (force simp: continuous_on_eq_continuous_within intro!: has_derivative_inverse_within)
   qed (use h' hg in auto)
 qed
 
 
 theorem has_absolute_integral_change_of_variables_invertible:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and hg: "\<And>x. x \<in> S \<Longrightarrow> h(g x) = x"
       and conth: "continuous_on (g ` S) h"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b \<longleftrightarrow>
          f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
     (is "?lhs = ?rhs")
 proof -
   let ?S = "{x \<in> S. invertible (matrix (g' x))}" and ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)"
   have *: "?D absolutely_integrable_on ?S \<and> integral ?S ?D = b
            \<longleftrightarrow> f absolutely_integrable_on (g ` ?S) \<and> integral (g ` ?S) f = b"
   proof (rule cv_inv_version4)
     show "(g has_derivative g' x) (at x within ?S) \<and> invertible (matrix (g' x))"
       if "x \<in> ?S" for x
       using der_g that has_derivative_subset that by fastforce
     show "continuous_on (g ` ?S) h \<and> h (g x) = x"
       if "x \<in> ?S" for x
       using that continuous_on_subset [OF conth]  by (simp add: hg image_mono)
   qed
   have "(g has_derivative g' x) (at x within {x \<in> S. rank (matrix (g' x)) < CARD('m)})" if "x \<in> S" for x
     by (metis (no_types, lifting) der_g has_derivative_subset mem_Collect_eq subsetI that)
   then have "negligible (g ` {x \<in> S. \<not> invertible (matrix (g' x))})"
     by (auto simp: invertible_det_nz det_eq_0_rank intro: baby_Sard)
   then have neg: "negligible {x \<in> g ` S. x \<notin> g ` ?S \<and> f x \<noteq> 0}"
     by (auto intro: negligible_subset)
   have [simp]: "{x \<in> g ` ?S. x \<notin> g ` S \<and> f x \<noteq> 0} = {}"
     by auto
   have "?D absolutely_integrable_on ?S \<and> integral ?S ?D = b
     \<longleftrightarrow> ?D absolutely_integrable_on S \<and> integral S ?D = b"
     apply (intro conj_cong absolutely_integrable_spike_set_eq)
       apply(auto simp: integral_spike_set invertible_det_nz empty_imp_negligible neg)
     done
   moreover
   have "f absolutely_integrable_on (g ` ?S) \<and> integral (g ` ?S) f = b
     \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
     by (auto intro!: conj_cong absolutely_integrable_spike_set_eq integral_spike_set neg)
   ultimately
   show ?thesis
     using "*" by blast
 qed
 
 
 
 theorem has_absolute_integral_change_of_variables_compact:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "compact S"
       and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and inj: "inj_on g S"
   shows "((\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
              integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
       \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b)"
 proof -
   obtain h where hg: "\<And>x. x \<in> S \<Longrightarrow> h(g x) = x"
     using inj by (metis the_inv_into_f_f)
   have conth: "continuous_on (g ` S) h"
     by (metis \<open>compact S\<close> continuous_on_inv der_g has_derivative_continuous_on hg)
   show ?thesis
     by (rule has_absolute_integral_change_of_variables_invertible [OF der_g hg conth])
 qed
 
 
 lemma has_absolute_integral_change_of_variables_compact_family:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes compact: "\<And>n::nat. compact (F n)"
       and der_g: "\<And>x. x \<in> (\<Union>n. F n) \<Longrightarrow> (g has_derivative g' x) (at x within (\<Union>n. F n))"
       and inj: "inj_on g (\<Union>n. F n)"
   shows "((\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on (\<Union>n. F n) \<and>
              integral (\<Union>n. F n) (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
       \<longleftrightarrow> f absolutely_integrable_on (g ` (\<Union>n. F n)) \<and> integral (g ` (\<Union>n. F n)) f = b)"
 proof -
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f (g x)"
   let ?U = "\<lambda>n. \<Union>m\<le>n. F m"
   let ?lift = "vec::real\<Rightarrow>real^1"
   have F_leb: "F m \<in> sets lebesgue" for m
     by (simp add: compact borel_compact)
   have iff: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f (g x)) absolutely_integrable_on (?U n) \<and>
              integral (?U n) (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f (g x)) = b
          \<longleftrightarrow> f absolutely_integrable_on (g ` (?U n)) \<and> integral (g ` (?U n)) f = b" for n b and f :: "real^'m::_ \<Rightarrow> real^'k"
   proof (rule has_absolute_integral_change_of_variables_compact)
     show "compact (?U n)"
       by (simp add: compact compact_UN)
     show "(g has_derivative g' x) (at x within (?U n))"
       if "x \<in> ?U n" for x
       using that by (blast intro!: has_derivative_subset [OF der_g])
     show "inj_on g (?U n)"
       using inj by (auto simp: inj_on_def)
   qed
   show ?thesis
     unfolding image_UN
   proof safe
     assume DS: "?D absolutely_integrable_on (\<Union>n. F n)"
       and b: "b = integral (\<Union>n. F n) ?D"
     have DU: "\<And>n. ?D absolutely_integrable_on (?U n)"
              "(\<lambda>n. integral (?U n) ?D) \<longlonglongrightarrow> integral (\<Union>n. F n) ?D"
       using integral_countable_UN [OF DS F_leb] by auto
     with iff have fag: "f absolutely_integrable_on g ` (?U n)"
       and fg_int: "integral (\<Union>m\<le>n. g ` F m) f = integral (?U n) ?D" for n
       by (auto simp: image_UN)
     let ?h = "\<lambda>x. if x \<in> (\<Union>m. g ` F m) then norm(f x) else 0"
     have "(\<lambda>x. if x \<in> (\<Union>m. g ` F m) then f x else 0) absolutely_integrable_on UNIV"
     proof (rule dominated_convergence_absolutely_integrable)
       show "(\<lambda>x. if x \<in> (\<Union>m\<le>k. g ` F m) then f x else 0) absolutely_integrable_on UNIV" for k
         unfolding absolutely_integrable_restrict_UNIV
         using fag by (simp add: image_UN)
       let ?nf = "\<lambda>n x. if x \<in> (\<Union>m\<le>n. g ` F m) then norm(f x) else 0"
       show "?h integrable_on UNIV"
       proof (rule monotone_convergence_increasing [THEN conjunct1])
         show "?nf k integrable_on UNIV" for k
           using fag
           unfolding integrable_restrict_UNIV absolutely_integrable_on_def by (simp add: image_UN)
         { fix n
           have "(norm \<circ> ?D) absolutely_integrable_on ?U n"
             by (intro absolutely_integrable_norm DU)
           then have "integral (g ` ?U n) (norm \<circ> f) = integral (?U n) (norm \<circ> ?D)"
             using iff [of n "vec \<circ> norm \<circ> f" "integral (?U n) (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R (?lift \<circ> norm \<circ> f) (g x))"]
             unfolding absolutely_integrable_on_1_iff integral_on_1_eq by (auto simp: o_def)
         }
         moreover have "bounded (range (\<lambda>k. integral (?U k) (norm \<circ> ?D)))"
           unfolding bounded_iff
         proof (rule exI, clarify)
           fix k
           show "norm (integral (?U k) (norm \<circ> ?D)) \<le> integral (\<Union>n. F n) (norm \<circ> ?D)"
             unfolding integral_restrict_UNIV [of _ "norm \<circ> ?D", symmetric]
           proof (rule integral_norm_bound_integral)
             show "(\<lambda>x. if x \<in> \<Union> (F ` {..k}) then (norm \<circ> ?D) x else 0) integrable_on UNIV"
               "(\<lambda>x. if x \<in> (\<Union>n. F n) then (norm \<circ> ?D) x else 0) integrable_on UNIV"
               using DU(1) DS
               unfolding absolutely_integrable_on_def o_def integrable_restrict_UNIV by auto
           qed auto
         qed
         ultimately show "bounded (range (\<lambda>k. integral UNIV (?nf k)))"
           by (simp add: integral_restrict_UNIV image_UN [symmetric] o_def)
       next
         show "(\<lambda>k. if x \<in> (\<Union>m\<le>k. g ` F m) then norm (f x) else 0)
               \<longlonglongrightarrow> (if x \<in> (\<Union>m. g ` F m) then norm (f x) else 0)" for x
           by (force intro: tendsto_eventually eventually_sequentiallyI)
       qed auto
     next
       show "(\<lambda>k. if x \<in> (\<Union>m\<le>k. g ` F m) then f x else 0)
             \<longlonglongrightarrow> (if x \<in> (\<Union>m. g ` F m) then f x else 0)" for x
       proof clarsimp
         fix m y
         assume "y \<in> F m"
         show "(\<lambda>k. if \<exists>x\<in>{..k}. g y \<in> g ` F x then f (g y) else 0) \<longlonglongrightarrow> f (g y)"
           using \<open>y \<in> F m\<close> by (force intro: tendsto_eventually eventually_sequentiallyI [of m])
       qed
     qed auto
     then show fai: "f absolutely_integrable_on (\<Union>m. g ` F m)"
       using absolutely_integrable_restrict_UNIV by blast
     show "integral ((\<Union>x. g ` F x)) f = integral (\<Union>n. F n) ?D"
     proof (rule LIMSEQ_unique)
       show "(\<lambda>n. integral (?U n) ?D) \<longlonglongrightarrow> integral (\<Union>x. g ` F x) f"
         unfolding fg_int [symmetric]
       proof (rule integral_countable_UN [OF fai])
         show "g ` F m \<in> sets lebesgue" for m
         proof (rule differentiable_image_in_sets_lebesgue [OF F_leb])
           show "g differentiable_on F m"
             by (meson der_g differentiableI UnionI differentiable_on_def differentiable_on_subset rangeI subsetI)
         qed auto
       qed
     next
       show "(\<lambda>n. integral (?U n) ?D) \<longlonglongrightarrow> integral (\<Union>n. F n) ?D"
         by (rule DU)
     qed
   next
     assume fs: "f absolutely_integrable_on (\<Union>x. g ` F x)"
       and b: "b = integral ((\<Union>x. g ` F x)) f"
     have gF_leb: "g ` F m \<in> sets lebesgue" for m
     proof (rule differentiable_image_in_sets_lebesgue [OF F_leb])
       show "g differentiable_on F m"
         using der_g unfolding differentiable_def differentiable_on_def
         by (meson Sup_upper UNIV_I UnionI has_derivative_subset image_eqI)
     qed auto
     have fgU: "\<And>n. f absolutely_integrable_on (\<Union>m\<le>n. g ` F m)"
       "(\<lambda>n. integral (\<Union>m\<le>n. g ` F m) f) \<longlonglongrightarrow> integral (\<Union>m. g ` F m) f"
       using integral_countable_UN [OF fs gF_leb] by auto
     with iff have DUn: "?D absolutely_integrable_on ?U n"
       and D_int: "integral (?U n) ?D = integral (\<Union>m\<le>n. g ` F m) f" for n
       by (auto simp: image_UN)
     let ?h = "\<lambda>x. if x \<in> (\<Union>n. F n) then norm(?D x) else 0"
     have "(\<lambda>x. if x \<in> (\<Union>n. F n) then ?D x else 0) absolutely_integrable_on UNIV"
     proof (rule dominated_convergence_absolutely_integrable)
       show "(\<lambda>x. if x \<in> ?U k then ?D x else 0) absolutely_integrable_on UNIV" for k
         unfolding absolutely_integrable_restrict_UNIV using DUn by simp
       let ?nD = "\<lambda>n x. if x \<in> ?U n then norm(?D x) else 0"
       show "?h integrable_on UNIV"
       proof (rule monotone_convergence_increasing [THEN conjunct1])
         show "?nD k integrable_on UNIV" for k
           using DUn
           unfolding integrable_restrict_UNIV absolutely_integrable_on_def by (simp add: image_UN)
         { fix n::nat
           have "(norm \<circ> f) absolutely_integrable_on (\<Union>m\<le>n. g ` F m)"
             apply (rule absolutely_integrable_norm)
             using fgU by blast
           then have "integral (?U n) (norm \<circ> ?D) = integral (g ` ?U n) (norm \<circ> f)"
             using iff [of n "?lift \<circ> norm \<circ> f" "integral (g ` ?U n) (?lift \<circ> norm \<circ> f)"]
             unfolding absolutely_integrable_on_1_iff integral_on_1_eq image_UN by (auto simp: o_def)
         }
         moreover have "bounded (range (\<lambda>k. integral (g ` ?U k) (norm \<circ> f)))"
           unfolding bounded_iff
         proof (rule exI, clarify)
           fix k
           show "norm (integral (g ` ?U k) (norm \<circ> f)) \<le> integral (g ` (\<Union>n. F n)) (norm \<circ> f)"
             unfolding integral_restrict_UNIV [of _ "norm \<circ> f", symmetric]
           proof (rule integral_norm_bound_integral)
             show "(\<lambda>x. if x \<in> g ` ?U k then (norm \<circ> f) x else 0) integrable_on UNIV"
                  "(\<lambda>x. if x \<in> g ` (\<Union>n. F n) then (norm \<circ> f) x else 0) integrable_on UNIV"
               using fgU fs
               unfolding absolutely_integrable_on_def o_def integrable_restrict_UNIV
               by (auto simp: image_UN)
           qed auto
         qed
         ultimately show "bounded (range (\<lambda>k. integral UNIV (?nD k)))"
           unfolding integral_restrict_UNIV image_UN [symmetric] o_def by simp
       next
         show "(\<lambda>k. if x \<in> ?U k then norm (?D x) else 0) \<longlonglongrightarrow> (if x \<in> (\<Union>n. F n) then norm (?D x) else 0)" for x
           by (force intro: tendsto_eventually eventually_sequentiallyI)
       qed auto
     next
       show "(\<lambda>k. if x \<in> ?U k then ?D x else 0) \<longlonglongrightarrow> (if x \<in> (\<Union>n. F n) then ?D x else 0)" for x
       proof clarsimp
         fix n
         assume "x \<in> F n"
         show "(\<lambda>m. if \<exists>j\<in>{..m}. x \<in> F j then ?D x else 0) \<longlonglongrightarrow> ?D x"
           using \<open>x \<in> F n\<close> by (auto intro!: tendsto_eventually eventually_sequentiallyI [of n])
       qed
     qed auto
     then show Dai: "?D absolutely_integrable_on (\<Union>n. F n)"
       unfolding absolutely_integrable_restrict_UNIV by simp
     show "integral (\<Union>n. F n) ?D = integral ((\<Union>x. g ` F x)) f"
     proof (rule LIMSEQ_unique)
       show "(\<lambda>n. integral (\<Union>m\<le>n. g ` F m) f) \<longlonglongrightarrow> integral (\<Union>x. g ` F x) f"
         by (rule fgU)
       show "(\<lambda>n. integral (\<Union>m\<le>n. g ` F m) f) \<longlonglongrightarrow> integral (\<Union>n. F n) ?D"
         unfolding D_int [symmetric] by (rule integral_countable_UN [OF Dai F_leb])
     qed
   qed
 qed
 
 
 theorem has_absolute_integral_change_of_variables:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes S: "S \<in> sets lebesgue"
     and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and inj: "inj_on g S"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
      \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
 proof -
   obtain C N where "fsigma C" and N: "N \<in> null_sets lebesgue" and CNS: "C \<union> N = S" and "disjnt C N"
     using lebesgue_set_almost_fsigma [OF S] .
   then obtain F :: "nat \<Rightarrow> (real^'m::_) set"
     where F: "range F \<subseteq> Collect compact" and Ceq: "C = Union(range F)"
     using fsigma_Union_compact by metis
   have "negligible N"
     using N by (simp add: negligible_iff_null_sets)
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f (g x)"
   have "?D absolutely_integrable_on C \<and> integral C ?D = b
     \<longleftrightarrow> f absolutely_integrable_on (g ` C) \<and> integral (g ` C) f = b"
     unfolding Ceq
   proof (rule has_absolute_integral_change_of_variables_compact_family)
     fix n x
     assume "x \<in> \<Union>(F ` UNIV)"
     then show "(g has_derivative g' x) (at x within \<Union>(F ` UNIV))"
       using Ceq \<open>C \<union> N = S\<close> der_g has_derivative_subset by blast
   next
     have "\<Union>(F ` UNIV) \<subseteq> S"
       using Ceq \<open>C \<union> N = S\<close> by blast
     then show "inj_on g (\<Union>(F ` UNIV))"
       using inj by (meson inj_on_subset)
   qed (use F in auto)
   moreover
   have "?D absolutely_integrable_on C \<and> integral C ?D = b
     \<longleftrightarrow> ?D absolutely_integrable_on S \<and> integral S ?D = b"
   proof (rule conj_cong)
     have neg: "negligible {x \<in> C - S. ?D x \<noteq> 0}" "negligible {x \<in> S - C. ?D x \<noteq> 0}"
       using CNS by (blast intro: negligible_subset [OF \<open>negligible N\<close>])+
     then show "(?D absolutely_integrable_on C) = (?D absolutely_integrable_on S)"
       by (rule absolutely_integrable_spike_set_eq)
     show "(integral C ?D = b) \<longleftrightarrow> (integral S ?D = b)"
       using integral_spike_set [OF neg] by simp
   qed
   moreover
   have "f absolutely_integrable_on (g ` C) \<and> integral (g ` C) f = b
     \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
   proof (rule conj_cong)
     have "g differentiable_on N"
       by (metis CNS der_g differentiable_def differentiable_on_def differentiable_on_subset sup.cobounded2)
     with \<open>negligible N\<close>
     have neg_gN: "negligible (g ` N)"
       by (blast intro: negligible_differentiable_image_negligible)
     have neg: "negligible {x \<in> g ` C - g ` S. f x \<noteq> 0}"
               "negligible {x \<in> g ` S - g ` C. f x \<noteq> 0}"
       using CNS by (blast intro: negligible_subset [OF neg_gN])+
     then show "(f absolutely_integrable_on g ` C) = (f absolutely_integrable_on g ` S)"
       by (rule absolutely_integrable_spike_set_eq)
     show "(integral (g ` C) f = b) \<longleftrightarrow> (integral (g ` S) f = b)"
       using integral_spike_set [OF neg] by simp
   qed
   ultimately show ?thesis
     by simp
 qed
 
 
 corollary absolutely_integrable_change_of_variables:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "S \<in> sets lebesgue"
     and "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and "inj_on g S"
   shows "f absolutely_integrable_on (g ` S)
      \<longleftrightarrow> (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S"
   using assms has_absolute_integral_change_of_variables by blast
 
 corollary integral_change_of_variables:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes S: "S \<in> sets lebesgue"
     and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and inj: "inj_on g S"
     and disj: "(f absolutely_integrable_on (g ` S) \<or>
         (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S)"
   shows "integral (g ` S) f = integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x))"
   using has_absolute_integral_change_of_variables [OF S der_g inj] disj
   by blast
 
 lemma has_absolute_integral_change_of_variables_1:
   fixes f :: "real \<Rightarrow> real^'n::{finite,wellorder}" and g :: "real \<Rightarrow> real"
   assumes S: "S \<in> sets lebesgue"
     and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_vector_derivative g' x) (at x within S)"
     and inj: "inj_on g S"
   shows "(\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)) = b
      \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
 proof -
   let ?lift = "vec :: real \<Rightarrow> real^1"
   let ?drop = "(\<lambda>x::real^1. x $ 1)"
   have S': "?lift ` S \<in> sets lebesgue"
     by (auto intro: differentiable_image_in_sets_lebesgue [OF S] differentiable_vec)
   have "((\<lambda>x. vec (g (x $ 1))) has_derivative (*\<^sub>R) (g' z)) (at (vec z) within ?lift ` S)"
     if "z \<in> S" for z
     using der_g [OF that]
     by (simp add: has_vector_derivative_def has_derivative_vector_1)
   then have der': "\<And>x. x \<in> ?lift ` S \<Longrightarrow>
         (?lift \<circ> g \<circ> ?drop has_derivative (*\<^sub>R) (g' (?drop x))) (at x within ?lift ` S)"
     by (auto simp: o_def)
   have inj': "inj_on (vec \<circ> g \<circ> ?drop) (vec ` S)"
     using inj by (simp add: inj_on_def)
   let ?fg = "\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)"
   have "((\<lambda>x. ?fg x $ i) absolutely_integrable_on S \<and> ((\<lambda>x. ?fg x $ i) has_integral b $ i) S
     \<longleftrightarrow> (\<lambda>x. f x $ i) absolutely_integrable_on g ` S \<and> ((\<lambda>x. f x $ i) has_integral b $ i) (g ` S))" for i
     using has_absolute_integral_change_of_variables [OF S' der' inj', of "\<lambda>x. ?lift(f (?drop x) $ i)" "?lift (b$i)"]
     unfolding integrable_on_1_iff integral_on_1_eq absolutely_integrable_on_1_iff absolutely_integrable_drop absolutely_integrable_on_def
     by (auto simp: image_comp o_def integral_vec1_eq has_integral_iff)
   then have "?fg absolutely_integrable_on S \<and> (?fg has_integral b) S
          \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> (f has_integral b) (g ` S)"
     unfolding has_integral_componentwise_iff [where y=b]
            absolutely_integrable_componentwise_iff [where f=f]
            absolutely_integrable_componentwise_iff [where f = ?fg]
     by (force simp: Basis_vec_def cart_eq_inner_axis)
   then show ?thesis
     using absolutely_integrable_on_def by blast
 qed
 
 
 corollary absolutely_integrable_change_of_variables_1:
   fixes f :: "real \<Rightarrow> real^'n::{finite,wellorder}" and g :: "real \<Rightarrow> real"
   assumes S: "S \<in> sets lebesgue"
     and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_vector_derivative g' x) (at x within S)"
     and inj: "inj_on g S"
   shows "(f absolutely_integrable_on g ` S \<longleftrightarrow>
              (\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S)"
   using has_absolute_integral_change_of_variables_1 [OF assms] by auto
 
 
 subsection\<open>Change of variables for integrals: special case of linear function\<close>
 
 lemma has_absolute_integral_change_of_variables_linear:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "linear g"
   shows "(\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f(g x)) = b
      \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
 proof (cases "det(matrix g) = 0")
   case True
   then have "negligible(g ` S)"
     using assms det_nz_iff_inj negligible_linear_singular_image by blast
   with True show ?thesis
     by (auto simp: absolutely_integrable_on_def integrable_negligible integral_negligible)
 next
   case False
   then obtain h where h: "\<And>x. x \<in> S \<Longrightarrow> h (g x) = x" "linear h"
     using assms det_nz_iff_inj linear_injective_isomorphism by metis
   show ?thesis
   proof (rule has_absolute_integral_change_of_variables_invertible)
     show "(g has_derivative g) (at x within S)" for x
       by (simp add: assms linear_imp_has_derivative)
     show "continuous_on (g ` S) h"
       using continuous_on_eq_continuous_within has_derivative_continuous linear_imp_has_derivative h by blast
   qed (use h in auto)
 qed
 
 lemma absolutely_integrable_change_of_variables_linear:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "linear g"
   shows "(\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S
      \<longleftrightarrow> f absolutely_integrable_on (g ` S)"
   using assms has_absolute_integral_change_of_variables_linear by blast
 
 lemma absolutely_integrable_on_linear_image:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "linear g"
   shows "f absolutely_integrable_on (g ` S)
      \<longleftrightarrow> (f \<circ> g) absolutely_integrable_on S \<or> det(matrix g) = 0"
   unfolding assms absolutely_integrable_change_of_variables_linear [OF assms, symmetric] absolutely_integrable_on_scaleR_iff
   by (auto simp: set_integrable_def)
 
 lemma integral_change_of_variables_linear:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "linear g"
       and "f absolutely_integrable_on (g ` S) \<or> (f \<circ> g) absolutely_integrable_on S"
     shows "integral (g ` S) f = \<bar>det (matrix g)\<bar> *\<^sub>R integral S (f \<circ> g)"
 proof -
   have "((\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f (g x)) absolutely_integrable_on S) \<or> (f absolutely_integrable_on g ` S)"
     using absolutely_integrable_on_linear_image assms by blast
   moreover
   have ?thesis if "((\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f (g x)) absolutely_integrable_on S)" "(f absolutely_integrable_on g ` S)"
     using has_absolute_integral_change_of_variables_linear [OF \<open>linear g\<close>] that
     by (auto simp: o_def)
   ultimately show ?thesis
     using absolutely_integrable_change_of_variables_linear [OF \<open>linear g\<close>]
     by blast
 qed
 
 subsection\<open>Change of variable for measure\<close>
 
 lemma has_measure_differentiable_image:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes "S \<in> sets lebesgue"
       and "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
       and "inj_on f S"
   shows "f ` S \<in> lmeasurable \<and> measure lebesgue (f ` S) = m
      \<longleftrightarrow> ((\<lambda>x. \<bar>det (matrix (f' x))\<bar>) has_integral m) S"
   using has_absolute_integral_change_of_variables [OF assms, of "\<lambda>x. (1::real^1)" "vec m"]
   unfolding absolutely_integrable_on_1_iff integral_on_1_eq integrable_on_1_iff absolutely_integrable_on_def
   by (auto simp: has_integral_iff lmeasurable_iff_integrable_on lmeasure_integral)
 
 lemma measurable_differentiable_image_eq:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes "S \<in> sets lebesgue"
       and "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
       and "inj_on f S"
   shows "f ` S \<in> lmeasurable \<longleftrightarrow> (\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   using has_measure_differentiable_image [OF assms]
   by blast
 
 lemma measurable_differentiable_image_alt:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes "S \<in> sets lebesgue"
     and "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and "inj_on f S"
   shows "f ` S \<in> lmeasurable \<longleftrightarrow> (\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on S"
   using measurable_differentiable_image_eq [OF assms]
   by (simp only: absolutely_integrable_on_iff_nonneg)
 
 lemma measure_differentiable_image_eq:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> sets lebesgue"
     and der_f: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and inj: "inj_on f S"
     and intS: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   shows "measure lebesgue (f ` S) = integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
   using measurable_differentiable_image_eq [OF S der_f inj]
         assms has_measure_differentiable_image by blast
 
 end
diff --git a/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy b/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy
--- a/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy
+++ b/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy
@@ -1,5020 +1,5021 @@
 (*  Title:      HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy
     Author:     Johannes Hölzl, TU München
     Author:     Robert Himmelmann, TU München
     Huge cleanup by LCP
 *)
 
 theory Equivalence_Lebesgue_Henstock_Integration
   imports
     Lebesgue_Measure
     Henstock_Kurzweil_Integration
     Complete_Measure
     Set_Integral
     Homeomorphism
     Cartesian_Euclidean_Space
 begin
 
 lemma LIMSEQ_if_less: "(\<lambda>k. if i < k then a else b) \<longlonglongrightarrow> a"
   by (rule_tac k="Suc i" in LIMSEQ_offset) auto
 
 text \<open>Note that the rhs is an implication. This lemma plays a specific role in one proof.\<close>
 lemma le_left_mono: "x \<le> y \<Longrightarrow> y \<le> a \<longrightarrow> x \<le> (a::'a::preorder)"
   by (auto intro: order_trans)
 
 lemma ball_trans:
   assumes "y \<in> ball z q" "r + q \<le> s" shows "ball y r \<subseteq> ball z s"
   using assms by metric
 
 lemma has_integral_implies_lebesgue_measurable_cbox:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes f: "(f has_integral I) (cbox x y)"
   shows "f \<in> lebesgue_on (cbox x y) \<rightarrow>\<^sub>M borel"
 proof (rule cld_measure.borel_measurable_cld)
   let ?L = "lebesgue_on (cbox x y)"
   let ?\<mu> = "emeasure ?L"
   let ?\<mu>' = "outer_measure_of ?L"
   interpret L: finite_measure ?L
   proof
     show "?\<mu> (space ?L) \<noteq> \<infinity>"
       by (simp add: emeasure_restrict_space space_restrict_space emeasure_lborel_cbox_eq)
   qed
 
   show "cld_measure ?L"
   proof
     fix B A assume "B \<subseteq> A" "A \<in> null_sets ?L"
     then show "B \<in> sets ?L"
       using null_sets_completion_subset[OF \<open>B \<subseteq> A\<close>, of lborel]
       by (auto simp add: null_sets_restrict_space sets_restrict_space_iff intro: )
   next
     fix A assume "A \<subseteq> space ?L" "\<And>B. B \<in> sets ?L \<Longrightarrow> ?\<mu> B < \<infinity> \<Longrightarrow> A \<inter> B \<in> sets ?L"
     from this(1) this(2)[of "space ?L"] show "A \<in> sets ?L"
       by (auto simp: Int_absorb2 less_top[symmetric])
   qed auto
   then interpret cld_measure ?L
     .
 
   have content_eq_L: "A \<in> sets borel \<Longrightarrow> A \<subseteq> cbox x y \<Longrightarrow> content A = measure ?L A" for A
     by (subst measure_restrict_space) (auto simp: measure_def)
 
   fix E and a b :: real assume "E \<in> sets ?L" "a < b" "0 < ?\<mu> E" "?\<mu> E < \<infinity>"
   then obtain M :: real where "?\<mu> E = M" "0 < M"
     by (cases "?\<mu> E") auto
   define e where "e = M / (4 + 2 / (b - a))"
   from \<open>a < b\<close> \<open>0<M\<close> have "0 < e"
     by (auto intro!: divide_pos_pos simp: field_simps e_def)
 
   have "e < M / (3 + 2 / (b - a))"
     using \<open>a < b\<close> \<open>0 < M\<close>
     unfolding e_def by (intro divide_strict_left_mono add_strict_right_mono mult_pos_pos) (auto simp: field_simps)
   then have "2 * e < (b - a) * (M - e * 3)"
     using \<open>0<M\<close> \<open>0 < e\<close> \<open>a < b\<close> by (simp add: field_simps)
 
   have e_less_M: "e < M / 1"
     unfolding e_def using \<open>a < b\<close> \<open>0<M\<close> by (intro divide_strict_left_mono) (auto simp: field_simps)
 
   obtain d
     where "gauge d"
       and integral_f: "\<forall>p. p tagged_division_of cbox x y \<and> d fine p \<longrightarrow>
         norm ((\<Sum>(x,k) \<in> p. content k *\<^sub>R f x) - I) < e"
     using \<open>0<e\<close> f unfolding has_integral by auto
 
   define C where "C X m = X \<inter> {x. ball x (1/Suc m) \<subseteq> d x}" for X m
   have "incseq (C X)" for X
     unfolding C_def [abs_def]
     by (intro monoI Collect_mono conj_mono imp_refl le_left_mono subset_ball divide_left_mono Int_mono) auto
 
   { fix X assume "X \<subseteq> space ?L" and eq: "?\<mu>' X = ?\<mu> E"
     have "(SUP m. outer_measure_of ?L (C X m)) = outer_measure_of ?L (\<Union>m. C X m)"
       using \<open>X \<subseteq> space ?L\<close> by (intro SUP_outer_measure_of_incseq \<open>incseq (C X)\<close>) (auto simp: C_def)
     also have "(\<Union>m. C X m) = X"
     proof -
       { fix x
         obtain e where "0 < e" "ball x e \<subseteq> d x"
           using gaugeD[OF \<open>gauge d\<close>, of x] unfolding open_contains_ball by auto
         moreover
         obtain n where "1 / (1 + real n) < e"
           using reals_Archimedean[OF \<open>0<e\<close>] by (auto simp: inverse_eq_divide)
         then have "ball x (1 / (1 + real n)) \<subseteq> ball x e"
           by (intro subset_ball) auto
         ultimately have "\<exists>n. ball x (1 / (1 + real n)) \<subseteq> d x"
           by blast }
       then show ?thesis
         by (auto simp: C_def)
     qed
     finally have "(SUP m. outer_measure_of ?L (C X m)) = ?\<mu> E"
       using eq by auto
     also have "\<dots> > M - e"
       using \<open>0 < M\<close> \<open>?\<mu> E = M\<close> \<open>0<e\<close> by (auto intro!: ennreal_lessI)
     finally have "\<exists>m. M - e < outer_measure_of ?L (C X m)"
       unfolding less_SUP_iff by auto }
   note C = this
 
   let ?E = "{x\<in>E. f x \<le> a}" and ?F = "{x\<in>E. b \<le> f x}"
 
   have "\<not> (?\<mu>' ?E = ?\<mu> E \<and> ?\<mu>' ?F = ?\<mu> E)"
   proof
     assume eq: "?\<mu>' ?E = ?\<mu> E \<and> ?\<mu>' ?F = ?\<mu> E"
     with C[of ?E] C[of ?F] \<open>E \<in> sets ?L\<close>[THEN sets.sets_into_space] obtain ma mb
       where "M - e < outer_measure_of ?L (C ?E ma)" "M - e < outer_measure_of ?L (C ?F mb)"
       by auto
     moreover define m where "m = max ma mb"
     ultimately have M_minus_e: "M - e < outer_measure_of ?L (C ?E m)" "M - e < outer_measure_of ?L (C ?F m)"
       using
         incseqD[OF \<open>incseq (C ?E)\<close>, of ma m, THEN outer_measure_of_mono]
         incseqD[OF \<open>incseq (C ?F)\<close>, of mb m, THEN outer_measure_of_mono]
       by (auto intro: less_le_trans)
     define d' where "d' x = d x \<inter> ball x (1 / (3 * Suc m))" for x
     have "gauge d'"
       unfolding d'_def by (intro gauge_Int \<open>gauge d\<close> gauge_ball) auto
     then obtain p where p: "p tagged_division_of cbox x y" "d' fine p"
       by (rule fine_division_exists)
     then have "d fine p"
       unfolding d'_def[abs_def] fine_def by auto
 
     define s where "s = {(x::'a, k). k \<inter> (C ?E m) \<noteq> {} \<and> k \<inter> (C ?F m) \<noteq> {}}"
     define T where "T E k = (SOME x. x \<in> k \<inter> C E m)" for E k
     let ?A = "(\<lambda>(x, k). (T ?E k, k)) ` (p \<inter> s) \<union> (p - s)"
     let ?B = "(\<lambda>(x, k). (T ?F k, k)) ` (p \<inter> s) \<union> (p - s)"
 
     { fix X assume X_eq: "X = ?E \<or> X = ?F"
       let ?T = "(\<lambda>(x, k). (T X k, k))"
       let ?p = "?T ` (p \<inter> s) \<union> (p - s)"
 
       have in_s: "(x, k) \<in> s \<Longrightarrow> T X k \<in> k \<inter> C X m" for x k
         using someI_ex[of "\<lambda>x. x \<in> k \<inter> C X m"] X_eq unfolding ex_in_conv by (auto simp: T_def s_def)
 
       { fix x k assume "(x, k) \<in> p" "(x, k) \<in> s"
         have k: "k \<subseteq> ball x (1 / (3 * Suc m))"
           using \<open>d' fine p\<close>[THEN fineD, OF \<open>(x, k) \<in> p\<close>] by (auto simp: d'_def)
         then have "x \<in> ball (T X k) (1 / (3 * Suc m))"
           using in_s[OF \<open>(x, k) \<in> s\<close>] by (auto simp: C_def subset_eq dist_commute)
         then have "ball x (1 / (3 * Suc m)) \<subseteq> ball (T X k) (1 / Suc m)"
           by (rule ball_trans) (auto simp: field_split_simps)
         with k in_s[OF \<open>(x, k) \<in> s\<close>] have "k \<subseteq> d (T X k)"
           by (auto simp: C_def) }
       then have "d fine ?p"
         using \<open>d fine p\<close> by (auto intro!: fineI)
       moreover
       have "?p tagged_division_of cbox x y"
       proof (rule tagged_division_ofI)
         show "finite ?p"
           using p(1) by auto
       next
         fix z k assume *: "(z, k) \<in> ?p"
         then consider "(z, k) \<in> p" "(z, k) \<notin> s"
           | x' where "(x', k) \<in> p" "(x', k) \<in> s" "z = T X k"
           by (auto simp: T_def)
         then have "z \<in> k \<and> k \<subseteq> cbox x y \<and> (\<exists>a b. k = cbox a b)"
           using p(1) by cases (auto dest: in_s)
         then show "z \<in> k" "k \<subseteq> cbox x y" "\<exists>a b. k = cbox a b"
           by auto
       next
         fix z k z' k' assume "(z, k) \<in> ?p" "(z', k') \<in> ?p" "(z, k) \<noteq> (z', k')"
         with tagged_division_ofD(5)[OF p(1), of _ k _ k']
         show "interior k \<inter> interior k' = {}"
           by (auto simp: T_def dest: in_s)
       next
         have "{k. \<exists>x. (x, k) \<in> ?p} = {k. \<exists>x. (x, k) \<in> p}"
           by (auto simp: T_def image_iff Bex_def)
         then show "\<Union>{k. \<exists>x. (x, k) \<in> ?p} = cbox x y"
           using p(1) by auto
       qed
       ultimately have I: "norm ((\<Sum>(x,k) \<in> ?p. content k *\<^sub>R f x) - I) < e"
         using integral_f by auto
 
       have "(\<Sum>(x,k) \<in> ?p. content k *\<^sub>R f x) =
         (\<Sum>(x,k) \<in> ?T ` (p \<inter> s). content k *\<^sub>R f x) + (\<Sum>(x,k) \<in> p - s. content k *\<^sub>R f x)"
         using p(1)[THEN tagged_division_ofD(1)]
         by (safe intro!: sum.union_inter_neutral) (auto simp: s_def T_def)
       also have "(\<Sum>(x,k) \<in> ?T ` (p \<inter> s). content k *\<^sub>R f x) = (\<Sum>(x,k) \<in> p \<inter> s. content k *\<^sub>R f (T X k))"
       proof (subst sum.reindex_nontrivial, safe)
         fix x1 x2 k assume 1: "(x1, k) \<in> p" "(x1, k) \<in> s" and 2: "(x2, k) \<in> p" "(x2, k) \<in> s"
           and eq: "content k *\<^sub>R f (T X k) \<noteq> 0"
         with tagged_division_ofD(5)[OF p(1), of x1 k x2 k] tagged_division_ofD(4)[OF p(1), of x1 k]
         show "x1 = x2"
           by (auto simp: content_eq_0_interior)
       qed (use p in \<open>auto intro!: sum.cong\<close>)
       finally have eq: "(\<Sum>(x,k) \<in> ?p. content k *\<^sub>R f x) =
         (\<Sum>(x,k) \<in> p \<inter> s. content k *\<^sub>R f (T X k)) + (\<Sum>(x,k) \<in> p - s. content k *\<^sub>R f x)" .
 
       have in_T: "(x, k) \<in> s \<Longrightarrow> T X k \<in> X" for x k
         using in_s[of x k] by (auto simp: C_def)
 
       note I eq in_T }
     note parts = this
 
     have p_in_L: "(x, k) \<in> p \<Longrightarrow> k \<in> sets ?L" for x k
       using tagged_division_ofD(3, 4)[OF p(1), of x k] by (auto simp: sets_restrict_space)
 
     have [simp]: "finite p"
       using tagged_division_ofD(1)[OF p(1)] .
 
     have "(M - 3*e) * (b - a) \<le> (\<Sum>(x,k) \<in> p \<inter> s. content k) * (b - a)"
     proof (intro mult_right_mono)
       have fin: "?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}}) < \<infinity>" for X
         using \<open>?\<mu> E < \<infinity>\<close> by (rule le_less_trans[rotated]) (auto intro!: emeasure_mono \<open>E \<in> sets ?L\<close>)
       have sets: "(E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}}) \<in> sets ?L" for X
         using tagged_division_ofD(1)[OF p(1)] by (intro sets.Diff \<open>E \<in> sets ?L\<close> sets.finite_Union sets.Int) (auto intro: p_in_L)
       { fix X assume "X \<subseteq> E" "M - e < ?\<mu>' (C X m)"
         have "M - e \<le> ?\<mu>' (C X m)"
           by (rule less_imp_le) fact
         also have "\<dots> \<le> ?\<mu>' (E - (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}}))"
         proof (intro outer_measure_of_mono subsetI)
           fix v assume "v \<in> C X m"
           then have "v \<in> cbox x y" "v \<in> E"
             using \<open>E \<subseteq> space ?L\<close> \<open>X \<subseteq> E\<close> by (auto simp: space_restrict_space C_def)
           then obtain z k where "(z, k) \<in> p" "v \<in> k"
             using tagged_division_ofD(6)[OF p(1), symmetric] by auto
           then show "v \<in> E - E \<inter> (\<Union>{k\<in>snd`p. k \<inter> C X m = {}})"
             using \<open>v \<in> C X m\<close> \<open>v \<in> E\<close> by auto
         qed
         also have "\<dots> = ?\<mu> E - ?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}})"
           using \<open>E \<in> sets ?L\<close> fin[of X] sets[of X] by (auto intro!: emeasure_Diff)
         finally have "?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}}) \<le> e"
           using \<open>0 < e\<close> e_less_M 
           by (cases "?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}})") (auto simp add: \<open>?\<mu> E = M\<close> ennreal_minus ennreal_le_iff2)
         note this }
       note upper_bound = this
 
       have "?\<mu> (E \<inter> \<Union>(snd`(p - s))) =
         ?\<mu> ((E \<inter> \<Union>{k\<in>snd`p. k \<inter> C ?E m = {}}) \<union> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C ?F m = {}}))"
         by (intro arg_cong[where f="?\<mu>"]) (auto simp: s_def image_def Bex_def)
       also have "\<dots> \<le> ?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C ?E m = {}}) + ?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C ?F m = {}})"
         using sets[of ?E] sets[of ?F] M_minus_e by (intro emeasure_subadditive) auto
       also have "\<dots> \<le> e + ennreal e"
         using upper_bound[of ?E] upper_bound[of ?F] M_minus_e by (intro add_mono) auto
       finally have "?\<mu> E - 2*e \<le> ?\<mu> (E - (E \<inter> \<Union>(snd`(p - s))))"
         using \<open>0 < e\<close> \<open>E \<in> sets ?L\<close> tagged_division_ofD(1)[OF p(1)]
         by (subst emeasure_Diff)
            (auto simp: top_unique simp flip: ennreal_plus
                  intro!: sets.Int sets.finite_UN ennreal_mono_minus intro: p_in_L)
       also have "\<dots> \<le> ?\<mu> (\<Union>x\<in>p \<inter> s. snd x)"
       proof (safe intro!: emeasure_mono subsetI)
         fix v assume "v \<in> E" and not: "v \<notin> (\<Union>x\<in>p \<inter> s. snd x)"
         then have "v \<in> cbox x y"
           using \<open>E \<subseteq> space ?L\<close> by (auto simp: space_restrict_space)
         then obtain z k where "(z, k) \<in> p" "v \<in> k"
           using tagged_division_ofD(6)[OF p(1), symmetric] by auto
         with not show "v \<in> \<Union>(snd ` (p - s))"
           by (auto intro!: bexI[of _ "(z, k)"] elim: ballE[of _ _ "(z, k)"])
       qed (auto intro!: sets.Int sets.finite_UN ennreal_mono_minus intro: p_in_L)
       also have "\<dots> = measure ?L (\<Union>x\<in>p \<inter> s. snd x)"
         by (auto intro!: emeasure_eq_ennreal_measure)
       finally have "M - 2 * e \<le> measure ?L (\<Union>x\<in>p \<inter> s. snd x)"
         unfolding \<open>?\<mu> E = M\<close> using \<open>0 < e\<close> by (simp add: ennreal_minus)
       also have "measure ?L (\<Union>x\<in>p \<inter> s. snd x) = content (\<Union>x\<in>p \<inter> s. snd x)"
         using tagged_division_ofD(1,3,4) [OF p(1)]
         by (intro content_eq_L[symmetric])
            (fastforce intro!: sets.finite_UN UN_least del: subsetI)+
       also have "content (\<Union>x\<in>p \<inter> s. snd x) \<le> (\<Sum>k\<in>p \<inter> s. content (snd k))"
         using p(1) by (auto simp: emeasure_lborel_cbox_eq intro!: measure_subadditive_finite
                             dest!: p(1)[THEN tagged_division_ofD(4)])
       finally show "M - 3 * e \<le> (\<Sum>(x, y)\<in>p \<inter> s. content y)"
         using \<open>0 < e\<close> by (simp add: split_beta)
     qed (use \<open>a < b\<close> in auto)
     also have "\<dots> = (\<Sum>(x,k) \<in> p \<inter> s. content k * (b - a))"
       by (simp add: sum_distrib_right split_beta')
     also have "\<dots> \<le> (\<Sum>(x,k) \<in> p \<inter> s. content k * (f (T ?F k) - f (T ?E k)))"
       using parts(3) by (auto intro!: sum_mono mult_left_mono diff_mono)
     also have "\<dots> = (\<Sum>(x,k) \<in> p \<inter> s. content k * f (T ?F k)) - (\<Sum>(x,k) \<in> p \<inter> s. content k * f (T ?E k))"
       by (auto intro!: sum.cong simp: field_simps sum_subtractf[symmetric])
     also have "\<dots> = (\<Sum>(x,k) \<in> ?B. content k *\<^sub>R f x) - (\<Sum>(x,k) \<in> ?A. content k *\<^sub>R f x)"
       by (subst (1 2) parts) auto
     also have "\<dots> \<le> norm ((\<Sum>(x,k) \<in> ?B. content k *\<^sub>R f x) - (\<Sum>(x,k) \<in> ?A. content k *\<^sub>R f x))"
       by auto
     also have "\<dots> \<le> e + e"
       using parts(1)[of ?E] parts(1)[of ?F] by (intro norm_diff_triangle_le[of _ I]) auto
     finally show False
       using \<open>2 * e < (b - a) * (M - e * 3)\<close> by (auto simp: field_simps)
   qed
   moreover have "?\<mu>' ?E \<le> ?\<mu> E" "?\<mu>' ?F \<le> ?\<mu> E"
     unfolding outer_measure_of_eq[OF \<open>E \<in> sets ?L\<close>, symmetric] by (auto intro!: outer_measure_of_mono)
   ultimately show "min (?\<mu>' ?E) (?\<mu>' ?F) < ?\<mu> E"
     unfolding min_less_iff_disj by (auto simp: less_le)
 qed
 
 lemma has_integral_implies_lebesgue_measurable_real:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes f: "(f has_integral I) \<Omega>"
   shows "(\<lambda>x. f x * indicator \<Omega> x) \<in> lebesgue \<rightarrow>\<^sub>M borel"
 proof -
   define B :: "nat \<Rightarrow> 'a set" where "B n = cbox (- real n *\<^sub>R One) (real n *\<^sub>R One)" for n
   show "(\<lambda>x. f x * indicator \<Omega> x) \<in> lebesgue \<rightarrow>\<^sub>M borel"
   proof (rule measurable_piecewise_restrict)
     have "(\<Union>n. box (- real n *\<^sub>R One) (real n *\<^sub>R One)) \<subseteq> \<Union>(B ` UNIV)"
       unfolding B_def by (intro UN_mono box_subset_cbox order_refl)
     then show "countable (range B)" "space lebesgue \<subseteq> \<Union>(B ` UNIV)"
       by (auto simp: B_def UN_box_eq_UNIV)
   next
     fix \<Omega>' assume "\<Omega>' \<in> range B"
     then obtain n where \<Omega>': "\<Omega>' = B n" by auto
     then show "\<Omega>' \<inter> space lebesgue \<in> sets lebesgue"
       by (auto simp: B_def)
 
     have "f integrable_on \<Omega>"
       using f by auto
     then have "(\<lambda>x. f x * indicator \<Omega> x) integrable_on \<Omega>"
       by (auto simp: integrable_on_def cong: has_integral_cong)
     then have "(\<lambda>x. f x * indicator \<Omega> x) integrable_on (\<Omega> \<union> B n)"
       by (rule integrable_on_superset) auto
     then have "(\<lambda>x. f x * indicator \<Omega> x) integrable_on B n"
       unfolding B_def by (rule integrable_on_subcbox) auto
     then show "(\<lambda>x. f x * indicator \<Omega> x) \<in> lebesgue_on \<Omega>' \<rightarrow>\<^sub>M borel"
       unfolding B_def \<Omega>' by (auto intro: has_integral_implies_lebesgue_measurable_cbox simp: integrable_on_def)
   qed
 qed
 
 lemma has_integral_implies_lebesgue_measurable:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes f: "(f has_integral I) \<Omega>"
   shows "(\<lambda>x. indicator \<Omega> x *\<^sub>R f x) \<in> lebesgue \<rightarrow>\<^sub>M borel"
 proof (intro borel_measurable_euclidean_space[where 'c='b, THEN iffD2] ballI)
   fix i :: "'b" assume "i \<in> Basis"
   have "(\<lambda>x. (f x \<bullet> i) * indicator \<Omega> x) \<in> borel_measurable (completion lborel)"
     using has_integral_linear[OF f bounded_linear_inner_left, of i]
     by (intro has_integral_implies_lebesgue_measurable_real) (auto simp: comp_def)
   then show "(\<lambda>x. indicator \<Omega> x *\<^sub>R f x \<bullet> i) \<in> borel_measurable (completion lborel)"
     by (simp add: ac_simps)
 qed
 
 subsection \<open>Equivalence Lebesgue integral on \<^const>\<open>lborel\<close> and HK-integral\<close>
 
 lemma has_integral_measure_lborel:
   fixes A :: "'a::euclidean_space set"
   assumes A[measurable]: "A \<in> sets borel" and finite: "emeasure lborel A < \<infinity>"
   shows "((\<lambda>x. 1) has_integral measure lborel A) A"
 proof -
   { fix l u :: 'a
     have "((\<lambda>x. 1) has_integral measure lborel (box l u)) (box l u)"
     proof cases
       assume "\<forall>b\<in>Basis. l \<bullet> b \<le> u \<bullet> b"
       then show ?thesis
         using has_integral_const[of "1::real" l u]
         by (simp flip: has_integral_restrict[OF box_subset_cbox] add: has_integral_spike_interior)
     next
       assume "\<not> (\<forall>b\<in>Basis. l \<bullet> b \<le> u \<bullet> b)"
       then have "box l u = {}"
         unfolding box_eq_empty by (auto simp: not_le intro: less_imp_le)
       then show ?thesis
         by simp
     qed }
   note has_integral_box = this
 
   { fix a b :: 'a let ?M = "\<lambda>A. measure lborel (A \<inter> box a b)"
     have "Int_stable  (range (\<lambda>(a, b). box a b))"
       by (auto simp: Int_stable_def box_Int_box)
     moreover have "(range (\<lambda>(a, b). box a b)) \<subseteq> Pow UNIV"
       by auto
     moreover have "A \<in> sigma_sets UNIV (range (\<lambda>(a, b). box a b))"
        using A unfolding borel_eq_box by simp
     ultimately have "((\<lambda>x. 1) has_integral ?M A) (A \<inter> box a b)"
     proof (induction rule: sigma_sets_induct_disjoint)
       case (basic A) then show ?case
         by (auto simp: box_Int_box has_integral_box)
     next
       case empty then show ?case
         by simp
     next
       case (compl A)
       then have [measurable]: "A \<in> sets borel"
         by (simp add: borel_eq_box)
 
       have "((\<lambda>x. 1) has_integral ?M (box a b)) (box a b)"
         by (simp add: has_integral_box)
       moreover have "((\<lambda>x. if x \<in> A \<inter> box a b then 1 else 0) has_integral ?M A) (box a b)"
         by (subst has_integral_restrict) (auto intro: compl)
       ultimately have "((\<lambda>x. 1 - (if x \<in> A \<inter> box a b then 1 else 0)) has_integral ?M (box a b) - ?M A) (box a b)"
         by (rule has_integral_diff)
       then have "((\<lambda>x. (if x \<in> (UNIV - A) \<inter> box a b then 1 else 0)) has_integral ?M (box a b) - ?M A) (box a b)"
         by (rule has_integral_cong[THEN iffD1, rotated 1]) auto
       then have "((\<lambda>x. 1) has_integral ?M (box a b) - ?M A) ((UNIV - A) \<inter> box a b)"
         by (subst (asm) has_integral_restrict) auto
       also have "?M (box a b) - ?M A = ?M (UNIV - A)"
         by (subst measure_Diff[symmetric]) (auto simp: emeasure_lborel_box_eq Diff_Int_distrib2)
       finally show ?case .
     next
       case (union F)
       then have [measurable]: "\<And>i. F i \<in> sets borel"
         by (simp add: borel_eq_box subset_eq)
       have "((\<lambda>x. if x \<in> \<Union>(F ` UNIV) \<inter> box a b then 1 else 0) has_integral ?M (\<Union>i. F i)) (box a b)"
       proof (rule has_integral_monotone_convergence_increasing)
         let ?f = "\<lambda>k x. \<Sum>i<k. if x \<in> F i \<inter> box a b then 1 else 0 :: real"
         show "\<And>k. (?f k has_integral (\<Sum>i<k. ?M (F i))) (box a b)"
           using union.IH by (auto intro!: has_integral_sum simp del: Int_iff)
         show "\<And>k x. ?f k x \<le> ?f (Suc k) x"
           by (intro sum_mono2) auto
         from union(1) have *: "\<And>x i j. x \<in> F i \<Longrightarrow> x \<in> F j \<longleftrightarrow> j = i"
           by (auto simp add: disjoint_family_on_def)
         show "(\<lambda>k. ?f k x) \<longlonglongrightarrow> (if x \<in> \<Union>(F ` UNIV) \<inter> box a b then 1 else 0)" for x
           by (auto simp: * sum.If_cases Iio_Int_singleton if_distrib LIMSEQ_if_less cong: if_cong)
         have *: "emeasure lborel ((\<Union>x. F x) \<inter> box a b) \<le> emeasure lborel (box a b)"
           by (intro emeasure_mono) auto
 
         with union(1) show "(\<lambda>k. \<Sum>i<k. ?M (F i)) \<longlonglongrightarrow> ?M (\<Union>i. F i)"
           unfolding sums_def[symmetric] UN_extend_simps
           by (intro measure_UNION) (auto simp: disjoint_family_on_def emeasure_lborel_box_eq top_unique)
       qed
       then show ?case
         by (subst (asm) has_integral_restrict) auto
     qed }
   note * = this
 
   show ?thesis
   proof (rule has_integral_monotone_convergence_increasing)
     let ?B = "\<lambda>n::nat. box (- real n *\<^sub>R One) (real n *\<^sub>R One) :: 'a set"
     let ?f = "\<lambda>n::nat. \<lambda>x. if x \<in> A \<inter> ?B n then 1 else 0 :: real"
     let ?M = "\<lambda>n. measure lborel (A \<inter> ?B n)"
 
     show "\<And>n::nat. (?f n has_integral ?M n) A"
       using * by (subst has_integral_restrict) simp_all
     show "\<And>k x. ?f k x \<le> ?f (Suc k) x"
       by (auto simp: box_def)
     { fix x assume "x \<in> A"
       moreover have "(\<lambda>k. indicator (A \<inter> ?B k) x :: real) \<longlonglongrightarrow> indicator (\<Union>k::nat. A \<inter> ?B k) x"
         by (intro LIMSEQ_indicator_incseq) (auto simp: incseq_def box_def)
       ultimately show "(\<lambda>k. if x \<in> A \<inter> ?B k then 1 else 0::real) \<longlonglongrightarrow> 1"
-        by (simp add: indicator_def UN_box_eq_UNIV) }
+        by (simp add: indicator_def of_bool_def UN_box_eq_UNIV) }
 
     have "(\<lambda>n. emeasure lborel (A \<inter> ?B n)) \<longlonglongrightarrow> emeasure lborel (\<Union>n::nat. A \<inter> ?B n)"
       by (intro Lim_emeasure_incseq) (auto simp: incseq_def box_def)
     also have "(\<lambda>n. emeasure lborel (A \<inter> ?B n)) = (\<lambda>n. measure lborel (A \<inter> ?B n))"
     proof (intro ext emeasure_eq_ennreal_measure)
       fix n have "emeasure lborel (A \<inter> ?B n) \<le> emeasure lborel (?B n)"
         by (intro emeasure_mono) auto
       then show "emeasure lborel (A \<inter> ?B n) \<noteq> top"
         by (auto simp: top_unique)
     qed
     finally show "(\<lambda>n. measure lborel (A \<inter> ?B n)) \<longlonglongrightarrow> measure lborel A"
       using emeasure_eq_ennreal_measure[of lborel A] finite
       by (simp add: UN_box_eq_UNIV less_top)
   qed
 qed
 
 lemma nn_integral_has_integral:
   fixes f::"'a::euclidean_space \<Rightarrow> real"
   assumes f: "f \<in> borel_measurable borel" "\<And>x. 0 \<le> f x" "(\<integral>\<^sup>+x. f x \<partial>lborel) = ennreal r" "0 \<le> r"
   shows "(f has_integral r) UNIV"
 using f proof (induct f arbitrary: r rule: borel_measurable_induct_real)
   case (set A)
   then have "((\<lambda>x. 1) has_integral measure lborel A) A"
     by (intro has_integral_measure_lborel) (auto simp: ennreal_indicator)
   with set show ?case
-    by (simp add: ennreal_indicator measure_def) (simp add: indicator_def)
+    by (simp add: ennreal_indicator measure_def) (simp add: indicator_def of_bool_def)
 next
   case (mult g c)
   then have "ennreal c * (\<integral>\<^sup>+ x. g x \<partial>lborel) = ennreal r"
     by (subst nn_integral_cmult[symmetric]) (auto simp: ennreal_mult)
   with \<open>0 \<le> r\<close> \<open>0 \<le> c\<close>
   obtain r' where "(c = 0 \<and> r = 0) \<or> (0 \<le> r' \<and> (\<integral>\<^sup>+ x. ennreal (g x) \<partial>lborel) = ennreal r' \<and> r = c * r')"
     by (cases "\<integral>\<^sup>+ x. ennreal (g x) \<partial>lborel" rule: ennreal_cases)
        (auto split: if_split_asm simp: ennreal_mult_top ennreal_mult[symmetric])
   with mult show ?case
     by (auto intro!: has_integral_cmult_real)
 next
   case (add g h)
   then have "(\<integral>\<^sup>+ x. h x + g x \<partial>lborel) = (\<integral>\<^sup>+ x. h x \<partial>lborel) + (\<integral>\<^sup>+ x. g x \<partial>lborel)"
     by (simp add: nn_integral_add)
   with add obtain a b where "0 \<le> a" "0 \<le> b" "(\<integral>\<^sup>+ x. h x \<partial>lborel) = ennreal a" "(\<integral>\<^sup>+ x. g x \<partial>lborel) = ennreal b" "r = a + b"
     by (cases "\<integral>\<^sup>+ x. h x \<partial>lborel" "\<integral>\<^sup>+ x. g x \<partial>lborel" rule: ennreal2_cases)
        (auto simp: add_top nn_integral_add top_add simp flip: ennreal_plus)
   with add show ?case
     by (auto intro!: has_integral_add)
 next
   case (seq U)
   note seq(1)[measurable] and f[measurable]
 
   have U_le_f: "U i x \<le> f x" for i x
     by (metis (no_types) LIMSEQ_le_const UNIV_I incseq_def le_fun_def seq.hyps(4) seq.hyps(5) space_borel)
 
   { fix i
     have "(\<integral>\<^sup>+x. U i x \<partial>lborel) \<le> (\<integral>\<^sup>+x. f x \<partial>lborel)"
       using seq(2) f(2) U_le_f by (intro nn_integral_mono) simp
     then obtain p where "(\<integral>\<^sup>+x. U i x \<partial>lborel) = ennreal p" "p \<le> r" "0 \<le> p"
       using seq(6) \<open>0\<le>r\<close> by (cases "\<integral>\<^sup>+x. U i x \<partial>lborel" rule: ennreal_cases) (auto simp: top_unique)
     moreover note seq
     ultimately have "\<exists>p. (\<integral>\<^sup>+x. U i x \<partial>lborel) = ennreal p \<and> 0 \<le> p \<and> p \<le> r \<and> (U i has_integral p) UNIV"
       by auto }
   then obtain p where p: "\<And>i. (\<integral>\<^sup>+x. ennreal (U i x) \<partial>lborel) = ennreal (p i)"
     and bnd: "\<And>i. p i \<le> r" "\<And>i. 0 \<le> p i"
     and U_int: "\<And>i.(U i has_integral (p i)) UNIV" by metis
 
   have int_eq: "\<And>i. integral UNIV (U i) = p i" using U_int by (rule integral_unique)
 
   have *: "f integrable_on UNIV \<and> (\<lambda>k. integral UNIV (U k)) \<longlonglongrightarrow> integral UNIV f"
   proof (rule monotone_convergence_increasing)
     show "\<And>k. U k integrable_on UNIV" using U_int by auto
     show "\<And>k x. x\<in>UNIV \<Longrightarrow> U k x \<le> U (Suc k) x" using \<open>incseq U\<close> by (auto simp: incseq_def le_fun_def)
     then show "bounded (range (\<lambda>k. integral UNIV (U k)))"
       using bnd int_eq by (auto simp: bounded_real intro!: exI[of _ r])
     show "\<And>x. x\<in>UNIV \<Longrightarrow> (\<lambda>k. U k x) \<longlonglongrightarrow> f x"
       using seq by auto
   qed
   moreover have "(\<lambda>i. (\<integral>\<^sup>+x. U i x \<partial>lborel)) \<longlonglongrightarrow> (\<integral>\<^sup>+x. f x \<partial>lborel)"
     using seq f(2) U_le_f by (intro nn_integral_dominated_convergence[where w=f]) auto
   ultimately have "integral UNIV f = r"
     by (auto simp add: bnd int_eq p seq intro: LIMSEQ_unique)
   with * show ?case
     by (simp add: has_integral_integral)
 qed
 
 lemma nn_integral_lborel_eq_integral:
   fixes f::"'a::euclidean_space \<Rightarrow> real"
   assumes f: "f \<in> borel_measurable borel" "\<And>x. 0 \<le> f x" "(\<integral>\<^sup>+x. f x \<partial>lborel) < \<infinity>"
   shows "(\<integral>\<^sup>+x. f x \<partial>lborel) = integral UNIV f"
 proof -
   from f(3) obtain r where r: "(\<integral>\<^sup>+x. f x \<partial>lborel) = ennreal r" "0 \<le> r"
     by (cases "\<integral>\<^sup>+x. f x \<partial>lborel" rule: ennreal_cases) auto
   then show ?thesis
     using nn_integral_has_integral[OF f(1,2) r] by (simp add: integral_unique)
 qed
 
 lemma nn_integral_integrable_on:
   fixes f::"'a::euclidean_space \<Rightarrow> real"
   assumes f: "f \<in> borel_measurable borel" "\<And>x. 0 \<le> f x" "(\<integral>\<^sup>+x. f x \<partial>lborel) < \<infinity>"
   shows "f integrable_on UNIV"
 proof -
   from f(3) obtain r where r: "(\<integral>\<^sup>+x. f x \<partial>lborel) = ennreal r" "0 \<le> r"
     by (cases "\<integral>\<^sup>+x. f x \<partial>lborel" rule: ennreal_cases) auto
   then show ?thesis
     by (intro has_integral_integrable[where i=r] nn_integral_has_integral[where r=r] f)
 qed
 
 lemma nn_integral_has_integral_lborel:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f_borel: "f \<in> borel_measurable borel" and nonneg: "\<And>x. 0 \<le> f x"
   assumes I: "(f has_integral I) UNIV"
   shows "integral\<^sup>N lborel f = I"
 proof -
   from f_borel have "(\<lambda>x. ennreal (f x)) \<in> borel_measurable lborel" by auto
   from borel_measurable_implies_simple_function_sequence'[OF this]
   obtain F where F: "\<And>i. simple_function lborel (F i)" "incseq F"
                  "\<And>i x. F i x < top" "\<And>x. (SUP i. F i x) = ennreal (f x)"
     by blast
   then have [measurable]: "\<And>i. F i \<in> borel_measurable lborel"
     by (metis borel_measurable_simple_function)
   let ?B = "\<lambda>i::nat. box (- (real i *\<^sub>R One)) (real i *\<^sub>R One) :: 'a set"
 
   have "0 \<le> I"
     using I by (rule has_integral_nonneg) (simp add: nonneg)
 
   have F_le_f: "enn2real (F i x) \<le> f x" for i x
     using F(3,4)[where x=x] nonneg SUP_upper[of i UNIV "\<lambda>i. F i x"]
     by (cases "F i x" rule: ennreal_cases) auto
   let ?F = "\<lambda>i x. F i x * indicator (?B i) x"
   have "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>lborel) = (SUP i. integral\<^sup>N lborel (\<lambda>x. ?F i x))"
   proof (subst nn_integral_monotone_convergence_SUP[symmetric])
     { fix x
       obtain j where j: "x \<in> ?B j"
         using UN_box_eq_UNIV by auto
 
       have "ennreal (f x) = (SUP i. F i x)"
         using F(4)[of x] nonneg[of x] by (simp add: max_def)
       also have "\<dots> = (SUP i. ?F i x)"
       proof (rule SUP_eq)
         fix i show "\<exists>j\<in>UNIV. F i x \<le> ?F j x"
           using j F(2)
           by (intro bexI[of _ "max i j"])
              (auto split: split_max split_indicator simp: incseq_def le_fun_def box_def)
       qed (auto intro!: F split: split_indicator)
       finally have "ennreal (f x) =  (SUP i. ?F i x)" . }
     then show "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>lborel) = (\<integral>\<^sup>+ x. (SUP i. ?F i x) \<partial>lborel)"
       by simp
   qed (insert F, auto simp: incseq_def le_fun_def box_def split: split_indicator)
   also have "\<dots> \<le> ennreal I"
   proof (rule SUP_least)
     fix i :: nat
     have finite_F: "(\<integral>\<^sup>+ x. ennreal (enn2real (F i x) * indicator (?B i) x) \<partial>lborel) < \<infinity>"
     proof (rule nn_integral_bound_simple_function)
       have "emeasure lborel {x \<in> space lborel. ennreal (enn2real (F i x) * indicator (?B i) x) \<noteq> 0} \<le>
         emeasure lborel (?B i)"
         by (intro emeasure_mono)  (auto split: split_indicator)
       then show "emeasure lborel {x \<in> space lborel. ennreal (enn2real (F i x) * indicator (?B i) x) \<noteq> 0} < \<infinity>"
         by (auto simp: less_top[symmetric] top_unique)
     qed (auto split: split_indicator
               intro!: F simple_function_compose1[where g="enn2real"] simple_function_ennreal)
 
     have int_F: "(\<lambda>x. enn2real (F i x) * indicator (?B i) x) integrable_on UNIV"
       using F(4) finite_F
       by (intro nn_integral_integrable_on) (auto split: split_indicator simp: enn2real_nonneg)
 
     have "(\<integral>\<^sup>+ x. F i x * indicator (?B i) x \<partial>lborel) =
       (\<integral>\<^sup>+ x. ennreal (enn2real (F i x) * indicator (?B i) x) \<partial>lborel)"
       using F(3,4)
       by (intro nn_integral_cong) (auto simp: image_iff eq_commute split: split_indicator)
     also have "\<dots> = ennreal (integral UNIV (\<lambda>x. enn2real (F i x) * indicator (?B i) x))"
       using F
       by (intro nn_integral_lborel_eq_integral[OF _ _ finite_F])
          (auto split: split_indicator intro: enn2real_nonneg)
     also have "\<dots> \<le> ennreal I"
       by (auto intro!: has_integral_le[OF integrable_integral[OF int_F] I] nonneg F_le_f
                simp: \<open>0 \<le> I\<close> split: split_indicator )
     finally show "(\<integral>\<^sup>+ x. F i x * indicator (?B i) x \<partial>lborel) \<le> ennreal I" .
   qed
   finally have "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>lborel) < \<infinity>"
     by (auto simp: less_top[symmetric] top_unique)
   from nn_integral_lborel_eq_integral[OF assms(1,2) this] I show ?thesis
     by (simp add: integral_unique)
 qed
 
 lemma has_integral_iff_emeasure_lborel:
   fixes A :: "'a::euclidean_space set"
   assumes A[measurable]: "A \<in> sets borel" and [simp]: "0 \<le> r"
   shows "((\<lambda>x. 1) has_integral r) A \<longleftrightarrow> emeasure lborel A = ennreal r"
 proof (cases "emeasure lborel A = \<infinity>")
   case emeasure_A: True
   have "\<not> (\<lambda>x. 1::real) integrable_on A"
   proof
     assume int: "(\<lambda>x. 1::real) integrable_on A"
     then have "(indicator A::'a \<Rightarrow> real) integrable_on UNIV"
-      unfolding indicator_def[abs_def] integrable_restrict_UNIV .
+      unfolding indicator_def of_bool_def integrable_restrict_UNIV .
     then obtain r where "((indicator A::'a\<Rightarrow>real) has_integral r) UNIV"
       by auto
     from nn_integral_has_integral_lborel[OF _ _ this] emeasure_A show False
       by (simp add: ennreal_indicator)
   qed
   with emeasure_A show ?thesis
     by auto
 next
   case False
   then have "((\<lambda>x. 1) has_integral measure lborel A) A"
     by (simp add: has_integral_measure_lborel less_top)
   with False show ?thesis
     by (auto simp: emeasure_eq_ennreal_measure has_integral_unique)
 qed
 
 lemma ennreal_max_0: "ennreal (max 0 x) = ennreal x"
   by (auto simp: max_def ennreal_neg)
 
 lemma has_integral_integral_real:
   fixes f::"'a::euclidean_space \<Rightarrow> real"
   assumes f: "integrable lborel f"
   shows "(f has_integral (integral\<^sup>L lborel f)) UNIV"
 proof -
   from integrableE[OF f] obtain r q
     where "0 \<le> r" "0 \<le> q"
       and r: "(\<integral>\<^sup>+ x. ennreal (max 0 (f x)) \<partial>lborel) = ennreal r"
       and q: "(\<integral>\<^sup>+ x. ennreal (max 0 (- f x)) \<partial>lborel) = ennreal q"
       and f: "f \<in> borel_measurable lborel" and eq: "integral\<^sup>L lborel f = r - q"
     unfolding ennreal_max_0 by auto
   then have "((\<lambda>x. max 0 (f x)) has_integral r) UNIV" "((\<lambda>x. max 0 (- f x)) has_integral q) UNIV"
     using nn_integral_has_integral[OF _ _ r] nn_integral_has_integral[OF _ _ q] by auto
   note has_integral_diff[OF this]
   moreover have "(\<lambda>x. max 0 (f x) - max 0 (- f x)) = f"
     by auto
   ultimately show ?thesis
     by (simp add: eq)
 qed
 
 lemma has_integral_AE:
   assumes ae: "AE x in lborel. x \<in> \<Omega> \<longrightarrow> f x = g x"
   shows "(f has_integral x) \<Omega> = (g has_integral x) \<Omega>"
 proof -
   from ae obtain N
     where N: "N \<in> sets borel" "emeasure lborel N = 0" "{x. \<not> (x \<in> \<Omega> \<longrightarrow> f x = g x)} \<subseteq> N"
     by (auto elim!: AE_E)
   then have not_N: "AE x in lborel. x \<notin> N"
     by (simp add: AE_iff_measurable)
   show ?thesis
   proof (rule has_integral_spike_eq[symmetric])
     show "\<And>x. x\<in>\<Omega> - N \<Longrightarrow> f x = g x" using N(3) by auto
     show "negligible N"
       unfolding negligible_def
     proof (intro allI)
       fix a b :: "'a"
       let ?F = "\<lambda>x::'a. if x \<in> cbox a b then indicator N x else 0 :: real"
       have "integrable lborel ?F = integrable lborel (\<lambda>x::'a. 0::real)"
         using not_N N(1) by (intro integrable_cong_AE) auto
       moreover have "(LINT x|lborel. ?F x) = (LINT x::'a|lborel. 0::real)"
         using not_N N(1) by (intro integral_cong_AE) auto
       ultimately have "(?F has_integral 0) UNIV"
         using has_integral_integral_real[of ?F] by simp
       then show "(indicator N has_integral (0::real)) (cbox a b)"
         unfolding has_integral_restrict_UNIV .
     qed
   qed
 qed
 
 lemma nn_integral_has_integral_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes nonneg: "\<And>x. 0 \<le> f x" and I: "(f has_integral I) \<Omega>"
   shows "integral\<^sup>N lborel (\<lambda>x. indicator \<Omega> x * f x) = I"
 proof -
   from I have "(\<lambda>x. indicator \<Omega> x *\<^sub>R f x) \<in> lebesgue \<rightarrow>\<^sub>M borel"
     by (rule has_integral_implies_lebesgue_measurable)
   then obtain f' :: "'a \<Rightarrow> real"
     where [measurable]: "f' \<in> borel \<rightarrow>\<^sub>M borel" and eq: "AE x in lborel. indicator \<Omega> x * f x = f' x"
     by (auto dest: completion_ex_borel_measurable_real)
 
   from I have "((\<lambda>x. abs (indicator \<Omega> x * f x)) has_integral I) UNIV"
-    using nonneg by (simp add: indicator_def if_distrib[of "\<lambda>x. x * f y" for y] cong: if_cong)
+    using nonneg by (simp add: indicator_def of_bool_def if_distrib[of "\<lambda>x. x * f y" for y] cong: if_cong)
   also have "((\<lambda>x. abs (indicator \<Omega> x * f x)) has_integral I) UNIV \<longleftrightarrow> ((\<lambda>x. abs (f' x)) has_integral I) UNIV"
     using eq by (intro has_integral_AE) auto
   finally have "integral\<^sup>N lborel (\<lambda>x. abs (f' x)) = I"
     by (rule nn_integral_has_integral_lborel[rotated 2]) auto
   also have "integral\<^sup>N lborel (\<lambda>x. abs (f' x)) = integral\<^sup>N lborel (\<lambda>x. abs (indicator \<Omega> x * f x))"
     using eq by (intro nn_integral_cong_AE) auto
   finally show ?thesis
     using nonneg by auto
 qed
 
 lemma has_integral_iff_nn_integral_lebesgue:
   assumes f: "\<And>x. 0 \<le> f x"
   shows "(f has_integral r) UNIV \<longleftrightarrow> (f \<in> lebesgue \<rightarrow>\<^sub>M borel \<and> integral\<^sup>N lebesgue f = r \<and> 0 \<le> r)" (is "?I = ?N")
 proof
   assume ?I
   have "0 \<le> r"
     using has_integral_nonneg[OF \<open>?I\<close>] f by auto
   then show ?N
     using nn_integral_has_integral_lebesgue[OF f \<open>?I\<close>]
       has_integral_implies_lebesgue_measurable[OF \<open>?I\<close>]
     by (auto simp: nn_integral_completion)
 next
   assume ?N
   then obtain f' where f': "f' \<in> borel \<rightarrow>\<^sub>M borel" "AE x in lborel. f x = f' x"
     by (auto dest: completion_ex_borel_measurable_real)
   moreover have "(\<integral>\<^sup>+ x. ennreal \<bar>f' x\<bar> \<partial>lborel) = (\<integral>\<^sup>+ x. ennreal \<bar>f x\<bar> \<partial>lborel)"
     using f' by (intro nn_integral_cong_AE) auto
   moreover have "((\<lambda>x. \<bar>f' x\<bar>) has_integral r) UNIV \<longleftrightarrow> ((\<lambda>x. \<bar>f x\<bar>) has_integral r) UNIV"
     using f' by (intro has_integral_AE) auto
   moreover note nn_integral_has_integral[of "\<lambda>x. \<bar>f' x\<bar>" r] \<open>?N\<close>
   ultimately show ?I
     using f by (auto simp: nn_integral_completion)
 qed
 
 context
   fixes f::"'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
 begin
 
 lemma has_integral_integral_lborel:
   assumes f: "integrable lborel f"
   shows "(f has_integral (integral\<^sup>L lborel f)) UNIV"
 proof -
   have "((\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) has_integral (\<Sum>b\<in>Basis. integral\<^sup>L lborel (\<lambda>x. f x \<bullet> b) *\<^sub>R b)) UNIV"
     using f by (intro has_integral_sum finite_Basis ballI has_integral_scaleR_left has_integral_integral_real) auto
   also have eq_f: "(\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) = f"
     by (simp add: fun_eq_iff euclidean_representation)
   also have "(\<Sum>b\<in>Basis. integral\<^sup>L lborel (\<lambda>x. f x \<bullet> b) *\<^sub>R b) = integral\<^sup>L lborel f"
     using f by (subst (2) eq_f[symmetric]) simp
   finally show ?thesis .
 qed
 
 lemma integrable_on_lborel: "integrable lborel f \<Longrightarrow> f integrable_on UNIV"
   using has_integral_integral_lborel by auto
 
 lemma integral_lborel: "integrable lborel f \<Longrightarrow> integral UNIV f = (\<integral>x. f x \<partial>lborel)"
   using has_integral_integral_lborel by auto
 
 end
 
 context
 begin
 
 private lemma has_integral_integral_lebesgue_real:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f: "integrable lebesgue f"
   shows "(f has_integral (integral\<^sup>L lebesgue f)) UNIV"
 proof -
   obtain f' where f': "f' \<in> borel \<rightarrow>\<^sub>M borel" "AE x in lborel. f x = f' x"
     using completion_ex_borel_measurable_real[OF borel_measurable_integrable[OF f]] by auto
   moreover have "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>lborel) = (\<integral>\<^sup>+ x. ennreal (norm (f' x)) \<partial>lborel)"
     using f' by (intro nn_integral_cong_AE) auto
   ultimately have "integrable lborel f'"
     using f by (auto simp: integrable_iff_bounded nn_integral_completion cong: nn_integral_cong_AE)
   note has_integral_integral_real[OF this]
   moreover have "integral\<^sup>L lebesgue f = integral\<^sup>L lebesgue f'"
     using f' f by (intro integral_cong_AE) (auto intro: AE_completion measurable_completion)
   moreover have "integral\<^sup>L lebesgue f' = integral\<^sup>L lborel f'"
     using f' by (simp add: integral_completion)
   moreover have "(f' has_integral integral\<^sup>L lborel f') UNIV \<longleftrightarrow> (f has_integral integral\<^sup>L lborel f') UNIV"
     using f' by (intro has_integral_AE) auto
   ultimately show ?thesis
     by auto
 qed
 
 lemma has_integral_integral_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "integrable lebesgue f"
   shows "(f has_integral (integral\<^sup>L lebesgue f)) UNIV"
 proof -
   have "((\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) has_integral (\<Sum>b\<in>Basis. integral\<^sup>L lebesgue (\<lambda>x. f x \<bullet> b) *\<^sub>R b)) UNIV"
     using f by (intro has_integral_sum finite_Basis ballI has_integral_scaleR_left has_integral_integral_lebesgue_real) auto
   also have eq_f: "(\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) = f"
     by (simp add: fun_eq_iff euclidean_representation)
   also have "(\<Sum>b\<in>Basis. integral\<^sup>L lebesgue (\<lambda>x. f x \<bullet> b) *\<^sub>R b) = integral\<^sup>L lebesgue f"
     using f by (subst (2) eq_f[symmetric]) simp
   finally show ?thesis .
 qed
 
 lemma has_integral_integral_lebesgue_on:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "integrable (lebesgue_on S) f" "S \<in> sets lebesgue"
   shows "(f has_integral (integral\<^sup>L (lebesgue_on S) f)) S"
 proof -
   let ?f = "\<lambda>x. if x \<in> S then f x else 0"
   have "integrable lebesgue (\<lambda>x. indicat_real S x *\<^sub>R f x)"
     using indicator_scaleR_eq_if [of S _ f] assms
   by (metis (full_types) integrable_restrict_space sets.Int_space_eq2)
   then have "integrable lebesgue ?f"
     using indicator_scaleR_eq_if [of S _ f] assms by auto
   then have "(?f has_integral (integral\<^sup>L lebesgue ?f)) UNIV"
     by (rule has_integral_integral_lebesgue)
   then have "(f has_integral (integral\<^sup>L lebesgue ?f)) S"
     using has_integral_restrict_UNIV by blast
   moreover
   have "S \<inter> space lebesgue \<in> sets lebesgue"
     by (simp add: assms)
   then have "(integral\<^sup>L lebesgue ?f) = (integral\<^sup>L (lebesgue_on S) f)"
     by (simp add: integral_restrict_space indicator_scaleR_eq_if)
   ultimately show ?thesis
     by auto
 qed
 
 lemma lebesgue_integral_eq_integral:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "integrable (lebesgue_on S) f" "S \<in> sets lebesgue"
   shows "integral\<^sup>L (lebesgue_on S) f = integral S f"
   by (metis has_integral_integral_lebesgue_on assms integral_unique)
 
 lemma integrable_on_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "integrable lebesgue f \<Longrightarrow> f integrable_on UNIV"
   using has_integral_integral_lebesgue by auto
 
 lemma integral_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "integrable lebesgue f \<Longrightarrow> integral UNIV f = (\<integral>x. f x \<partial>lebesgue)"
   using has_integral_integral_lebesgue by auto
 
 end
 
 subsection \<open>Absolute integrability (this is the same as Lebesgue integrability)\<close>
 
 translations
 "LBINT x. f" == "CONST lebesgue_integral CONST lborel (\<lambda>x. f)"
 
 translations
 "LBINT x:A. f" == "CONST set_lebesgue_integral CONST lborel A (\<lambda>x. f)"
 
 lemma set_integral_reflect:
   fixes S and f :: "real \<Rightarrow> 'a :: {banach, second_countable_topology}"
   shows "(LBINT x : S. f x) = (LBINT x : {x. - x \<in> S}. f (- x))"
   unfolding set_lebesgue_integral_def
   by (subst lborel_integral_real_affine[where c="-1" and t=0])
      (auto intro!: Bochner_Integration.integral_cong split: split_indicator)
 
 lemma borel_integrable_atLeastAtMost':
   fixes f :: "real \<Rightarrow> 'a::{banach, second_countable_topology}"
   assumes f: "continuous_on {a..b} f"
   shows "set_integrable lborel {a..b} f"
   unfolding set_integrable_def
   by (intro borel_integrable_compact compact_Icc f)
 
 lemma integral_FTC_atLeastAtMost:
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space"
   assumes "a \<le> b"
     and F: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> (F has_vector_derivative f x) (at x within {a .. b})"
     and f: "continuous_on {a .. b} f"
   shows "integral\<^sup>L lborel (\<lambda>x. indicator {a .. b} x *\<^sub>R f x) = F b - F a"
 proof -
   let ?f = "\<lambda>x. indicator {a .. b} x *\<^sub>R f x"
   have "(?f has_integral (\<integral>x. ?f x \<partial>lborel)) UNIV"
     using borel_integrable_atLeastAtMost'[OF f]
     unfolding set_integrable_def by (rule has_integral_integral_lborel)
   moreover
   have "(f has_integral F b - F a) {a .. b}"
     by (intro fundamental_theorem_of_calculus ballI assms) auto
   then have "(?f has_integral F b - F a) {a .. b}"
     by (subst has_integral_cong[where g=f]) auto
   then have "(?f has_integral F b - F a) UNIV"
     by (intro has_integral_on_superset[where T=UNIV and S="{a..b}"]) auto
   ultimately show "integral\<^sup>L lborel ?f = F b - F a"
     by (rule has_integral_unique)
 qed
 
 lemma set_borel_integral_eq_integral:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "set_integrable lborel S f"
   shows "f integrable_on S" "LINT x : S | lborel. f x = integral S f"
 proof -
   let ?f = "\<lambda>x. indicator S x *\<^sub>R f x"
   have "(?f has_integral LINT x : S | lborel. f x) UNIV"
     using assms has_integral_integral_lborel
     unfolding set_integrable_def set_lebesgue_integral_def by blast
   hence 1: "(f has_integral (set_lebesgue_integral lborel S f)) S"
     by (simp add: indicator_scaleR_eq_if)
   thus "f integrable_on S"
     by (auto simp add: integrable_on_def)
   with 1 have "(f has_integral (integral S f)) S"
     by (intro integrable_integral, auto simp add: integrable_on_def)
   thus "LINT x : S | lborel. f x = integral S f"
     by (intro has_integral_unique [OF 1])
 qed
 
 lemma has_integral_set_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "set_integrable lebesgue S f"
   shows "(f has_integral (LINT x:S|lebesgue. f x)) S"
   using has_integral_integral_lebesgue f
-  by (fastforce simp add: set_integrable_def set_lebesgue_integral_def indicator_def if_distrib[of "\<lambda>x. x *\<^sub>R f _"] cong: if_cong)
+  by (fastforce simp add: set_integrable_def set_lebesgue_integral_def indicator_def
+    of_bool_def if_distrib[of "\<lambda>x. x *\<^sub>R f _"] cong: if_cong)
 
 lemma set_lebesgue_integral_eq_integral:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "set_integrable lebesgue S f"
   shows "f integrable_on S" "LINT x:S | lebesgue. f x = integral S f"
   using has_integral_set_lebesgue[OF f] by (auto simp: integral_unique integrable_on_def)
 
 lemma lmeasurable_iff_has_integral:
   "S \<in> lmeasurable \<longleftrightarrow> ((indicator S) has_integral measure lebesgue S) UNIV"
   by (subst has_integral_iff_nn_integral_lebesgue)
      (auto simp: ennreal_indicator emeasure_eq_measure2 borel_measurable_indicator_iff intro!: fmeasurableI)
 
 abbreviation
   absolutely_integrable_on :: "('a::euclidean_space \<Rightarrow> 'b::{banach, second_countable_topology}) \<Rightarrow> 'a set \<Rightarrow> bool"
   (infixr "absolutely'_integrable'_on" 46)
   where "f absolutely_integrable_on s \<equiv> set_integrable lebesgue s f"
 
 
 lemma absolutely_integrable_zero [simp]: "(\<lambda>x. 0) absolutely_integrable_on S"
     by (simp add: set_integrable_def)
 
 lemma absolutely_integrable_on_def:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f absolutely_integrable_on S \<longleftrightarrow> f integrable_on S \<and> (\<lambda>x. norm (f x)) integrable_on S"
 proof safe
   assume f: "f absolutely_integrable_on S"
   then have nf: "integrable lebesgue (\<lambda>x. norm (indicator S x *\<^sub>R f x))"
     using integrable_norm set_integrable_def by blast
   show "f integrable_on S"
     by (rule set_lebesgue_integral_eq_integral[OF f])
   have "(\<lambda>x. norm (indicator S x *\<^sub>R f x)) = (\<lambda>x. if x \<in> S then norm (f x) else 0)"
     by auto
   with integrable_on_lebesgue[OF nf] show "(\<lambda>x. norm (f x)) integrable_on S"
     by (simp add: integrable_restrict_UNIV)
 next
   assume f: "f integrable_on S" and nf: "(\<lambda>x. norm (f x)) integrable_on S"
   show "f absolutely_integrable_on S"
     unfolding set_integrable_def
   proof (rule integrableI_bounded)
     show "(\<lambda>x. indicator S x *\<^sub>R f x) \<in> borel_measurable lebesgue"
       using f has_integral_implies_lebesgue_measurable[of f _ S] by (auto simp: integrable_on_def)
     show "(\<integral>\<^sup>+ x. ennreal (norm (indicator S x *\<^sub>R f x)) \<partial>lebesgue) < \<infinity>"
       using nf nn_integral_has_integral_lebesgue[of "\<lambda>x. norm (f x)" _ S]
       by (auto simp: integrable_on_def nn_integral_completion)
   qed
 qed
 
 lemma integrable_on_lebesgue_on:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "integrable (lebesgue_on S) f" and S: "S \<in> sets lebesgue"
   shows "f integrable_on S"
 proof -
   have "integrable lebesgue (\<lambda>x. indicator S x *\<^sub>R f x)"
     using S f inf_top.comm_neutral integrable_restrict_space by blast
   then show ?thesis
     using absolutely_integrable_on_def set_integrable_def by blast
 qed
 
 lemma absolutely_integrable_imp_integrable:
   assumes "f absolutely_integrable_on S" "S \<in> sets lebesgue"
   shows "integrable (lebesgue_on S) f"
   by (meson assms integrable_restrict_space set_integrable_def sets.Int sets.top)
 
 lemma absolutely_integrable_on_null [intro]:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "content (cbox a b) = 0 \<Longrightarrow> f absolutely_integrable_on (cbox a b)"
   by (auto simp: absolutely_integrable_on_def)
 
 lemma absolutely_integrable_on_open_interval:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "f absolutely_integrable_on box a b \<longleftrightarrow>
          f absolutely_integrable_on cbox a b"
   by (auto simp: integrable_on_open_interval absolutely_integrable_on_def)
 
 lemma absolutely_integrable_restrict_UNIV:
   "(\<lambda>x. if x \<in> S then f x else 0) absolutely_integrable_on UNIV \<longleftrightarrow> f absolutely_integrable_on S"
     unfolding set_integrable_def
   by (intro arg_cong2[where f=integrable]) auto
 
 lemma absolutely_integrable_onI:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f integrable_on S \<Longrightarrow> (\<lambda>x. norm (f x)) integrable_on S \<Longrightarrow> f absolutely_integrable_on S"
   unfolding absolutely_integrable_on_def by auto
 
 lemma nonnegative_absolutely_integrable_1:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes f: "f integrable_on A" and "\<And>x. x \<in> A \<Longrightarrow> 0 \<le> f x"
   shows "f absolutely_integrable_on A"
   by (rule absolutely_integrable_onI [OF f]) (use assms in \<open>simp add: integrable_eq\<close>)
 
 lemma absolutely_integrable_on_iff_nonneg:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f x" shows "f absolutely_integrable_on S \<longleftrightarrow> f integrable_on S"
 proof -
   { assume "f integrable_on S"
     then have "(\<lambda>x. if x \<in> S then f x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have "(\<lambda>x. if x \<in> S then f x else 0) absolutely_integrable_on UNIV"
       using \<open>f integrable_on S\<close> absolutely_integrable_restrict_UNIV assms nonnegative_absolutely_integrable_1 by blast
     then have "f absolutely_integrable_on S"
       using absolutely_integrable_restrict_UNIV by blast
   }
   then show ?thesis
     unfolding absolutely_integrable_on_def by auto
 qed
 
 lemma absolutely_integrable_on_scaleR_iff:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows
    "(\<lambda>x. c *\<^sub>R f x) absolutely_integrable_on S \<longleftrightarrow>
       c = 0 \<or> f absolutely_integrable_on S"
 proof (cases "c=0")
   case False
   then show ?thesis
   unfolding absolutely_integrable_on_def
   by (simp add: norm_mult)
 qed auto
 
 lemma absolutely_integrable_spike:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f absolutely_integrable_on T" and S: "negligible S" "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "g absolutely_integrable_on T"
   using assms integrable_spike
   unfolding absolutely_integrable_on_def by metis
 
 lemma absolutely_integrable_negligible:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "negligible S"
   shows "f absolutely_integrable_on S"
   using assms by (simp add: absolutely_integrable_on_def integrable_negligible)
 
 lemma absolutely_integrable_spike_eq:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "negligible S" "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "(f absolutely_integrable_on T \<longleftrightarrow> g absolutely_integrable_on T)"
   using assms by (blast intro: absolutely_integrable_spike sym)
 
 lemma absolutely_integrable_spike_set_eq:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "(f absolutely_integrable_on S \<longleftrightarrow> f absolutely_integrable_on T)"
 proof -
   have "(\<lambda>x. if x \<in> S then f x else 0) absolutely_integrable_on UNIV \<longleftrightarrow>
         (\<lambda>x. if x \<in> T then f x else 0) absolutely_integrable_on UNIV"
   proof (rule absolutely_integrable_spike_eq)
     show "negligible ({x \<in> S - T. f x \<noteq> 0} \<union> {x \<in> T - S. f x \<noteq> 0})"
       by (rule negligible_Un [OF assms])
   qed auto
   with absolutely_integrable_restrict_UNIV show ?thesis
     by blast
 qed
 
 lemma absolutely_integrable_spike_set:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f absolutely_integrable_on S" and neg: "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "f absolutely_integrable_on T"
   using absolutely_integrable_spike_set_eq f neg by blast
 
 lemma absolutely_integrable_reflect[simp]:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "(\<lambda>x. f(-x)) absolutely_integrable_on cbox (-b) (-a) \<longleftrightarrow> f absolutely_integrable_on cbox a b"
   unfolding absolutely_integrable_on_def
   by (metis (mono_tags, lifting) integrable_eq integrable_reflect)
 
 lemma absolutely_integrable_reflect_real[simp]:
   fixes f :: "real \<Rightarrow> 'b::euclidean_space"
   shows "(\<lambda>x. f(-x)) absolutely_integrable_on {-b .. -a} \<longleftrightarrow> f absolutely_integrable_on {a..b::real}"
   unfolding box_real[symmetric] by (rule absolutely_integrable_reflect)
 
 lemma absolutely_integrable_on_subcbox:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "\<lbrakk>f absolutely_integrable_on S; cbox a b \<subseteq> S\<rbrakk> \<Longrightarrow> f absolutely_integrable_on cbox a b"
   by (meson absolutely_integrable_on_def integrable_on_subcbox)
 
 lemma absolutely_integrable_on_subinterval:
   fixes f :: "real \<Rightarrow> 'b::euclidean_space"
   shows "\<lbrakk>f absolutely_integrable_on S; {a..b} \<subseteq> S\<rbrakk> \<Longrightarrow> f absolutely_integrable_on {a..b}"
   using absolutely_integrable_on_subcbox by fastforce
 
 lemma integrable_subinterval:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "integrable (lebesgue_on {a..b}) f"
     and "{c..d} \<subseteq> {a..b}"
   shows "integrable (lebesgue_on {c..d}) f"
 proof (rule absolutely_integrable_imp_integrable)
   show "f absolutely_integrable_on {c..d}"
   proof -
     have "f integrable_on {c..d}"
       using assms integrable_on_lebesgue_on integrable_on_subinterval by fastforce
     moreover have "(\<lambda>x. norm (f x)) integrable_on {c..d}"
     proof (rule integrable_on_subinterval)
       show "(\<lambda>x. norm (f x)) integrable_on {a..b}"
         by (simp add: assms integrable_on_lebesgue_on)
     qed (use assms in auto)
     ultimately show ?thesis
       by (auto simp: absolutely_integrable_on_def)
   qed
 qed auto
 
 lemma indefinite_integral_continuous_real:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "integrable (lebesgue_on {a..b}) f"
   shows "continuous_on {a..b} (\<lambda>x. integral\<^sup>L (lebesgue_on {a..x}) f)"
 proof -
   have "f integrable_on {a..b}"
     by (simp add: assms integrable_on_lebesgue_on)
   then have "continuous_on {a..b} (\<lambda>x. integral {a..x} f)"
     using indefinite_integral_continuous_1 by blast
   moreover have "integral\<^sup>L (lebesgue_on {a..x}) f = integral {a..x} f" if "a \<le> x" "x \<le> b" for x
   proof -
     have "{a..x} \<subseteq> {a..b}"
       using that by auto
     then have "integrable (lebesgue_on {a..x}) f"
       using integrable_subinterval assms by blast
     then show "integral\<^sup>L (lebesgue_on {a..x}) f = integral {a..x} f"
       by (simp add: lebesgue_integral_eq_integral)
   qed
   ultimately show ?thesis
     by (metis (no_types, lifting) atLeastAtMost_iff continuous_on_cong)
 qed
 
 lemma lmeasurable_iff_integrable_on: "S \<in> lmeasurable \<longleftrightarrow> (\<lambda>x. 1::real) integrable_on S"
   by (subst absolutely_integrable_on_iff_nonneg[symmetric])
      (simp_all add: lmeasurable_iff_integrable set_integrable_def)
 
 lemma lmeasure_integral_UNIV: "S \<in> lmeasurable \<Longrightarrow> measure lebesgue S = integral UNIV (indicator S)"
   by (simp add: lmeasurable_iff_has_integral integral_unique)
 
 lemma lmeasure_integral: "S \<in> lmeasurable \<Longrightarrow> measure lebesgue S = integral S (\<lambda>x. 1::real)"
-  by (fastforce simp add: lmeasure_integral_UNIV indicator_def[abs_def] lmeasurable_iff_integrable_on)
+  by (fastforce simp add: lmeasure_integral_UNIV indicator_def [abs_def] of_bool_def lmeasurable_iff_integrable_on)
 
 lemma integrable_on_const: "S \<in> lmeasurable \<Longrightarrow> (\<lambda>x. c) integrable_on S"
   unfolding lmeasurable_iff_integrable
   by (metis (mono_tags, lifting) integrable_eq integrable_on_scaleR_left lmeasurable_iff_integrable lmeasurable_iff_integrable_on scaleR_one)
 
 lemma integral_indicator:
   assumes "(S \<inter> T) \<in> lmeasurable"
   shows "integral T (indicator S) = measure lebesgue (S \<inter> T)"
 proof -
   have "integral UNIV (indicator (S \<inter> T)) = integral UNIV (\<lambda>a. if a \<in> S \<inter> T then 1::real else 0)"
-    by (meson indicator_def)
+    by (simp add: indicator_def [abs_def] of_bool_def)
   moreover have "(indicator (S \<inter> T) has_integral measure lebesgue (S \<inter> T)) UNIV"
     using assms by (simp add: lmeasurable_iff_has_integral)
   ultimately have "integral UNIV (\<lambda>x. if x \<in> S \<inter> T then 1 else 0) = measure lebesgue (S \<inter> T)"
     by (metis (no_types) integral_unique)
   moreover have "integral T (\<lambda>a. if a \<in> S then 1::real else 0) = integral (S \<inter> T \<inter> UNIV) (\<lambda>a. 1)"
     by (simp add: Henstock_Kurzweil_Integration.integral_restrict_Int)
   moreover have "integral T (indicat_real S) = integral T (\<lambda>a. if a \<in> S then 1 else 0)"
-    by (meson indicator_def)
+    by (simp add: indicator_def [abs_def] of_bool_def)
   ultimately show ?thesis
     by (simp add: assms lmeasure_integral)
 qed
 
 lemma measurable_integrable:
   fixes S :: "'a::euclidean_space set"
   shows "S \<in> lmeasurable \<longleftrightarrow> (indicat_real S) integrable_on UNIV"
   by (auto simp: lmeasurable_iff_integrable absolutely_integrable_on_iff_nonneg [symmetric] set_integrable_def)
 
 lemma integrable_on_indicator:
   fixes S :: "'a::euclidean_space set"
   shows "indicat_real S integrable_on T \<longleftrightarrow> (S \<inter> T) \<in> lmeasurable"
   unfolding measurable_integrable
   unfolding integrable_restrict_UNIV [of T, symmetric]
   by (fastforce simp add: indicator_def elim: integrable_eq)
 
 lemma
   assumes \<D>: "\<D> division_of S"
   shows lmeasurable_division: "S \<in> lmeasurable" (is ?l)
     and content_division: "(\<Sum>k\<in>\<D>. measure lebesgue k) = measure lebesgue S" (is ?m)
 proof -
   { fix d1 d2 assume *: "d1 \<in> \<D>" "d2 \<in> \<D>" "d1 \<noteq> d2"
     then obtain a b c d where "d1 = cbox a b" "d2 = cbox c d"
       using division_ofD(4)[OF \<D>] by blast
     with division_ofD(5)[OF \<D> *]
     have "d1 \<in> sets lborel" "d2 \<in> sets lborel" "d1 \<inter> d2 \<subseteq> (cbox a b - box a b) \<union> (cbox c d - box c d)"
       by auto
     moreover have "(cbox a b - box a b) \<union> (cbox c d - box c d) \<in> null_sets lborel"
       by (intro null_sets.Un null_sets_cbox_Diff_box)
     ultimately have "d1 \<inter> d2 \<in> null_sets lborel"
       by (blast intro: null_sets_subset) }
   then show ?l ?m
     unfolding division_ofD(6)[OF \<D>, symmetric]
     using division_ofD(1,4)[OF \<D>]
     by (auto intro!: measure_Union_AE[symmetric] simp: completion.AE_iff_null_sets Int_def[symmetric] pairwise_def null_sets_def)
 qed
 
 lemma has_measure_limit:
   assumes "S \<in> lmeasurable" "e > 0"
   obtains B where "B > 0"
     "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> \<bar>measure lebesgue (S \<inter> cbox a b) - measure lebesgue S\<bar> < e"
   using assms unfolding lmeasurable_iff_has_integral has_integral_alt'
   by (force simp: integral_indicator integrable_on_indicator)
 
 lemma lmeasurable_iff_indicator_has_integral:
   fixes S :: "'a::euclidean_space set"
   shows "S \<in> lmeasurable \<and> m = measure lebesgue S \<longleftrightarrow> (indicat_real S has_integral m) UNIV"
   by (metis has_integral_iff lmeasurable_iff_has_integral measurable_integrable)
 
 lemma has_measure_limit_iff:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "S \<in> lmeasurable \<and> m = measure lebesgue S \<longleftrightarrow>
           (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
             (S \<inter> cbox a b) \<in> lmeasurable \<and> \<bar>measure lebesgue (S \<inter> cbox a b) - m\<bar> < e)" (is "?lhs = ?rhs")
 proof
   assume ?lhs then show ?rhs
     by (meson has_measure_limit fmeasurable.Int lmeasurable_cbox)
 next
   assume RHS [rule_format]: ?rhs
   then show ?lhs
     apply (simp add: lmeasurable_iff_indicator_has_integral has_integral' [where i=m])
     by (metis (full_types) integral_indicator integrable_integral integrable_on_indicator)
 qed
 
 subsection\<open>Applications to Negligibility\<close>
 
 lemma negligible_iff_null_sets: "negligible S \<longleftrightarrow> S \<in> null_sets lebesgue"
 proof
   assume "negligible S"
   then have "(indicator S has_integral (0::real)) UNIV"
     by (auto simp: negligible)
   then show "S \<in> null_sets lebesgue"
     by (subst (asm) has_integral_iff_nn_integral_lebesgue)
         (auto simp: borel_measurable_indicator_iff nn_integral_0_iff_AE AE_iff_null_sets indicator_eq_0_iff)
 next
   assume S: "S \<in> null_sets lebesgue"
   show "negligible S"
     unfolding negligible_def
   proof (safe intro!: has_integral_iff_nn_integral_lebesgue[THEN iffD2]
                       has_integral_restrict_UNIV[where s="cbox _ _", THEN iffD1])
     fix a b
     show "(\<lambda>x. if x \<in> cbox a b then indicator S x else 0) \<in> lebesgue \<rightarrow>\<^sub>M borel"
       using S by (auto intro!: measurable_If)
     then show "(\<integral>\<^sup>+ x. ennreal (if x \<in> cbox a b then indicator S x else 0) \<partial>lebesgue) = ennreal 0"
       using S[THEN AE_not_in] by (auto intro!: nn_integral_0_iff_AE[THEN iffD2])
   qed auto
 qed
 
 corollary eventually_ae_filter_negligible:
   "eventually P (ae_filter lebesgue) \<longleftrightarrow> (\<exists>N. negligible N \<and> {x. \<not> P x} \<subseteq> N)"
   by (auto simp: completion.AE_iff_null_sets negligible_iff_null_sets null_sets_completion_subset)
 
 lemma starlike_negligible:
   assumes "closed S"
       and eq1: "\<And>c x. (a + c *\<^sub>R x) \<in> S \<Longrightarrow> 0 \<le> c \<Longrightarrow> a + x \<in> S \<Longrightarrow> c = 1"
     shows "negligible S"
 proof -
   have "negligible ((+) (-a) ` S)"
   proof (subst negligible_on_intervals, intro allI)
     fix u v
     show "negligible ((+) (- a) ` S \<inter> cbox u v)"
       using \<open>closed S\<close> eq1 by (auto simp add: negligible_iff_null_sets algebra_simps
         intro!: closed_translation_subtract starlike_negligible_compact cong: image_cong_simp)
         (metis add_diff_eq diff_add_cancel scale_right_diff_distrib)
   qed
   then show ?thesis
     by (rule negligible_translation_rev)
 qed
 
 lemma starlike_negligible_strong:
   assumes "closed S"
       and star: "\<And>c x. \<lbrakk>0 \<le> c; c < 1; a+x \<in> S\<rbrakk> \<Longrightarrow> a + c *\<^sub>R x \<notin> S"
     shows "negligible S"
 proof -
   show ?thesis
   proof (rule starlike_negligible [OF \<open>closed S\<close>, of a])
     fix c x
     assume cx: "a + c *\<^sub>R x \<in> S" "0 \<le> c" "a + x \<in> S"
     with star have "\<not> (c < 1)" by auto
     moreover have "\<not> (c > 1)"
       using star [of "1/c" "c *\<^sub>R x"] cx by force
     ultimately show "c = 1" by arith
   qed
 qed
 
 lemma negligible_hyperplane:
   assumes "a \<noteq> 0 \<or> b \<noteq> 0" shows "negligible {x. a \<bullet> x = b}"
 proof -
   obtain x where x: "a \<bullet> x \<noteq> b"
     using assms by (metis euclidean_all_zero_iff inner_zero_right)
   moreover have "c = 1" if "a \<bullet> (x + c *\<^sub>R w) = b" "a \<bullet> (x + w) = b" for c w
     using that
     by (metis (no_types, hide_lams) add_diff_eq diff_0 diff_minus_eq_add inner_diff_right inner_scaleR_right mult_cancel_right2 right_minus_eq x)
   ultimately
   show ?thesis
     using starlike_negligible [OF closed_hyperplane, of x] by simp
 qed
 
 lemma negligible_lowdim:
   fixes S :: "'N :: euclidean_space set"
   assumes "dim S < DIM('N)"
     shows "negligible S"
 proof -
   obtain a where "a \<noteq> 0" and a: "span S \<subseteq> {x. a \<bullet> x = 0}"
     using lowdim_subset_hyperplane [OF assms] by blast
   have "negligible (span S)"
     using \<open>a \<noteq> 0\<close> a negligible_hyperplane by (blast intro: negligible_subset)
   then show ?thesis
     using span_base by (blast intro: negligible_subset)
 qed
 
 proposition negligible_convex_frontier:
   fixes S :: "'N :: euclidean_space set"
   assumes "convex S"
     shows "negligible(frontier S)"
 proof -
   have nf: "negligible(frontier S)" if "convex S" "0 \<in> S" for S :: "'N set"
   proof -
     obtain B where "B \<subseteq> S" and indB: "independent B"
                and spanB: "S \<subseteq> span B" and cardB: "card B = dim S"
       by (metis basis_exists)
     consider "dim S < DIM('N)" | "dim S = DIM('N)"
       using dim_subset_UNIV le_eq_less_or_eq by auto
     then show ?thesis
     proof cases
       case 1
       show ?thesis
         by (rule negligible_subset [of "closure S"])
            (simp_all add: frontier_def negligible_lowdim 1)
     next
       case 2
       obtain a where "a \<in> interior (convex hull insert 0 B)"
       proof (rule interior_simplex_nonempty [OF indB])
         show "finite B"
           by (simp add: indB independent_finite)
         show "card B = DIM('N)"
           by (simp add: cardB 2)
       qed
       then have a: "a \<in> interior S"
         by (metis \<open>B \<subseteq> S\<close> \<open>0 \<in> S\<close> \<open>convex S\<close> insert_absorb insert_subset interior_mono subset_hull)
       show ?thesis
       proof (rule starlike_negligible_strong [where a=a])
         fix c::real and x
         have eq: "a + c *\<^sub>R x = (a + x) - (1 - c) *\<^sub>R ((a + x) - a)"
           by (simp add: algebra_simps)
         assume "0 \<le> c" "c < 1" "a + x \<in> frontier S"
         then show "a + c *\<^sub>R x \<notin> frontier S"
           using eq mem_interior_closure_convex_shrink [OF \<open>convex S\<close> a, of _ "1-c"]
           unfolding frontier_def
           by (metis Diff_iff add_diff_cancel_left' add_diff_eq diff_gt_0_iff_gt group_cancel.rule0 not_le)
       qed auto
     qed
   qed
   show ?thesis
   proof (cases "S = {}")
     case True then show ?thesis by auto
   next
     case False
     then obtain a where "a \<in> S" by auto
     show ?thesis
       using nf [of "(\<lambda>x. -a + x) ` S"]
       by (metis \<open>a \<in> S\<close> add.left_inverse assms convex_translation_eq frontier_translation
                 image_eqI negligible_translation_rev)
   qed
 qed
 
 corollary negligible_sphere: "negligible (sphere a e)"
   using frontier_cball negligible_convex_frontier convex_cball
   by (blast intro: negligible_subset)
 
 lemma non_negligible_UNIV [simp]: "\<not> negligible UNIV"
   unfolding negligible_iff_null_sets by (auto simp: null_sets_def)
 
 lemma negligible_interval:
   "negligible (cbox a b) \<longleftrightarrow> box a b = {}" "negligible (box a b) \<longleftrightarrow> box a b = {}"
    by (auto simp: negligible_iff_null_sets null_sets_def prod_nonneg inner_diff_left box_eq_empty
                   not_le emeasure_lborel_cbox_eq emeasure_lborel_box_eq
             intro: eq_refl antisym less_imp_le)
 
 proposition open_not_negligible:
   assumes "open S" "S \<noteq> {}"
   shows "\<not> negligible S"
 proof
   assume neg: "negligible S"
   obtain a where "a \<in> S"
     using \<open>S \<noteq> {}\<close> by blast
   then obtain e where "e > 0" "cball a e \<subseteq> S"
     using \<open>open S\<close> open_contains_cball_eq by blast
   let ?p = "a - (e / DIM('a)) *\<^sub>R One" let ?q = "a + (e / DIM('a)) *\<^sub>R One"
   have "cbox ?p ?q \<subseteq> cball a e"
   proof (clarsimp simp: mem_box dist_norm)
     fix x
     assume "\<forall>i\<in>Basis. ?p \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> ?q \<bullet> i"
     then have ax: "\<bar>(a - x) \<bullet> i\<bar> \<le> e / real DIM('a)" if "i \<in> Basis" for i
       using that by (auto simp: algebra_simps)
     have "norm (a - x) \<le> (\<Sum>i\<in>Basis. \<bar>(a - x) \<bullet> i\<bar>)"
       by (rule norm_le_l1)
     also have "\<dots> \<le> DIM('a) * (e / real DIM('a))"
       by (intro sum_bounded_above ax)
     also have "\<dots> = e"
       by simp
     finally show "norm (a - x) \<le> e" .
   qed
   then have "negligible (cbox ?p ?q)"
     by (meson \<open>cball a e \<subseteq> S\<close> neg negligible_subset)
   with \<open>e > 0\<close> show False
     by (simp add: negligible_interval box_eq_empty algebra_simps field_split_simps mult_le_0_iff)
 qed
 
 lemma negligible_convex_interior:
    "convex S \<Longrightarrow> (negligible S \<longleftrightarrow> interior S = {})"
   by (metis Diff_empty closure_subset frontier_def interior_subset negligible_convex_frontier negligible_subset open_interior open_not_negligible)
 
 lemma measure_eq_0_null_sets: "S \<in> null_sets M \<Longrightarrow> measure M S = 0"
   by (auto simp: measure_def null_sets_def)
 
 lemma negligible_imp_measure0: "negligible S \<Longrightarrow> measure lebesgue S = 0"
   by (simp add: measure_eq_0_null_sets negligible_iff_null_sets)
 
 lemma negligible_iff_emeasure0: "S \<in> sets lebesgue \<Longrightarrow> (negligible S \<longleftrightarrow> emeasure lebesgue S = 0)"
   by (auto simp: measure_eq_0_null_sets negligible_iff_null_sets)
 
 lemma negligible_iff_measure0: "S \<in> lmeasurable \<Longrightarrow> (negligible S \<longleftrightarrow> measure lebesgue S = 0)"
   by (metis (full_types) completion.null_sets_outer negligible_iff_null_sets negligible_imp_measure0 order_refl)
 
 lemma negligible_imp_sets: "negligible S \<Longrightarrow> S \<in> sets lebesgue"
   by (simp add: negligible_iff_null_sets null_setsD2)
 
 lemma negligible_imp_measurable: "negligible S \<Longrightarrow> S \<in> lmeasurable"
   by (simp add: fmeasurableI_null_sets negligible_iff_null_sets)
 
 lemma negligible_iff_measure: "negligible S \<longleftrightarrow> S \<in> lmeasurable \<and> measure lebesgue S = 0"
   by (fastforce simp: negligible_iff_measure0 negligible_imp_measurable dest: negligible_imp_measure0)
 
 lemma negligible_outer:
   "negligible S \<longleftrightarrow> (\<forall>e>0. \<exists>T. S \<subseteq> T \<and> T \<in> lmeasurable \<and> measure lebesgue T < e)" (is "_ = ?rhs")
 proof
   assume "negligible S" then show ?rhs
     by (metis negligible_iff_measure order_refl)
 next
   assume ?rhs then show "negligible S"
   by (meson completion.null_sets_outer negligible_iff_null_sets)
 qed
 
 lemma negligible_outer_le:
      "negligible S \<longleftrightarrow> (\<forall>e>0. \<exists>T. S \<subseteq> T \<and> T \<in> lmeasurable \<and> measure lebesgue T \<le> e)" (is "_ = ?rhs")
 proof
   assume "negligible S" then show ?rhs
     by (metis dual_order.strict_implies_order negligible_imp_measurable negligible_imp_measure0 order_refl)
 next
   assume ?rhs then show "negligible S"
     by (metis le_less_trans negligible_outer field_lbound_gt_zero)
 qed
 
 lemma negligible_UNIV: "negligible S \<longleftrightarrow> (indicat_real S has_integral 0) UNIV" (is "_=?rhs")
   by (metis lmeasurable_iff_indicator_has_integral negligible_iff_measure)
 
 lemma sets_negligible_symdiff:
    "\<lbrakk>S \<in> sets lebesgue; negligible((S - T) \<union> (T - S))\<rbrakk> \<Longrightarrow> T \<in> sets lebesgue"
   by (metis Diff_Diff_Int Int_Diff_Un inf_commute negligible_Un_eq negligible_imp_sets sets.Diff sets.Un)
 
 lemma lmeasurable_negligible_symdiff:
    "\<lbrakk>S \<in> lmeasurable; negligible((S - T) \<union> (T - S))\<rbrakk> \<Longrightarrow> T \<in> lmeasurable"
   using integrable_spike_set_eq lmeasurable_iff_integrable_on by blast
 
 
 lemma measure_Un3_negligible:
   assumes meas: "S \<in> lmeasurable" "T \<in> lmeasurable" "U \<in> lmeasurable"
   and neg: "negligible(S \<inter> T)" "negligible(S \<inter> U)" "negligible(T \<inter> U)" and V: "S \<union> T \<union> U = V"
 shows "measure lebesgue V = measure lebesgue S + measure lebesgue T + measure lebesgue U"
 proof -
   have [simp]: "measure lebesgue (S \<inter> T) = 0"
     using neg(1) negligible_imp_measure0 by blast
   have [simp]: "measure lebesgue (S \<inter> U \<union> T \<inter> U) = 0"
     using neg(2) neg(3) negligible_Un negligible_imp_measure0 by blast
   have "measure lebesgue V = measure lebesgue (S \<union> T \<union> U)"
     using V by simp
   also have "\<dots> = measure lebesgue S + measure lebesgue T + measure lebesgue U"
     by (simp add: measure_Un3 meas fmeasurable.Un Int_Un_distrib2)
   finally show ?thesis .
 qed
 
 lemma measure_translate_add:
   assumes meas: "S \<in> lmeasurable" "T \<in> lmeasurable"
     and U: "S \<union> ((+)a ` T) = U" and neg: "negligible(S \<inter> ((+)a ` T))"
   shows "measure lebesgue S + measure lebesgue T = measure lebesgue U"
 proof -
   have [simp]: "measure lebesgue (S \<inter> (+) a ` T) = 0"
     using neg negligible_imp_measure0 by blast
   have "measure lebesgue (S \<union> ((+)a ` T)) = measure lebesgue S + measure lebesgue T"
     by (simp add: measure_Un3 meas measurable_translation measure_translation fmeasurable.Un)
   then show ?thesis
     using U by auto
 qed
 
 lemma measure_negligible_symdiff:
   assumes S: "S \<in> lmeasurable"
     and neg: "negligible (S - T \<union> (T - S))"
   shows "measure lebesgue T = measure lebesgue S"
 proof -
   have "measure lebesgue (S - T) = 0"
     using neg negligible_Un_eq negligible_imp_measure0 by blast
   then show ?thesis
     by (metis S Un_commute add.right_neutral lmeasurable_negligible_symdiff measure_Un2 neg negligible_Un_eq negligible_imp_measure0)
 qed
 
 lemma measure_closure:
   assumes "bounded S" and neg: "negligible (frontier S)"
   shows "measure lebesgue (closure S) = measure lebesgue S"
 proof -
   have "measure lebesgue (frontier S) = 0"
     by (metis neg negligible_imp_measure0)
   then show ?thesis
     by (metis assms lmeasurable_iff_integrable_on eq_iff_diff_eq_0 has_integral_interior integrable_on_def integral_unique lmeasurable_interior lmeasure_integral measure_frontier)
 qed
 
 lemma measure_interior:
    "\<lbrakk>bounded S; negligible(frontier S)\<rbrakk> \<Longrightarrow> measure lebesgue (interior S) = measure lebesgue S"
   using measure_closure measure_frontier negligible_imp_measure0 by fastforce
 
 lemma measurable_Jordan:
   assumes "bounded S" and neg: "negligible (frontier S)"
   shows "S \<in> lmeasurable"
 proof -
   have "closure S \<in> lmeasurable"
     by (metis lmeasurable_closure \<open>bounded S\<close>)
   moreover have "interior S \<in> lmeasurable"
     by (simp add: lmeasurable_interior \<open>bounded S\<close>)
   moreover have "interior S \<subseteq> S"
     by (simp add: interior_subset)
   ultimately show ?thesis
     using assms by (metis (full_types) closure_subset completion.complete_sets_sandwich_fmeasurable measure_closure measure_interior)
 qed
 
 lemma measurable_convex: "\<lbrakk>convex S; bounded S\<rbrakk> \<Longrightarrow> S \<in> lmeasurable"
   by (simp add: measurable_Jordan negligible_convex_frontier)
 
 lemma content_cball_conv_ball: "content (cball c r) = content (ball c r)"
 proof -
   have "ball c r - cball c r \<union> (cball c r - ball c r) = sphere c r"
     by auto
   hence "measure lebesgue (cball c r) = measure lebesgue (ball c r)"
     using negligible_sphere[of c r] by (intro measure_negligible_symdiff) simp_all
   thus ?thesis by simp
 qed
 
 subsection\<open>Negligibility of image under non-injective linear map\<close>
 
 lemma negligible_Union_nat:
   assumes "\<And>n::nat. negligible(S n)"
   shows "negligible(\<Union>n. S n)"
 proof -
   have "negligible (\<Union>m\<le>k. S m)" for k
     using assms by blast
   then have 0:  "integral UNIV (indicat_real (\<Union>m\<le>k. S m)) = 0"
     and 1: "(indicat_real (\<Union>m\<le>k. S m)) integrable_on UNIV" for k
     by (auto simp: negligible has_integral_iff)
   have 2: "\<And>k x. indicat_real (\<Union>m\<le>k. S m) x \<le> (indicat_real (\<Union>m\<le>Suc k. S m) x)"
-    by (simp add: indicator_def)
+    by (auto simp add: indicator_def)
   have 3: "\<And>x. (\<lambda>k. indicat_real (\<Union>m\<le>k. S m) x) \<longlonglongrightarrow> (indicat_real (\<Union>n. S n) x)"
     by (force simp: indicator_def eventually_sequentially intro: tendsto_eventually)
   have 4: "bounded (range (\<lambda>k. integral UNIV (indicat_real (\<Union>m\<le>k. S m))))"
     by (simp add: 0)
   have *: "indicat_real (\<Union>n. S n) integrable_on UNIV \<and>
         (\<lambda>k. integral UNIV (indicat_real (\<Union>m\<le>k. S m))) \<longlonglongrightarrow> (integral UNIV (indicat_real (\<Union>n. S n)))"
     by (intro monotone_convergence_increasing 1 2 3 4)
   then have "integral UNIV (indicat_real (\<Union>n. S n)) = (0::real)"
     using LIMSEQ_unique by (auto simp: 0)
   then show ?thesis
     using * by (simp add: negligible_UNIV has_integral_iff)
 qed
 
 
 lemma negligible_linear_singular_image:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'n"
   assumes "linear f" "\<not> inj f"
   shows "negligible (f ` S)"
 proof -
   obtain a where "a \<noteq> 0" "\<And>S. f ` S \<subseteq> {x. a \<bullet> x = 0}"
     using assms linear_singular_image_hyperplane by blast
   then show "negligible (f ` S)"
     by (metis negligible_hyperplane negligible_subset)
 qed
 
 lemma measure_negligible_finite_Union:
   assumes "finite \<F>"
     and meas: "\<And>S. S \<in> \<F> \<Longrightarrow> S \<in> lmeasurable"
     and djointish: "pairwise (\<lambda>S T. negligible (S \<inter> T)) \<F>"
   shows "measure lebesgue (\<Union>\<F>) = (\<Sum>S\<in>\<F>. measure lebesgue S)"
   using assms
 proof (induction)
   case empty
   then show ?case
     by auto
 next
   case (insert S \<F>)
   then have "S \<in> lmeasurable" "\<Union>\<F> \<in> lmeasurable" "pairwise (\<lambda>S T. negligible (S \<inter> T)) \<F>"
     by (simp_all add: fmeasurable.finite_Union insert.hyps(1) insert.prems(1) pairwise_insert subsetI)
   then show ?case
   proof (simp add: measure_Un3 insert)
     have *: "\<And>T. T \<in> (\<inter>) S ` \<F> \<Longrightarrow> negligible T"
       using insert by (force simp: pairwise_def)
     have "negligible(S \<inter> \<Union>\<F>)"
       unfolding Int_Union
       by (rule negligible_Union) (simp_all add: * insert.hyps(1))
     then show "measure lebesgue (S \<inter> \<Union>\<F>) = 0"
       using negligible_imp_measure0 by blast
   qed
 qed
 
 lemma measure_negligible_finite_Union_image:
   assumes "finite S"
     and meas: "\<And>x. x \<in> S \<Longrightarrow> f x \<in> lmeasurable"
     and djointish: "pairwise (\<lambda>x y. negligible (f x \<inter> f y)) S"
   shows "measure lebesgue (\<Union>(f ` S)) = (\<Sum>x\<in>S. measure lebesgue (f x))"
 proof -
   have "measure lebesgue (\<Union>(f ` S)) = sum (measure lebesgue) (f ` S)"
     using assms by (auto simp: pairwise_mono pairwise_image intro: measure_negligible_finite_Union)
   also have "\<dots> = sum (measure lebesgue \<circ> f) S"
     using djointish [unfolded pairwise_def] by (metis inf.idem negligible_imp_measure0 sum.reindex_nontrivial [OF \<open>finite S\<close>])
   also have "\<dots> = (\<Sum>x\<in>S. measure lebesgue (f x))"
     by simp
   finally show ?thesis .
 qed
 
 subsection \<open>Negligibility of a Lipschitz image of a negligible set\<close>
 
 text\<open>The bound will be eliminated by a sort of onion argument\<close>
 lemma locally_Lipschitz_negl_bounded:
   fixes f :: "'M::euclidean_space \<Rightarrow> 'N::euclidean_space"
   assumes MleN: "DIM('M) \<le> DIM('N)" "0 < B" "bounded S" "negligible S"
       and lips: "\<And>x. x \<in> S
                       \<Longrightarrow> \<exists>T. open T \<and> x \<in> T \<and>
                               (\<forall>y \<in> S \<inter> T. norm(f y - f x) \<le> B * norm(y - x))"
   shows "negligible (f ` S)"
   unfolding negligible_iff_null_sets
 proof (clarsimp simp: completion.null_sets_outer)
   fix e::real
   assume "0 < e"
   have "S \<in> lmeasurable"
     using \<open>negligible S\<close> by (simp add: negligible_iff_null_sets fmeasurableI_null_sets)
   then have "S \<in> sets lebesgue"
     by blast
   have e22: "0 < e/2 / (2 * B * real DIM('M)) ^ DIM('N)"
     using \<open>0 < e\<close> \<open>0 < B\<close> by (simp add: field_split_simps)
   obtain T where "open T" "S \<subseteq> T" "(T - S) \<in> lmeasurable"
                  "measure lebesgue (T - S) < e/2 / (2 * B * DIM('M)) ^ DIM('N)"
     using sets_lebesgue_outer_open [OF \<open>S \<in> sets lebesgue\<close> e22]
     by (metis emeasure_eq_measure2 ennreal_leI linorder_not_le)
   then have T: "measure lebesgue T \<le> e/2 / (2 * B * DIM('M)) ^ DIM('N)"
     using \<open>negligible S\<close> by (simp add: measure_Diff_null_set negligible_iff_null_sets)
   have "\<exists>r. 0 < r \<and> r \<le> 1/2 \<and>
             (x \<in> S \<longrightarrow> (\<forall>y. norm(y - x) < r
                        \<longrightarrow> y \<in> T \<and> (y \<in> S \<longrightarrow> norm(f y - f x) \<le> B * norm(y - x))))"
         for x
   proof (cases "x \<in> S")
     case True
     obtain U where "open U" "x \<in> U" and U: "\<And>y. y \<in> S \<inter> U \<Longrightarrow> norm(f y - f x) \<le> B * norm(y - x)"
       using lips [OF \<open>x \<in> S\<close>] by auto
     have "x \<in> T \<inter> U"
       using \<open>S \<subseteq> T\<close> \<open>x \<in> U\<close> \<open>x \<in> S\<close> by auto
     then obtain \<epsilon> where "0 < \<epsilon>" "ball x \<epsilon> \<subseteq> T \<inter> U"
       by (metis \<open>open T\<close> \<open>open U\<close> openE open_Int)
     then show ?thesis
       by (rule_tac x="min (1/2) \<epsilon>" in exI) (simp add: U dist_norm norm_minus_commute subset_iff)
   next
     case False
     then show ?thesis
       by (rule_tac x="1/4" in exI) auto
   qed
   then obtain R where R12: "\<And>x. 0 < R x \<and> R x \<le> 1/2"
                 and RT: "\<And>x y. \<lbrakk>x \<in> S; norm(y - x) < R x\<rbrakk> \<Longrightarrow> y \<in> T"
                 and RB: "\<And>x y. \<lbrakk>x \<in> S; y \<in> S; norm(y - x) < R x\<rbrakk> \<Longrightarrow> norm(f y - f x) \<le> B * norm(y - x)"
     by metis+
   then have gaugeR: "gauge (\<lambda>x. ball x (R x))"
     by (simp add: gauge_def)
   obtain c where c: "S \<subseteq> cbox (-c *\<^sub>R One) (c *\<^sub>R One)" "box (-c *\<^sub>R One:: 'M) (c *\<^sub>R One) \<noteq> {}"
   proof -
     obtain B where B: "\<And>x. x \<in> S \<Longrightarrow> norm x \<le> B"
       using \<open>bounded S\<close> bounded_iff by blast
     show ?thesis
     proof (rule_tac c = "abs B + 1" in that)
       show "S \<subseteq> cbox (- (\<bar>B\<bar> + 1) *\<^sub>R One) ((\<bar>B\<bar> + 1) *\<^sub>R One)"
         using norm_bound_Basis_le Basis_le_norm
         by (fastforce simp: mem_box dest!: B intro: order_trans)
       show "box (- (\<bar>B\<bar> + 1) *\<^sub>R One) ((\<bar>B\<bar> + 1) *\<^sub>R One) \<noteq> {}"
         by (simp add: box_eq_empty(1))
     qed
   qed
   obtain \<D> where "countable \<D>"
      and Dsub: "\<Union>\<D> \<subseteq> cbox (-c *\<^sub>R One) (c *\<^sub>R One)"
      and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> interior K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
      and pw:   "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
      and Ksub: "\<And>K. K \<in> \<D> \<Longrightarrow> \<exists>x \<in> S \<inter> K. K \<subseteq> (\<lambda>x. ball x (R x)) x"
      and exN:  "\<And>u v. cbox u v \<in> \<D> \<Longrightarrow> \<exists>n. \<forall>i \<in> Basis. v \<bullet> i - u \<bullet> i = (2*c) / 2^n"
      and "S \<subseteq> \<Union>\<D>"
     using covering_lemma [OF c gaugeR]  by force
   have "\<exists>u v z. K = cbox u v \<and> box u v \<noteq> {} \<and> z \<in> S \<and> z \<in> cbox u v \<and>
                 cbox u v \<subseteq> ball z (R z)" if "K \<in> \<D>" for K
   proof -
     obtain u v where "K = cbox u v"
       using \<open>K \<in> \<D>\<close> cbox by blast
     with that show ?thesis
       by (metis Int_iff interior_cbox cbox Ksub)
   qed
   then obtain uf vf zf
     where uvz: "\<And>K. K \<in> \<D> \<Longrightarrow>
                 K = cbox (uf K) (vf K) \<and> box (uf K) (vf K) \<noteq> {} \<and> zf K \<in> S \<and>
                 zf K \<in> cbox (uf K) (vf K) \<and> cbox (uf K) (vf K) \<subseteq> ball (zf K) (R (zf K))"
     by metis
   define prj1 where "prj1 \<equiv> \<lambda>x::'M. x \<bullet> (SOME i. i \<in> Basis)"
   define fbx where "fbx \<equiv> \<lambda>D. cbox (f(zf D) - (B * DIM('M) * (prj1(vf D - uf D))) *\<^sub>R One::'N)
                                     (f(zf D) + (B * DIM('M) * prj1(vf D - uf D)) *\<^sub>R One)"
   have vu_pos: "0 < prj1 (vf X - uf X)" if "X \<in> \<D>" for X
     using uvz [OF that] by (simp add: prj1_def box_ne_empty SOME_Basis inner_diff_left)
   have prj1_idem: "prj1 (vf X - uf X) = (vf X - uf X) \<bullet> i" if  "X \<in> \<D>" "i \<in> Basis" for X i
   proof -
     have "cbox (uf X) (vf X) \<in> \<D>"
       using uvz \<open>X \<in> \<D>\<close> by auto
     with exN obtain n where "\<And>i. i \<in> Basis \<Longrightarrow> vf X \<bullet> i - uf X \<bullet> i = (2*c) / 2^n"
       by blast
     then show ?thesis
       by (simp add: \<open>i \<in> Basis\<close> SOME_Basis inner_diff prj1_def)
   qed
   have countbl: "countable (fbx ` \<D>)"
     using \<open>countable \<D>\<close> by blast
   have "(\<Sum>k\<in>fbx`\<D>'. measure lebesgue k) \<le> e/2" if "\<D>' \<subseteq> \<D>" "finite \<D>'" for \<D>'
   proof -
     have BM_ge0: "0 \<le> B * (DIM('M) * prj1 (vf X - uf X))" if "X \<in> \<D>'" for X
       using \<open>0 < B\<close> \<open>\<D>' \<subseteq> \<D>\<close> that vu_pos by fastforce
     have "{} \<notin> \<D>'"
       using cbox \<open>\<D>' \<subseteq> \<D>\<close> interior_empty by blast
     have "(\<Sum>k\<in>fbx`\<D>'. measure lebesgue k) \<le> sum (measure lebesgue o fbx) \<D>'"
       by (rule sum_image_le [OF \<open>finite \<D>'\<close>]) (force simp: fbx_def)
     also have "\<dots> \<le> (\<Sum>X\<in>\<D>'. (2 * B * DIM('M)) ^ DIM('N) * measure lebesgue X)"
     proof (rule sum_mono)
       fix X assume "X \<in> \<D>'"
       then have "X \<in> \<D>" using \<open>\<D>' \<subseteq> \<D>\<close> by blast
       then have ufvf: "cbox (uf X) (vf X) = X"
         using uvz by blast
       have "prj1 (vf X - uf X) ^ DIM('M) = (\<Prod>i::'M \<in> Basis. prj1 (vf X - uf X))"
         by (rule prod_constant [symmetric])
       also have "\<dots> = (\<Prod>i\<in>Basis. vf X \<bullet> i - uf X \<bullet> i)"
         by (simp add: \<open>X \<in> \<D>\<close> inner_diff_left prj1_idem cong: prod.cong)
       finally have prj1_eq: "prj1 (vf X - uf X) ^ DIM('M) = (\<Prod>i\<in>Basis. vf X \<bullet> i - uf X \<bullet> i)" .
       have "uf X \<in> cbox (uf X) (vf X)" "vf X \<in> cbox (uf X) (vf X)"
         using uvz [OF \<open>X \<in> \<D>\<close>] by (force simp: mem_box)+
       moreover have "cbox (uf X) (vf X) \<subseteq> ball (zf X) (1/2)"
         by (meson R12 order_trans subset_ball uvz [OF \<open>X \<in> \<D>\<close>])
       ultimately have "uf X \<in> ball (zf X) (1/2)"  "vf X \<in> ball (zf X) (1/2)"
         by auto
       then have "dist (vf X) (uf X) \<le> 1"
         unfolding mem_ball
         by (metis dist_commute dist_triangle_half_l dual_order.order_iff_strict)
       then have 1: "prj1 (vf X - uf X) \<le> 1"
         unfolding prj1_def dist_norm using Basis_le_norm SOME_Basis order_trans by fastforce
       have 0: "0 \<le> prj1 (vf X - uf X)"
         using \<open>X \<in> \<D>\<close> prj1_def vu_pos by fastforce
       have "(measure lebesgue \<circ> fbx) X \<le> (2 * B * DIM('M)) ^ DIM('N) * content (cbox (uf X) (vf X))"
         apply (simp add: fbx_def content_cbox_cases algebra_simps BM_ge0 \<open>X \<in> \<D>'\<close> \<open>0 < B\<close> flip: prj1_eq)
         using MleN 0 1 uvz \<open>X \<in> \<D>\<close>
         by (fastforce simp add: box_ne_empty power_decreasing)
       also have "\<dots> = (2 * B * DIM('M)) ^ DIM('N) * measure lebesgue X"
         by (subst (3) ufvf[symmetric]) simp
       finally show "(measure lebesgue \<circ> fbx) X \<le> (2 * B * DIM('M)) ^ DIM('N) * measure lebesgue X" .
     qed
     also have "\<dots> = (2 * B * DIM('M)) ^ DIM('N) * sum (measure lebesgue) \<D>'"
       by (simp add: sum_distrib_left)
     also have "\<dots> \<le> e/2"
     proof -
       have "\<And>K. K \<in> \<D>' \<Longrightarrow> \<exists>a b. K = cbox a b"
         using cbox that by blast
       then have div: "\<D>' division_of \<Union>\<D>'"
         using pairwise_subset [OF pw \<open>\<D>' \<subseteq> \<D>\<close>] unfolding pairwise_def
         by (force simp: \<open>finite \<D>'\<close> \<open>{} \<notin> \<D>'\<close> division_of_def)
       have le_meaT: "measure lebesgue (\<Union>\<D>') \<le> measure lebesgue T"
       proof (rule measure_mono_fmeasurable)
         show "(\<Union>\<D>') \<in> sets lebesgue"
           using div lmeasurable_division by auto
         have "\<Union>\<D>' \<subseteq> \<Union>\<D>"
           using \<open>\<D>' \<subseteq> \<D>\<close> by blast
         also have "... \<subseteq> T"
         proof (clarify)
           fix x D
           assume "x \<in> D" "D \<in> \<D>"
           show "x \<in> T"
             using Ksub [OF \<open>D \<in> \<D>\<close>]
             by (metis \<open>x \<in> D\<close> Int_iff dist_norm mem_ball norm_minus_commute subsetD RT)
         qed
         finally show "\<Union>\<D>' \<subseteq> T" .
         show "T \<in> lmeasurable"
           using \<open>S \<in> lmeasurable\<close> \<open>S \<subseteq> T\<close> \<open>T - S \<in> lmeasurable\<close> fmeasurable_Diff_D by blast
       qed
       have "sum (measure lebesgue) \<D>' = sum content \<D>'"
         using  \<open>\<D>' \<subseteq> \<D>\<close> cbox by (force intro: sum.cong)
       then have "(2 * B * DIM('M)) ^ DIM('N) * sum (measure lebesgue) \<D>' =
                  (2 * B * real DIM('M)) ^ DIM('N) * measure lebesgue (\<Union>\<D>')"
         using content_division [OF div] by auto
       also have "\<dots> \<le> (2 * B * real DIM('M)) ^ DIM('N) * measure lebesgue T"
         using \<open>0 < B\<close> 
         by (intro mult_left_mono [OF le_meaT]) (force simp add: algebra_simps)
       also have "\<dots> \<le> e/2"
         using T \<open>0 < B\<close> by (simp add: field_simps)
       finally show ?thesis .
     qed
     finally show ?thesis .
   qed
   then have e2: "sum (measure lebesgue) \<G> \<le> e/2" if "\<G> \<subseteq> fbx ` \<D>" "finite \<G>" for \<G>
     by (metis finite_subset_image that)
   show "\<exists>W\<in>lmeasurable. f ` S \<subseteq> W \<and> measure lebesgue W < e"
   proof (intro bexI conjI)
     have "\<exists>X\<in>\<D>. f y \<in> fbx X" if "y \<in> S" for y
     proof -
       obtain X where "y \<in> X" "X \<in> \<D>"
         using \<open>S \<subseteq> \<Union>\<D>\<close> \<open>y \<in> S\<close> by auto
       then have y: "y \<in> ball(zf X) (R(zf X))"
         using uvz by fastforce
       have conj_le_eq: "z - b \<le> y \<and> y \<le> z + b \<longleftrightarrow> abs(y - z) \<le> b" for z y b::real
         by auto
       have yin: "y \<in> cbox (uf X) (vf X)" and zin: "(zf X) \<in> cbox (uf X) (vf X)"
         using uvz \<open>X \<in> \<D>\<close> \<open>y \<in> X\<close> by auto
       have "norm (y - zf X) \<le> (\<Sum>i\<in>Basis. \<bar>(y - zf X) \<bullet> i\<bar>)"
         by (rule norm_le_l1)
       also have "\<dots> \<le> real DIM('M) * prj1 (vf X - uf X)"
       proof (rule sum_bounded_above)
         fix j::'M assume j: "j \<in> Basis"
         show "\<bar>(y - zf X) \<bullet> j\<bar> \<le> prj1 (vf X - uf X)"
           using yin zin j
           by (fastforce simp add: mem_box prj1_idem [OF \<open>X \<in> \<D>\<close> j] inner_diff_left)
       qed
       finally have nole: "norm (y - zf X) \<le> DIM('M) * prj1 (vf X - uf X)"
         by simp
       have fle: "\<bar>f y \<bullet> i - f(zf X) \<bullet> i\<bar> \<le> B * DIM('M) * prj1 (vf X - uf X)" if "i \<in> Basis" for i
       proof -
         have "\<bar>f y \<bullet> i - f (zf X) \<bullet> i\<bar> = \<bar>(f y - f (zf X)) \<bullet> i\<bar>"
           by (simp add: algebra_simps)
         also have "\<dots> \<le> norm (f y - f (zf X))"
           by (simp add: Basis_le_norm that)
         also have "\<dots> \<le> B * norm(y - zf X)"
           by (metis uvz RB \<open>X \<in> \<D>\<close> dist_commute dist_norm mem_ball \<open>y \<in> S\<close> y)
         also have "\<dots> \<le> B * real DIM('M) * prj1 (vf X - uf X)"
           using \<open>0 < B\<close> by (simp add: nole)
         finally show ?thesis .
       qed
       show ?thesis
         by (rule_tac x=X in bexI)
            (auto simp: fbx_def prj1_idem mem_box conj_le_eq inner_add inner_diff fle \<open>X \<in> \<D>\<close>)
     qed
     then show "f ` S \<subseteq> (\<Union>D\<in>\<D>. fbx D)" by auto
   next
     have 1: "\<And>D. D \<in> \<D> \<Longrightarrow> fbx D \<in> lmeasurable"
       by (auto simp: fbx_def)
     have 2: "I' \<subseteq> \<D> \<Longrightarrow> finite I' \<Longrightarrow> measure lebesgue (\<Union>D\<in>I'. fbx D) \<le> e/2" for I'
       by (rule order_trans[OF measure_Union_le e2]) (auto simp: fbx_def)
     show "(\<Union>D\<in>\<D>. fbx D) \<in> lmeasurable"
       by (intro fmeasurable_UN_bound[OF \<open>countable \<D>\<close> 1 2])
     have "measure lebesgue (\<Union>D\<in>\<D>. fbx D) \<le> e/2"
       by (intro measure_UN_bound[OF \<open>countable \<D>\<close> 1 2])
     then show "measure lebesgue (\<Union>D\<in>\<D>. fbx D) < e"
       using \<open>0 < e\<close> by linarith
   qed
 qed
 
 proposition negligible_locally_Lipschitz_image:
   fixes f :: "'M::euclidean_space \<Rightarrow> 'N::euclidean_space"
   assumes MleN: "DIM('M) \<le> DIM('N)" "negligible S"
       and lips: "\<And>x. x \<in> S
                       \<Longrightarrow> \<exists>T B. open T \<and> x \<in> T \<and>
                               (\<forall>y \<in> S \<inter> T. norm(f y - f x) \<le> B * norm(y - x))"
     shows "negligible (f ` S)"
 proof -
   let ?S = "\<lambda>n. ({x \<in> S. norm x \<le> n \<and>
                           (\<exists>T. open T \<and> x \<in> T \<and>
                                (\<forall>y\<in>S \<inter> T. norm (f y - f x) \<le> (real n + 1) * norm (y - x)))})"
   have negfn: "f ` ?S n \<in> null_sets lebesgue" for n::nat
     unfolding negligible_iff_null_sets[symmetric]
     apply (rule_tac B = "real n + 1" in locally_Lipschitz_negl_bounded)
     by (auto simp: MleN bounded_iff intro: negligible_subset [OF \<open>negligible S\<close>])
   have "S = (\<Union>n. ?S n)"
   proof (intro set_eqI iffI)
     fix x assume "x \<in> S"
     with lips obtain T B where T: "open T" "x \<in> T"
                            and B: "\<And>y. y \<in> S \<inter> T \<Longrightarrow> norm(f y - f x) \<le> B * norm(y - x)"
       by metis+
     have no: "norm (f y - f x) \<le> (nat \<lceil>max B (norm x)\<rceil> + 1) * norm (y - x)" if "y \<in> S \<inter> T" for y
     proof -
       have "B * norm(y - x) \<le> (nat \<lceil>max B (norm x)\<rceil> + 1) * norm (y - x)"
         by (meson max.cobounded1 mult_right_mono nat_ceiling_le_eq nat_le_iff_add norm_ge_zero order_trans)
       then show ?thesis
         using B order_trans that by blast
     qed
     have "norm x \<le> real (nat \<lceil>max B (norm x)\<rceil>)"
       by linarith
     then have "x \<in> ?S (nat (ceiling (max B (norm x))))"
       using T no by (force simp: \<open>x \<in> S\<close> algebra_simps)
     then show "x \<in> (\<Union>n. ?S n)" by force
   qed auto
   then show ?thesis
     by (rule ssubst) (auto simp: image_Union negligible_iff_null_sets intro: negfn)
 qed
 
 corollary negligible_differentiable_image_negligible:
   fixes f :: "'M::euclidean_space \<Rightarrow> 'N::euclidean_space"
   assumes MleN: "DIM('M) \<le> DIM('N)" "negligible S"
       and diff_f: "f differentiable_on S"
     shows "negligible (f ` S)"
 proof -
   have "\<exists>T B. open T \<and> x \<in> T \<and> (\<forall>y \<in> S \<inter> T. norm(f y - f x) \<le> B * norm(y - x))"
         if "x \<in> S" for x
   proof -
     obtain f' where "linear f'"
        and f': "\<And>e. e>0 \<Longrightarrow>
                         \<exists>d>0. \<forall>y\<in>S. norm (y - x) < d \<longrightarrow>
                                     norm (f y - f x - f' (y - x)) \<le> e * norm (y - x)"
       using diff_f \<open>x \<in> S\<close>
       by (auto simp: linear_linear differentiable_on_def differentiable_def has_derivative_within_alt)
     obtain B where "B > 0" and B: "\<forall>x. norm (f' x) \<le> B * norm x"
       using linear_bounded_pos \<open>linear f'\<close> by blast
     obtain d where "d>0"
               and d: "\<And>y. \<lbrakk>y \<in> S; norm (y - x) < d\<rbrakk> \<Longrightarrow>
                           norm (f y - f x - f' (y - x)) \<le> norm (y - x)"
       using f' [of 1] by (force simp:)
     show ?thesis
     proof (intro exI conjI ballI)
       show "norm (f y - f x) \<le> (B + 1) * norm (y - x)"
         if "y \<in> S \<inter> ball x d" for y
       proof -
         have "norm (f y - f x) - B * norm (y - x) \<le> norm (f y - f x) - norm (f' (y - x))"
           by (simp add: B)
         also have "\<dots> \<le> norm (f y - f x - f' (y - x))"
           by (rule norm_triangle_ineq2)
         also have "... \<le> norm (y - x)"
           by (metis IntE d dist_norm mem_ball norm_minus_commute that)
         finally show ?thesis
           by (simp add: algebra_simps)
       qed
     qed (use \<open>d>0\<close> in auto)
   qed
   with negligible_locally_Lipschitz_image assms show ?thesis by metis
 qed
 
 corollary negligible_differentiable_image_lowdim:
   fixes f :: "'M::euclidean_space \<Rightarrow> 'N::euclidean_space"
   assumes MlessN: "DIM('M) < DIM('N)" and diff_f: "f differentiable_on S"
     shows "negligible (f ` S)"
 proof -
   have "x \<le> DIM('M) \<Longrightarrow> x \<le> DIM('N)" for x
     using MlessN by linarith
   obtain lift :: "'M * real \<Rightarrow> 'N" and drop :: "'N \<Rightarrow> 'M * real" and j :: 'N
     where "linear lift" "linear drop" and dropl [simp]: "\<And>z. drop (lift z) = z"
       and "j \<in> Basis" and j: "\<And>x. lift(x,0) \<bullet> j = 0"
     using lowerdim_embeddings [OF MlessN] by metis
   have "negligible ((\<lambda>x. lift (x, 0)) ` S)"
   proof -
     have "negligible {x. x\<bullet>j = 0}"
       by (metis \<open>j \<in> Basis\<close> negligible_standard_hyperplane)
     moreover have "(\<lambda>m. lift (m, 0)) ` S \<subseteq> {n. n \<bullet> j = 0}"
       using j by force
     ultimately show ?thesis
       using negligible_subset by auto
   qed
   moreover
   have "f \<circ> fst \<circ> drop differentiable_on (\<lambda>x. lift (x, 0)) ` S"
     using diff_f
     apply (clarsimp simp add: differentiable_on_def)
     apply (intro differentiable_chain_within linear_imp_differentiable [OF \<open>linear drop\<close>]
              linear_imp_differentiable [OF linear_fst])
     apply (force simp: image_comp o_def)
     done
   moreover
   have "f = f \<circ> fst \<circ> drop \<circ> (\<lambda>x. lift (x, 0))"
     by (simp add: o_def)
   ultimately show ?thesis
     by (metis (no_types) image_comp negligible_differentiable_image_negligible order_refl)
 qed
 
 subsection\<open>Measurability of countable unions and intersections of various kinds.\<close>
 
 lemma
   assumes S: "\<And>n. S n \<in> lmeasurable"
     and leB: "\<And>n. measure lebesgue (S n) \<le> B"
     and nest: "\<And>n. S n \<subseteq> S(Suc n)"
   shows measurable_nested_Union: "(\<Union>n. S n) \<in> lmeasurable"
   and measure_nested_Union:  "(\<lambda>n. measure lebesgue (S n)) \<longlonglongrightarrow> measure lebesgue (\<Union>n. S n)" (is ?Lim)
 proof -
   have "indicat_real (\<Union> (range S)) integrable_on UNIV \<and>
     (\<lambda>n. integral UNIV (indicat_real (S n)))
     \<longlonglongrightarrow> integral UNIV (indicat_real (\<Union> (range S)))"
   proof (rule monotone_convergence_increasing)
     show "\<And>n. (indicat_real (S n)) integrable_on UNIV"
       using S measurable_integrable by blast
     show "\<And>n x::'a. indicat_real (S n) x \<le> (indicat_real (S (Suc n)) x)"
       by (simp add: indicator_leI nest rev_subsetD)
     have "\<And>x. (\<exists>n. x \<in> S n) \<longrightarrow> (\<forall>\<^sub>F n in sequentially. x \<in> S n)"
       by (metis eventually_sequentiallyI lift_Suc_mono_le nest subsetCE)
     then
     show "\<And>x. (\<lambda>n. indicat_real (S n) x) \<longlonglongrightarrow> (indicat_real (\<Union>(S ` UNIV)) x)"
       by (simp add: indicator_def tendsto_eventually)
     show "bounded (range (\<lambda>n. integral UNIV (indicat_real (S n))))"
       using leB by (auto simp: lmeasure_integral_UNIV [symmetric] S bounded_iff)
   qed
   then have "(\<Union>n. S n) \<in> lmeasurable \<and> ?Lim"
     by (simp add: lmeasure_integral_UNIV S cong: conj_cong) (simp add: measurable_integrable)
   then show "(\<Union>n. S n) \<in> lmeasurable" "?Lim"
     by auto
 qed
 
 lemma
   assumes S: "\<And>n. S n \<in> lmeasurable"
     and djointish: "pairwise (\<lambda>m n. negligible (S m \<inter> S n)) UNIV"
     and leB: "\<And>n. (\<Sum>k\<le>n. measure lebesgue (S k)) \<le> B"
   shows measurable_countable_negligible_Union: "(\<Union>n. S n) \<in> lmeasurable"
   and   measure_countable_negligible_Union:    "(\<lambda>n. (measure lebesgue (S n))) sums measure lebesgue (\<Union>n. S n)" (is ?Sums)
 proof -
   have 1: "\<Union> (S ` {..n}) \<in> lmeasurable" for n
     using S by blast
   have 2: "measure lebesgue (\<Union> (S ` {..n})) \<le> B" for n
   proof -
     have "measure lebesgue (\<Union> (S ` {..n})) \<le> (\<Sum>k\<le>n. measure lebesgue (S k))"
       by (simp add: S fmeasurableD measure_UNION_le)
     with leB show ?thesis
       using order_trans by blast
   qed
   have 3: "\<And>n. \<Union> (S ` {..n}) \<subseteq> \<Union> (S ` {..Suc n})"
     by (simp add: SUP_subset_mono)
   have eqS: "(\<Union>n. S n) = (\<Union>n. \<Union> (S ` {..n}))"
     using atLeastAtMost_iff by blast
   also have "(\<Union>n. \<Union> (S ` {..n})) \<in> lmeasurable"
     by (intro measurable_nested_Union [OF 1 2] 3)
   finally show "(\<Union>n. S n) \<in> lmeasurable" .
   have eqm: "(\<Sum>i\<le>n. measure lebesgue (S i)) = measure lebesgue (\<Union> (S ` {..n}))" for n
     using assms by (simp add: measure_negligible_finite_Union_image pairwise_mono)
   have "(\<lambda>n. (measure lebesgue (S n))) sums measure lebesgue (\<Union>n. \<Union> (S ` {..n}))"
     by (simp add: sums_def' eqm atLeast0AtMost) (intro measure_nested_Union [OF 1 2] 3)
   then show ?Sums
     by (simp add: eqS)
 qed
 
 lemma negligible_countable_Union [intro]:
   assumes "countable \<F>" and meas: "\<And>S. S \<in> \<F> \<Longrightarrow> negligible S"
   shows "negligible (\<Union>\<F>)"
 proof (cases "\<F> = {}")
   case False
   then show ?thesis
     by (metis from_nat_into range_from_nat_into assms negligible_Union_nat)
 qed simp
 
 lemma
   assumes S: "\<And>n. (S n) \<in> lmeasurable"
     and djointish: "pairwise (\<lambda>m n. negligible (S m \<inter> S n)) UNIV"
     and bo: "bounded (\<Union>n. S n)"
   shows measurable_countable_negligible_Union_bounded: "(\<Union>n. S n) \<in> lmeasurable"
   and   measure_countable_negligible_Union_bounded:    "(\<lambda>n. (measure lebesgue (S n))) sums measure lebesgue (\<Union>n. S n)" (is ?Sums)
 proof -
   obtain a b where ab: "(\<Union>n. S n) \<subseteq> cbox a b"
     using bo bounded_subset_cbox_symmetric by metis
   then have B: "(\<Sum>k\<le>n. measure lebesgue (S k)) \<le> measure lebesgue (cbox a b)" for n
   proof -
     have "(\<Sum>k\<le>n. measure lebesgue (S k)) = measure lebesgue (\<Union> (S ` {..n}))"
       using measure_negligible_finite_Union_image [OF _ _ pairwise_subset] djointish
       by (metis S finite_atMost subset_UNIV)
     also have "\<dots> \<le> measure lebesgue (cbox a b)"
     proof (rule measure_mono_fmeasurable)
       show "\<Union> (S ` {..n}) \<in> sets lebesgue" using S by blast
     qed (use ab in auto)
     finally show ?thesis .
   qed
   show "(\<Union>n. S n) \<in> lmeasurable"
     by (rule measurable_countable_negligible_Union [OF S djointish B])
   show ?Sums
     by (rule measure_countable_negligible_Union [OF S djointish B])
 qed
 
 lemma measure_countable_Union_approachable:
   assumes "countable \<D>" "e > 0" and measD: "\<And>d. d \<in> \<D> \<Longrightarrow> d \<in> lmeasurable"
       and B: "\<And>D'. \<lbrakk>D' \<subseteq> \<D>; finite D'\<rbrakk> \<Longrightarrow> measure lebesgue (\<Union>D') \<le> B"
     obtains D' where "D' \<subseteq> \<D>" "finite D'" "measure lebesgue (\<Union>\<D>) - e < measure lebesgue (\<Union>D')"
 proof (cases "\<D> = {}")
   case True
   then show ?thesis
     by (simp add: \<open>e > 0\<close> that)
 next
   case False
   let ?S = "\<lambda>n. \<Union>k \<le> n. from_nat_into \<D> k"
   have "(\<lambda>n. measure lebesgue (?S n)) \<longlonglongrightarrow> measure lebesgue (\<Union>n. ?S n)"
   proof (rule measure_nested_Union)
     show "?S n \<in> lmeasurable" for n
       by (simp add: False fmeasurable.finite_UN from_nat_into measD)
     show "measure lebesgue (?S n) \<le> B" for n
       by (metis (mono_tags, lifting) B False finite_atMost finite_imageI from_nat_into image_iff subsetI)
     show "?S n \<subseteq> ?S (Suc n)" for n
       by force
   qed
   then obtain N where N: "\<And>n. n \<ge> N \<Longrightarrow> dist (measure lebesgue (?S n)) (measure lebesgue (\<Union>n. ?S n)) < e"
     using metric_LIMSEQ_D \<open>e > 0\<close> by blast
   show ?thesis
   proof
     show "from_nat_into \<D> ` {..N} \<subseteq> \<D>"
       by (auto simp: False from_nat_into)
     have eq: "(\<Union>n. \<Union>k\<le>n. from_nat_into \<D> k) = (\<Union>\<D>)"
       using \<open>countable \<D>\<close> False
       by (auto intro: from_nat_into dest: from_nat_into_surj [OF \<open>countable \<D>\<close>])
     show "measure lebesgue (\<Union>\<D>) - e < measure lebesgue (\<Union> (from_nat_into \<D> ` {..N}))"
       using N [OF order_refl]
       by (auto simp: eq algebra_simps dist_norm)
   qed auto
 qed
 
 
 subsection\<open>Negligibility is a local property\<close>
 
 lemma locally_negligible_alt:
     "negligible S \<longleftrightarrow> (\<forall>x \<in> S. \<exists>U. openin (top_of_set S) U \<and> x \<in> U \<and> negligible U)"
      (is "_ = ?rhs")
 proof
   assume "negligible S"
   then show ?rhs
     using openin_subtopology_self by blast
 next
   assume ?rhs
   then obtain U where ope: "\<And>x. x \<in> S \<Longrightarrow> openin (top_of_set S) (U x)"
     and cov: "\<And>x. x \<in> S \<Longrightarrow> x \<in> U x"
     and neg: "\<And>x. x \<in> S \<Longrightarrow> negligible (U x)"
     by metis
   obtain \<F> where "\<F> \<subseteq> U ` S" "countable \<F>" and eq: "\<Union>\<F> = \<Union>(U ` S)"
     using ope by (force intro: Lindelof_openin [of "U ` S" S])
   then have "negligible (\<Union>\<F>)"
     by (metis imageE neg negligible_countable_Union subset_eq)
   with eq have "negligible (\<Union>(U ` S))"
     by metis
   moreover have "S \<subseteq> \<Union>(U ` S)"
     using cov by blast
   ultimately show "negligible S"
     using negligible_subset by blast
 qed
 
 lemma locally_negligible: "locally negligible S \<longleftrightarrow> negligible S"
   unfolding locally_def
   by (metis locally_negligible_alt negligible_subset openin_imp_subset openin_subtopology_self)
 
 
 subsection\<open>Integral bounds\<close>
 
 lemma set_integral_norm_bound:
   fixes f :: "_ \<Rightarrow> 'a :: {banach, second_countable_topology}"
   shows "set_integrable M k f \<Longrightarrow> norm (LINT x:k|M. f x) \<le> LINT x:k|M. norm (f x)"
   using integral_norm_bound[of M "\<lambda>x. indicator k x *\<^sub>R f x"] by (simp add: set_lebesgue_integral_def)
 
 lemma set_integral_finite_UN_AE:
   fixes f :: "_ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes "finite I"
     and ae: "\<And>i j. i \<in> I \<Longrightarrow> j \<in> I \<Longrightarrow> AE x in M. (x \<in> A i \<and> x \<in> A j) \<longrightarrow> i = j"
     and [measurable]: "\<And>i. i \<in> I \<Longrightarrow> A i \<in> sets M"
     and f: "\<And>i. i \<in> I \<Longrightarrow> set_integrable M (A i) f"
   shows "LINT x:(\<Union>i\<in>I. A i)|M. f x = (\<Sum>i\<in>I. LINT x:A i|M. f x)"
   using \<open>finite I\<close> order_refl[of I]
 proof (induction I rule: finite_subset_induct')
   case (insert i I')
   have "AE x in M. (\<forall>j\<in>I'. x \<in> A i \<longrightarrow> x \<notin> A j)"
   proof (intro AE_ball_countable[THEN iffD2] ballI)
     fix j assume "j \<in> I'"
     with \<open>I' \<subseteq> I\<close> \<open>i \<notin> I'\<close> have "i \<noteq> j" "j \<in> I"
       by auto
     then show "AE x in M. x \<in> A i \<longrightarrow> x \<notin> A j"
       using ae[of i j] \<open>i \<in> I\<close> by auto
   qed (use \<open>finite I'\<close> in \<open>rule countable_finite\<close>)
   then have "AE x\<in>A i in M. \<forall>xa\<in>I'. x \<notin> A xa "
     by auto
   with insert.hyps insert.IH[symmetric]
   show ?case
     by (auto intro!: set_integral_Un_AE sets.finite_UN f set_integrable_UN)
 qed (simp add: set_lebesgue_integral_def)
 
 lemma set_integrable_norm:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes f: "set_integrable M k f" shows "set_integrable M k (\<lambda>x. norm (f x))"
   using integrable_norm f by (force simp add: set_integrable_def)
 
 lemma absolutely_integrable_bounded_variation:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f absolutely_integrable_on UNIV"
   obtains B where "\<forall>d. d division_of (\<Union>d) \<longrightarrow> sum (\<lambda>k. norm (integral k f)) d \<le> B"
 proof (rule that[of "integral UNIV (\<lambda>x. norm (f x))"]; safe)
   fix d :: "'a set set" assume d: "d division_of \<Union>d"
   have *: "k \<in> d \<Longrightarrow> f absolutely_integrable_on k" for k
     using f[THEN set_integrable_subset, of k] division_ofD(2,4)[OF d, of k] by auto
   note d' = division_ofD[OF d]
   have "(\<Sum>k\<in>d. norm (integral k f)) = (\<Sum>k\<in>d. norm (LINT x:k|lebesgue. f x))"
     by (intro sum.cong refl arg_cong[where f=norm] set_lebesgue_integral_eq_integral(2)[symmetric] *)
   also have "\<dots> \<le> (\<Sum>k\<in>d. LINT x:k|lebesgue. norm (f x))"
     by (intro sum_mono set_integral_norm_bound *)
   also have "\<dots> = (\<Sum>k\<in>d. integral k (\<lambda>x. norm (f x)))"
     by (intro sum.cong refl set_lebesgue_integral_eq_integral(2) set_integrable_norm *)
   also have "\<dots> \<le> integral (\<Union>d) (\<lambda>x. norm (f x))"
     using integrable_on_subdivision[OF d] assms f unfolding absolutely_integrable_on_def
     by (subst integral_combine_division_topdown[OF _ d]) auto
   also have "\<dots> \<le> integral UNIV (\<lambda>x. norm (f x))"
     using integrable_on_subdivision[OF d] assms unfolding absolutely_integrable_on_def
     by (intro integral_subset_le) auto
   finally show "(\<Sum>k\<in>d. norm (integral k f)) \<le> integral UNIV (\<lambda>x. norm (f x))" .
 qed
 
 lemma absdiff_norm_less:
   assumes "sum (\<lambda>x. norm (f x - g x)) S < e"
   shows "\<bar>sum (\<lambda>x. norm(f x)) S - sum (\<lambda>x. norm(g x)) S\<bar> < e" (is "?lhs < e")
 proof -
   have "?lhs \<le> (\<Sum>i\<in>S. \<bar>norm (f i) - norm (g i)\<bar>)"
     by (metis (no_types) sum_abs sum_subtractf)
   also have "... \<le> (\<Sum>x\<in>S. norm (f x - g x))"
     by (simp add: norm_triangle_ineq3 sum_mono)
   also have "... < e"
     using assms(1) by blast
   finally show ?thesis .
 qed
 
 proposition bounded_variation_absolutely_integrable_interval:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes f: "f integrable_on cbox a b"
     and *: "\<And>d. d division_of (cbox a b) \<Longrightarrow> sum (\<lambda>K. norm(integral K f)) d \<le> B"
   shows "f absolutely_integrable_on cbox a b"
 proof -
   let ?f = "\<lambda>d. \<Sum>K\<in>d. norm (integral K f)" and ?D = "{d. d division_of (cbox a b)}"
   have D_1: "?D \<noteq> {}"
     by (rule elementary_interval[of a b]) auto
   have D_2: "bdd_above (?f`?D)"
     by (metis * mem_Collect_eq bdd_aboveI2)
   note D = D_1 D_2
   let ?S = "SUP x\<in>?D. ?f x"
   have *: "\<exists>\<gamma>. gauge \<gamma> \<and>
              (\<forall>p. p tagged_division_of cbox a b \<and>
                   \<gamma> fine p \<longrightarrow>
                   norm ((\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) - ?S) < e)"
     if e: "e > 0" for e
   proof -
     have "?S - e/2 < ?S" using \<open>e > 0\<close> by simp
     then obtain d where d: "d division_of (cbox a b)" "?S - e/2 < (\<Sum>k\<in>d. norm (integral k f))"
       unfolding less_cSUP_iff[OF D] by auto
     note d' = division_ofD[OF this(1)]
 
     have "\<exists>e>0. \<forall>i\<in>d. x \<notin> i \<longrightarrow> ball x e \<inter> i = {}" for x
     proof -
       have "\<exists>d'>0. \<forall>x'\<in>\<Union>{i \<in> d. x \<notin> i}. d' \<le> dist x x'"
       proof (rule separate_point_closed)
         show "closed (\<Union>{i \<in> d. x \<notin> i})"
           using d' by force
         show "x \<notin> \<Union>{i \<in> d. x \<notin> i}"
           by auto
       qed
       then show ?thesis
         by force
     qed
     then obtain k where k: "\<And>x. 0 < k x" "\<And>i x. \<lbrakk>i \<in> d; x \<notin> i\<rbrakk> \<Longrightarrow> ball x (k x) \<inter> i = {}"
       by metis
     have "e/2 > 0"
       using e by auto
     with Henstock_lemma[OF f]
     obtain \<gamma> where g: "gauge \<gamma>"
       "\<And>p. \<lbrakk>p tagged_partial_division_of cbox a b; \<gamma> fine p\<rbrakk>
                 \<Longrightarrow> (\<Sum>(x,k) \<in> p. norm (content k *\<^sub>R f x - integral k f)) < e/2"
       by (metis (no_types, lifting))
     let ?g = "\<lambda>x. \<gamma> x \<inter> ball x (k x)"
     show ?thesis
     proof (intro exI conjI allI impI)
       show "gauge ?g"
         using g(1) k(1) by (auto simp: gauge_def)
     next
       fix p
       assume "p tagged_division_of (cbox a b) \<and> ?g fine p"
       then have p: "p tagged_division_of cbox a b" "\<gamma> fine p" "(\<lambda>x. ball x (k x)) fine p"
         by (auto simp: fine_Int)
       note p' = tagged_division_ofD[OF p(1)]
       define p' where "p' = {(x,k) | x k. \<exists>i l. x \<in> i \<and> i \<in> d \<and> (x,l) \<in> p \<and> k = i \<inter> l}"
       have gp': "\<gamma> fine p'"
         using p(2) by (auto simp: p'_def fine_def)
       have p'': "p' tagged_division_of (cbox a b)"
       proof (rule tagged_division_ofI)
         show "finite p'"
         proof (rule finite_subset)
           show "p' \<subseteq> (\<lambda>(k, x, l). (x, k \<inter> l)) ` (d \<times> p)"
             by (force simp: p'_def image_iff)
           show "finite ((\<lambda>(k, x, l). (x, k \<inter> l)) ` (d \<times> p))"
             by (simp add: d'(1) p'(1))
         qed
       next
         fix x K
         assume "(x, K) \<in> p'"
         then have "\<exists>i l. x \<in> i \<and> i \<in> d \<and> (x, l) \<in> p \<and> K = i \<inter> l"
           unfolding p'_def by auto
         then obtain i l where il: "x \<in> i" "i \<in> d" "(x, l) \<in> p" "K = i \<inter> l" by blast
         show "x \<in> K" and "K \<subseteq> cbox a b"
           using p'(2-3)[OF il(3)] il by auto
         show "\<exists>a b. K = cbox a b"
           unfolding il using p'(4)[OF il(3)] d'(4)[OF il(2)] by (meson Int_interval)
       next
         fix x1 K1
         assume "(x1, K1) \<in> p'"
         then have "\<exists>i l. x1 \<in> i \<and> i \<in> d \<and> (x1, l) \<in> p \<and> K1 = i \<inter> l"
           unfolding p'_def by auto
         then obtain i1 l1 where il1: "x1 \<in> i1" "i1 \<in> d" "(x1, l1) \<in> p" "K1 = i1 \<inter> l1" by blast
         fix x2 K2
         assume "(x2,K2) \<in> p'"
         then have "\<exists>i l. x2 \<in> i \<and> i \<in> d \<and> (x2, l) \<in> p \<and> K2 = i \<inter> l"
           unfolding p'_def by auto
         then obtain i2 l2 where il2: "x2 \<in> i2" "i2 \<in> d" "(x2, l2) \<in> p" "K2 = i2 \<inter> l2" by blast
         assume "(x1, K1) \<noteq> (x2, K2)"
         then have "interior i1 \<inter> interior i2 = {} \<or> interior l1 \<inter> interior l2 = {}"
           using d'(5)[OF il1(2) il2(2)] p'(5)[OF il1(3) il2(3)]  by (auto simp: il1 il2)
         then show "interior K1 \<inter> interior K2 = {}"
           unfolding il1 il2 by auto
       next
         have *: "\<forall>(x, X) \<in> p'. X \<subseteq> cbox a b"
           unfolding p'_def using d' by blast
         show "\<Union>{K. \<exists>x. (x, K) \<in> p'} = cbox a b"
         proof
           show "\<Union>{k. \<exists>x. (x, k) \<in> p'} \<subseteq> cbox a b"
             using * by auto
         next
           show "cbox a b \<subseteq> \<Union>{k. \<exists>x. (x, k) \<in> p'}"
           proof
             fix y
             assume y: "y \<in> cbox a b"
             obtain x L where xl: "(x, L) \<in> p" "y \<in> L"
               using y unfolding p'(6)[symmetric] by auto
             obtain I where i: "I \<in> d" "y \<in> I"
               using y unfolding d'(6)[symmetric] by auto
             have "x \<in> I"
               using fineD[OF p(3) xl(1)] using k(2) i xl by auto
             then show "y \<in> \<Union>{K. \<exists>x. (x, K) \<in> p'}"
             proof -
               obtain x l where xl: "(x, l) \<in> p" "y \<in> l"
                 using y unfolding p'(6)[symmetric] by auto
               obtain i where i: "i \<in> d" "y \<in> i"
                 using y unfolding d'(6)[symmetric] by auto
               have "x \<in> i"
                 using fineD[OF p(3) xl(1)] using k(2) i xl by auto
               then show ?thesis
                 unfolding p'_def by (rule_tac X="i \<inter> l" in UnionI) (use i xl in auto)
             qed
           qed
         qed
       qed
       then have sum_less_e2: "(\<Sum>(x,K) \<in> p'. norm (content K *\<^sub>R f x - integral K f)) < e/2"
         using g(2) gp' tagged_division_of_def by blast
 
       have in_p': "(x, I \<inter> L) \<in> p'" if x: "(x, L) \<in> p" "I \<in> d" and y: "y \<in> I" "y \<in> L"
         for x I L y
       proof -
         have "x \<in> I"
           using fineD[OF p(3) that(1)] k(2)[OF \<open>I \<in> d\<close>] y by auto
         with x have "(\<exists>i l. x \<in> i \<and> i \<in> d \<and> (x, l) \<in> p \<and> I \<inter> L = i \<inter> l)"
           by blast
         then have "(x, I \<inter> L) \<in> p'"
           by (simp add: p'_def)
         with y show ?thesis by auto
       qed
       moreover 
       have Ex_p_p': "\<exists>y i l. (x, K) = (y, i \<inter> l) \<and> (y, l) \<in> p \<and> i \<in> d \<and> i \<inter> l \<noteq> {}"
         if xK: "(x,K) \<in> p'" for x K
       proof -
         obtain i l where il: "x \<in> i" "i \<in> d" "(x, l) \<in> p" "K = i \<inter> l"
           using xK unfolding p'_def by auto
         then show ?thesis
           using p'(2) by fastforce
       qed
       ultimately have p'alt: "p' = {(x, I \<inter> L) | x I L. (x,L) \<in> p \<and> I \<in> d \<and> I \<inter> L \<noteq> {}}"
         by auto
       have sum_p': "(\<Sum>(x,K) \<in> p'. norm (integral K f)) = (\<Sum>k\<in>snd ` p'. norm (integral k f))"
       proof (rule sum.over_tagged_division_lemma[OF p''])
         show "\<And>u v. box u v = {} \<Longrightarrow> norm (integral (cbox u v) f) = 0"
           by (auto intro: integral_null simp: content_eq_0_interior)
       qed
       have snd_p_div: "snd ` p division_of cbox a b"
         by (rule division_of_tagged_division[OF p(1)])
       note snd_p = division_ofD[OF snd_p_div]
       have fin_d_sndp: "finite (d \<times> snd ` p)"
         by (simp add: d'(1) snd_p(1))
 
       have *: "\<And>sni sni' sf sf'. \<lbrakk>\<bar>sf' - sni'\<bar> < e/2; ?S - e/2 < sni; sni' \<le> ?S;
                        sni \<le> sni'; sf' = sf\<rbrakk> \<Longrightarrow> \<bar>sf - ?S\<bar> < e"
         by arith
       show "norm ((\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) - ?S) < e"
         unfolding real_norm_def
       proof (rule *)
         show "\<bar>(\<Sum>(x,K)\<in>p'. norm (content K *\<^sub>R f x)) - (\<Sum>(x,k)\<in>p'. norm (integral k f))\<bar> < e/2"
           using p'' sum_less_e2 unfolding split_def by (force intro!: absdiff_norm_less)
         show "(\<Sum>(x,k) \<in> p'. norm (integral k f)) \<le>?S"
           by (auto simp: sum_p' division_of_tagged_division[OF p''] D intro!: cSUP_upper)
         show "(\<Sum>k\<in>d. norm (integral k f)) \<le> (\<Sum>(x,k) \<in> p'. norm (integral k f))"
         proof -
           have *: "{k \<inter> l | k l. k \<in> d \<and> l \<in> snd ` p} = (\<lambda>(k,l). k \<inter> l) ` (d \<times> snd ` p)"
             by auto
           have "(\<Sum>K\<in>d. norm (integral K f)) \<le> (\<Sum>i\<in>d. \<Sum>l\<in>snd ` p. norm (integral (i \<inter> l) f))"
           proof (rule sum_mono)
             fix K assume k: "K \<in> d"
             from d'(4)[OF this] obtain u v where uv: "K = cbox u v" by metis
             define d' where "d' = {cbox u v \<inter> l |l. l \<in> snd ` p \<and>  cbox u v \<inter> l \<noteq> {}}"
             have uvab: "cbox u v \<subseteq> cbox a b"
               using d(1) k uv by blast
             have d'_div: "d' division_of cbox u v"
               unfolding d'_def by (rule division_inter_1 [OF snd_p_div uvab])
             moreover have "norm (\<Sum>i\<in>d'. integral i f) \<le> (\<Sum>k\<in>d'. norm (integral k f))"
               by (simp add: sum_norm_le)
             moreover have "f integrable_on K"
               using f integrable_on_subcbox uv uvab by blast
             moreover have "d' division_of K"
               using d'_div uv by blast
             ultimately have "norm (integral K f) \<le> sum (\<lambda>k. norm (integral k f)) d'"
               by (simp add: integral_combine_division_topdown)
             also have "\<dots> = (\<Sum>I\<in>{K \<inter> L |L. L \<in> snd ` p}. norm (integral I f))"
             proof (rule sum.mono_neutral_left)
               show "finite {K \<inter> L |L. L \<in> snd ` p}"
                 by (simp add: snd_p(1))
               show "\<forall>i\<in>{K \<inter> L |L. L \<in> snd ` p} - d'. norm (integral i f) = 0"
                 "d' \<subseteq> {K \<inter> L |L. L \<in> snd ` p}"
                 using d'_def image_eqI uv by auto
             qed
             also have "\<dots> = (\<Sum>l\<in>snd ` p. norm (integral (K \<inter> l) f))"
               unfolding Setcompr_eq_image
             proof (rule sum.reindex_nontrivial [unfolded o_def])
               show "finite (snd ` p)"
                 using snd_p(1) by blast
               show "norm (integral (K \<inter> l) f) = 0"
                 if "l \<in> snd ` p" "y \<in> snd ` p" "l \<noteq> y" "K \<inter> l = K \<inter> y" for l y
               proof -
                 have "interior (K \<inter> l) \<subseteq> interior (l \<inter> y)"
                   by (metis Int_lower2 interior_mono le_inf_iff that(4))
                 then have "interior (K \<inter> l) = {}"
                   by (simp add: snd_p(5) that)
                 moreover from d'(4)[OF k] snd_p(4)[OF that(1)]
                 obtain u1 v1 u2 v2
                   where uv: "K = cbox u1 u2" "l = cbox v1 v2" by metis
                 ultimately show ?thesis
                   using that integral_null
                   unfolding uv Int_interval content_eq_0_interior
                   by (metis (mono_tags, lifting) norm_eq_zero)
               qed
             qed
             finally show "norm (integral K f) \<le> (\<Sum>l\<in>snd ` p. norm (integral (K \<inter> l) f))" .
           qed
           also have "\<dots> = (\<Sum>(i,l) \<in> d \<times> snd ` p. norm (integral (i\<inter>l) f))"
             by (simp add: sum.cartesian_product)
           also have "\<dots> = (\<Sum>x \<in> d \<times> snd ` p. norm (integral (case_prod (\<inter>) x) f))"
             by (force simp: split_def intro!: sum.cong)
           also have "\<dots> = (\<Sum>k\<in>{i \<inter> l |i l. i \<in> d \<and> l \<in> snd ` p}. norm (integral k f))"
           proof -
             have eq0: " (integral (l1 \<inter> k1) f) = 0"
               if "l1 \<inter> k1 = l2 \<inter> k2" "(l1, k1) \<noteq> (l2, k2)"
                  "l1 \<in> d" "(j1,k1) \<in> p" "l2 \<in> d" "(j2,k2) \<in> p"
               for l1 l2 k1 k2 j1 j2
             proof -
               obtain u1 v1 u2 v2 where uv: "l1 = cbox u1 u2" "k1 = cbox v1 v2"
                 using \<open>(j1, k1) \<in> p\<close> \<open>l1 \<in> d\<close> d'(4) p'(4) by blast
               have "l1 \<noteq> l2 \<or> k1 \<noteq> k2"
                 using that by auto
               then have "interior k1 \<inter> interior k2 = {} \<or> interior l1 \<inter> interior l2 = {}"
                 by (meson d'(5) old.prod.inject p'(5) that(3) that(4) that(5) that(6))
               moreover have "interior (l1 \<inter> k1) = interior (l2 \<inter> k2)"
                 by (simp add: that(1))
               ultimately have "interior(l1 \<inter> k1) = {}"
                 by auto
               then show ?thesis
                 unfolding uv Int_interval content_eq_0_interior[symmetric] by auto
             qed
             show ?thesis
               unfolding *
               apply (rule sum.reindex_nontrivial [OF fin_d_sndp, symmetric, unfolded o_def])
               apply clarsimp
               by (metis eq0 fst_conv snd_conv)
           qed
           also have "\<dots> = (\<Sum>(x,k) \<in> p'. norm (integral k f))"
             unfolding sum_p'
           proof (rule sum.mono_neutral_right)
             show "finite {i \<inter> l |i l. i \<in> d \<and> l \<in> snd ` p}"
               by (metis * finite_imageI[OF fin_d_sndp])
             show "snd ` p' \<subseteq> {i \<inter> l |i l. i \<in> d \<and> l \<in> snd ` p}"
               by (clarsimp simp: p'_def) (metis image_eqI snd_conv)
             show "\<forall>i\<in>{i \<inter> l |i l. i \<in> d \<and> l \<in> snd ` p} - snd ` p'. norm (integral i f) = 0"
               by clarsimp (metis Henstock_Kurzweil_Integration.integral_empty disjoint_iff image_eqI in_p' snd_conv)
           qed
           finally show ?thesis .
         qed
         show "(\<Sum>(x,k) \<in> p'. norm (content k *\<^sub>R f x)) = (\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x))"
         proof -
           let ?S = "{(x, i \<inter> l) |x i l. (x, l) \<in> p \<and> i \<in> d}"
           have *: "?S = (\<lambda>(xl,i). (fst xl, snd xl \<inter> i)) ` (p \<times> d)"
             by force
           have fin_pd: "finite (p \<times> d)"
             using finite_cartesian_product[OF p'(1) d'(1)] by metis
           have "(\<Sum>(x,k) \<in> p'. norm (content k *\<^sub>R f x)) = (\<Sum>(x,k) \<in> ?S. \<bar>content k\<bar> * norm (f x))"
             unfolding norm_scaleR
           proof (rule sum.mono_neutral_left)
             show "finite {(x, i \<inter> l) |x i l. (x, l) \<in> p \<and> i \<in> d}"
               by (simp add: "*" fin_pd)
           qed (use p'alt in \<open>force+\<close>)
           also have "\<dots> = (\<Sum>((x,l),i)\<in>p \<times> d. \<bar>content (l \<inter> i)\<bar> * norm (f x))"
           proof -
             have "\<bar>content (l1 \<inter> k1)\<bar> * norm (f x1) = 0"
               if "(x1, l1) \<in> p" "(x2, l2) \<in> p" "k1 \<in> d" "k2 \<in> d"
                 "x1 = x2" "l1 \<inter> k1 = l2 \<inter> k2" "x1 \<noteq> x2 \<or> l1 \<noteq> l2 \<or> k1 \<noteq> k2"
               for x1 l1 k1 x2 l2 k2
             proof -
               obtain u1 v1 u2 v2 where uv: "k1 = cbox u1 u2" "l1 = cbox v1 v2"
                 by (meson \<open>(x1, l1) \<in> p\<close> \<open>k1 \<in> d\<close> d(1) division_ofD(4) p'(4))
               have "l1 \<noteq> l2 \<or> k1 \<noteq> k2"
                 using that by auto
               then have "interior k1 \<inter> interior k2 = {} \<or> interior l1 \<inter> interior l2 = {}"
                 using that p'(5) d'(5) by (metis snd_conv)
               moreover have "interior (l1 \<inter> k1) = interior (l2 \<inter> k2)"
                 unfolding that ..
               ultimately have "interior (l1 \<inter> k1) = {}"
                 by auto
               then show "\<bar>content (l1 \<inter> k1)\<bar> * norm (f x1) = 0"
                 unfolding uv Int_interval content_eq_0_interior[symmetric] by auto
             qed
             then show ?thesis
               unfolding *
               apply (subst sum.reindex_nontrivial [OF fin_pd])
               unfolding split_paired_all o_def split_def prod.inject
               by force+
           qed
           also have "\<dots> = (\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x))"
           proof -
             have sumeq: "(\<Sum>i\<in>d. content (l \<inter> i) * norm (f x)) = content l * norm (f x)"
               if "(x, l) \<in> p" for x l
             proof -
               note xl = p'(2-4)[OF that]
               then obtain u v where uv: "l = cbox u v" by blast
               have "(\<Sum>i\<in>d. \<bar>content (l \<inter> i)\<bar>) = (\<Sum>k\<in>d. content (k \<inter> cbox u v))"
                 by (simp add: Int_commute uv)
               also have "\<dots> = sum content {k \<inter> cbox u v| k. k \<in> d}"
               proof -
                 have eq0: "content (k \<inter> cbox u v) = 0"
                   if "k \<in> d" "y \<in> d" "k \<noteq> y" and eq: "k \<inter> cbox u v = y \<inter> cbox u v" for k y
                 proof -
                   from d'(4)[OF that(1)] d'(4)[OF that(2)]
                   obtain \<alpha> \<beta> where \<alpha>: "k \<inter> cbox u v = cbox \<alpha> \<beta>"
                     by (meson Int_interval)
                   have "{} = interior ((k \<inter> y) \<inter> cbox u v)"
                     by (simp add: d'(5) that)
                   also have "\<dots> = interior (y \<inter> (k \<inter> cbox u v))"
                     by auto
                   also have "\<dots> = interior (k \<inter> cbox u v)"
                     unfolding eq by auto
                   finally show ?thesis
                     unfolding \<alpha> content_eq_0_interior ..
                 qed
                 then show ?thesis
                   unfolding Setcompr_eq_image
                   by (fastforce intro: sum.reindex_nontrivial [OF \<open>finite d\<close>, unfolded o_def, symmetric])
               qed
               also have "\<dots> = sum content {cbox u v \<inter> k |k. k \<in> d \<and> cbox u v \<inter> k \<noteq> {}}"
               proof (rule sum.mono_neutral_right)
                 show "finite {k \<inter> cbox u v |k. k \<in> d}"
                   by (simp add: d'(1))
               qed (fastforce simp: inf.commute)+
               finally have "(\<Sum>i\<in>d. \<bar>content (l \<inter> i)\<bar>) = content (cbox u v)"
                 using additive_content_division[OF division_inter_1[OF d(1)]] uv xl(2) by auto
               then show "(\<Sum>i\<in>d. content (l \<inter> i) * norm (f x)) = content l * norm (f x)"              
                 unfolding sum_distrib_right[symmetric] using uv by auto
             qed
             show ?thesis
               by (subst sum_Sigma_product[symmetric]) (auto intro!: sumeq sum.cong p' d')
           qed
           finally show ?thesis .
         qed
       qed (rule d)
     qed
   qed
   then show ?thesis
     using absolutely_integrable_onI [OF f has_integral_integrable] has_integral[of _ ?S]
     by blast
 qed
 
 
 lemma bounded_variation_absolutely_integrable:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "f integrable_on UNIV"
     and "\<forall>d. d division_of (\<Union>d) \<longrightarrow> sum (\<lambda>k. norm (integral k f)) d \<le> B"
   shows "f absolutely_integrable_on UNIV"
 proof (rule absolutely_integrable_onI, fact)
   let ?f = "\<lambda>D. \<Sum>k\<in>D. norm (integral k f)" and ?D = "{d. d division_of (\<Union>d)}"
   define SDF where "SDF \<equiv> SUP d\<in>?D. ?f d"
   have D_1: "?D \<noteq> {}"
     by (rule elementary_interval) auto
   have D_2: "bdd_above (?f`?D)"
     using assms(2) by auto
   have f_int: "\<And>a b. f absolutely_integrable_on cbox a b"
     using assms integrable_on_subcbox 
     by (blast intro!: bounded_variation_absolutely_integrable_interval)
   have "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
                     \<bar>integral (cbox a b) (\<lambda>x. norm (f x)) - SDF\<bar> < e"
     if "0 < e" for e
   proof -
     have "\<exists>y \<in> ?f ` ?D. \<not> y \<le> SDF - e"
     proof (rule ccontr)
       assume "\<not> ?thesis"
       then have "SDF \<le> SDF - e"
         unfolding SDF_def
         by (metis (mono_tags) D_1 cSUP_least image_eqI)
       then show False
         using that by auto
     qed
     then obtain d K where ddiv: "d division_of \<Union>d" and "K = ?f d" "SDF - e < K"
       by (auto simp add: image_iff not_le)
     then have d: "SDF - e < ?f d"
       by auto
     note d'=division_ofD[OF ddiv]
     have "bounded (\<Union>d)"
       using ddiv by blast
     then obtain K where K: "0 < K" "\<forall>x\<in>\<Union>d. norm x \<le> K"
       using bounded_pos by blast
     show ?thesis
     proof (intro conjI impI allI exI)
       fix a b :: 'n
       assume ab: "ball 0 (K + 1) \<subseteq> cbox a b"
       have *: "\<And>s s1. \<lbrakk>SDF - e < s1; s1 \<le> s; s < SDF + e\<rbrakk> \<Longrightarrow> \<bar>s - SDF\<bar> < e"
         by arith
       show "\<bar>integral (cbox a b) (\<lambda>x. norm (f x)) - SDF\<bar> < e"
         unfolding real_norm_def
       proof (rule * [OF d])
         have "?f d \<le> sum (\<lambda>k. integral k (\<lambda>x. norm (f x))) d"
         proof (intro sum_mono)
           fix k assume "k \<in> d"
           with d'(4) f_int show "norm (integral k f) \<le> integral k (\<lambda>x. norm (f x))"
             by (force simp: absolutely_integrable_on_def integral_norm_bound_integral)
         qed
         also have "\<dots> = integral (\<Union>d) (\<lambda>x. norm (f x))"
           by (metis (full_types) absolutely_integrable_on_def d'(4) ddiv f_int integral_combine_division_bottomup)
         also have "\<dots> \<le> integral (cbox a b) (\<lambda>x. norm (f x))"
         proof -
           have "\<Union>d \<subseteq> cbox a b"
             using K(2) ab by fastforce
           then show ?thesis
             using integrable_on_subdivision[OF ddiv] f_int[of a b] unfolding absolutely_integrable_on_def
             by (auto intro!: integral_subset_le)
         qed
         finally show "?f d \<le> integral (cbox a b) (\<lambda>x. norm (f x))" .
       next
         have "e/2>0"
           using \<open>e > 0\<close> by auto
         moreover
         have f: "f integrable_on cbox a b" "(\<lambda>x. norm (f x)) integrable_on cbox a b"
           using f_int by (auto simp: absolutely_integrable_on_def)
         ultimately obtain d1 where "gauge d1"
            and d1: "\<And>p. \<lbrakk>p tagged_division_of (cbox a b); d1 fine p\<rbrakk> \<Longrightarrow>
             norm ((\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) - integral (cbox a b) (\<lambda>x. norm (f x))) < e/2"
           unfolding has_integral_integral has_integral by meson
         obtain d2 where "gauge d2"
           and d2: "\<And>p. \<lbrakk>p tagged_partial_division_of (cbox a b); d2 fine p\<rbrakk> \<Longrightarrow>
             (\<Sum>(x,k) \<in> p. norm (content k *\<^sub>R f x - integral k f)) < e/2"
           by (blast intro: Henstock_lemma [OF f(1) \<open>e/2>0\<close>])
         obtain p where
           p: "p tagged_division_of (cbox a b)" "d1 fine p" "d2 fine p"
           by (rule fine_division_exists [OF gauge_Int [OF \<open>gauge d1\<close> \<open>gauge d2\<close>], of a b])
             (auto simp add: fine_Int)
         have *: "\<And>sf sf' si di. \<lbrakk>sf' = sf; si \<le> SDF; \<bar>sf - si\<bar> < e/2;
                       \<bar>sf' - di\<bar> < e/2\<rbrakk> \<Longrightarrow> di < SDF + e"
           by arith
         have "integral (cbox a b) (\<lambda>x. norm (f x)) < SDF + e"
         proof (rule *)
           show "\<bar>(\<Sum>(x,k)\<in>p. norm (content k *\<^sub>R f x)) - (\<Sum>(x,k)\<in>p. norm (integral k f))\<bar> < e/2"
             unfolding split_def
           proof (rule absdiff_norm_less)
             show "(\<Sum>p\<in>p. norm (content (snd p) *\<^sub>R f (fst p) - integral (snd p) f)) < e/2"
               using d2[of p] p(1,3) by (auto simp: tagged_division_of_def split_def)
           qed
           show "\<bar>(\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) - integral (cbox a b) (\<lambda>x. norm(f x))\<bar> < e/2"
             using d1[OF p(1,2)] by (simp only: real_norm_def)
           show "(\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) = (\<Sum>(x,k) \<in> p. norm (content k *\<^sub>R f x))"
             by (auto simp: split_paired_all sum.cong [OF refl])
           have "(\<Sum>(x,k) \<in> p. norm (integral k f)) = (\<Sum>k\<in>snd ` p. norm (integral k f))"
             apply (rule sum.over_tagged_division_lemma[OF p(1)])
             by (metis Henstock_Kurzweil_Integration.integral_empty integral_open_interval norm_zero)
           also have "... \<le> SDF"
             using partial_division_of_tagged_division[of p "cbox a b"] p(1)
             by (auto simp: SDF_def tagged_partial_division_of_def intro!: cSUP_upper2 D_1 D_2)
           finally show "(\<Sum>(x,k) \<in> p. norm (integral k f)) \<le> SDF" .
         qed
         then show "integral (cbox a b) (\<lambda>x. norm (f x)) < SDF + e"
           by simp
       qed
     qed (use K in auto)
   qed
   moreover have "\<And>a b. (\<lambda>x. norm (f x)) integrable_on cbox a b"
     using absolutely_integrable_on_def f_int by auto
   ultimately
   have "((\<lambda>x. norm (f x)) has_integral SDF) UNIV"
     by (auto simp: has_integral_alt')
   then show "(\<lambda>x. norm (f x)) integrable_on UNIV"
     by blast
 qed
 
 
 subsection\<open>Outer and inner approximation of measurable sets by well-behaved sets.\<close>
 
 proposition measurable_outer_intervals_bounded:
   assumes "S \<in> lmeasurable" "S \<subseteq> cbox a b" "e > 0"
   obtains \<D>
   where "countable \<D>"
         "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
         "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
         "\<And>u v. cbox u v \<in> \<D> \<Longrightarrow> \<exists>n. \<forall>i \<in> Basis. v \<bullet> i - u \<bullet> i = (b \<bullet> i - a \<bullet> i)/2^n"
         "\<And>K. \<lbrakk>K \<in> \<D>; box a b \<noteq> {}\<rbrakk> \<Longrightarrow> interior K \<noteq> {}"
         "S \<subseteq> \<Union>\<D>" "\<Union>\<D> \<in> lmeasurable" "measure lebesgue (\<Union>\<D>) \<le> measure lebesgue S + e"
 proof (cases "box a b = {}")
   case True
   show ?thesis
   proof (cases "cbox a b = {}")
     case True
     with assms have [simp]: "S = {}"
       by auto
     show ?thesis
     proof
       show "countable {}"
         by simp
     qed (use \<open>e > 0\<close> in auto)
   next
     case False
     show ?thesis
     proof
       show "countable {cbox a b}"
         by simp
       show "\<And>u v. cbox u v \<in> {cbox a b} \<Longrightarrow> \<exists>n. \<forall>i\<in>Basis. v \<bullet> i - u \<bullet> i = (b \<bullet> i - a \<bullet> i)/2 ^ n"
         using False by (force simp: eq_cbox intro: exI [where x=0])
       show "measure lebesgue (\<Union>{cbox a b}) \<le> measure lebesgue S + e"
         using assms by (simp add: sum_content.box_empty_imp [OF True])
     qed (use assms \<open>cbox a b \<noteq> {}\<close> in auto)
   qed
 next
   case False
   let ?\<mu> = "measure lebesgue"
   have "S \<inter> cbox a b \<in> lmeasurable"
     using \<open>S \<in> lmeasurable\<close> by blast
   then have indS_int: "(indicator S has_integral (?\<mu> S)) (cbox a b)"
     by (metis integral_indicator \<open>S \<subseteq> cbox a b\<close> has_integral_integrable_integral inf.orderE integrable_on_indicator)
   with \<open>e > 0\<close> obtain \<gamma> where "gauge \<gamma>" and \<gamma>:
     "\<And>\<D>. \<lbrakk>\<D> tagged_division_of (cbox a b); \<gamma> fine \<D>\<rbrakk> \<Longrightarrow> norm ((\<Sum>(x,K)\<in>\<D>. content(K) *\<^sub>R indicator S x) - ?\<mu> S) < e"
     by (force simp: has_integral)
   have inteq: "integral (cbox a b) (indicat_real S) = integral UNIV (indicator S)"
     using assms by (metis has_integral_iff indS_int lmeasure_integral_UNIV)
   obtain \<D> where \<D>: "countable \<D>"  "\<Union>\<D> \<subseteq> cbox a b"
             and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> interior K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
             and djointish: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
             and covered: "\<And>K. K \<in> \<D> \<Longrightarrow> \<exists>x \<in> S \<inter> K. K \<subseteq> \<gamma> x"
             and close: "\<And>u v. cbox u v \<in> \<D> \<Longrightarrow> \<exists>n. \<forall>i \<in> Basis. v\<bullet>i - u\<bullet>i = (b\<bullet>i - a\<bullet>i)/2^n"
             and covers: "S \<subseteq> \<Union>\<D>"
     using covering_lemma [of S a b \<gamma>] \<open>gauge \<gamma>\<close> \<open>box a b \<noteq> {}\<close> assms by force
   show ?thesis
   proof
     show "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
       by (meson Sup_le_iff \<D>(2) cbox interior_empty)
     have negl_int: "negligible(K \<inter> L)" if "K \<in> \<D>" "L \<in> \<D>" "K \<noteq> L" for K L
     proof -
       have "interior K \<inter> interior L = {}"
         using djointish pairwiseD that by fastforce
       moreover obtain u v x y where "K = cbox u v" "L = cbox x y"
         using cbox \<open>K \<in> \<D>\<close> \<open>L \<in> \<D>\<close> by blast
       ultimately show ?thesis
         by (simp add: Int_interval box_Int_box negligible_interval(1))
     qed
     have fincase: "\<Union>\<F> \<in> lmeasurable \<and> ?\<mu> (\<Union>\<F>) \<le> ?\<mu> S + e" if "finite \<F>" "\<F> \<subseteq> \<D>" for \<F>
     proof -
       obtain t where t: "\<And>K. K \<in> \<F> \<Longrightarrow> t K \<in> S \<inter> K \<and> K \<subseteq> \<gamma>(t K)"
         using covered \<open>\<F> \<subseteq> \<D>\<close> subsetD by metis
       have "\<forall>K \<in> \<F>. \<forall>L \<in> \<F>. K \<noteq> L \<longrightarrow> interior K \<inter> interior L = {}"
         using that djointish by (simp add: pairwise_def) (metis subsetD)
       with cbox that \<D> have \<F>div: "\<F> division_of (\<Union>\<F>)"
         by (fastforce simp: division_of_def dest: cbox)
       then have 1: "\<Union>\<F> \<in> lmeasurable"
         by blast
       have norme: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma> fine p\<rbrakk>
           \<Longrightarrow> norm ((\<Sum>(x,K)\<in>p. content K * indicator S x) - integral (cbox a b) (indicator S)) < e"
         by (auto simp: lmeasure_integral_UNIV assms inteq dest: \<gamma>)
       have "\<forall>x K y L. (x,K) \<in> (\<lambda>K. (t K,K)) ` \<F> \<and> (y,L) \<in> (\<lambda>K. (t K,K)) ` \<F> \<and> (x,K) \<noteq> (y,L) \<longrightarrow>             interior K \<inter> interior L = {}"
         using that djointish  by (clarsimp simp: pairwise_def) (metis subsetD)
       with that \<D> have tagged: "(\<lambda>K. (t K, K)) ` \<F> tagged_partial_division_of cbox a b"
         by (auto simp: tagged_partial_division_of_def dest: t cbox)
       have fine: "\<gamma> fine (\<lambda>K. (t K, K)) ` \<F>"
         using t by (auto simp: fine_def)
       have *: "y \<le> ?\<mu> S \<Longrightarrow> \<bar>x - y\<bar> \<le> e \<Longrightarrow> x \<le> ?\<mu> S + e" for x y
         by arith
       have "?\<mu> (\<Union>\<F>) \<le> ?\<mu> S + e"
       proof (rule *)
         have "(\<Sum>K\<in>\<F>. ?\<mu> (K \<inter> S)) = ?\<mu> (\<Union>C\<in>\<F>. C \<inter> S)"
         proof (rule measure_negligible_finite_Union_image [OF \<open>finite \<F>\<close>, symmetric])
           show "\<And>K. K \<in> \<F> \<Longrightarrow> K \<inter> S \<in> lmeasurable"
             using \<F>div \<open>S \<in> lmeasurable\<close> by blast
           show "pairwise (\<lambda>K y. negligible (K \<inter> S \<inter> (y \<inter> S))) \<F>"
             unfolding pairwise_def
             by (metis inf.commute inf_sup_aci(3) negligible_Int subsetCE negl_int \<open>\<F> \<subseteq> \<D>\<close>)
         qed
         also have "\<dots> = ?\<mu> (\<Union>\<F> \<inter> S)"
           by simp
         also have "\<dots> \<le> ?\<mu> S"
           by (simp add: "1" \<open>S \<in> lmeasurable\<close> fmeasurableD measure_mono_fmeasurable sets.Int)
         finally show "(\<Sum>K\<in>\<F>. ?\<mu> (K \<inter> S)) \<le> ?\<mu> S" .
       next
         have "?\<mu> (\<Union>\<F>) = sum ?\<mu> \<F>"
           by (metis \<F>div content_division)
         also have "\<dots> = (\<Sum>K\<in>\<F>. content K)"
           using \<F>div by (force intro: sum.cong)
         also have "\<dots> = (\<Sum>x\<in>\<F>. content x * indicator S (t x))"
           using t by auto
         finally have eq1: "?\<mu> (\<Union>\<F>) = (\<Sum>x\<in>\<F>. content x * indicator S (t x))" .
         have eq2: "(\<Sum>K\<in>\<F>. ?\<mu> (K \<inter> S)) = (\<Sum>K\<in>\<F>. integral K (indicator S))"
           apply (rule sum.cong [OF refl])
           by (metis integral_indicator \<F>div \<open>S \<in> lmeasurable\<close> division_ofD(4) fmeasurable.Int inf.commute lmeasurable_cbox)
         have "\<bar>\<Sum>(x,K)\<in>(\<lambda>K. (t K, K)) ` \<F>. content K * indicator S x - integral K (indicator S)\<bar> \<le> e"
           using Henstock_lemma_part1 [of "indicator S::'a\<Rightarrow>real", OF _ \<open>e > 0\<close> \<open>gauge \<gamma>\<close> _ tagged fine]
             indS_int norme by auto
         then show "\<bar>?\<mu> (\<Union>\<F>) - (\<Sum>K\<in>\<F>. ?\<mu> (K \<inter> S))\<bar> \<le> e"
           by (simp add: eq1 eq2 comm_monoid_add_class.sum.reindex inj_on_def sum_subtractf)
       qed
       with 1 show ?thesis by blast
     qed
     have "\<Union>\<D> \<in> lmeasurable \<and> ?\<mu> (\<Union>\<D>) \<le> ?\<mu> S + e"
     proof (cases "finite \<D>")
       case True
       with fincase show ?thesis
         by blast
     next
       case False
       let ?T = "from_nat_into \<D>"
       have T: "bij_betw ?T UNIV \<D>"
         by (simp add: False \<D>(1) bij_betw_from_nat_into)
       have TM: "\<And>n. ?T n \<in> lmeasurable"
         by (metis False cbox finite.emptyI from_nat_into lmeasurable_cbox)
       have TN: "\<And>m n. m \<noteq> n \<Longrightarrow> negligible (?T m \<inter> ?T n)"
         by (simp add: False \<D>(1) from_nat_into infinite_imp_nonempty negl_int)
       have TB: "(\<Sum>k\<le>n. ?\<mu> (?T k)) \<le> ?\<mu> S + e" for n
       proof -
         have "(\<Sum>k\<le>n. ?\<mu> (?T k)) = ?\<mu> (\<Union> (?T ` {..n}))"
           by (simp add: pairwise_def TM TN measure_negligible_finite_Union_image)
         also have "?\<mu> (\<Union> (?T ` {..n})) \<le> ?\<mu> S + e"
           using fincase [of "?T ` {..n}"] T by (auto simp: bij_betw_def)
         finally show ?thesis .
       qed
       have "\<Union>\<D> \<in> lmeasurable"
         by (metis lmeasurable_compact T \<D>(2) bij_betw_def cbox compact_cbox countable_Un_Int(1) fmeasurableD fmeasurableI2 rangeI)
       moreover
       have "?\<mu> (\<Union>x. from_nat_into \<D> x) \<le> ?\<mu> S + e"
       proof (rule measure_countable_Union_le [OF TM])
         show "?\<mu> (\<Union>x\<le>n. from_nat_into \<D> x) \<le> ?\<mu> S + e" for n
           by (metis (mono_tags, lifting) False fincase finite.emptyI finite_atMost finite_imageI from_nat_into imageE subsetI)
       qed
       ultimately show ?thesis by (metis T bij_betw_def)
     qed
     then show "\<Union>\<D> \<in> lmeasurable" "measure lebesgue (\<Union>\<D>) \<le> ?\<mu> S + e" by blast+
   qed (use \<D> cbox djointish close covers in auto)
 qed
 
 
 subsection\<open>Transformation of measure by linear maps\<close>
 
 lemma emeasure_lebesgue_ball_conv_unit_ball:
   fixes c :: "'a :: euclidean_space"
   assumes "r \<ge> 0"
   shows "emeasure lebesgue (ball c r) =
            ennreal (r ^ DIM('a)) * emeasure lebesgue (ball (0 :: 'a) 1)"
 proof (cases "r = 0")
   case False
   with assms have r: "r > 0" by auto
   have "emeasure lebesgue ((\<lambda>x. c + x) ` (\<lambda>x. r *\<^sub>R x) ` ball (0 :: 'a) 1) =
           r ^ DIM('a) * emeasure lebesgue (ball (0 :: 'a) 1)"
     unfolding image_image using emeasure_lebesgue_affine[of r c "ball 0 1"] assms
     by (simp add: add_ac)
   also have "(\<lambda>x. r *\<^sub>R x) ` ball 0 1 = ball (0 :: 'a) r"
     using r by (subst ball_scale) auto
   also have "(\<lambda>x. c + x) ` \<dots> = ball c r"
     by (subst image_add_ball) (simp_all add: algebra_simps)
   finally show ?thesis by simp
 qed auto
 
 lemma content_ball_conv_unit_ball:
   fixes c :: "'a :: euclidean_space"
   assumes "r \<ge> 0"
   shows "content (ball c r) = r ^ DIM('a) * content (ball (0 :: 'a) 1)"
 proof -
   have "ennreal (content (ball c r)) = emeasure lebesgue (ball c r)"
     using emeasure_lborel_ball_finite[of c r] by (subst emeasure_eq_ennreal_measure) auto
   also have "\<dots> = ennreal (r ^ DIM('a)) * emeasure lebesgue (ball (0 :: 'a) 1)"
     using assms by (intro emeasure_lebesgue_ball_conv_unit_ball) auto
   also have "\<dots> = ennreal (r ^ DIM('a) * content (ball (0::'a) 1))"
     using emeasure_lborel_ball_finite[of "0::'a" 1] assms
     by (subst emeasure_eq_ennreal_measure) (auto simp: ennreal_mult')
   finally show ?thesis 
     using assms by (subst (asm) ennreal_inj) auto
 qed
 
 lemma measurable_linear_image_interval:
    "linear f \<Longrightarrow> f ` (cbox a b) \<in> lmeasurable"
   by (metis bounded_linear_image linear_linear bounded_cbox closure_bounded_linear_image closure_cbox compact_closure lmeasurable_compact)
 
 proposition measure_linear_sufficient:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'n"
   assumes "linear f" and S: "S \<in> lmeasurable"
     and im: "\<And>a b. measure lebesgue (f ` (cbox a b)) = m * measure lebesgue (cbox a b)"
   shows "f ` S \<in> lmeasurable \<and> m * measure lebesgue S = measure lebesgue (f ` S)"
   using le_less_linear [of 0 m]
 proof
   assume "m < 0"
   then show ?thesis
     using im [of 0 One] by auto
 next
   assume "m \<ge> 0"
   let ?\<mu> = "measure lebesgue"
   show ?thesis
   proof (cases "inj f")
     case False
     then have "?\<mu> (f ` S) = 0"
       using \<open>linear f\<close> negligible_imp_measure0 negligible_linear_singular_image by blast
     then have "m * ?\<mu> (cbox 0 (One)) = 0"
       by (metis False \<open>linear f\<close> cbox_borel content_unit im measure_completion negligible_imp_measure0 negligible_linear_singular_image sets_lborel)
     then show ?thesis
       using \<open>linear f\<close> negligible_linear_singular_image negligible_imp_measure0 False
       by (auto simp: lmeasurable_iff_has_integral negligible_UNIV)
   next
     case True
     then obtain h where "linear h" and hf: "\<And>x. h (f x) = x" and fh: "\<And>x. f (h x) = x"
       using \<open>linear f\<close> linear_injective_isomorphism by blast
     have fBS: "(f ` S) \<in> lmeasurable \<and> m * ?\<mu> S = ?\<mu> (f ` S)"
       if "bounded S" "S \<in> lmeasurable" for S
     proof -
       obtain a b where "S \<subseteq> cbox a b"
         using \<open>bounded S\<close> bounded_subset_cbox_symmetric by metis
       have fUD: "(f ` \<Union>\<D>) \<in> lmeasurable \<and> ?\<mu> (f ` \<Union>\<D>) = (m * ?\<mu> (\<Union>\<D>))"
         if "countable \<D>"
           and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
           and intint: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
         for \<D>
       proof -
         have conv: "\<And>K. K \<in> \<D> \<Longrightarrow> convex K"
           using cbox convex_box(1) by blast
         have neg: "negligible (g ` K \<inter> g ` L)" if "linear g" "K \<in> \<D>" "L \<in> \<D>" "K \<noteq> L"
           for K L and g :: "'n\<Rightarrow>'n"
         proof (cases "inj g")
           case True
           have "negligible (frontier(g ` K \<inter> g ` L) \<union> interior(g ` K \<inter> g ` L))"
           proof (rule negligible_Un)
             show "negligible (frontier (g ` K \<inter> g ` L))"
               by (simp add: negligible_convex_frontier convex_Int conv convex_linear_image that)
           next
             have "\<forall>p N. pairwise p N = (\<forall>Na. (Na::'n set) \<in> N \<longrightarrow> (\<forall>Nb. Nb \<in> N \<and> Na \<noteq> Nb \<longrightarrow> p Na Nb))"
               by (metis pairwise_def)
             then have "interior K \<inter> interior L = {}"
               using intint that(2) that(3) that(4) by presburger
             then show "negligible (interior (g ` K \<inter> g ` L))"
               by (metis True empty_imp_negligible image_Int image_empty interior_Int interior_injective_linear_image that(1))
           qed
           moreover have "g ` K \<inter> g ` L \<subseteq> frontier (g ` K \<inter> g ` L) \<union> interior (g ` K \<inter> g ` L)"
             by (metis Diff_partition Int_commute calculation closure_Un_frontier frontier_def inf.absorb_iff2 inf_bot_right inf_sup_absorb negligible_Un_eq open_interior open_not_negligible sup_commute)
           ultimately show ?thesis
             by (rule negligible_subset)
         next
           case False
           then show ?thesis
             by (simp add: negligible_Int negligible_linear_singular_image \<open>linear g\<close>)
         qed
         have negf: "negligible ((f ` K) \<inter> (f ` L))"
         and negid: "negligible (K \<inter> L)" if "K \<in> \<D>" "L \<in> \<D>" "K \<noteq> L" for K L
           using neg [OF \<open>linear f\<close>] neg [OF linear_id] that by auto
         show ?thesis
         proof (cases "finite \<D>")
           case True
           then have "?\<mu> (\<Union>x\<in>\<D>. f ` x) = (\<Sum>x\<in>\<D>. ?\<mu> (f ` x))"
             using \<open>linear f\<close> cbox measurable_linear_image_interval negf
             by (blast intro: measure_negligible_finite_Union_image [unfolded pairwise_def])
           also have "\<dots> = (\<Sum>k\<in>\<D>. m * ?\<mu> k)"
             by (metis (no_types, lifting) cbox im sum.cong)
           also have "\<dots> = m * ?\<mu> (\<Union>\<D>)"
             unfolding sum_distrib_left [symmetric]
             by (metis True cbox lmeasurable_cbox measure_negligible_finite_Union [unfolded pairwise_def] negid)
           finally show ?thesis
             by (metis True \<open>linear f\<close> cbox image_Union fmeasurable.finite_UN measurable_linear_image_interval)
         next
           case False
           with \<open>countable \<D>\<close> obtain X :: "nat \<Rightarrow> 'n set" where S: "bij_betw X UNIV \<D>"
             using bij_betw_from_nat_into by blast
           then have eq: "(\<Union>\<D>) = (\<Union>n. X n)" "(f ` \<Union>\<D>) = (\<Union>n. f ` X n)"
             by (auto simp: bij_betw_def)
           have meas: "\<And>K. K \<in> \<D> \<Longrightarrow> K \<in> lmeasurable"
             using cbox by blast
           with S have 1: "\<And>n. X n \<in> lmeasurable"
             by (auto simp: bij_betw_def)
           have 2: "pairwise (\<lambda>m n. negligible (X m \<inter> X n)) UNIV"
             using S unfolding bij_betw_def pairwise_def by (metis injD negid range_eqI)
           have "bounded (\<Union>\<D>)"
             by (meson Sup_least bounded_cbox bounded_subset cbox)
           then have 3: "bounded (\<Union>n. X n)"
             using S unfolding bij_betw_def by blast
           have "(\<Union>n. X n) \<in> lmeasurable"
             by (rule measurable_countable_negligible_Union_bounded [OF 1 2 3])
           with S have f1: "\<And>n. f ` (X n) \<in> lmeasurable"
             unfolding bij_betw_def by (metis assms(1) cbox measurable_linear_image_interval rangeI)
           have f2: "pairwise (\<lambda>m n. negligible (f ` (X m) \<inter> f ` (X n))) UNIV"
             using S unfolding bij_betw_def pairwise_def by (metis injD negf rangeI)
           have "bounded (\<Union>\<D>)"
             by (meson Sup_least bounded_cbox bounded_subset cbox)
           then have f3: "bounded (\<Union>n. f ` X n)"
             using S unfolding bij_betw_def
             by (metis bounded_linear_image linear_linear assms(1) image_Union range_composition)
           have "(\<lambda>n. ?\<mu> (X n)) sums ?\<mu> (\<Union>n. X n)"
             by (rule measure_countable_negligible_Union_bounded [OF 1 2 3])
           have meq: "?\<mu> (\<Union>n. f ` X n) = m * ?\<mu> (\<Union>(X ` UNIV))"
           proof (rule sums_unique2 [OF measure_countable_negligible_Union_bounded [OF f1 f2 f3]])
             have m: "\<And>n. ?\<mu> (f ` X n) = (m * ?\<mu> (X n))"
               using S unfolding bij_betw_def by (metis cbox im rangeI)
             show "(\<lambda>n. ?\<mu> (f ` X n)) sums (m * ?\<mu> (\<Union>(X ` UNIV)))"
               unfolding m
               using measure_countable_negligible_Union_bounded [OF 1 2 3] sums_mult by blast
           qed
           show ?thesis
             using measurable_countable_negligible_Union_bounded [OF f1 f2 f3] meq
             by (auto simp: eq [symmetric])
         qed
       qed
       show ?thesis
         unfolding completion.fmeasurable_measure_inner_outer_le
       proof (intro conjI allI impI)
         fix e :: real
         assume "e > 0"
         have 1: "cbox a b - S \<in> lmeasurable"
           by (simp add: fmeasurable.Diff that)
         have 2: "0 < e / (1 + \<bar>m\<bar>)"
           using \<open>e > 0\<close> by (simp add: field_split_simps abs_add_one_gt_zero)
         obtain \<D>
           where "countable \<D>"
             and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
             and intdisj: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
             and DD: "cbox a b - S \<subseteq> \<Union>\<D>" "\<Union>\<D> \<in> lmeasurable"
             and le: "?\<mu> (\<Union>\<D>) \<le> ?\<mu> (cbox a b - S) + e/(1 + \<bar>m\<bar>)"
           by (rule measurable_outer_intervals_bounded [of "cbox a b - S" a b "e/(1 + \<bar>m\<bar>)"]; use 1 2 pairwise_def in force)
         show "\<exists>T \<in> lmeasurable. T \<subseteq> f ` S \<and> m * ?\<mu> S - e \<le> ?\<mu> T"
         proof (intro bexI conjI)
           show "f ` (cbox a b) - f ` (\<Union>\<D>) \<subseteq> f ` S"
             using \<open>cbox a b - S \<subseteq> \<Union>\<D>\<close> by force
           have "m * ?\<mu> S - e \<le> m * (?\<mu> S - e / (1 + \<bar>m\<bar>))"
             using \<open>m \<ge> 0\<close> \<open>e > 0\<close> by (simp add: field_simps)
           also have "\<dots> \<le> ?\<mu> (f ` cbox a b) - ?\<mu> (f ` (\<Union>\<D>))"
           proof -
             have "?\<mu> (cbox a b - S) = ?\<mu> (cbox a b) - ?\<mu> S"
               by (simp add: measurable_measure_Diff \<open>S \<subseteq> cbox a b\<close> fmeasurableD that(2))
             then have "(?\<mu> S - e / (1 + m)) \<le> (content (cbox a b) - ?\<mu> (\<Union> \<D>))"
               using \<open>m \<ge> 0\<close> le by auto
             then show ?thesis
               using \<open>m \<ge> 0\<close> \<open>e > 0\<close>
               by (simp add: mult_left_mono im fUD [OF \<open>countable \<D>\<close> cbox intdisj] flip: right_diff_distrib)
           qed
           also have "\<dots> = ?\<mu> (f ` cbox a b - f ` \<Union>\<D>)"
           proof (rule measurable_measure_Diff [symmetric])
             show "f ` cbox a b \<in> lmeasurable"
               by (simp add: assms(1) measurable_linear_image_interval)
             show "f ` \<Union> \<D> \<in> sets lebesgue"
               by (simp add: \<open>countable \<D>\<close> cbox fUD fmeasurableD intdisj)
             show "f ` \<Union> \<D> \<subseteq> f ` cbox a b"
               by (simp add: Sup_le_iff cbox image_mono)
           qed
           finally show "m * ?\<mu> S - e \<le> ?\<mu> (f ` cbox a b - f ` \<Union>\<D>)" .
           show "f ` cbox a b - f ` \<Union>\<D> \<in> lmeasurable"
             by (simp add: fUD \<open>countable \<D>\<close> \<open>linear f\<close> cbox fmeasurable.Diff intdisj measurable_linear_image_interval)
         qed
       next
         fix e :: real
         assume "e > 0"
         have em: "0 < e / (1 + \<bar>m\<bar>)"
           using \<open>e > 0\<close> by (simp add: field_split_simps abs_add_one_gt_zero)
         obtain \<D>
           where "countable \<D>"
             and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
             and intdisj: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
             and DD: "S \<subseteq> \<Union>\<D>" "\<Union>\<D> \<in> lmeasurable"
             and le: "?\<mu> (\<Union>\<D>) \<le> ?\<mu> S + e/(1 + \<bar>m\<bar>)"
           by (rule measurable_outer_intervals_bounded [of S a b "e/(1 + \<bar>m\<bar>)"]; use \<open>S \<in> lmeasurable\<close> \<open>S \<subseteq> cbox a b\<close> em in force)
         show "\<exists>U \<in> lmeasurable. f ` S \<subseteq> U \<and> ?\<mu> U \<le> m * ?\<mu> S + e"
         proof (intro bexI conjI)
           show "f ` S \<subseteq> f ` (\<Union>\<D>)"
             by (simp add: DD(1) image_mono)
           have "?\<mu> (f ` \<Union>\<D>) \<le> m * (?\<mu> S + e / (1 + \<bar>m\<bar>))"
             using \<open>m \<ge> 0\<close> le mult_left_mono
             by (auto simp: fUD \<open>countable \<D>\<close> \<open>linear f\<close> cbox fmeasurable.Diff intdisj measurable_linear_image_interval)
           also have "\<dots> \<le> m * ?\<mu> S + e"
             using \<open>m \<ge> 0\<close> \<open>e > 0\<close> by (simp add: fUD [OF \<open>countable \<D>\<close> cbox intdisj] field_simps)
           finally show "?\<mu> (f ` \<Union>\<D>) \<le> m * ?\<mu> S + e" .
           show "f ` \<Union>\<D> \<in> lmeasurable"
             by (simp add: \<open>countable \<D>\<close> cbox fUD intdisj)
         qed
       qed
     qed
     show ?thesis
       unfolding has_measure_limit_iff
     proof (intro allI impI)
       fix e :: real
       assume "e > 0"
       obtain B where "B > 0" and B:
         "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> \<bar>?\<mu> (S \<inter> cbox a b) - ?\<mu> S\<bar> < e / (1 + \<bar>m\<bar>)"
         using has_measure_limit [OF S] \<open>e > 0\<close> by (metis abs_add_one_gt_zero zero_less_divide_iff)
       obtain c d::'n where cd: "ball 0 B \<subseteq> cbox c d"
         by (metis bounded_subset_cbox_symmetric bounded_ball)
       with B have less: "\<bar>?\<mu> (S \<inter> cbox c d) - ?\<mu> S\<bar> < e / (1 + \<bar>m\<bar>)" .
       obtain D where "D > 0" and D: "cbox c d \<subseteq> ball 0 D"
         by (metis bounded_cbox bounded_subset_ballD)
       obtain C where "C > 0" and C: "\<And>x. norm (f x) \<le> C * norm x"
         using linear_bounded_pos \<open>linear f\<close> by blast
       have "f ` S \<inter> cbox a b \<in> lmeasurable \<and>
             \<bar>?\<mu> (f ` S \<inter> cbox a b) - m * ?\<mu> S\<bar> < e"
         if "ball 0 (D*C) \<subseteq> cbox a b" for a b
       proof -
         have "bounded (S \<inter> h ` cbox a b)"
           by (simp add: bounded_linear_image linear_linear \<open>linear h\<close> bounded_Int)
         moreover have Shab: "S \<inter> h ` cbox a b \<in> lmeasurable"
           by (simp add: S \<open>linear h\<close> fmeasurable.Int measurable_linear_image_interval)
         moreover have fim: "f ` (S \<inter> h ` (cbox a b)) = (f ` S) \<inter> cbox a b"
           by (auto simp: hf rev_image_eqI fh)
         ultimately have 1: "(f ` S) \<inter> cbox a b \<in> lmeasurable"
               and 2: "?\<mu> ((f ` S) \<inter> cbox a b) = m * ?\<mu> (S \<inter> h ` cbox a b)"
           using fBS [of "S \<inter> (h ` (cbox a b))"] by auto
         have *: "\<lbrakk>\<bar>z - m\<bar> < e; z \<le> w; w \<le> m\<rbrakk> \<Longrightarrow> \<bar>w - m\<bar> \<le> e"
           for w z m and e::real by auto
         have meas_adiff: "\<bar>?\<mu> (S \<inter> h ` cbox a b) - ?\<mu> S\<bar> \<le> e / (1 + \<bar>m\<bar>)"
         proof (rule * [OF less])
           show "?\<mu> (S \<inter> cbox c d) \<le> ?\<mu> (S \<inter> h ` cbox a b)"
           proof (rule measure_mono_fmeasurable [OF _ _ Shab])
             have "f ` ball 0 D \<subseteq> ball 0 (C * D)"
               using C \<open>C > 0\<close>
               apply (clarsimp simp: algebra_simps)
               by (meson le_less_trans linordered_comm_semiring_strict_class.comm_mult_strict_left_mono)
             then have "f ` ball 0 D \<subseteq> cbox a b"
               by (metis mult.commute order_trans that)
             have "ball 0 D \<subseteq> h ` cbox a b"
               by (metis \<open>f ` ball 0 D \<subseteq> cbox a b\<close> hf image_subset_iff subsetI)
             then show "S \<inter> cbox c d \<subseteq> S \<inter> h ` cbox a b"
               using D by blast
           next
             show "S \<inter> cbox c d \<in> sets lebesgue"
               using S fmeasurable_cbox by blast
           qed
         next
           show "?\<mu> (S \<inter> h ` cbox a b) \<le> ?\<mu> S"
             by (simp add: S Shab fmeasurableD measure_mono_fmeasurable)
         qed
         have "\<bar>?\<mu> (f ` S \<inter> cbox a b) - m * ?\<mu> S\<bar> \<le> \<bar>?\<mu> S - ?\<mu> (S \<inter> h ` cbox a b)\<bar> * m"
           by (metis "2" \<open>m \<ge> 0\<close> abs_minus_commute abs_mult_pos mult.commute order_refl right_diff_distrib')
         also have "\<dots> \<le> e / (1 + m) * m"
           by (metis \<open>m \<ge> 0\<close> abs_minus_commute abs_of_nonneg meas_adiff mult.commute mult_left_mono)
         also have "\<dots> < e"
           using \<open>e > 0\<close> \<open>m \<ge> 0\<close> by (simp add: field_simps)
         finally have "\<bar>?\<mu> (f ` S \<inter> cbox a b) - m * ?\<mu> S\<bar> < e" .
         with 1 show ?thesis by auto
       qed
       then show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
                          f ` S \<inter> cbox a b \<in> lmeasurable \<and>
                          \<bar>?\<mu> (f ` S \<inter> cbox a b) - m * ?\<mu> S\<bar> < e"
         using \<open>C>0\<close> \<open>D>0\<close> by (metis mult_zero_left mult_less_iff1)
     qed
   qed
 qed
 
 subsection\<open>Lemmas about absolute integrability\<close>
 
 lemma absolutely_integrable_linear:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
     and h :: "'n::euclidean_space \<Rightarrow> 'p::euclidean_space"
   shows "f absolutely_integrable_on s \<Longrightarrow> bounded_linear h \<Longrightarrow> (h \<circ> f) absolutely_integrable_on s"
   using integrable_bounded_linear[of h lebesgue "\<lambda>x. indicator s x *\<^sub>R f x"]
   by (simp add: linear_simps[of h] set_integrable_def)
 
 lemma absolutely_integrable_sum:
   fixes f :: "'a \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "finite T" and "\<And>a. a \<in> T \<Longrightarrow> (f a) absolutely_integrable_on S"
   shows "(\<lambda>x. sum (\<lambda>a. f a x) T) absolutely_integrable_on S"
   using assms by induction auto
 
 lemma absolutely_integrable_integrable_bound:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes le: "\<And>x. x\<in>S \<Longrightarrow> norm (f x) \<le> g x" and f: "f integrable_on S" and g: "g integrable_on S"
   shows "f absolutely_integrable_on S"
     unfolding set_integrable_def
 proof (rule Bochner_Integration.integrable_bound)
   have "g absolutely_integrable_on S"
     unfolding absolutely_integrable_on_def
   proof
     show "(\<lambda>x. norm (g x)) integrable_on S"
       using le norm_ge_zero[of "f _"]
       by (intro integrable_spike_finite[OF _ _ g, of "{}"])
          (auto intro!: abs_of_nonneg intro: order_trans simp del: norm_ge_zero)
   qed fact
   then show "integrable lebesgue (\<lambda>x. indicat_real S x *\<^sub>R g x)"
     by (simp add: set_integrable_def)
   show "(\<lambda>x. indicat_real S x *\<^sub>R f x) \<in> borel_measurable lebesgue"
     using f by (auto intro: has_integral_implies_lebesgue_measurable simp: integrable_on_def)
 qed (use le in \<open>force intro!: always_eventually split: split_indicator\<close>)
 
 corollary absolutely_integrable_on_const [simp]:
   fixes c :: "'a::euclidean_space"
   assumes "S \<in> lmeasurable"
   shows "(\<lambda>x. c) absolutely_integrable_on S"
   by (metis (full_types) assms absolutely_integrable_integrable_bound integrable_on_const order_refl)
 
 lemma absolutely_integrable_continuous:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "continuous_on (cbox a b) f \<Longrightarrow> f absolutely_integrable_on cbox a b"
   using absolutely_integrable_integrable_bound
   by (simp add: absolutely_integrable_on_def continuous_on_norm integrable_continuous)
 
 lemma absolutely_integrable_continuous_real:
   fixes f :: "real \<Rightarrow> 'b::euclidean_space"
   shows "continuous_on {a..b} f \<Longrightarrow> f absolutely_integrable_on {a..b}"
   by (metis absolutely_integrable_continuous box_real(2))
 
 lemma continuous_imp_integrable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "continuous_on (cbox a b) f"
   shows "integrable (lebesgue_on (cbox a b)) f"
 proof -
   have "f absolutely_integrable_on cbox a b"
     by (simp add: absolutely_integrable_continuous assms)
   then show ?thesis
     by (simp add: integrable_restrict_space set_integrable_def)
 qed
 
 lemma continuous_imp_integrable_real:
   fixes f :: "real \<Rightarrow> 'b::euclidean_space"
   assumes "continuous_on {a..b} f"
   shows "integrable (lebesgue_on {a..b}) f"
   by (metis assms continuous_imp_integrable interval_cbox)
 
 
 
 subsection \<open>Componentwise\<close>
 
 proposition absolutely_integrable_componentwise_iff:
   shows "f absolutely_integrable_on A \<longleftrightarrow> (\<forall>b\<in>Basis. (\<lambda>x. f x \<bullet> b) absolutely_integrable_on A)"
 proof -
   have *: "(\<lambda>x. norm (f x)) integrable_on A \<longleftrightarrow> (\<forall>b\<in>Basis. (\<lambda>x. norm (f x \<bullet> b)) integrable_on A)" (is "?lhs = ?rhs")
     if "f integrable_on A"
   proof
     assume ?lhs
     then show ?rhs
       by (metis absolutely_integrable_on_def Topology_Euclidean_Space.norm_nth_le absolutely_integrable_integrable_bound integrable_component that)
   next
     assume R: ?rhs
     have "f absolutely_integrable_on A"
     proof (rule absolutely_integrable_integrable_bound)
       show "(\<lambda>x. \<Sum>i\<in>Basis. norm (f x \<bullet> i)) integrable_on A"
         using R by (force intro: integrable_sum)
     qed (use that norm_le_l1 in auto)
     then show ?lhs
       using absolutely_integrable_on_def by auto
   qed
   show ?thesis
     unfolding absolutely_integrable_on_def
     by (simp add:  integrable_componentwise_iff [symmetric] ball_conj_distrib * cong: conj_cong)
 qed
 
 lemma absolutely_integrable_componentwise:
   shows "(\<And>b. b \<in> Basis \<Longrightarrow> (\<lambda>x. f x \<bullet> b) absolutely_integrable_on A) \<Longrightarrow> f absolutely_integrable_on A"
   using absolutely_integrable_componentwise_iff by blast
 
 lemma absolutely_integrable_component:
   "f absolutely_integrable_on A \<Longrightarrow> (\<lambda>x. f x \<bullet> (b :: 'b :: euclidean_space)) absolutely_integrable_on A"
   by (drule absolutely_integrable_linear[OF _ bounded_linear_inner_left[of b]]) (simp add: o_def)
 
 
 lemma absolutely_integrable_scaleR_left:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
     assumes "f absolutely_integrable_on S"
   shows "(\<lambda>x. c *\<^sub>R f x) absolutely_integrable_on S"
 proof -
   have "(\<lambda>x. c *\<^sub>R x) o f absolutely_integrable_on S"
     by (simp add: absolutely_integrable_linear assms bounded_linear_scaleR_right)
   then show ?thesis
     using assms by blast
 qed
 
 lemma absolutely_integrable_scaleR_right:
   assumes "f absolutely_integrable_on S"
   shows "(\<lambda>x. f x *\<^sub>R c) absolutely_integrable_on S"
   using assms by blast
 
 lemma absolutely_integrable_norm:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes "f absolutely_integrable_on S"
   shows "(norm o f) absolutely_integrable_on S"
   using assms by (simp add: absolutely_integrable_on_def o_def)
 
 lemma absolutely_integrable_abs:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes "f absolutely_integrable_on S"
   shows "(\<lambda>x. \<Sum>i\<in>Basis. \<bar>f x \<bullet> i\<bar> *\<^sub>R i) absolutely_integrable_on S"
         (is "?g absolutely_integrable_on S")
 proof -
   have *: "(\<lambda>y. \<Sum>j\<in>Basis. if j = i then y *\<^sub>R j else 0) \<circ>
            (\<lambda>x. norm (\<Sum>j\<in>Basis. if j = i then (x \<bullet> i) *\<^sub>R j else 0)) \<circ> f
            absolutely_integrable_on S"
         if "i \<in> Basis" for i
   proof -
     have "bounded_linear (\<lambda>y. \<Sum>j\<in>Basis. if j = i then y *\<^sub>R j else 0)"
       by (simp add: linear_linear algebra_simps linearI)
     moreover have "(\<lambda>x. norm (\<Sum>j\<in>Basis. if j = i then (x \<bullet> i) *\<^sub>R j else 0)) \<circ> f
                    absolutely_integrable_on S"
       using assms \<open>i \<in> Basis\<close>
       unfolding o_def
       by (intro absolutely_integrable_norm [unfolded o_def])
          (auto simp: algebra_simps dest: absolutely_integrable_component)
     ultimately show ?thesis
       by (subst comp_assoc) (blast intro: absolutely_integrable_linear)
   qed
   have eq: "?g =
         (\<lambda>x. \<Sum>i\<in>Basis. ((\<lambda>y. \<Sum>j\<in>Basis. if j = i then y *\<^sub>R j else 0) \<circ>
                (\<lambda>x. norm(\<Sum>j\<in>Basis. if j = i then (x \<bullet> i) *\<^sub>R j else 0)) \<circ> f) x)"
     by (simp)
   show ?thesis
     unfolding eq
     by (rule absolutely_integrable_sum) (force simp: intro!: *)+
 qed
 
 lemma abs_absolutely_integrableI_1:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes f: "f integrable_on A" and "(\<lambda>x. \<bar>f x\<bar>) integrable_on A"
   shows "f absolutely_integrable_on A"
   by (rule absolutely_integrable_integrable_bound [OF _ assms]) auto
 
 
 lemma abs_absolutely_integrableI:
   assumes f: "f integrable_on S" and fcomp: "(\<lambda>x. \<Sum>i\<in>Basis. \<bar>f x \<bullet> i\<bar> *\<^sub>R i) integrable_on S"
   shows "f absolutely_integrable_on S"
 proof -
   have "(\<lambda>x. (f x \<bullet> i) *\<^sub>R i) absolutely_integrable_on S" if "i \<in> Basis" for i
   proof -
     have "(\<lambda>x. \<bar>f x \<bullet> i\<bar>) integrable_on S"
       using assms integrable_component [OF fcomp, where y=i] that by simp
     then have "(\<lambda>x. f x \<bullet> i) absolutely_integrable_on S"
       using abs_absolutely_integrableI_1 f integrable_component by blast
     then show ?thesis
       by (rule absolutely_integrable_scaleR_right)
   qed
   then have "(\<lambda>x. \<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i) absolutely_integrable_on S"
     by (simp add: absolutely_integrable_sum)
   then show ?thesis
     by (simp add: euclidean_representation)
 qed
 
 
 lemma absolutely_integrable_abs_iff:
    "f absolutely_integrable_on S \<longleftrightarrow>
     f integrable_on S \<and> (\<lambda>x. \<Sum>i\<in>Basis. \<bar>f x \<bullet> i\<bar> *\<^sub>R i) integrable_on S"
     (is "?lhs = ?rhs")
 proof
   assume ?lhs then show ?rhs
     using absolutely_integrable_abs absolutely_integrable_on_def by blast
 next
   assume ?rhs
   moreover
   have "(\<lambda>x. if x \<in> S then \<Sum>i\<in>Basis. \<bar>f x \<bullet> i\<bar> *\<^sub>R i else 0) = (\<lambda>x. \<Sum>i\<in>Basis. \<bar>(if x \<in> S then f x else 0) \<bullet> i\<bar> *\<^sub>R i)"
     by force
   ultimately show ?lhs
     by (simp only: absolutely_integrable_restrict_UNIV [of S, symmetric] integrable_restrict_UNIV [of S, symmetric] abs_absolutely_integrableI)
 qed
 
 lemma absolutely_integrable_max:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "f absolutely_integrable_on S" "g absolutely_integrable_on S"
    shows "(\<lambda>x. \<Sum>i\<in>Basis. max (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i)
             absolutely_integrable_on S"
 proof -
   have "(\<lambda>x. \<Sum>i\<in>Basis. max (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) =
         (\<lambda>x. (1/2) *\<^sub>R (f x + g x + (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i)))"
   proof (rule ext)
     fix x
     have "(\<Sum>i\<in>Basis. max (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) = (\<Sum>i\<in>Basis. ((f x \<bullet> i + g x \<bullet> i + \<bar>f x \<bullet> i - g x \<bullet> i\<bar>) / 2) *\<^sub>R i)"
       by (force intro: sum.cong)
     also have "... = (1 / 2) *\<^sub>R (\<Sum>i\<in>Basis. (f x \<bullet> i + g x \<bullet> i + \<bar>f x \<bullet> i - g x \<bullet> i\<bar>) *\<^sub>R i)"
       by (simp add: scaleR_right.sum)
     also have "... = (1 / 2) *\<^sub>R (f x + g x + (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i))"
       by (simp add: sum.distrib algebra_simps euclidean_representation)
     finally
     show "(\<Sum>i\<in>Basis. max (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) =
          (1 / 2) *\<^sub>R (f x + g x + (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i))" .
   qed
   moreover have "(\<lambda>x. (1 / 2) *\<^sub>R (f x + g x + (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i)))
                  absolutely_integrable_on S"
     using absolutely_integrable_abs [OF set_integral_diff(1) [OF assms]]
     by (intro set_integral_add absolutely_integrable_scaleR_left assms) (simp add: algebra_simps)
   ultimately show ?thesis by metis
 qed
 
 corollary absolutely_integrable_max_1:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "f absolutely_integrable_on S" "g absolutely_integrable_on S"
    shows "(\<lambda>x. max (f x) (g x)) absolutely_integrable_on S"
   using absolutely_integrable_max [OF assms] by simp
 
 lemma absolutely_integrable_min:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "f absolutely_integrable_on S" "g absolutely_integrable_on S"
    shows "(\<lambda>x. \<Sum>i\<in>Basis. min (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i)
             absolutely_integrable_on S"
 proof -
   have "(\<lambda>x. \<Sum>i\<in>Basis. min (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) =
         (\<lambda>x. (1/2) *\<^sub>R (f x + g x - (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i)))"
   proof (rule ext)
     fix x
     have "(\<Sum>i\<in>Basis. min (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) = (\<Sum>i\<in>Basis. ((f x \<bullet> i + g x \<bullet> i - \<bar>f x \<bullet> i - g x \<bullet> i\<bar>) / 2) *\<^sub>R i)"
       by (force intro: sum.cong)
     also have "... = (1 / 2) *\<^sub>R (\<Sum>i\<in>Basis. (f x \<bullet> i + g x \<bullet> i - \<bar>f x \<bullet> i - g x \<bullet> i\<bar>) *\<^sub>R i)"
       by (simp add: scaleR_right.sum)
     also have "... = (1 / 2) *\<^sub>R (f x + g x - (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i))"
       by (simp add: sum.distrib sum_subtractf algebra_simps euclidean_representation)
     finally
     show "(\<Sum>i\<in>Basis. min (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) =
          (1 / 2) *\<^sub>R (f x + g x - (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i))" .
   qed
   moreover have "(\<lambda>x. (1 / 2) *\<^sub>R (f x + g x - (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i)))
                  absolutely_integrable_on S"
     using absolutely_integrable_abs [OF set_integral_diff(1) [OF assms]]
     by (intro set_integral_add set_integral_diff absolutely_integrable_scaleR_left assms)
        (simp add: algebra_simps)
   ultimately show ?thesis by metis
 qed
 
 corollary absolutely_integrable_min_1:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "f absolutely_integrable_on S" "g absolutely_integrable_on S"
    shows "(\<lambda>x. min (f x) (g x)) absolutely_integrable_on S"
   using absolutely_integrable_min [OF assms] by simp
 
 lemma nonnegative_absolutely_integrable:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes "f integrable_on A" and comp: "\<And>x b. \<lbrakk>x \<in> A; b \<in> Basis\<rbrakk> \<Longrightarrow> 0 \<le> f x \<bullet> b"
   shows "f absolutely_integrable_on A"
 proof -
   have "(\<lambda>x. (f x \<bullet> i) *\<^sub>R i) absolutely_integrable_on A" if "i \<in> Basis" for i
   proof -
     have "(\<lambda>x. f x \<bullet> i) integrable_on A"
       by (simp add: assms(1) integrable_component)
     then have "(\<lambda>x. f x \<bullet> i) absolutely_integrable_on A"
       by (metis that comp nonnegative_absolutely_integrable_1)
     then show ?thesis
       by (rule absolutely_integrable_scaleR_right)
   qed
   then have "(\<lambda>x. \<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i) absolutely_integrable_on A"
     by (simp add: absolutely_integrable_sum)
   then show ?thesis
     by (simp add: euclidean_representation)
 qed
 
 lemma absolutely_integrable_component_ubound:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes f: "f integrable_on A" and g: "g absolutely_integrable_on A"
       and comp: "\<And>x b. \<lbrakk>x \<in> A; b \<in> Basis\<rbrakk> \<Longrightarrow> f x \<bullet> b \<le> g x \<bullet> b"
   shows "f absolutely_integrable_on A"
 proof -
   have "(\<lambda>x. g x - (g x - f x)) absolutely_integrable_on A"
   proof (rule set_integral_diff [OF g nonnegative_absolutely_integrable])
     show "(\<lambda>x. g x - f x) integrable_on A"
       using Henstock_Kurzweil_Integration.integrable_diff absolutely_integrable_on_def f g by blast
   qed (simp add: comp inner_diff_left)
   then show ?thesis
     by simp
 qed
 
 lemma absolutely_integrable_component_lbound:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes f: "f absolutely_integrable_on A" and g: "g integrable_on A"
       and comp: "\<And>x b. \<lbrakk>x \<in> A; b \<in> Basis\<rbrakk> \<Longrightarrow> f x \<bullet> b \<le> g x \<bullet> b"
   shows "g absolutely_integrable_on A"
 proof -
   have "(\<lambda>x. f x + (g x - f x)) absolutely_integrable_on A"
   proof (rule set_integral_add [OF f nonnegative_absolutely_integrable])
     show "(\<lambda>x. g x - f x) integrable_on A"
       using Henstock_Kurzweil_Integration.integrable_diff absolutely_integrable_on_def f g by blast
   qed (simp add: comp inner_diff_left)
   then show ?thesis
     by simp
 qed
 
 lemma integrable_on_1_iff:
   fixes f :: "'a::euclidean_space \<Rightarrow> real^1"
   shows "f integrable_on S \<longleftrightarrow> (\<lambda>x. f x $ 1) integrable_on S"
   by (auto simp: integrable_componentwise_iff [of f] Basis_vec_def cart_eq_inner_axis)
 
 lemma integral_on_1_eq:
   fixes f :: "'a::euclidean_space \<Rightarrow> real^1"
   shows "integral S f = vec (integral S (\<lambda>x. f x $ 1))"
 by (cases "f integrable_on S") (simp_all add: integrable_on_1_iff vec_eq_iff not_integrable_integral)
 
 lemma absolutely_integrable_on_1_iff:
   fixes f :: "'a::euclidean_space \<Rightarrow> real^1"
   shows "f absolutely_integrable_on S \<longleftrightarrow> (\<lambda>x. f x $ 1) absolutely_integrable_on S"
   unfolding absolutely_integrable_on_def
   by (auto simp: integrable_on_1_iff norm_real)
 
 lemma absolutely_integrable_absolutely_integrable_lbound:
   fixes f :: "'m::euclidean_space \<Rightarrow> real"
   assumes f: "f integrable_on S" and g: "g absolutely_integrable_on S"
     and *: "\<And>x. x \<in> S \<Longrightarrow> g x \<le> f x"
   shows "f absolutely_integrable_on S"
   by (rule absolutely_integrable_component_lbound [OF g f]) (simp add: *)
 
 lemma absolutely_integrable_absolutely_integrable_ubound:
   fixes f :: "'m::euclidean_space \<Rightarrow> real"
   assumes fg: "f integrable_on S" "g absolutely_integrable_on S"
     and *: "\<And>x. x \<in> S \<Longrightarrow> f x \<le> g x"
   shows "f absolutely_integrable_on S"
   by (rule absolutely_integrable_component_ubound [OF fg]) (simp add: *)
 
 lemma has_integral_vec1_I_cbox:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral y) (cbox a b)"
   shows "((f \<circ> vec) has_integral y) {a$1..b$1}"
 proof -
   have "((\<lambda>x. f(vec x)) has_integral (1 / 1) *\<^sub>R y) ((\<lambda>x. x $ 1) ` cbox a b)"
   proof (rule has_integral_twiddle)
     show "\<exists>w z::real^1. vec ` cbox u v = cbox w z"
          "content (vec ` cbox u v :: (real^1) set) = 1 * content (cbox u v)" for u v
       unfolding vec_cbox_1_eq
       by (auto simp: content_cbox_if_cart interval_eq_empty_cart)
     show "\<exists>w z. (\<lambda>x. x $ 1) ` cbox u v = cbox w z" for u v :: "real^1"
       using vec_nth_cbox_1_eq by blast
   qed (auto simp: continuous_vec assms)
   then show ?thesis
     by (simp add: o_def)
 qed
 
 lemma has_integral_vec1_I:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral y) S"
   shows "(f \<circ> vec has_integral y) ((\<lambda>x. x $ 1) ` S)"
 proof -
   have *: "\<exists>z. ((\<lambda>x. if x \<in> (\<lambda>x. x $ 1) ` S then (f \<circ> vec) x else 0) has_integral z) {a..b} \<and> norm (z - y) < e"
     if int: "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow>
                     (\<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b) \<and> norm (z - y) < e)"
       and B: "ball 0 B \<subseteq> {a..b}" for e B a b
   proof -
     have [simp]: "(\<exists>y\<in>S. x = y $ 1) \<longleftrightarrow> vec x \<in> S" for x
       by force
     have B': "ball (0::real^1) B \<subseteq> cbox (vec a) (vec b)"
       using B by (simp add: Basis_vec_def cart_eq_inner_axis [symmetric] mem_box norm_real subset_iff)
     show ?thesis
       using int [OF B'] by (auto simp: image_iff o_def cong: if_cong dest!: has_integral_vec1_I_cbox)
   qed
   show ?thesis
     using assms
     apply (subst has_integral_alt)
     apply (subst (asm) has_integral_alt)
     apply (simp add: has_integral_vec1_I_cbox split: if_split_asm)
     subgoal by (metis vector_one_nth)
     subgoal
       apply (erule all_forward imp_forward ex_forward asm_rl)+
       by (blast intro!: *)+
     done
 qed
 
 lemma has_integral_vec1_nth_cbox:
   fixes f :: "real \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral y) {a..b}"
   shows "((\<lambda>x::real^1. f(x$1)) has_integral y) (cbox (vec a) (vec b))"
 proof -
   have "((\<lambda>x::real^1. f(x$1)) has_integral (1 / 1) *\<^sub>R y) (vec ` cbox a b)"
   proof (rule has_integral_twiddle)
     show "\<exists>w z::real. (\<lambda>x. x $ 1) ` cbox u v = cbox w z"
          "content ((\<lambda>x. x $ 1) ` cbox u v) = 1 * content (cbox u v)" for u v::"real^1"
       unfolding vec_cbox_1_eq by (auto simp: content_cbox_if_cart interval_eq_empty_cart)
     show "\<exists>w z::real^1. vec ` cbox u v = cbox w z" for u v :: "real"
       using vec_cbox_1_eq by auto
   qed (auto simp: continuous_vec assms)
   then show ?thesis
     using vec_cbox_1_eq by auto
 qed
 
 lemma has_integral_vec1_D_cbox:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   assumes "((f \<circ> vec) has_integral y) {a$1..b$1}"
   shows "(f has_integral y) (cbox a b)"
   by (metis (mono_tags, lifting) assms comp_apply has_integral_eq has_integral_vec1_nth_cbox vector_one_nth)
 
 lemma has_integral_vec1_D:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   assumes "((f \<circ> vec) has_integral y) ((\<lambda>x. x $ 1) ` S)"
   shows "(f has_integral y) S"
 proof -
   have *: "\<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b) \<and> norm (z - y) < e"
     if int: "\<And>a b. ball 0 B \<subseteq> {a..b} \<Longrightarrow>
                              (\<exists>z. ((\<lambda>x. if x \<in> (\<lambda>x. x $ 1) ` S then (f \<circ> vec) x else 0) has_integral z) {a..b} \<and> norm (z - y) < e)"
       and B: "ball 0 B \<subseteq> cbox a b" for e B and a b::"real^1"
   proof -
     have B': "ball 0 B \<subseteq> {a$1..b$1}"
     proof (clarsimp)
       fix t
       assume "\<bar>t\<bar> < B" then show "a $ 1 \<le> t \<and> t \<le> b $ 1"
         using subsetD [OF B]
         by (metis (mono_tags, hide_lams) mem_ball_0 mem_box_cart(2) norm_real vec_component)
     qed
     have eq: "(\<lambda>x. if vec x \<in> S then f (vec x) else 0) = (\<lambda>x. if x \<in> S then f x else 0) \<circ> vec"
       by force
     have [simp]: "(\<exists>y\<in>S. x = y $ 1) \<longleftrightarrow> vec x \<in> S" for x
       by force
     show ?thesis
       using int [OF B'] by (auto simp: image_iff eq cong: if_cong dest!: has_integral_vec1_D_cbox)
 qed
   show ?thesis
     using assms
     apply (subst has_integral_alt)
     apply (subst (asm) has_integral_alt)
     apply (simp add: has_integral_vec1_D_cbox eq_cbox split: if_split_asm, blast)
     apply (intro conjI impI)
     subgoal by (metis vector_one_nth)
     apply (erule thin_rl)
     apply (erule all_forward ex_forward conj_forward)+
       by (blast intro!: *)+
 qed
 
 
 lemma integral_vec1_eq:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   shows "integral S f = integral ((\<lambda>x. x $ 1) ` S) (f \<circ> vec)"
   using has_integral_vec1_I [of f] has_integral_vec1_D [of f]
   by (metis has_integral_iff not_integrable_integral)
 
 lemma absolutely_integrable_drop:
   fixes f :: "real^1 \<Rightarrow> 'b::euclidean_space"
   shows "f absolutely_integrable_on S \<longleftrightarrow> (f \<circ> vec) absolutely_integrable_on (\<lambda>x. x $ 1) ` S"
   unfolding absolutely_integrable_on_def integrable_on_def
 proof safe
   fix y r
   assume "(f has_integral y) S" "((\<lambda>x. norm (f x)) has_integral r) S"
   then show "\<exists>y. (f \<circ> vec has_integral y) ((\<lambda>x. x $ 1) ` S)"
             "\<exists>y. ((\<lambda>x. norm ((f \<circ> vec) x)) has_integral y) ((\<lambda>x. x $ 1) ` S)"
     by (force simp: o_def dest!: has_integral_vec1_I)+
 next
   fix y :: "'b" and r :: "real"
   assume "(f \<circ> vec has_integral y) ((\<lambda>x. x $ 1) ` S)"
          "((\<lambda>x. norm ((f \<circ> vec) x)) has_integral r) ((\<lambda>x. x $ 1) ` S)"
   then show "\<exists>y. (f has_integral y) S"  "\<exists>y. ((\<lambda>x. norm (f x)) has_integral y) S"
     by (force simp: o_def intro: has_integral_vec1_D)+
 qed
 
 subsection \<open>Dominated convergence\<close>
 
 lemma dominated_convergence:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes f: "\<And>k. (f k) integrable_on S" and h: "h integrable_on S"
     and le: "\<And>k x. x \<in> S \<Longrightarrow> norm (f k x) \<le> h x"
     and conv: "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
   shows "g integrable_on S" "(\<lambda>k. integral S (f k)) \<longlonglongrightarrow> integral S g"
 proof -
   have 3: "h absolutely_integrable_on S"
     unfolding absolutely_integrable_on_def
   proof
     show "(\<lambda>x. norm (h x)) integrable_on S"
     proof (intro integrable_spike_finite[OF _ _ h, of "{}"] ballI)
       fix x assume "x \<in> S - {}" then show "norm (h x) = h x"
         by (metis Diff_empty abs_of_nonneg bot_set_def le norm_ge_zero order_trans real_norm_def)
     qed auto
   qed fact
   have 2: "set_borel_measurable lebesgue S (f k)" for k
     unfolding set_borel_measurable_def
     using f by (auto intro: has_integral_implies_lebesgue_measurable simp: integrable_on_def)
   then have 1: "set_borel_measurable lebesgue S g"
     unfolding set_borel_measurable_def
     by (rule borel_measurable_LIMSEQ_metric) (use conv in \<open>auto split: split_indicator\<close>)
   have 4: "AE x in lebesgue. (\<lambda>i. indicator S x *\<^sub>R f i x) \<longlonglongrightarrow> indicator S x *\<^sub>R g x"
     "AE x in lebesgue. norm (indicator S x *\<^sub>R f k x) \<le> indicator S x *\<^sub>R h x" for k
     using conv le by (auto intro!: always_eventually split: split_indicator)
   have g: "g absolutely_integrable_on S"
     using 1 2 3 4 unfolding set_borel_measurable_def set_integrable_def
     by (rule integrable_dominated_convergence)
   then show "g integrable_on S"
     by (auto simp: absolutely_integrable_on_def)
   have "(\<lambda>k. (LINT x:S|lebesgue. f k x)) \<longlonglongrightarrow> (LINT x:S|lebesgue. g x)"
     unfolding set_borel_measurable_def set_lebesgue_integral_def
     using 1 2 3 4 unfolding set_borel_measurable_def set_lebesgue_integral_def set_integrable_def
     by (rule integral_dominated_convergence)
   then show "(\<lambda>k. integral S (f k)) \<longlonglongrightarrow> integral S g"
     using g absolutely_integrable_integrable_bound[OF le f h]
     by (subst (asm) (1 2) set_lebesgue_integral_eq_integral) auto
 qed
 
 lemma has_integral_dominated_convergence:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "\<And>k. (f k has_integral y k) S" "h integrable_on S"
     "\<And>k. \<forall>x\<in>S. norm (f k x) \<le> h x" "\<forall>x\<in>S. (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
     and x: "y \<longlonglongrightarrow> x"
   shows "(g has_integral x) S"
 proof -
   have int_f: "\<And>k. (f k) integrable_on S"
     using assms by (auto simp: integrable_on_def)
   have "(g has_integral (integral S g)) S"
     by (metis assms(2-4) dominated_convergence(1) has_integral_integral int_f)
   moreover have "integral S g = x"
   proof (rule LIMSEQ_unique)
     show "(\<lambda>i. integral S (f i)) \<longlonglongrightarrow> x"
       using integral_unique[OF assms(1)] x by simp
     show "(\<lambda>i. integral S (f i)) \<longlonglongrightarrow> integral S g"
       by (metis assms(2) assms(3) assms(4) dominated_convergence(2) int_f)
   qed
   ultimately show ?thesis
     by simp
 qed
 
 lemma dominated_convergence_integrable_1:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real"
   assumes f: "\<And>k. f k absolutely_integrable_on S"
     and h: "h integrable_on S"
     and normg: "\<And>x. x \<in> S \<Longrightarrow> norm(g x) \<le> (h x)"
     and lim: "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
  shows "g integrable_on S"
 proof -
   have habs: "h absolutely_integrable_on S"
     using h normg nonnegative_absolutely_integrable_1 norm_ge_zero order_trans by blast
   let ?f = "\<lambda>n x. (min (max (- h x) (f n x)) (h x))"
   have h0: "h x \<ge> 0" if "x \<in> S" for x
     using normg that by force
   have leh: "norm (?f k x) \<le> h x" if "x \<in> S" for k x
     using h0 that by force
   have limf: "(\<lambda>k. ?f k x) \<longlonglongrightarrow> g x" if "x \<in> S" for x
   proof -
     have "\<And>e y. \<bar>f y x - g x\<bar> < e \<Longrightarrow> \<bar>min (max (- h x) (f y x)) (h x) - g x\<bar> < e"
       using h0 [OF that] normg [OF that] by simp
     then show ?thesis
       using lim [OF that] by (auto simp add: tendsto_iff dist_norm elim!: eventually_mono)
   qed
   show ?thesis
   proof (rule dominated_convergence [of ?f S h g])
     have "(\<lambda>x. - h x) absolutely_integrable_on S"
       using habs unfolding set_integrable_def by auto
     then show "?f k integrable_on S" for k
       by (intro set_lebesgue_integral_eq_integral absolutely_integrable_min_1 absolutely_integrable_max_1 f habs)
   qed (use assms leh limf in auto)
 qed
 
 lemma dominated_convergence_integrable:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes f: "\<And>k. f k absolutely_integrable_on S"
     and h: "h integrable_on S"
     and normg: "\<And>x. x \<in> S \<Longrightarrow> norm(g x) \<le> (h x)"
     and lim: "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
   shows "g integrable_on S"
   using f
   unfolding integrable_componentwise_iff [of g] absolutely_integrable_componentwise_iff [where f = "f k" for k]
 proof clarify
   fix b :: "'m"
   assume fb [rule_format]: "\<And>k. \<forall>b\<in>Basis. (\<lambda>x. f k x \<bullet> b) absolutely_integrable_on S" and b: "b \<in> Basis"
   show "(\<lambda>x. g x \<bullet> b) integrable_on S"
   proof (rule dominated_convergence_integrable_1 [OF fb h])
     fix x
     assume "x \<in> S"
     show "norm (g x \<bullet> b) \<le> h x"
       using norm_nth_le \<open>x \<in> S\<close> b normg order.trans by blast
     show "(\<lambda>k. f k x \<bullet> b) \<longlonglongrightarrow> g x \<bullet> b"
       using \<open>x \<in> S\<close> b lim tendsto_componentwise_iff by fastforce
   qed (use b in auto)
 qed
 
 lemma dominated_convergence_absolutely_integrable:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes f: "\<And>k. f k absolutely_integrable_on S"
     and h: "h integrable_on S"
     and normg: "\<And>x. x \<in> S \<Longrightarrow> norm(g x) \<le> (h x)"
     and lim: "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
   shows "g absolutely_integrable_on S"
 proof -
   have "g integrable_on S"
     by (rule dominated_convergence_integrable [OF assms])
   with assms show ?thesis
     by (blast intro:  absolutely_integrable_integrable_bound [where g=h])
 qed
 
 
 proposition integral_countable_UN:
   fixes f :: "real^'m \<Rightarrow> real^'n"
   assumes f: "f absolutely_integrable_on (\<Union>(range s))"
     and s: "\<And>m. s m \<in> sets lebesgue"
   shows "\<And>n. f absolutely_integrable_on (\<Union>m\<le>n. s m)"
     and "(\<lambda>n. integral (\<Union>m\<le>n. s m) f) \<longlonglongrightarrow> integral (\<Union>(s ` UNIV)) f" (is "?F \<longlonglongrightarrow> ?I")
 proof -
   show fU: "f absolutely_integrable_on (\<Union>m\<le>n. s m)" for n
     using assms by (blast intro: set_integrable_subset [OF f])
   have fint: "f integrable_on (\<Union> (range s))"
     using absolutely_integrable_on_def f by blast
   let ?h = "\<lambda>x. if x \<in> \<Union>(s ` UNIV) then norm(f x) else 0"
   have "(\<lambda>n. integral UNIV (\<lambda>x. if x \<in> (\<Union>m\<le>n. s m) then f x else 0))
         \<longlonglongrightarrow> integral UNIV (\<lambda>x. if x \<in> \<Union>(s ` UNIV) then f x else 0)"
   proof (rule dominated_convergence)
     show "(\<lambda>x. if x \<in> (\<Union>m\<le>n. s m) then f x else 0) integrable_on UNIV" for n
       unfolding integrable_restrict_UNIV
       using fU absolutely_integrable_on_def by blast
     show "(\<lambda>x. if x \<in> \<Union>(s ` UNIV) then norm(f x) else 0) integrable_on UNIV"
       by (metis (no_types) absolutely_integrable_on_def f integrable_restrict_UNIV)
     show "\<And>x. (\<lambda>n. if x \<in> (\<Union>m\<le>n. s m) then f x else 0)
          \<longlonglongrightarrow> (if x \<in> \<Union>(s ` UNIV) then f x else 0)"
       by (force intro: tendsto_eventually eventually_sequentiallyI)
   qed auto
   then show "?F \<longlonglongrightarrow> ?I"
     by (simp only: integral_restrict_UNIV)
 qed
 
 
 subsection \<open>Fundamental Theorem of Calculus for the Lebesgue integral\<close>
 
 text \<open>
 
 For the positive integral we replace continuity with Borel-measurability.
 
 \<close>
 
 lemma
   fixes f :: "real \<Rightarrow> real"
   assumes [measurable]: "f \<in> borel_measurable borel"
   assumes f: "\<And>x. x \<in> {a..b} \<Longrightarrow> DERIV F x :> f x" "\<And>x. x \<in> {a..b} \<Longrightarrow> 0 \<le> f x" and "a \<le> b"
   shows nn_integral_FTC_Icc: "(\<integral>\<^sup>+x. ennreal (f x) * indicator {a .. b} x \<partial>lborel) = F b - F a" (is ?nn)
     and has_bochner_integral_FTC_Icc_nonneg:
       "has_bochner_integral lborel (\<lambda>x. f x * indicator {a .. b} x) (F b - F a)" (is ?has)
     and integral_FTC_Icc_nonneg: "(\<integral>x. f x * indicator {a .. b} x \<partial>lborel) = F b - F a" (is ?eq)
     and integrable_FTC_Icc_nonneg: "integrable lborel (\<lambda>x. f x * indicator {a .. b} x)" (is ?int)
 proof -
   have *: "(\<lambda>x. f x * indicator {a..b} x) \<in> borel_measurable borel" "\<And>x. 0 \<le> f x * indicator {a..b} x"
     using f(2) by (auto split: split_indicator)
 
   have F_mono: "a \<le> x \<Longrightarrow> x \<le> y \<Longrightarrow> y \<le> b\<Longrightarrow> F x \<le> F y" for x y
     using f by (intro DERIV_nonneg_imp_nondecreasing[of x y F]) (auto intro: order_trans)
 
   have "(f has_integral F b - F a) {a..b}"
     by (intro fundamental_theorem_of_calculus)
        (auto simp: has_field_derivative_iff_has_vector_derivative[symmetric]
              intro: has_field_derivative_subset[OF f(1)] \<open>a \<le> b\<close>)
   then have i: "((\<lambda>x. f x * indicator {a .. b} x) has_integral F b - F a) UNIV"
-    unfolding indicator_def if_distrib[where f="\<lambda>x. a * x" for a]
+    unfolding indicator_def of_bool_def if_distrib[where f="\<lambda>x. a * x" for a]
     by (simp cong del: if_weak_cong del: atLeastAtMost_iff)
   then have nn: "(\<integral>\<^sup>+x. f x * indicator {a .. b} x \<partial>lborel) = F b - F a"
     by (rule nn_integral_has_integral_lborel[OF *])
   then show ?has
     by (rule has_bochner_integral_nn_integral[rotated 3]) (simp_all add: * F_mono \<open>a \<le> b\<close>)
   then show ?eq ?int
     unfolding has_bochner_integral_iff by auto
   show ?nn
     by (subst nn[symmetric])
        (auto intro!: nn_integral_cong simp add: ennreal_mult f split: split_indicator)
 qed
 
 lemma
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space"
   assumes "a \<le> b"
   assumes "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> (F has_vector_derivative f x) (at x within {a .. b})"
   assumes cont: "continuous_on {a .. b} f"
   shows has_bochner_integral_FTC_Icc:
       "has_bochner_integral lborel (\<lambda>x. indicator {a .. b} x *\<^sub>R f x) (F b - F a)" (is ?has)
     and integral_FTC_Icc: "(\<integral>x. indicator {a .. b} x *\<^sub>R f x \<partial>lborel) = F b - F a" (is ?eq)
 proof -
   let ?f = "\<lambda>x. indicator {a .. b} x *\<^sub>R f x"
   have int: "integrable lborel ?f"
     using borel_integrable_compact[OF _ cont] by auto
   have "(f has_integral F b - F a) {a..b}"
     using assms(1,2) by (intro fundamental_theorem_of_calculus) auto
   moreover
   have "(f has_integral integral\<^sup>L lborel ?f) {a..b}"
     using has_integral_integral_lborel[OF int]
-    unfolding indicator_def if_distrib[where f="\<lambda>x. x *\<^sub>R a" for a]
+    unfolding indicator_def of_bool_def if_distrib[where f="\<lambda>x. x *\<^sub>R a" for a]
     by (simp cong del: if_weak_cong del: atLeastAtMost_iff)
   ultimately show ?eq
     by (auto dest: has_integral_unique)
   then show ?has
     using int by (auto simp: has_bochner_integral_iff)
 qed
 
 lemma
   fixes f :: "real \<Rightarrow> real"
   assumes "a \<le> b"
   assumes deriv: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> DERIV F x :> f x"
   assumes cont: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> isCont f x"
   shows has_bochner_integral_FTC_Icc_real:
       "has_bochner_integral lborel (\<lambda>x. f x * indicator {a .. b} x) (F b - F a)" (is ?has)
     and integral_FTC_Icc_real: "(\<integral>x. f x * indicator {a .. b} x \<partial>lborel) = F b - F a" (is ?eq)
 proof -
   have 1: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> (F has_vector_derivative f x) (at x within {a .. b})"
     unfolding has_field_derivative_iff_has_vector_derivative[symmetric]
     using deriv by (auto intro: DERIV_subset)
   have 2: "continuous_on {a .. b} f"
     using cont by (intro continuous_at_imp_continuous_on) auto
   show ?has ?eq
     using has_bochner_integral_FTC_Icc[OF \<open>a \<le> b\<close> 1 2] integral_FTC_Icc[OF \<open>a \<le> b\<close> 1 2]
     by (auto simp: mult.commute)
 qed
 
 lemma nn_integral_FTC_atLeast:
   fixes f :: "real \<Rightarrow> real"
   assumes f_borel: "f \<in> borel_measurable borel"
   assumes f: "\<And>x. a \<le> x \<Longrightarrow> DERIV F x :> f x"
   assumes nonneg: "\<And>x. a \<le> x \<Longrightarrow> 0 \<le> f x"
   assumes lim: "(F \<longlongrightarrow> T) at_top"
   shows "(\<integral>\<^sup>+x. ennreal (f x) * indicator {a ..} x \<partial>lborel) = T - F a"
 proof -
   let ?f = "\<lambda>(i::nat) (x::real). ennreal (f x) * indicator {a..a + real i} x"
   let ?fR = "\<lambda>x. ennreal (f x) * indicator {a ..} x"
 
   have F_mono: "a \<le> x \<Longrightarrow> x \<le> y \<Longrightarrow> F x \<le> F y" for x y
     using f nonneg by (intro DERIV_nonneg_imp_nondecreasing[of x y F]) (auto intro: order_trans)
   then have F_le_T: "a \<le> x \<Longrightarrow> F x \<le> T" for x
     by (intro tendsto_lowerbound[OF lim])
        (auto simp: eventually_at_top_linorder)
 
   have "(SUP i. ?f i x) = ?fR x" for x
   proof (rule LIMSEQ_unique[OF LIMSEQ_SUP])
     obtain n where "x - a < real n"
       using reals_Archimedean2[of "x - a"] ..
     then have "eventually (\<lambda>n. ?f n x = ?fR x) sequentially"
       by (auto intro!: eventually_sequentiallyI[where c=n] split: split_indicator)
     then show "(\<lambda>n. ?f n x) \<longlonglongrightarrow> ?fR x"
       by (rule tendsto_eventually)
   qed (auto simp: nonneg incseq_def le_fun_def split: split_indicator)
   then have "integral\<^sup>N lborel ?fR = (\<integral>\<^sup>+ x. (SUP i. ?f i x) \<partial>lborel)"
     by simp
   also have "\<dots> = (SUP i. (\<integral>\<^sup>+ x. ?f i x \<partial>lborel))"
   proof (rule nn_integral_monotone_convergence_SUP)
     show "incseq ?f"
       using nonneg by (auto simp: incseq_def le_fun_def split: split_indicator)
     show "\<And>i. (?f i) \<in> borel_measurable lborel"
       using f_borel by auto
   qed
   also have "\<dots> = (SUP i. ennreal (F (a + real i) - F a))"
     by (subst nn_integral_FTC_Icc[OF f_borel f nonneg]) auto
   also have "\<dots> = T - F a"
   proof (rule LIMSEQ_unique[OF LIMSEQ_SUP])
      have "(\<lambda>x. F (a + real x)) \<longlonglongrightarrow> T"
        by (auto intro: filterlim_compose[OF lim filterlim_tendsto_add_at_top] filterlim_real_sequentially)
     then show "(\<lambda>n. ennreal (F (a + real n) - F a)) \<longlonglongrightarrow> ennreal (T - F a)"
       by (simp add: F_mono F_le_T tendsto_diff)
   qed (auto simp: incseq_def intro!: ennreal_le_iff[THEN iffD2] F_mono)
   finally show ?thesis .
 qed
 
 lemma integral_power:
   "a \<le> b \<Longrightarrow> (\<integral>x. x^k * indicator {a..b} x \<partial>lborel) = (b^Suc k - a^Suc k) / Suc k"
 proof (subst integral_FTC_Icc_real)
   fix x show "DERIV (\<lambda>x. x^Suc k / Suc k) x :> x^k"
     by (intro derivative_eq_intros) auto
 qed (auto simp: field_simps simp del: of_nat_Suc)
 
 subsection \<open>Integration by parts\<close>
 
 lemma integral_by_parts_integrable:
   fixes f g F G::"real \<Rightarrow> real"
   assumes "a \<le> b"
   assumes cont_f[intro]: "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont f x"
   assumes cont_g[intro]: "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont g x"
   assumes [intro]: "!!x. DERIV F x :> f x"
   assumes [intro]: "!!x. DERIV G x :> g x"
   shows  "integrable lborel (\<lambda>x.((F x) * (g x) + (f x) * (G x)) * indicator {a .. b} x)"
   by (auto intro!: borel_integrable_atLeastAtMost continuous_intros) (auto intro!: DERIV_isCont)
 
 lemma integral_by_parts:
   fixes f g F G::"real \<Rightarrow> real"
   assumes [arith]: "a \<le> b"
   assumes cont_f[intro]: "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont f x"
   assumes cont_g[intro]: "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont g x"
   assumes [intro]: "!!x. DERIV F x :> f x"
   assumes [intro]: "!!x. DERIV G x :> g x"
   shows "(\<integral>x. (F x * g x) * indicator {a .. b} x \<partial>lborel)
             =  F b * G b - F a * G a - \<integral>x. (f x * G x) * indicator {a .. b} x \<partial>lborel"
 proof-
   have "(\<integral>x. (F x * g x + f x * G x) * indicator {a .. b} x \<partial>lborel) 
       = LBINT x. F x * g x * indicat_real {a..b} x + f x * G x * indicat_real {a..b} x"
     by (meson vector_space_over_itself.scale_left_distrib)
   also have "... = (\<integral>x. (F x * g x) * indicator {a .. b} x \<partial>lborel) + \<integral>x. (f x * G x) * indicator {a .. b} x \<partial>lborel"
   proof (intro Bochner_Integration.integral_add borel_integrable_atLeastAtMost cont_f cont_g continuous_intros)
     show "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> isCont F x" "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> isCont G x"
       using DERIV_isCont by blast+
   qed
   finally have "(\<integral>x. (F x * g x + f x * G x) * indicator {a .. b} x \<partial>lborel) =
                 (\<integral>x. (F x * g x) * indicator {a .. b} x \<partial>lborel) + \<integral>x. (f x * G x) * indicator {a .. b} x \<partial>lborel" .
   moreover have "(\<integral>x. (F x * g x + f x * G x) * indicator {a .. b} x \<partial>lborel) = F b * G b - F a * G a"
   proof (intro integral_FTC_Icc_real derivative_eq_intros cont_f cont_g continuous_intros)
     show "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> isCont F x" "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> isCont G x"
       using DERIV_isCont by blast+
   qed auto
   ultimately show ?thesis by auto
 qed
 
 lemma integral_by_parts':
   fixes f g F G::"real \<Rightarrow> real"
   assumes "a \<le> b"
   assumes "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont f x"
   assumes "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont g x"
   assumes "!!x. DERIV F x :> f x"
   assumes "!!x. DERIV G x :> g x"
   shows "(\<integral>x. indicator {a .. b} x *\<^sub>R (F x * g x) \<partial>lborel)
             =  F b * G b - F a * G a - \<integral>x. indicator {a .. b} x *\<^sub>R (f x * G x) \<partial>lborel"
   using integral_by_parts[OF assms] by (simp add: ac_simps)
 
 lemma has_bochner_integral_even_function:
   fixes f :: "real \<Rightarrow> 'a :: {banach, second_countable_topology}"
   assumes f: "has_bochner_integral lborel (\<lambda>x. indicator {0..} x *\<^sub>R f x) x"
   assumes even: "\<And>x. f (- x) = f x"
   shows "has_bochner_integral lborel f (2 *\<^sub>R x)"
 proof -
   have indicator: "\<And>x::real. indicator {..0} (- x) = indicator {0..} x"
     by (auto split: split_indicator)
   have "has_bochner_integral lborel (\<lambda>x. indicator {.. 0} x *\<^sub>R f x) x"
     by (subst lborel_has_bochner_integral_real_affine_iff[where c="-1" and t=0])
        (auto simp: indicator even f)
   with f have "has_bochner_integral lborel (\<lambda>x. indicator {0..} x *\<^sub>R f x + indicator {.. 0} x *\<^sub>R f x) (x + x)"
     by (rule has_bochner_integral_add)
   then have "has_bochner_integral lborel f (x + x)"
     by (rule has_bochner_integral_discrete_difference[where X="{0}", THEN iffD1, rotated 4])
        (auto split: split_indicator)
   then show ?thesis
     by (simp add: scaleR_2)
 qed
 
 lemma has_bochner_integral_odd_function:
   fixes f :: "real \<Rightarrow> 'a :: {banach, second_countable_topology}"
   assumes f: "has_bochner_integral lborel (\<lambda>x. indicator {0..} x *\<^sub>R f x) x"
   assumes odd: "\<And>x. f (- x) = - f x"
   shows "has_bochner_integral lborel f 0"
 proof -
   have indicator: "\<And>x::real. indicator {..0} (- x) = indicator {0..} x"
     by (auto split: split_indicator)
   have "has_bochner_integral lborel (\<lambda>x. - indicator {.. 0} x *\<^sub>R f x) x"
     by (subst lborel_has_bochner_integral_real_affine_iff[where c="-1" and t=0])
        (auto simp: indicator odd f)
   from has_bochner_integral_minus[OF this]
   have "has_bochner_integral lborel (\<lambda>x. indicator {.. 0} x *\<^sub>R f x) (- x)"
     by simp
   with f have "has_bochner_integral lborel (\<lambda>x. indicator {0..} x *\<^sub>R f x + indicator {.. 0} x *\<^sub>R f x) (x + - x)"
     by (rule has_bochner_integral_add)
   then have "has_bochner_integral lborel f (x + - x)"
     by (rule has_bochner_integral_discrete_difference[where X="{0}", THEN iffD1, rotated 4])
        (auto split: split_indicator)
   then show ?thesis
     by simp
 qed
 
 lemma has_integral_0_closure_imp_0:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f: "continuous_on (closure S) f"
     and nonneg_interior: "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f x"
     and pos: "0 < emeasure lborel S"
     and finite: "emeasure lborel S < \<infinity>"
     and regular: "emeasure lborel (closure S) = emeasure lborel S"
     and opn: "open S"
   assumes int: "(f has_integral 0) (closure S)"
   assumes x: "x \<in> closure S"
   shows "f x = 0"
 proof -
   have zero: "emeasure lborel (frontier S) = 0"
     using finite closure_subset regular
     unfolding frontier_def
     by (subst emeasure_Diff) (auto simp: frontier_def interior_open \<open>open S\<close> )
   have nonneg: "0 \<le> f x" if "x \<in> closure S" for x
     using continuous_ge_on_closure[OF f that nonneg_interior] by simp
   have "0 = integral (closure S) f"
     by (blast intro: int sym)
   also
   note intl = has_integral_integrable[OF int]
   have af: "f absolutely_integrable_on (closure S)"
     using nonneg
     by (intro absolutely_integrable_onI intl integrable_eq[OF intl]) simp
   then have "integral (closure S) f = set_lebesgue_integral lebesgue (closure S) f"
     by (intro set_lebesgue_integral_eq_integral(2)[symmetric])
   also have "\<dots> = 0 \<longleftrightarrow> (AE x in lebesgue. indicator (closure S) x *\<^sub>R f x = 0)"
     unfolding set_lebesgue_integral_def
   proof (rule integral_nonneg_eq_0_iff_AE)
     show "integrable lebesgue (\<lambda>x. indicat_real (closure S) x *\<^sub>R f x)"
       by (metis af set_integrable_def)
   qed (use nonneg in \<open>auto simp: indicator_def\<close>)
   also have "\<dots> \<longleftrightarrow> (AE x in lebesgue. x \<in> {x. x \<in> closure S \<longrightarrow> f x = 0})"
     by (auto simp: indicator_def)
   finally have "(AE x in lebesgue. x \<in> {x. x \<in> closure S \<longrightarrow> f x = 0})" by simp
   moreover have "(AE x in lebesgue. x \<in> - frontier S)"
     using zero
     by (auto simp: eventually_ae_filter null_sets_def intro!: exI[where x="frontier S"])
   ultimately have ae: "AE x \<in> S in lebesgue. x \<in> {x \<in> closure S. f x = 0}" (is ?th)
     by eventually_elim (use closure_subset in \<open>auto simp: \<close>)
   have "closed {0::real}" by simp
   with continuous_on_closed_vimage[OF closed_closure, of S f] f
   have "closed (f -` {0} \<inter> closure S)" by blast
   then have "closed {x \<in> closure S. f x = 0}" by (auto simp: vimage_def Int_def conj_commute)
   with \<open>open S\<close> have "x \<in> {x \<in> closure S. f x = 0}" if "x \<in> S" for x using ae that
     by (rule mem_closed_if_AE_lebesgue_open)
   then have "f x = 0" if "x \<in> S" for x using that by auto
   from continuous_constant_on_closure[OF f this \<open>x \<in> closure S\<close>]
   show "f x = 0" .
 qed
 
 lemma has_integral_0_cbox_imp_0:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f: "continuous_on (cbox a b) f"
     and nonneg_interior: "\<And>x. x \<in> box a b \<Longrightarrow> 0 \<le> f x"
   assumes int: "(f has_integral 0) (cbox a b)"
   assumes ne: "box a b \<noteq> {}"
   assumes x: "x \<in> cbox a b"
   shows "f x = 0"
 proof -
   have "0 < emeasure lborel (box a b)"
     using ne x unfolding emeasure_lborel_box_eq
     by (force intro!: prod_pos simp: mem_box algebra_simps)
   then show ?thesis using assms
     by (intro has_integral_0_closure_imp_0[of "box a b" f x])
       (auto simp: emeasure_lborel_box_eq emeasure_lborel_cbox_eq algebra_simps mem_box)
 qed
 
 subsection\<open>Various common equivalent forms of function measurability\<close>
 
 lemma indicator_sum_eq:
   fixes m::real and f :: "'a \<Rightarrow> real"
   assumes "\<bar>m\<bar> \<le> 2 ^ (2*n)" "m/2^n \<le> f x" "f x < (m+1)/2^n" "m \<in> \<int>"
   shows   "(\<Sum>k::real | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n).
             k/2^n * indicator {y. k/2^n \<le> f y \<and> f y < (k+1)/2^n} x)  = m/2^n"
           (is "sum ?f ?S = _")
 proof -
   have "sum ?f ?S = sum (\<lambda>k. k/2^n * indicator {y. k/2^n \<le> f y \<and> f y < (k+1)/2^n} x) {m}"
   proof (rule comm_monoid_add_class.sum.mono_neutral_right)
     show "finite ?S"
       by (rule finite_abs_int_segment)
     show "{m} \<subseteq> {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}"
       using assms by auto
     show "\<forall>i\<in>{k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)} - {m}. ?f i = 0"
       using assms by (auto simp: indicator_def Ints_def abs_le_iff field_split_simps)
   qed
   also have "\<dots> = m/2^n"
     using assms by (auto simp: indicator_def not_less)
   finally show ?thesis .
 qed
 
 lemma measurable_on_sf_limit_lemma1:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "\<And>a b. {x \<in> S. a \<le> f x \<and> f x < b} \<in> sets (lebesgue_on S)"
   obtains g where "\<And>n. g n \<in> borel_measurable (lebesgue_on S)"
                   "\<And>n. finite(range (g n))"
                   "\<And>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x"
 proof
   show "(\<lambda>x. sum (\<lambda>k::real. k/2^n * indicator {y. k/2^n \<le> f y \<and> f y < (k+1)/2^n} x)
                  {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}) \<in> borel_measurable (lebesgue_on S)"
         (is "?g \<in> _")  for n
   proof -
     have "\<And>k. \<lbrakk>k \<in> \<int>; \<bar>k\<bar> \<le> 2 ^ (2*n)\<rbrakk>
          \<Longrightarrow> Measurable.pred (lebesgue_on S) (\<lambda>x. k / (2^n) \<le> f x \<and> f x < (k+1) / (2^n))"
       using assms by (force simp: pred_def space_restrict_space)
     then show ?thesis
       by (simp add: field_class.field_divide_inverse)
   qed
   show "finite (range (?g n))" for n
   proof -
     have "range (?g n) \<subseteq> (\<lambda>k. k/2^n) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}"
     proof clarify
       fix x
       show "?g n x  \<in> (\<lambda>k. k/2^n) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}"
       proof (cases "\<exists>k::real. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n) \<and> k/2^n \<le> (f x) \<and> (f x) < (k+1)/2^n")
         case True
         then show ?thesis
           apply clarify
           by (subst indicator_sum_eq) auto
       next
         case False
         then have "?g n x = 0" by auto
         then show ?thesis by force
       qed
     qed
     moreover have "finite ((\<lambda>k::real. (k/2^n)) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)})"
       by (simp add: finite_abs_int_segment)
     ultimately show ?thesis
       using finite_subset by blast
   qed
   show "(\<lambda>n. ?g n x) \<longlonglongrightarrow> f x" for x
   proof (rule LIMSEQ_I)
     fix e::real
     assume "e > 0"
     obtain N1 where N1: "\<bar>f x\<bar> < 2 ^ N1"
       using real_arch_pow by fastforce
     obtain N2 where N2: "(1/2) ^ N2 < e"
       using real_arch_pow_inv \<open>e > 0\<close> by force
     have "norm (?g n x - f x) < e" if n: "n \<ge> max N1 N2" for n
     proof -
       define m where "m \<equiv> floor(2^n * (f x))"
       have "1 \<le> \<bar>2^n\<bar> * e"
         using n N2 \<open>e > 0\<close> less_eq_real_def less_le_trans by (fastforce simp add: field_split_simps)
       then have *: "\<lbrakk>x \<le> y; y < x + 1\<rbrakk> \<Longrightarrow> abs(x - y) < \<bar>2^n\<bar> * e" for x y::real
         by linarith
       have "\<bar>2^n\<bar> * \<bar>m/2^n - f x\<bar> = \<bar>2^n * (m/2^n - f x)\<bar>"
         by (simp add: abs_mult)
       also have "\<dots> = \<bar>real_of_int \<lfloor>2^n * f x\<rfloor> - f x * 2^n\<bar>"
         by (simp add: algebra_simps m_def)
       also have "\<dots> < \<bar>2^n\<bar> * e"
         by (rule *; simp add: mult.commute)
       finally have "\<bar>2^n\<bar> * \<bar>m/2^n - f x\<bar> < \<bar>2^n\<bar> * e" .
       then have me: "\<bar>m/2^n - f x\<bar> < e"
         by simp
       have "\<bar>real_of_int m\<bar> \<le> 2 ^ (2*n)"
       proof (cases "f x < 0")
         case True
         then have "-\<lfloor>f x\<rfloor> \<le> \<lfloor>(2::real) ^ N1\<rfloor>"
           using N1 le_floor_iff minus_le_iff by fastforce
         with n True have "\<bar>real_of_int\<lfloor>f x\<rfloor>\<bar> \<le> 2 ^ N1"
           by linarith
         also have "\<dots> \<le> 2^n"
           using n by (simp add: m_def)
         finally have "\<bar>real_of_int \<lfloor>f x\<rfloor>\<bar> * 2^n \<le> 2^n * 2^n"
           by simp
         moreover
         have "\<bar>real_of_int \<lfloor>2^n * f x\<rfloor>\<bar> \<le> \<bar>real_of_int \<lfloor>f x\<rfloor>\<bar> * 2^n"
         proof -
           have "\<bar>real_of_int \<lfloor>2^n * f x\<rfloor>\<bar> = - (real_of_int \<lfloor>2^n * f x\<rfloor>)"
             using True by (simp add: abs_if mult_less_0_iff)
           also have "\<dots> \<le> - (real_of_int (\<lfloor>(2::real) ^ n\<rfloor> * \<lfloor>f x\<rfloor>))"
             using le_mult_floor_Ints [of "(2::real)^n"] by simp
           also have "\<dots> \<le> \<bar>real_of_int \<lfloor>f x\<rfloor>\<bar> * 2^n"
             using True
             by simp
           finally show ?thesis .
         qed
         ultimately show ?thesis
           by (metis (no_types, hide_lams) m_def order_trans power2_eq_square power_even_eq)
       next
         case False
         with n N1 have "f x \<le> 2^n"
           by (simp add: not_less) (meson less_eq_real_def one_le_numeral order_trans power_increasing)
         moreover have "0 \<le> m"
           using False m_def by force
         ultimately show ?thesis
           by (metis abs_of_nonneg floor_mono le_floor_iff m_def of_int_0_le_iff power2_eq_square power_mult mult_le_cancel_iff1 zero_less_numeral mult.commute zero_less_power)
       qed
       then have "?g n x = m/2^n"
         by (rule indicator_sum_eq) (auto simp add: m_def field_split_simps, linarith)
       then have "norm (?g n x - f x) = norm (m/2^n - f x)"
         by simp
       also have "\<dots> < e"
         by (simp add: me)
       finally show ?thesis .
     qed
     then show "\<exists>no. \<forall>n\<ge>no. norm (?g n x - f x) < e"
       by blast
   qed
 qed
 
 
 lemma borel_measurable_simple_function_limit:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<exists>g. (\<forall>n. (g n) \<in> borel_measurable (lebesgue_on S)) \<and>
               (\<forall>n. finite (range (g n))) \<and> (\<forall>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x))"
 proof -
   have "\<exists>g. (\<forall>n. (g n) \<in> borel_measurable (lebesgue_on S)) \<and>
             (\<forall>n. finite (range (g n))) \<and> (\<forall>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x)"
        if f: "\<And>a i. i \<in> Basis \<Longrightarrow> {x \<in> S. f x \<bullet> i < a} \<in> sets (lebesgue_on S)"
   proof -
     have "\<exists>g. (\<forall>n. (g n) \<in> borel_measurable (lebesgue_on S)) \<and>
                   (\<forall>n. finite(image (g n) UNIV)) \<and>
                   (\<forall>x. ((\<lambda>n. g n x) \<longlonglongrightarrow> f x \<bullet> i))" if "i \<in> Basis" for i
     proof (rule measurable_on_sf_limit_lemma1 [of S "\<lambda>x. f x \<bullet> i"])
       show "{x \<in> S. a \<le> f x \<bullet> i \<and> f x \<bullet> i < b} \<in> sets (lebesgue_on S)" for a b
       proof -
         have "{x \<in> S. a \<le> f x \<bullet> i \<and> f x \<bullet> i < b} = {x \<in> S. f x \<bullet> i < b} - {x \<in> S. a > f x \<bullet> i}"
           by auto
         also have "\<dots> \<in> sets (lebesgue_on S)"
           using f that by blast
         finally show ?thesis .
       qed
     qed blast
     then obtain g where g:
           "\<And>i n. i \<in> Basis \<Longrightarrow> g i n \<in> borel_measurable (lebesgue_on S)"
           "\<And>i n. i \<in> Basis \<Longrightarrow> finite(range (g i n))"
           "\<And>i x. i \<in> Basis \<Longrightarrow> ((\<lambda>n. g i n x) \<longlonglongrightarrow> f x \<bullet> i)"
       by metis
     show ?thesis
     proof (intro conjI allI exI)
       show "(\<lambda>x. \<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<in> borel_measurable (lebesgue_on S)" for n
         by (intro borel_measurable_sum borel_measurable_scaleR) (auto intro: g)
       show "finite (range (\<lambda>x. \<Sum>i\<in>Basis. g i n x *\<^sub>R i))" for n
       proof -
         have "range (\<lambda>x. \<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<subseteq> (\<lambda>h. \<Sum>i\<in>Basis. h i *\<^sub>R i) ` PiE Basis (\<lambda>i. range (g i n))"
         proof clarify
           fix x
           show "(\<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<in> (\<lambda>h. \<Sum>i\<in>Basis. h i *\<^sub>R i) ` (\<Pi>\<^sub>E i\<in>Basis. range (g i n))"
             by (rule_tac x="\<lambda>i\<in>Basis. g i n x" in image_eqI) auto
         qed
         moreover have "finite(PiE Basis (\<lambda>i. range (g i n)))"
           by (simp add: g finite_PiE)
         ultimately show ?thesis
           by (metis (mono_tags, lifting) finite_surj)
       qed
       show "(\<lambda>n. \<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<longlonglongrightarrow> f x" for x
       proof -
         have "(\<lambda>n. \<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<longlonglongrightarrow> (\<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i)"
           by (auto intro!: tendsto_sum tendsto_scaleR g)
         moreover have "(\<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i) = f x"
           using euclidean_representation by blast
         ultimately show ?thesis
           by metis
       qed
     qed
   qed
   moreover have "f \<in> borel_measurable (lebesgue_on S)"
               if meas_g: "\<And>n. g n \<in> borel_measurable (lebesgue_on S)"
                  and fin: "\<And>n. finite (range (g n))"
                  and to_f: "\<And>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x" for  g
     by (rule borel_measurable_LIMSEQ_metric [OF meas_g to_f])
   ultimately show ?thesis
     using borel_measurable_vimage_halfspace_component_lt by blast
 qed
 
 subsection \<open>Lebesgue sets and continuous images\<close>
 
 proposition lebesgue_regular_inner:
  assumes "S \<in> sets lebesgue"
  obtains K C where "negligible K" "\<And>n::nat. compact(C n)" "S = (\<Union>n. C n) \<union> K"
 proof -
   have "\<exists>T. closed T \<and> T \<subseteq> S \<and> (S - T) \<in> lmeasurable \<and> emeasure lebesgue (S - T) < ennreal ((1/2)^n)" for n
     using sets_lebesgue_inner_closed assms
     by (metis sets_lebesgue_inner_closed zero_less_divide_1_iff zero_less_numeral zero_less_power)
   then obtain C where clo: "\<And>n. closed (C n)" and subS: "\<And>n. C n \<subseteq> S"
     and mea: "\<And>n. (S - C n) \<in> lmeasurable"
     and less: "\<And>n. emeasure lebesgue (S - C n) < ennreal ((1/2)^n)"
     by metis
   have "\<exists>F. (\<forall>n::nat. compact(F n)) \<and> (\<Union>n. F n) = C m" for m::nat
     by (metis clo closed_Union_compact_subsets)
   then obtain D :: "[nat,nat] \<Rightarrow> 'a set" where D: "\<And>m n. compact(D m n)" "\<And>m. (\<Union>n. D m n) = C m"
     by metis
   let ?C = "from_nat_into (\<Union>m. range (D m))"
   have "countable (\<Union>m. range (D m))"
     by blast
   have "range (from_nat_into (\<Union>m. range (D m))) = (\<Union>m. range (D m))"
     using range_from_nat_into by simp
   then have CD: "\<exists>m n. ?C k = D m n"  for k
     by (metis (mono_tags, lifting) UN_iff rangeE range_eqI)
   show thesis
   proof
     show "negligible (S - (\<Union>n. C n))"
     proof (clarsimp simp: negligible_outer_le)
       fix e :: "real"
       assume "e > 0"
       then obtain n where n: "(1/2)^n < e"
         using real_arch_pow_inv [of e "1/2"] by auto
       show "\<exists>T. S - (\<Union>n. C n) \<subseteq> T \<and> T \<in> lmeasurable \<and> measure lebesgue T \<le> e"
       proof (intro exI conjI)
         show "S - (\<Union>n. C n) \<subseteq> S - C n"
           by blast
         show "S - C n \<in> lmeasurable"
           by (simp add: mea)
         show "measure lebesgue (S - C n) \<le> e"
           using less [of n] n
           by (simp add: emeasure_eq_measure2 less_le mea)
       qed
     qed
     show "compact (?C n)" for n
       using CD D by metis
     show "S = (\<Union>n. ?C n) \<union> (S - (\<Union>n. C n))" (is "_ = ?rhs")
     proof
       show "S \<subseteq> ?rhs"
         using D by fastforce
       show "?rhs \<subseteq> S"
         using subS D CD by auto (metis Sup_upper range_eqI subsetCE)
     qed
   qed
 qed
 
 lemma sets_lebesgue_continuous_image:
   assumes T: "T \<in> sets lebesgue" and contf: "continuous_on S f"
     and negim: "\<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible(f ` T)" and "T \<subseteq> S"
  shows "f ` T \<in> sets lebesgue"
 proof -
   obtain K C where "negligible K" and com: "\<And>n::nat. compact(C n)" and Teq: "T = (\<Union>n. C n) \<union> K"
     using lebesgue_regular_inner [OF T] by metis
   then have comf: "\<And>n::nat. compact(f ` C n)"
     by (metis Un_subset_iff Union_upper \<open>T \<subseteq> S\<close> compact_continuous_image contf continuous_on_subset rangeI)
   have "((\<Union>n. f ` C n) \<union> f ` K) \<in> sets lebesgue"
   proof (rule sets.Un)
     have "K \<subseteq> S"
       using Teq \<open>T \<subseteq> S\<close> by blast
     show "(\<Union>n. f ` C n) \<in> sets lebesgue"
     proof (rule sets.countable_Union)
       show "range (\<lambda>n. f ` C n) \<subseteq> sets lebesgue"
         using borel_compact comf by (auto simp: borel_compact)
     qed auto
     show "f ` K \<in> sets lebesgue"
       by (simp add: \<open>K \<subseteq> S\<close> \<open>negligible K\<close> negim negligible_imp_sets)
   qed
   then show ?thesis
     by (simp add: Teq image_Un image_Union)
 qed
 
 lemma differentiable_image_in_sets_lebesgue:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
   assumes S: "S \<in> sets lebesgue" and dim: "DIM('m) \<le> DIM('n)" and f: "f differentiable_on S"
   shows "f`S \<in> sets lebesgue"
 proof (rule sets_lebesgue_continuous_image [OF S])
   show "continuous_on S f"
     by (meson differentiable_imp_continuous_on f)
   show "\<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible (f ` T)"
     using differentiable_on_subset f
     by (auto simp: intro!: negligible_differentiable_image_negligible [OF dim])
 qed auto
 
 lemma sets_lebesgue_on_continuous_image:
   assumes S: "S \<in> sets lebesgue" and X: "X \<in> sets (lebesgue_on S)" and contf: "continuous_on S f"
     and negim: "\<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible(f ` T)"
   shows "f ` X \<in> sets (lebesgue_on (f ` S))"
 proof -
   have "X \<subseteq> S"
     by (metis S X sets.Int_space_eq2 sets_restrict_space_iff)
   moreover have "f ` S \<in> sets lebesgue"
     using S contf negim sets_lebesgue_continuous_image by blast
   moreover have "f ` X \<in> sets lebesgue"
     by (metis S X contf negim sets_lebesgue_continuous_image sets_restrict_space_iff space_restrict_space space_restrict_space2)
   ultimately show ?thesis
     by (auto simp: sets_restrict_space_iff)
 qed
 
 lemma differentiable_image_in_sets_lebesgue_on:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
   assumes S: "S \<in> sets lebesgue" and X: "X \<in> sets (lebesgue_on S)" and dim: "DIM('m) \<le> DIM('n)"
        and f: "f differentiable_on S"
      shows "f ` X \<in> sets (lebesgue_on (f`S))"
 proof (rule sets_lebesgue_on_continuous_image [OF S X])
   show "continuous_on S f"
     by (meson differentiable_imp_continuous_on f)
   show "\<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible (f ` T)"
     using differentiable_on_subset f
     by (auto simp: intro!: negligible_differentiable_image_negligible [OF dim])
 qed
 
 subsection \<open>Affine lemmas\<close>
 
 lemma borel_measurable_affine:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes f: "f \<in> borel_measurable lebesgue" and "c \<noteq> 0"
   shows "(\<lambda>x. f(t + c *\<^sub>R x)) \<in> borel_measurable lebesgue"
 proof -
   { fix a b
     have "{x. f x \<in> cbox a b} \<in> sets lebesgue"
       using f cbox_borel lebesgue_measurable_vimage_borel by blast
     then have "(\<lambda>x. (x - t) /\<^sub>R c) ` {x. f x \<in> cbox a b} \<in> sets lebesgue"
     proof (rule differentiable_image_in_sets_lebesgue)
       show "(\<lambda>x. (x - t) /\<^sub>R c) differentiable_on {x. f x \<in> cbox a b}"
         unfolding differentiable_on_def differentiable_def
         by (rule \<open>c \<noteq> 0\<close> derivative_eq_intros strip exI | simp)+
     qed auto
     moreover
     have "{x. f(t + c *\<^sub>R x) \<in> cbox a b} = (\<lambda>x. (x-t) /\<^sub>R c) ` {x. f x \<in> cbox a b}"
       using \<open>c \<noteq> 0\<close> by (auto simp: image_def)
     ultimately have "{x. f(t + c *\<^sub>R x) \<in> cbox a b} \<in> sets lebesgue"
       by (auto simp: borel_measurable_vimage_closed_interval) }
   then show ?thesis
     by (subst lebesgue_on_UNIV_eq [symmetric]; auto simp: borel_measurable_vimage_closed_interval)
 qed
     
 lemma lebesgue_integrable_real_affine:
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space"
   assumes f: "integrable lebesgue f" and "c \<noteq> 0"
   shows "integrable lebesgue (\<lambda>x. f(t + c * x))"
 proof -
   have "(\<lambda>x. norm (f x)) \<in> borel_measurable lebesgue"
     by (simp add: borel_measurable_integrable f)
   then show ?thesis
     using assms borel_measurable_affine [of f c]
     unfolding integrable_iff_bounded
     by (subst (asm) nn_integral_real_affine_lebesgue[where c=c and t=t])  (auto simp: ennreal_mult_less_top)
 qed
 
 lemma lebesgue_integrable_real_affine_iff:
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space"
   shows "c \<noteq> 0 \<Longrightarrow> integrable lebesgue (\<lambda>x. f(t + c * x)) \<longleftrightarrow> integrable lebesgue f"
   using lebesgue_integrable_real_affine[of f c t]
         lebesgue_integrable_real_affine[of "\<lambda>x. f(t + c * x)" "1/c" "-t/c"]
   by (auto simp: field_simps)
 
 lemma\<^marker>\<open>tag important\<close> lebesgue_integral_real_affine:
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space" and c :: real
   assumes c: "c \<noteq> 0" shows "(\<integral>x. f x \<partial> lebesgue) = \<bar>c\<bar> *\<^sub>R (\<integral>x. f(t + c * x) \<partial>lebesgue)"
 proof cases
   have "(\<lambda>x. t + c * x) \<in> lebesgue \<rightarrow>\<^sub>M lebesgue"
     using lebesgue_affine_measurable[where c= "\<lambda>x::real. c"] \<open>c \<noteq> 0\<close> by simp
   moreover
   assume "integrable lebesgue f"
   ultimately show ?thesis
     by (subst lebesgue_real_affine[OF c, of t]) (auto simp: integral_density integral_distr)
 next
   assume "\<not> integrable lebesgue f" with c show ?thesis
     by (simp add: lebesgue_integrable_real_affine_iff not_integrable_integral_eq)
 qed
 
 lemma has_bochner_integral_lebesgue_real_affine_iff:
   fixes i :: "'a :: euclidean_space"
   shows "c \<noteq> 0 \<Longrightarrow>
     has_bochner_integral lebesgue f i \<longleftrightarrow>
     has_bochner_integral lebesgue (\<lambda>x. f(t + c * x)) (i /\<^sub>R \<bar>c\<bar>)"
   unfolding has_bochner_integral_iff lebesgue_integrable_real_affine_iff
   by (simp_all add: lebesgue_integral_real_affine[symmetric] divideR_right cong: conj_cong)
 
 lemma has_bochner_integral_reflect_real_lemma[intro]:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "has_bochner_integral (lebesgue_on {a..b}) f i"
   shows "has_bochner_integral (lebesgue_on {-b..-a}) (\<lambda>x. f(-x)) i"
 proof -
   have eq: "indicat_real {a..b} (- x) *\<^sub>R f(- x) = indicat_real {- b..- a} x *\<^sub>R f(- x)" for x
     by (auto simp: indicator_def)
   have i: "has_bochner_integral lebesgue (\<lambda>x. indicator {a..b} x *\<^sub>R f x) i"
     using assms by (auto simp: has_bochner_integral_restrict_space)
   then have "has_bochner_integral lebesgue (\<lambda>x. indicator {-b..-a} x *\<^sub>R f(-x)) i"
     using has_bochner_integral_lebesgue_real_affine_iff [of "-1" "(\<lambda>x. indicator {a..b} x *\<^sub>R f x)" i 0]
     by (auto simp: eq)
   then show ?thesis
     by (auto simp: has_bochner_integral_restrict_space)
 qed
 
 lemma has_bochner_integral_reflect_real[simp]:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   shows "has_bochner_integral (lebesgue_on {-b..-a}) (\<lambda>x. f(-x)) i \<longleftrightarrow> has_bochner_integral (lebesgue_on {a..b}) f i"
   by (auto simp: dest: has_bochner_integral_reflect_real_lemma)
 
 lemma integrable_reflect_real[simp]:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   shows "integrable (lebesgue_on {-b..-a}) (\<lambda>x. f(-x)) \<longleftrightarrow> integrable (lebesgue_on {a..b}) f"
   by (metis has_bochner_integral_iff has_bochner_integral_reflect_real)
 
 lemma integral_reflect_real[simp]:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   shows "integral\<^sup>L (lebesgue_on {-b .. -a}) (\<lambda>x. f(-x)) = integral\<^sup>L (lebesgue_on {a..b::real}) f"
   using has_bochner_integral_reflect_real [of b a f]
   by (metis has_bochner_integral_iff not_integrable_integral_eq)
 
 subsection\<open>More results on integrability\<close>
 
 lemma integrable_on_all_intervals_UNIV:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes intf: "\<And>a b. f integrable_on cbox a b"
     and normf: "\<And>x. norm(f x) \<le> g x" and g: "g integrable_on UNIV"
   shows "f integrable_on UNIV"
 proof -
 have intg: "(\<forall>a b. g integrable_on cbox a b)"
     and gle_e: "\<forall>e>0. \<exists>B>0. \<forall>a b c d.
                     ball 0 B \<subseteq> cbox a b \<and> cbox a b \<subseteq> cbox c d \<longrightarrow>
                     \<bar>integral (cbox a b) g - integral (cbox c d) g\<bar>
                     < e"
     using g
     by (auto simp: integrable_alt_subset [of _ UNIV] intf)
   have le: "norm (integral (cbox a b) f - integral (cbox c d) f) \<le> \<bar>integral (cbox a b) g - integral (cbox c d) g\<bar>"
     if "cbox a b \<subseteq> cbox c d" for a b c d
   proof -
     have "norm (integral (cbox a b) f - integral (cbox c d) f) = norm (integral (cbox c d - cbox a b) f)"
       using intf that by (simp add: norm_minus_commute integral_setdiff)
     also have "\<dots> \<le> integral (cbox c d - cbox a b) g"
     proof (rule integral_norm_bound_integral [OF _ _ normf])
       show "f integrable_on cbox c d - cbox a b" "g integrable_on cbox c d - cbox a b"
         by (meson integrable_integral integrable_setdiff intf intg negligible_setdiff that)+
     qed
     also have "\<dots> = integral (cbox c d) g - integral (cbox a b) g"
       using intg that by (simp add: integral_setdiff)
     also have "\<dots> \<le> \<bar>integral (cbox a b) g - integral (cbox c d) g\<bar>"
       by simp
     finally show ?thesis .
   qed
   show ?thesis
     using gle_e
     apply (simp add: integrable_alt_subset [of _ UNIV] intf)
     apply (erule imp_forward all_forward ex_forward asm_rl)+
     by (meson not_less order_trans le)
 qed
 
 lemma integrable_on_all_intervals_integrable_bound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes intf: "\<And>a b. (\<lambda>x. if x \<in> S then f x else 0) integrable_on cbox a b"
     and normf: "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> g x" and g: "g integrable_on S"
   shows "f integrable_on S"
   using integrable_on_all_intervals_UNIV [OF intf, of "(\<lambda>x. if x \<in> S then g x else 0)"]
   by (simp add: g integrable_restrict_UNIV normf)
 
 lemma measurable_bounded_lemma:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f \<in> borel_measurable lebesgue" and g: "g integrable_on cbox a b"
     and normf: "\<And>x. x \<in> cbox a b \<Longrightarrow> norm(f x) \<le> g x"
   shows "f integrable_on cbox a b"
 proof -
   have "g absolutely_integrable_on cbox a b"
     by (metis (full_types) add_increasing g le_add_same_cancel1 nonnegative_absolutely_integrable_1 norm_ge_zero normf)
   then have "integrable (lebesgue_on (cbox a b)) g"
     by (simp add: integrable_restrict_space set_integrable_def)
   then have "integrable (lebesgue_on (cbox a b)) f"
   proof (rule Bochner_Integration.integrable_bound)
     show "AE x in lebesgue_on (cbox a b). norm (f x) \<le> norm (g x)"
       by (rule AE_I2) (auto intro: normf order_trans)
   qed (simp add: f measurable_restrict_space1)
   then show ?thesis
     by (simp add: integrable_on_lebesgue_on)
 qed
 
 proposition measurable_bounded_by_integrable_imp_integrable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f \<in> borel_measurable (lebesgue_on S)" and g: "g integrable_on S"
     and normf: "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> g x" and S: "S \<in> sets lebesgue"
   shows "f integrable_on S"
 proof (rule integrable_on_all_intervals_integrable_bound [OF _ normf g])
   show "(\<lambda>x. if x \<in> S then f x else 0) integrable_on cbox a b" for a b
   proof (rule measurable_bounded_lemma)
     show "(\<lambda>x. if x \<in> S then f x else 0) \<in> borel_measurable lebesgue"
       by (simp add: S borel_measurable_if f)
     show "(\<lambda>x. if x \<in> S then g x else 0) integrable_on cbox a b"
       by (simp add: g integrable_altD(1))
     show "norm (if x \<in> S then f x else 0) \<le> (if x \<in> S then g x else 0)" for x
       using normf by simp
   qed
 qed
 
 lemma measurable_bounded_by_integrable_imp_lebesgue_integrable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f \<in> borel_measurable (lebesgue_on S)" and g: "integrable (lebesgue_on S) g"
     and normf: "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> g x" and S: "S \<in> sets lebesgue"
   shows "integrable (lebesgue_on S) f"
 proof -
   have "f absolutely_integrable_on S"
     by (metis (no_types) S absolutely_integrable_integrable_bound f g integrable_on_lebesgue_on measurable_bounded_by_integrable_imp_integrable normf)
   then show ?thesis
     by (simp add: S integrable_restrict_space set_integrable_def)
 qed
 
 lemma measurable_bounded_by_integrable_imp_integrable_real:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "f \<in> borel_measurable (lebesgue_on S)" "g integrable_on S" "\<And>x. x \<in> S \<Longrightarrow> abs(f x) \<le> g x" "S \<in> sets lebesgue"
   shows "f integrable_on S"
   using measurable_bounded_by_integrable_imp_integrable [of f S g] assms by simp
 
 subsection\<open> Relation between Borel measurability and integrability.\<close>
 
 lemma integrable_imp_measurable_weak:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue" "f integrable_on S"
   shows "f \<in> borel_measurable (lebesgue_on S)"
   by (metis (mono_tags, lifting) assms has_integral_implies_lebesgue_measurable borel_measurable_restrict_space_iff integrable_on_def sets.Int_space_eq2)
 
 lemma integrable_imp_measurable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f integrable_on S"
   shows "f \<in> borel_measurable (lebesgue_on S)"
 proof -
   have "(UNIV::'a set) \<in> sets lborel"
     by simp
   then show ?thesis
     by (metis (mono_tags, lifting) assms borel_measurable_if_D integrable_imp_measurable_weak integrable_restrict_UNIV lebesgue_on_UNIV_eq sets_lebesgue_on_refl)
 qed
 
 lemma integrable_iff_integrable_on:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue" "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>lebesgue_on S) < \<infinity>"
   shows "integrable (lebesgue_on S) f \<longleftrightarrow> f integrable_on S"
   using assms integrable_iff_bounded integrable_imp_measurable integrable_on_lebesgue_on by blast
 
 lemma absolutely_integrable_measurable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue"
   shows "f absolutely_integrable_on S \<longleftrightarrow> f \<in> borel_measurable (lebesgue_on S) \<and> integrable (lebesgue_on S) (norm \<circ> f)"
     (is "?lhs = ?rhs")
 proof
   assume L: ?lhs
   then have "f \<in> borel_measurable (lebesgue_on S)"
     by (simp add: absolutely_integrable_on_def integrable_imp_measurable)
   then show ?rhs
     using assms set_integrable_norm [of lebesgue S f] L
     by (simp add: integrable_restrict_space set_integrable_def)
 next
   assume ?rhs then show ?lhs
     using assms integrable_on_lebesgue_on
     by (metis absolutely_integrable_integrable_bound comp_def eq_iff measurable_bounded_by_integrable_imp_integrable)
 qed
 
 lemma absolutely_integrable_measurable_real:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "S \<in> sets lebesgue"
   shows "f absolutely_integrable_on S \<longleftrightarrow>
          f \<in> borel_measurable (lebesgue_on S) \<and> integrable (lebesgue_on S) (\<lambda>x. \<bar>f x\<bar>)"
   by (simp add: absolutely_integrable_measurable assms o_def)
 
 lemma absolutely_integrable_measurable_real':
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "S \<in> sets lebesgue"
   shows "f absolutely_integrable_on S \<longleftrightarrow> f \<in> borel_measurable (lebesgue_on S) \<and> (\<lambda>x. \<bar>f x\<bar>) integrable_on S"
   by (metis abs_absolutely_integrableI_1 absolutely_integrable_measurable_real assms 
             measurable_bounded_by_integrable_imp_integrable order_refl real_norm_def set_integrable_abs set_lebesgue_integral_eq_integral(1))
 
 lemma absolutely_integrable_imp_borel_measurable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f absolutely_integrable_on S" "S \<in> sets lebesgue"
   shows "f \<in> borel_measurable (lebesgue_on S)"
   using absolutely_integrable_measurable assms by blast
 
 lemma measurable_bounded_by_integrable_imp_absolutely_integrable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f \<in> borel_measurable (lebesgue_on S)" "S \<in> sets lebesgue"
     and "g integrable_on S" and "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> (g x)"
   shows "f absolutely_integrable_on S"
   using assms absolutely_integrable_integrable_bound measurable_bounded_by_integrable_imp_integrable by blast
 
 proposition negligible_differentiable_vimage:
   fixes f :: "'a \<Rightarrow> 'a::euclidean_space"
   assumes "negligible T"
     and f': "\<And>x. x \<in> S \<Longrightarrow> inj(f' x)"
     and derf: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   shows "negligible {x \<in> S. f x \<in> T}"
 proof -
   define U where
     "U \<equiv> \<lambda>n::nat. {x \<in> S. \<forall>y. y \<in> S \<and> norm(y - x) < 1/n
                      \<longrightarrow> norm(y - x) \<le> n * norm(f y - f x)}"
   have "negligible {x \<in> U n. f x \<in> T}" if "n > 0" for n
   proof (subst locally_negligible_alt, clarify)
     fix a
     assume a: "a \<in> U n" and fa: "f a \<in> T"
     define V where "V \<equiv> {x. x \<in> U n \<and> f x \<in> T} \<inter> ball a (1 / n / 2)"
     show "\<exists>V. openin (top_of_set {x \<in> U n. f x \<in> T}) V \<and> a \<in> V \<and> negligible V"
     proof (intro exI conjI)
       have noxy: "norm(x - y) \<le> n * norm(f x - f y)" if "x \<in> V" "y \<in> V" for x y
         using that unfolding U_def V_def mem_Collect_eq Int_iff mem_ball dist_norm
         by (meson norm_triangle_half_r)
       then have "inj_on f V"
         by (force simp: inj_on_def)
       then obtain g where g: "\<And>x. x \<in> V \<Longrightarrow> g(f x) = x"
         by (metis inv_into_f_f)
       have "\<exists>T' B. open T' \<and> f x \<in> T' \<and>
                    (\<forall>y\<in>f ` V \<inter> T \<inter> T'. norm (g y - g (f x)) \<le> B * norm (y - f x))"
         if "f x \<in> T" "x \<in> V" for x
         using that noxy 
         by (rule_tac x = "ball (f x) 1" in exI) (force simp: g)
       then have "negligible (g ` (f ` V \<inter> T))"
         by (force simp: \<open>negligible T\<close> negligible_Int intro!: negligible_locally_Lipschitz_image)
       moreover have "V \<subseteq> g ` (f ` V \<inter> T)"
         by (force simp: g image_iff V_def)
       ultimately show "negligible V"
         by (rule negligible_subset)
     qed (use a fa V_def that in auto)
   qed
   with negligible_countable_Union have "negligible (\<Union>n \<in> {0<..}. {x. x \<in> U n \<and> f x \<in> T})"
     by auto
   moreover have "{x \<in> S. f x \<in> T} \<subseteq> (\<Union>n \<in> {0<..}. {x. x \<in> U n \<and> f x \<in> T})"
   proof clarsimp
     fix x
     assume "x \<in> S" and "f x \<in> T"
     then obtain inj: "inj(f' x)" and der: "(f has_derivative f' x) (at x within S)"
       using assms by metis
     moreover have "linear(f' x)"
       and eps: "\<And>\<epsilon>. \<epsilon> > 0 \<Longrightarrow> \<exists>\<delta>>0. \<forall>y\<in>S. norm (y - x) < \<delta> \<longrightarrow>
                       norm (f y - f x - f' x (y - x)) \<le> \<epsilon> * norm (y - x)"
       using der by (auto simp: has_derivative_within_alt linear_linear)
     ultimately obtain g where "linear g" and g: "g \<circ> f' x = id"
       using linear_injective_left_inverse by metis
     then obtain B where "B > 0" and B: "\<And>z. B * norm z \<le> norm(f' x z)"
       using linear_invertible_bounded_below_pos \<open>linear (f' x)\<close> by blast
     then obtain i where "i \<noteq> 0" and i: "1 / real i < B"
       by (metis (full_types) inverse_eq_divide real_arch_invD)
     then obtain \<delta> where "\<delta> > 0"
          and \<delta>: "\<And>y. \<lbrakk>y\<in>S; norm (y - x) < \<delta>\<rbrakk> \<Longrightarrow>
                   norm (f y - f x - f' x (y - x)) \<le> (B - 1 / real i) * norm (y - x)"
       using eps [of "B - 1/i"] by auto
     then obtain j where "j \<noteq> 0" and j: "inverse (real j) < \<delta>"
       using real_arch_inverse by blast
     have "norm (y - x)/(max i j) \<le> norm (f y - f x)"
       if "y \<in> S" and less: "norm (y - x) < 1 / (max i j)" for y
     proof -
       have "1 / real (max i j) < \<delta>"
         using j \<open>j \<noteq> 0\<close> \<open>0 < \<delta>\<close>
         by (auto simp: field_split_simps max_mult_distrib_left of_nat_max)
     then have "norm (y - x) < \<delta>"
       using less by linarith
     with \<delta> \<open>y \<in> S\<close> have le: "norm (f y - f x - f' x (y - x)) \<le> B * norm (y - x) - norm (y - x)/i"
       by (auto simp: algebra_simps)
     have "norm (y - x) / real (max i j) \<le> norm (y - x) / real i"
       using \<open>i \<noteq> 0\<close> \<open>j \<noteq> 0\<close> by (simp add: field_split_simps max_mult_distrib_left of_nat_max less_max_iff_disj)
     also have "... \<le> norm (f y - f x)"
       using B [of "y-x"] le norm_triangle_ineq3 [of "f y - f x" "f' x (y - x)"]
       by linarith 
     finally show ?thesis .
   qed
   with \<open>x \<in> S\<close> \<open>i \<noteq> 0\<close> \<open>j \<noteq> 0\<close> show "\<exists>n\<in>{0<..}. x \<in> U n"
     by (rule_tac x="max i j" in bexI) (auto simp: field_simps U_def less_max_iff_disj)
 qed
   ultimately show ?thesis
     by (rule negligible_subset)
 qed
 
 lemma absolutely_integrable_Un:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes S: "f absolutely_integrable_on S" and T: "f absolutely_integrable_on T"
   shows "f absolutely_integrable_on (S \<union> T)"
 proof -
   have [simp]: "{x. (if x \<in> A then f x else 0) \<noteq> 0} = {x \<in> A. f x \<noteq> 0}" for A
     by auto
   let ?ST = "{x \<in> S. f x \<noteq> 0} \<inter> {x \<in> T. f x \<noteq> 0}"
   have "?ST \<in> sets lebesgue"
   proof (rule Sigma_Algebra.sets.Int)
     have "f integrable_on S"
       using S absolutely_integrable_on_def by blast
     then have "(\<lambda>x. if x \<in> S then f x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have borel: "(\<lambda>x. if x \<in> S then f x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
       using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
     then show "{x \<in> S. f x \<noteq> 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_open
       by (rule allE [where x = "-{0}"]) auto
   next
     have "f integrable_on T"
       using T absolutely_integrable_on_def by blast
     then have "(\<lambda>x. if x \<in> T then f x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have borel: "(\<lambda>x. if x \<in> T then f x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
       using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
     then show "{x \<in> T. f x \<noteq> 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_open
       by (rule allE [where x = "-{0}"]) auto
   qed
   then have "f absolutely_integrable_on ?ST"
     by (rule set_integrable_subset [OF S]) auto
   then have Int: "(\<lambda>x. if x \<in> ?ST then f x else 0) absolutely_integrable_on UNIV"
     using absolutely_integrable_restrict_UNIV by blast
   have "(\<lambda>x. if x \<in> S then f x else 0) absolutely_integrable_on UNIV"
        "(\<lambda>x. if x \<in> T then f x else 0) absolutely_integrable_on UNIV"
     using S T absolutely_integrable_restrict_UNIV by blast+
   then have "(\<lambda>x. (if x \<in> S then f x else 0) + (if x \<in> T then f x else 0)) absolutely_integrable_on UNIV"
     by (rule set_integral_add)
   then have "(\<lambda>x. ((if x \<in> S then f x else 0) + (if x \<in> T then f x else 0)) - (if x \<in> ?ST then f x else 0)) absolutely_integrable_on UNIV"
     using Int by (rule set_integral_diff)
   then have "(\<lambda>x. if x \<in> S \<union> T then f x else 0) absolutely_integrable_on UNIV"
     by (rule absolutely_integrable_spike) (auto intro: empty_imp_negligible)
   then show ?thesis
     unfolding absolutely_integrable_restrict_UNIV .
 qed
 
 lemma absolutely_integrable_on_combine:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "f absolutely_integrable_on {a..c}"
     and "f absolutely_integrable_on {c..b}"
     and "a \<le> c"
     and "c \<le> b"
   shows "f absolutely_integrable_on {a..b}"
   by (metis absolutely_integrable_Un assms ivl_disj_un_two_touch(4))
 
 lemma uniform_limit_set_lebesgue_integral_at_top:
   fixes f :: "'a \<Rightarrow> real \<Rightarrow> 'b::{banach, second_countable_topology}"
     and g :: "real \<Rightarrow> real"
   assumes bound: "\<And>x y. x \<in> A \<Longrightarrow> y \<ge> a \<Longrightarrow> norm (f x y) \<le> g y"
   assumes integrable: "set_integrable M {a..} g"
   assumes measurable: "\<And>x. x \<in> A \<Longrightarrow> set_borel_measurable M {a..} (f x)"
   assumes "sets borel \<subseteq> sets M"
   shows   "uniform_limit A (\<lambda>b x. LINT y:{a..b}|M. f x y) (\<lambda>x. LINT y:{a..}|M. f x y) at_top"
 proof (cases "A = {}")
   case False
   then obtain x where x: "x \<in> A" by auto
   have g_nonneg: "g y \<ge> 0" if "y \<ge> a" for y
   proof -
     have "0 \<le> norm (f x y)" by simp
     also have "\<dots> \<le> g y" using bound[OF x that] by simp
     finally show ?thesis .
   qed
 
   have integrable': "set_integrable M {a..} (\<lambda>y. f x y)" if "x \<in> A" for x
     unfolding set_integrable_def
   proof (rule Bochner_Integration.integrable_bound)
     show "integrable M (\<lambda>x. indicator {a..} x * g x)"
       using integrable by (simp add: set_integrable_def)
     show "(\<lambda>y. indicat_real {a..} y *\<^sub>R f x y) \<in> borel_measurable M" using measurable[OF that]
       by (simp add: set_borel_measurable_def)
     show "AE y in M. norm (indicat_real {a..} y *\<^sub>R f x y) \<le> norm (indicat_real {a..} y * g y)"
       using bound[OF that] by (intro AE_I2) (auto simp: indicator_def g_nonneg)
   qed
 
   show ?thesis
   proof (rule uniform_limitI)
     fix e :: real assume e: "e > 0"
     have sets [intro]: "A \<in> sets M" if "A \<in> sets borel" for A
       using that assms by blast
 
     have "((\<lambda>b. LINT y:{a..b}|M. g y) \<longlongrightarrow> (LINT y:{a..}|M. g y)) at_top"
       by (intro tendsto_set_lebesgue_integral_at_top assms sets) auto
     with e obtain b0 :: real where b0: "\<forall>b\<ge>b0. \<bar>(LINT y:{a..}|M. g y) - (LINT y:{a..b}|M. g y)\<bar> < e"
       by (auto simp: tendsto_iff eventually_at_top_linorder dist_real_def abs_minus_commute)
     define b where "b = max a b0"
     have "a \<le> b" by (simp add: b_def)
     from b0 have "\<bar>(LINT y:{a..}|M. g y) - (LINT y:{a..b}|M. g y)\<bar> < e"
       by (auto simp: b_def)
     also have "{a..} = {a..b} \<union> {b<..}" by (auto simp: b_def)
     also have "\<bar>(LINT y:\<dots>|M. g y) - (LINT y:{a..b}|M. g y)\<bar> = \<bar>(LINT y:{b<..}|M. g y)\<bar>"
       using \<open>a \<le> b\<close> by (subst set_integral_Un) (auto intro!: set_integrable_subset[OF integrable])
     also have "(LINT y:{b<..}|M. g y) \<ge> 0"
       using g_nonneg \<open>a \<le> b\<close> unfolding set_lebesgue_integral_def
       by (intro Bochner_Integration.integral_nonneg) (auto simp: indicator_def)
     hence "\<bar>(LINT y:{b<..}|M. g y)\<bar> = (LINT y:{b<..}|M. g y)" by simp
     finally have less: "(LINT y:{b<..}|M. g y) < e" .
 
     have "eventually (\<lambda>b. b \<ge> b0) at_top" by (rule eventually_ge_at_top)
     moreover have "eventually (\<lambda>b. b \<ge> a) at_top" by (rule eventually_ge_at_top)
     ultimately show "eventually (\<lambda>b. \<forall>x\<in>A.
                        dist (LINT y:{a..b}|M. f x y) (LINT y:{a..}|M. f x y) < e) at_top"
     proof eventually_elim
       case (elim b)
       show ?case
       proof
         fix x assume x: "x \<in> A"
         have "dist (LINT y:{a..b}|M. f x y) (LINT y:{a..}|M. f x y) =
                 norm ((LINT y:{a..}|M. f x y) - (LINT y:{a..b}|M. f x y))"
           by (simp add: dist_norm norm_minus_commute)
         also have "{a..} = {a..b} \<union> {b<..}" using elim by auto
         also have "(LINT y:\<dots>|M. f x y) - (LINT y:{a..b}|M. f x y) = (LINT y:{b<..}|M. f x y)"
           using elim x
           by (subst set_integral_Un) (auto intro!: set_integrable_subset[OF integrable'])
         also have "norm \<dots> \<le> (LINT y:{b<..}|M. norm (f x y))" using elim x
           by (intro set_integral_norm_bound set_integrable_subset[OF integrable']) auto
         also have "\<dots> \<le> (LINT y:{b<..}|M. g y)" using elim x bound g_nonneg
           by (intro set_integral_mono set_integrable_norm set_integrable_subset[OF integrable']
                     set_integrable_subset[OF integrable]) auto
         also have "(LINT y:{b<..}|M. g y) \<ge> 0"
           using g_nonneg \<open>a \<le> b\<close> unfolding set_lebesgue_integral_def
           by (intro Bochner_Integration.integral_nonneg) (auto simp: indicator_def)
         hence "(LINT y:{b<..}|M. g y) = \<bar>(LINT y:{b<..}|M. g y)\<bar>" by simp
         also have "\<dots> = \<bar>(LINT y:{a..b} \<union> {b<..}|M. g y) - (LINT y:{a..b}|M. g y)\<bar>"
           using elim by (subst set_integral_Un) (auto intro!: set_integrable_subset[OF integrable])
         also have "{a..b} \<union> {b<..} = {a..}" using elim by auto
         also have "\<bar>(LINT y:{a..}|M. g y) - (LINT y:{a..b}|M. g y)\<bar> < e"
           using b0 elim by blast
         finally show "dist (LINT y:{a..b}|M. f x y) (LINT y:{a..}|M. f x y) < e" .
       qed
     qed
   qed
 qed auto
 
 
 
 subsubsection\<open>Differentiability of inverse function (most basic form)\<close>
 
 proposition has_derivative_inverse_within:
   fixes f :: "'a::real_normed_vector \<Rightarrow> 'b::euclidean_space"
   assumes der_f: "(f has_derivative f') (at a within S)"
     and cont_g: "continuous (at (f a) within f ` S) g"
     and "a \<in> S" "linear g'" and id: "g' \<circ> f' = id"
     and gf: "\<And>x. x \<in> S \<Longrightarrow> g(f x) = x"
   shows "(g has_derivative g') (at (f a) within f ` S)"
 proof -
   have [simp]: "g' (f' x) = x" for x
     by (simp add: local.id pointfree_idE)
   have "bounded_linear f'"
     and f': "\<And>e. e>0 \<Longrightarrow> \<exists>d>0. \<forall>y\<in>S. norm (y - a) < d \<longrightarrow>
                         norm (f y - f a - f' (y - a)) \<le> e * norm (y - a)"
     using der_f by (auto simp: has_derivative_within_alt)
   obtain C where "C > 0" and C: "\<And>x. norm (g' x) \<le> C * norm x"
     using linear_bounded_pos [OF \<open>linear g'\<close>] by metis
   obtain B k where "B > 0" "k > 0"
     and Bk: "\<And>x. \<lbrakk>x \<in> S; norm(f x - f a) < k\<rbrakk> \<Longrightarrow> norm(x - a) \<le> B * norm(f x - f a)"
   proof -
     obtain B where "B > 0" and B: "\<And>x. B * norm x \<le> norm (f' x)"
       using linear_inj_bounded_below_pos [of f'] \<open>linear g'\<close> id der_f has_derivative_linear
         linear_invertible_bounded_below_pos by blast
     then obtain d where "d>0"
       and d: "\<And>y. \<lbrakk>y \<in> S; norm (y - a) < d\<rbrakk> \<Longrightarrow>
                     norm (f y - f a - f' (y - a)) \<le> B / 2 * norm (y - a)"
       using f' [of "B/2"] by auto
     then obtain e where "e > 0"
       and e: "\<And>x. \<lbrakk>x \<in> S; norm (f x - f a) < e\<rbrakk> \<Longrightarrow> norm (g (f x) - g (f a)) < d"
       using cont_g by (auto simp: continuous_within_eps_delta dist_norm)
     show thesis
     proof
       show "2/B > 0"
         using \<open>B > 0\<close> by simp
       show "norm (x - a) \<le> 2 / B * norm (f x - f a)"
         if "x \<in> S" "norm (f x - f a) < e" for x
       proof -
         have xa: "norm (x - a) < d"
           using e [OF that] gf by (simp add: \<open>a \<in> S\<close> that)
         have *: "\<lbrakk>norm(y - f') \<le> B / 2 * norm x; B * norm x \<le> norm f'\<rbrakk>
                  \<Longrightarrow> norm y \<ge> B / 2 * norm x" for y f'::'b and x::'a
           using norm_triangle_ineq3 [of y f'] by linarith
         show ?thesis
           using * [OF d [OF \<open>x \<in> S\<close> xa] B] \<open>B > 0\<close> by (simp add: field_simps)
       qed
     qed (use \<open>e > 0\<close> in auto)
   qed
   show ?thesis
     unfolding has_derivative_within_alt
   proof (intro conjI impI allI)
     show "bounded_linear g'"
       using \<open>linear g'\<close> by (simp add: linear_linear)
   next
     fix e :: "real"
     assume "e > 0"
     then obtain d where "d>0"
       and d: "\<And>y. \<lbrakk>y \<in> S; norm (y - a) < d\<rbrakk> \<Longrightarrow>
                     norm (f y - f a - f' (y - a)) \<le> e / (B * C) * norm (y - a)"
       using f' [of "e / (B * C)"] \<open>B > 0\<close> \<open>C > 0\<close> by auto
     have "norm (x - a - g' (f x - f a)) \<le> e * norm (f x - f a)"
       if "x \<in> S" and lt_k: "norm (f x - f a) < k" and lt_dB: "norm (f x - f a) < d/B" for x
     proof -
       have "norm (x - a) \<le> B * norm(f x - f a)"
         using Bk lt_k \<open>x \<in> S\<close> by blast
       also have "\<dots> < d"
         by (metis \<open>0 < B\<close> lt_dB mult.commute pos_less_divide_eq)
       finally have lt_d: "norm (x - a) < d" .
       have "norm (x - a - g' (f x - f a)) \<le> norm(g'(f x - f a - (f' (x - a))))"
         by (simp add: linear_diff [OF \<open>linear g'\<close>] norm_minus_commute)
       also have "\<dots> \<le> C * norm (f x - f a - f' (x - a))"
         using C by blast
       also have "\<dots> \<le> e * norm (f x - f a)"
       proof -
         have "norm (f x - f a - f' (x - a)) \<le> e / (B * C) * norm (x - a)"
           using d [OF \<open>x \<in> S\<close> lt_d] .
         also have "\<dots> \<le> (norm (f x - f a) * e) / C"
           using \<open>B > 0\<close> \<open>C > 0\<close> \<open>e > 0\<close> by (simp add: field_simps Bk lt_k \<open>x \<in> S\<close>)
         finally show ?thesis
           using \<open>C > 0\<close> by (simp add: field_simps)
       qed
     finally show ?thesis .
     qed
     with \<open>k > 0\<close> \<open>B > 0\<close> \<open>d > 0\<close> \<open>a \<in> S\<close> 
     show "\<exists>d>0. \<forall>y\<in>f ` S.
                norm (y - f a) < d \<longrightarrow>
                norm (g y - g (f a) - g' (y - f a)) \<le> e * norm (y - f a)"
       by (rule_tac x="min k (d / B)" in exI) (auto simp: gf)
   qed
 qed
 
 end
diff --git a/src/HOL/Analysis/Equivalence_Measurable_On_Borel.thy b/src/HOL/Analysis/Equivalence_Measurable_On_Borel.thy
--- a/src/HOL/Analysis/Equivalence_Measurable_On_Borel.thy
+++ b/src/HOL/Analysis/Equivalence_Measurable_On_Borel.thy
@@ -1,1743 +1,1743 @@
 (*  Title:      HOL/Analysis/Equivalence_Measurable_On_Borel
     Author: LC Paulson (some material ported from HOL Light)
 *)
 
 section\<open>Equivalence Between Classical Borel Measurability and HOL Light's\<close>
 
 theory Equivalence_Measurable_On_Borel
   imports Equivalence_Lebesgue_Henstock_Integration Improper_Integral Continuous_Extension
 begin
 
 (*Borrowed from Ergodic_Theory/SG_Library_Complement*)
 abbreviation sym_diff :: "'a set \<Rightarrow> 'a set \<Rightarrow> 'a set" where
   "sym_diff A B \<equiv> ((A - B) \<union> (B-A))"
 
 subsection\<open>Austin's Lemma\<close>
 
 lemma Austin_Lemma:
   fixes \<D> :: "'a::euclidean_space set set"
   assumes "finite \<D>" and \<D>: "\<And>D. D \<in> \<D> \<Longrightarrow> \<exists>k a b. D = cbox a b \<and> (\<forall>i \<in> Basis. b\<bullet>i - a\<bullet>i = k)"
   obtains \<C> where "\<C> \<subseteq> \<D>" "pairwise disjnt \<C>"
                   "measure lebesgue (\<Union>\<C>) \<ge> measure lebesgue (\<Union>\<D>) / 3 ^ (DIM('a))"
   using assms
 proof (induction "card \<D>" arbitrary: \<D> thesis rule: less_induct)
   case less
   show ?case
   proof (cases "\<D> = {}")
     case True
     then show thesis
       using less by auto
   next
     case False
     then have "Max (Sigma_Algebra.measure lebesgue ` \<D>) \<in> Sigma_Algebra.measure lebesgue ` \<D>"
       using Max_in finite_imageI \<open>finite \<D>\<close> by blast
     then obtain D where "D \<in> \<D>" and "measure lebesgue D = Max (measure lebesgue ` \<D>)"
       by auto
     then have D: "\<And>C. C \<in> \<D> \<Longrightarrow> measure lebesgue C \<le> measure lebesgue D"
       by (simp add: \<open>finite \<D>\<close>)
     let ?\<E> = "{C. C \<in> \<D> - {D} \<and> disjnt C D}"
     obtain \<D>' where \<D>'sub: "\<D>' \<subseteq> ?\<E>" and \<D>'dis: "pairwise disjnt \<D>'"
       and \<D>'m: "measure lebesgue (\<Union>\<D>') \<ge> measure lebesgue (\<Union>?\<E>) / 3 ^ (DIM('a))"
     proof (rule less.hyps)
       have *: "?\<E> \<subset> \<D>"
         using \<open>D \<in> \<D>\<close> by auto
       then show "card ?\<E> < card \<D>" "finite ?\<E>"
         by (auto simp: \<open>finite \<D>\<close> psubset_card_mono)
       show "\<exists>k a b. D = cbox a b \<and> (\<forall>i\<in>Basis. b \<bullet> i - a \<bullet> i = k)" if "D \<in> ?\<E>" for D
         using less.prems(3) that by auto
     qed
     then have [simp]: "\<Union>\<D>' - D = \<Union>\<D>'"
       by (auto simp: disjnt_iff)
     show ?thesis
     proof (rule less.prems)
       show "insert D \<D>' \<subseteq> \<D>"
         using \<D>'sub \<open>D \<in> \<D>\<close> by blast
       show "disjoint (insert D \<D>')"
         using \<D>'dis \<D>'sub by (fastforce simp add: pairwise_def disjnt_sym)
       obtain a3 b3 where  m3: "content (cbox a3 b3) = 3 ^ DIM('a) * measure lebesgue D"
         and sub3: "\<And>C. \<lbrakk>C \<in> \<D>; \<not> disjnt C D\<rbrakk> \<Longrightarrow> C \<subseteq> cbox a3 b3"
       proof -
         obtain k a b where ab: "D = cbox a b" and k: "\<And>i. i \<in> Basis \<Longrightarrow> b\<bullet>i - a\<bullet>i = k"
           using less.prems \<open>D \<in> \<D>\<close> by meson
         then have eqk: "\<And>i. i \<in> Basis \<Longrightarrow> a \<bullet> i \<le> b \<bullet> i \<longleftrightarrow> k \<ge> 0"
           by force
         show thesis
         proof
           let ?a = "(a + b) /\<^sub>R 2 - (3/2) *\<^sub>R (b - a)"
           let ?b = "(a + b) /\<^sub>R 2 + (3/2) *\<^sub>R (b - a)"
           have eq: "(\<Prod>i\<in>Basis. b \<bullet> i * 3 - a \<bullet> i * 3) = (\<Prod>i\<in>Basis. b \<bullet> i - a \<bullet> i) * 3 ^ DIM('a)"
             by (simp add: comm_monoid_mult_class.prod.distrib flip: left_diff_distrib inner_diff_left)
           show "content (cbox ?a ?b) = 3 ^ DIM('a) * measure lebesgue D"
             by (simp add: content_cbox_if box_eq_empty algebra_simps eq ab k)
           show "C \<subseteq> cbox ?a ?b" if "C \<in> \<D>" and CD: "\<not> disjnt C D" for C
           proof -
             obtain k' a' b' where ab': "C = cbox a' b'" and k': "\<And>i. i \<in> Basis \<Longrightarrow> b'\<bullet>i - a'\<bullet>i = k'"
               using less.prems \<open>C \<in> \<D>\<close> by meson
             then have eqk': "\<And>i. i \<in> Basis \<Longrightarrow> a' \<bullet> i \<le> b' \<bullet> i \<longleftrightarrow> k' \<ge> 0"
               by force
             show ?thesis
             proof (clarsimp simp add: disjoint_interval disjnt_def ab ab' not_less subset_box algebra_simps)
               show "a \<bullet> i * 2 \<le> a' \<bullet> i + b \<bullet> i \<and> a \<bullet> i + b' \<bullet> i \<le> b \<bullet> i * 2"
                 if * [rule_format]: "\<forall>j\<in>Basis. a' \<bullet> j \<le> b' \<bullet> j" and "i \<in> Basis" for i
               proof -
                 have "a' \<bullet> i \<le> b' \<bullet> i \<and> a \<bullet> i \<le> b \<bullet> i \<and> a \<bullet> i \<le> b' \<bullet> i \<and> a' \<bullet> i \<le> b \<bullet> i"
                   using \<open>i \<in> Basis\<close> CD by (simp_all add: disjoint_interval disjnt_def ab ab' not_less)
                 then show ?thesis
                   using D [OF \<open>C \<in> \<D>\<close>] \<open>i \<in> Basis\<close>
                   apply (simp add: ab ab' k k' eqk eqk' content_cbox_cases)
                   using k k' by fastforce
               qed
             qed
           qed
         qed
       qed
       have \<D>lm: "\<And>D. D \<in> \<D> \<Longrightarrow> D \<in> lmeasurable"
         using less.prems(3) by blast
       have "measure lebesgue (\<Union>\<D>)  \<le> measure lebesgue (cbox a3 b3 \<union> (\<Union>\<D> - cbox a3 b3))"
       proof (rule measure_mono_fmeasurable)
         show "\<Union>\<D> \<in> sets lebesgue"
           using \<D>lm \<open>finite \<D>\<close> by blast
         show "cbox a3 b3 \<union> (\<Union>\<D> - cbox a3 b3) \<in> lmeasurable"
           by (simp add: \<D>lm fmeasurable.Un fmeasurable.finite_Union less.prems(2) subset_eq)
       qed auto
       also have "\<dots> = content (cbox a3 b3) + measure lebesgue (\<Union>\<D> - cbox a3 b3)"
         by (simp add: \<D>lm fmeasurable.finite_Union less.prems(2) measure_Un2 subsetI)
       also have "\<dots> \<le> (measure lebesgue D + measure lebesgue (\<Union>\<D>')) * 3 ^ DIM('a)"
       proof -
         have "(\<Union>\<D> - cbox a3 b3) \<subseteq> \<Union>?\<E>"
           using sub3 by fastforce
         then have "measure lebesgue (\<Union>\<D> - cbox a3 b3) \<le> measure lebesgue (\<Union>?\<E>)"
         proof (rule measure_mono_fmeasurable)
           show "\<Union> \<D> - cbox a3 b3 \<in> sets lebesgue"
             by (simp add: \<D>lm fmeasurableD less.prems(2) sets.Diff sets.finite_Union subsetI)
           show "\<Union> {C \<in> \<D> - {D}. disjnt C D} \<in> lmeasurable"
             using \<D>lm less.prems(2) by auto
         qed
         then have "measure lebesgue (\<Union>\<D> - cbox a3 b3) / 3 ^ DIM('a) \<le> measure lebesgue (\<Union> \<D>')"
           using \<D>'m by (simp add: field_split_simps)
         then show ?thesis
           by (simp add: m3 field_simps)
       qed
       also have "\<dots> \<le> measure lebesgue (\<Union>(insert D \<D>')) * 3 ^ DIM('a)"
       proof (simp add: \<D>lm \<open>D \<in> \<D>\<close>)
         show "measure lebesgue D + measure lebesgue (\<Union>\<D>') \<le> measure lebesgue (D \<union> \<Union> \<D>')"
         proof (subst measure_Un2)
           show "\<Union> \<D>' \<in> lmeasurable"
             by (meson \<D>lm \<open>insert D \<D>' \<subseteq> \<D>\<close> fmeasurable.finite_Union less.prems(2) finite_subset subset_eq subset_insertI)
           show "measure lebesgue D + measure lebesgue (\<Union> \<D>') \<le> measure lebesgue D + measure lebesgue (\<Union> \<D>' - D)"
             using \<open>insert D \<D>' \<subseteq> \<D>\<close> infinite_super less.prems(2) by force
         qed (simp add: \<D>lm \<open>D \<in> \<D>\<close>)
       qed
       finally show "measure lebesgue (\<Union>\<D>) / 3 ^ DIM('a) \<le> measure lebesgue (\<Union>(insert D \<D>'))"
         by (simp add: field_split_simps)
     qed
   qed
 qed
 
 
 subsection\<open>A differentiability-like property of the indefinite integral.        \<close>
 
 proposition integrable_ccontinuous_explicit:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "\<And>a b::'a. f integrable_on cbox a b"
   obtains N where
        "negligible N"
        "\<And>x e. \<lbrakk>x \<notin> N; 0 < e\<rbrakk> \<Longrightarrow>
                \<exists>d>0. \<forall>h. 0 < h \<and> h < d \<longrightarrow>
                          norm(integral (cbox x (x + h *\<^sub>R One)) f /\<^sub>R h ^ DIM('a) - f x) < e"
 proof -
   define BOX where "BOX \<equiv> \<lambda>h. \<lambda>x::'a. cbox x (x + h *\<^sub>R One)"
   define BOX2 where "BOX2 \<equiv> \<lambda>h. \<lambda>x::'a. cbox (x - h *\<^sub>R One) (x + h *\<^sub>R One)"
   define i where "i \<equiv> \<lambda>h x. integral (BOX h x) f /\<^sub>R h ^ DIM('a)"
   define \<Psi> where "\<Psi> \<equiv> \<lambda>x r. \<forall>d>0. \<exists>h. 0 < h \<and> h < d \<and> r \<le> norm(i h x - f x)"
   let ?N = "{x. \<exists>e>0. \<Psi> x e}"
   have "\<exists>N. negligible N \<and> (\<forall>x e. x \<notin> N \<and> 0 < e \<longrightarrow> \<not> \<Psi> x e)"
   proof (rule exI ; intro conjI allI impI)
     let ?M =  "\<Union>n. {x. \<Psi> x (inverse(real n + 1))}"
     have "negligible ({x. \<Psi> x \<mu>} \<inter> cbox a b)"
       if "\<mu> > 0" for a b \<mu>
     proof (cases "negligible(cbox a b)")
       case True
       then show ?thesis
         by (simp add: negligible_Int)
     next
       case False
       then have "box a b \<noteq> {}"
         by (simp add: negligible_interval)
       then have ab: "\<And>i. i \<in> Basis \<Longrightarrow> a\<bullet>i < b\<bullet>i"
         by (simp add: box_ne_empty)
       show ?thesis
         unfolding negligible_outer_le
       proof (intro allI impI)
         fix e::real
         let ?ee = "(e * \<mu>) / 2 / 6 ^ (DIM('a))"
         assume "e > 0"
         then have gt0: "?ee > 0"
           using \<open>\<mu> > 0\<close> by auto
         have f': "f integrable_on cbox (a - One) (b + One)"
           using assms by blast
         obtain \<gamma> where "gauge \<gamma>"
           and \<gamma>: "\<And>p. \<lbrakk>p tagged_partial_division_of (cbox (a - One) (b + One)); \<gamma> fine p\<rbrakk>
                     \<Longrightarrow> (\<Sum>(x, k)\<in>p. norm (content k *\<^sub>R f x - integral k f)) < ?ee"
           using Henstock_lemma [OF f' gt0] that by auto
         let ?E = "{x. x \<in> cbox a b \<and> \<Psi> x \<mu>}"
         have "\<exists>h>0. BOX h x \<subseteq> \<gamma> x \<and>
                     BOX h x \<subseteq> cbox (a - One) (b + One) \<and> \<mu> \<le> norm (i h x - f x)"
           if "x \<in> cbox a b" "\<Psi> x \<mu>" for x
         proof -
           obtain d where "d > 0" and d: "ball x d \<subseteq> \<gamma> x"
             using gaugeD [OF \<open>gauge \<gamma>\<close>, of x] openE by blast
           then obtain h where "0 < h" "h < 1" and hless: "h < d / real DIM('a)"
                           and mule: "\<mu> \<le> norm (i h x - f x)"
             using \<open>\<Psi> x \<mu>\<close> [unfolded \<Psi>_def, rule_format, of "min 1 (d / DIM('a))"]
             by auto
           show ?thesis
           proof (intro exI conjI)
             show "0 < h" "\<mu> \<le> norm (i h x - f x)" by fact+
             have "BOX h x \<subseteq> ball x d"
             proof (clarsimp simp: BOX_def mem_box dist_norm algebra_simps)
               fix y
               assume "\<forall>i\<in>Basis. x \<bullet> i \<le> y \<bullet> i \<and> y \<bullet> i \<le> h + x \<bullet> i"
               then have lt: "\<bar>(x - y) \<bullet> i\<bar> < d / real DIM('a)" if "i \<in> Basis" for i
                 using hless that by (force simp: inner_diff_left)
               have "norm (x - y) \<le> (\<Sum>i\<in>Basis. \<bar>(x - y) \<bullet> i\<bar>)"
                 using norm_le_l1 by blast
               also have "\<dots> < d"
                 using sum_bounded_above_strict [of Basis "\<lambda>i. \<bar>(x - y) \<bullet> i\<bar>" "d / DIM('a)", OF lt]
                 by auto
               finally show "norm (x - y) < d" .
             qed
             with d show "BOX h x \<subseteq> \<gamma> x"
               by blast
             show "BOX h x \<subseteq> cbox (a - One) (b + One)"
               using that \<open>h < 1\<close>
               by (force simp: BOX_def mem_box algebra_simps intro: subset_box_imp)
           qed
         qed
         then obtain \<eta> where h0: "\<And>x. x \<in> ?E \<Longrightarrow> \<eta> x > 0"
           and BOX_\<gamma>: "\<And>x. x \<in> ?E \<Longrightarrow> BOX (\<eta> x) x \<subseteq> \<gamma> x"
           and "\<And>x. x \<in> ?E \<Longrightarrow> BOX (\<eta> x) x \<subseteq> cbox (a - One) (b + One) \<and> \<mu> \<le> norm (i (\<eta> x) x - f x)"
           by simp metis
         then have BOX_cbox: "\<And>x. x \<in> ?E \<Longrightarrow> BOX (\<eta> x) x \<subseteq> cbox (a - One) (b + One)"
              and \<mu>_le: "\<And>x. x \<in> ?E \<Longrightarrow> \<mu> \<le> norm (i (\<eta> x) x - f x)"
           by blast+
         define \<gamma>' where "\<gamma>' \<equiv> \<lambda>x. if x \<in> cbox a b \<and> \<Psi> x \<mu> then ball x (\<eta> x) else \<gamma> x"
         have "gauge \<gamma>'"
           using \<open>gauge \<gamma>\<close> by (auto simp: h0 gauge_def \<gamma>'_def)
         obtain \<D> where "countable \<D>"
           and \<D>: "\<Union>\<D> \<subseteq> cbox a b"
           "\<And>K. K \<in> \<D> \<Longrightarrow> interior K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
           and Dcovered: "\<And>K. K \<in> \<D> \<Longrightarrow> \<exists>x. x \<in> cbox a b \<and> \<Psi> x \<mu> \<and> x \<in> K \<and> K \<subseteq> \<gamma>' x"
           and subUD: "?E \<subseteq> \<Union>\<D>"
           by (rule covering_lemma [of ?E a b \<gamma>']) (simp_all add: Bex_def \<open>box a b \<noteq> {}\<close> \<open>gauge \<gamma>'\<close>)
         then have "\<D> \<subseteq> sets lebesgue"
           by fastforce
         show "\<exists>T. {x. \<Psi> x \<mu>} \<inter> cbox a b \<subseteq> T \<and> T \<in> lmeasurable \<and> measure lebesgue T \<le> e"
         proof (intro exI conjI)
           show "{x. \<Psi> x \<mu>} \<inter> cbox a b \<subseteq> \<Union>\<D>"
             apply auto
             using subUD by auto
           have mUE: "measure lebesgue (\<Union> \<E>) \<le> measure lebesgue (cbox a b)"
             if "\<E> \<subseteq> \<D>" "finite \<E>" for \<E>
           proof (rule measure_mono_fmeasurable)
             show "\<Union> \<E> \<subseteq> cbox a b"
               using \<D>(1) that(1) by blast
             show "\<Union> \<E> \<in> sets lebesgue"
               by (metis \<D>(2) fmeasurable.finite_Union fmeasurableD lmeasurable_cbox subset_eq that)
           qed auto
           then show "\<Union>\<D> \<in> lmeasurable"
             by (metis \<D>(2) \<open>countable \<D>\<close> fmeasurable_Union_bound lmeasurable_cbox)
           then have leab: "measure lebesgue (\<Union>\<D>) \<le> measure lebesgue (cbox a b)"
             by (meson \<D>(1) fmeasurableD lmeasurable_cbox measure_mono_fmeasurable)
           obtain \<F> where "\<F> \<subseteq> \<D>" "finite \<F>"
             and \<F>: "measure lebesgue (\<Union>\<D>) \<le> 2 * measure lebesgue (\<Union>\<F>)"
           proof (cases "measure lebesgue (\<Union>\<D>) = 0")
             case True
             then show ?thesis
               by (force intro: that [where \<F> = "{}"])
           next
             case False
             obtain \<F> where "\<F> \<subseteq> \<D>" "finite \<F>"
               and \<F>: "measure lebesgue (\<Union>\<D>)/2 < measure lebesgue (\<Union>\<F>)"
             proof (rule measure_countable_Union_approachable [of \<D> "measure lebesgue (\<Union>\<D>) / 2" "content (cbox a b)"])
               show "countable \<D>"
                 by fact
               show "0 < measure lebesgue (\<Union> \<D>) / 2"
                 using False by (simp add: zero_less_measure_iff)
               show Dlm: "D \<in> lmeasurable" if "D \<in> \<D>" for D
                 using \<D>(2) that by blast
               show "measure lebesgue (\<Union> \<F>) \<le> content (cbox a b)"
                 if "\<F> \<subseteq> \<D>" "finite \<F>" for \<F>
               proof -
                 have "measure lebesgue (\<Union> \<F>) \<le> measure lebesgue (\<Union>\<D>)"
                 proof (rule measure_mono_fmeasurable)
                   show "\<Union> \<F> \<subseteq> \<Union> \<D>"
                     by (simp add: Sup_subset_mono \<open>\<F> \<subseteq> \<D>\<close>)
                   show "\<Union> \<F> \<in> sets lebesgue"
                     by (meson Dlm fmeasurableD sets.finite_Union subset_eq that)
                   show "\<Union> \<D> \<in> lmeasurable"
                     by fact
                 qed
                 also have "\<dots> \<le> measure lebesgue (cbox a b)"
                 proof (rule measure_mono_fmeasurable)
                   show "\<Union> \<D> \<in> sets lebesgue"
                     by (simp add: \<open>\<Union> \<D> \<in> lmeasurable\<close> fmeasurableD)
                 qed (auto simp:\<D>(1))
                 finally show ?thesis
                   by simp
               qed
             qed auto
             then show ?thesis
               using that by auto
           qed
           obtain tag where tag_in_E: "\<And>D. D \<in> \<D> \<Longrightarrow> tag D \<in> ?E"
             and tag_in_self: "\<And>D. D \<in> \<D> \<Longrightarrow> tag D \<in> D"
             and tag_sub: "\<And>D. D \<in> \<D> \<Longrightarrow> D \<subseteq> \<gamma>' (tag D)"
             using Dcovered by simp metis
           then have sub_ball_tag: "\<And>D. D \<in> \<D> \<Longrightarrow> D \<subseteq> ball (tag D) (\<eta> (tag D))"
             by (simp add: \<gamma>'_def)
           define \<Phi> where "\<Phi> \<equiv> \<lambda>D. BOX (\<eta>(tag D)) (tag D)"
           define \<Phi>2 where "\<Phi>2 \<equiv> \<lambda>D. BOX2 (\<eta>(tag D)) (tag D)"
           obtain \<C> where "\<C> \<subseteq> \<Phi>2 ` \<F>" "pairwise disjnt \<C>"
             "measure lebesgue (\<Union>\<C>) \<ge> measure lebesgue (\<Union>(\<Phi>2`\<F>)) / 3 ^ (DIM('a))"
           proof (rule Austin_Lemma)
             show "finite (\<Phi>2`\<F>)"
               using \<open>finite \<F>\<close> by blast
             have "\<exists>k a b. \<Phi>2 D = cbox a b \<and> (\<forall>i\<in>Basis. b \<bullet> i - a \<bullet> i = k)" if "D \<in> \<F>" for D
               apply (rule_tac x="2 * \<eta>(tag D)" in exI)
               apply (rule_tac x="tag D - \<eta>(tag D) *\<^sub>R One" in exI)
               apply (rule_tac x="tag D + \<eta>(tag D) *\<^sub>R One" in exI)
               using that
               apply (auto simp: \<Phi>2_def BOX2_def algebra_simps)
               done
             then show "\<And>D. D \<in> \<Phi>2 ` \<F> \<Longrightarrow> \<exists>k a b. D = cbox a b \<and> (\<forall>i\<in>Basis. b \<bullet> i - a \<bullet> i = k)"
               by blast
           qed auto
           then obtain \<G> where "\<G> \<subseteq> \<F>" and disj: "pairwise disjnt (\<Phi>2 ` \<G>)"
             and "measure lebesgue (\<Union>(\<Phi>2 ` \<G>)) \<ge> measure lebesgue (\<Union>(\<Phi>2`\<F>)) / 3 ^ (DIM('a))"
             unfolding \<Phi>2_def subset_image_iff
             by (meson empty_subsetI equals0D pairwise_imageI)
           moreover
           have "measure lebesgue (\<Union>(\<Phi>2 ` \<G>)) * 3 ^ DIM('a) \<le> e/2"
           proof -
             have "finite \<G>"
               using \<open>finite \<F>\<close> \<open>\<G> \<subseteq> \<F>\<close> infinite_super by blast
             have BOX2_m: "\<And>x. x \<in> tag ` \<G> \<Longrightarrow> BOX2 (\<eta> x) x \<in> lmeasurable"
               by (auto simp: BOX2_def)
             have BOX_m: "\<And>x. x \<in> tag ` \<G> \<Longrightarrow> BOX (\<eta> x) x \<in> lmeasurable"
               by (auto simp: BOX_def)
             have BOX_sub: "BOX (\<eta> x) x \<subseteq> BOX2 (\<eta> x) x" for x
               by (auto simp: BOX_def BOX2_def subset_box algebra_simps)
             have DISJ2: "BOX2 (\<eta> (tag X)) (tag X) \<inter> BOX2 (\<eta> (tag Y)) (tag Y) = {}"
               if "X \<in> \<G>" "Y \<in> \<G>" "tag X \<noteq> tag Y" for X Y
             proof -
               obtain i where i: "i \<in> Basis" "tag X \<bullet> i \<noteq> tag Y \<bullet> i"
                 using \<open>tag X \<noteq> tag Y\<close> by (auto simp: euclidean_eq_iff [of "tag X"])
               have XY: "X \<in> \<D>" "Y \<in> \<D>"
                 using \<open>\<F> \<subseteq> \<D>\<close> \<open>\<G> \<subseteq> \<F>\<close> that by auto
               then have "0 \<le> \<eta> (tag X)" "0 \<le> \<eta> (tag Y)"
                 by (meson h0 le_cases not_le tag_in_E)+
               with XY i have "BOX2 (\<eta> (tag X)) (tag X) \<noteq> BOX2 (\<eta> (tag Y)) (tag Y)"
                 unfolding eq_iff
                 by (fastforce simp add: BOX2_def subset_box algebra_simps)
               then show ?thesis
                 using disj that by (auto simp: pairwise_def disjnt_def \<Phi>2_def)
             qed
             then have BOX2_disj: "pairwise (\<lambda>x y. negligible (BOX2 (\<eta> x) x \<inter> BOX2 (\<eta> y) y)) (tag ` \<G>)"
               by (simp add: pairwise_imageI)
             then have BOX_disj: "pairwise (\<lambda>x y. negligible (BOX (\<eta> x) x \<inter> BOX (\<eta> y) y)) (tag ` \<G>)"
             proof (rule pairwise_mono)
               show "negligible (BOX (\<eta> x) x \<inter> BOX (\<eta> y) y)"
                 if "negligible (BOX2 (\<eta> x) x \<inter> BOX2 (\<eta> y) y)" for x y
                 by (metis (no_types, hide_lams) that Int_mono negligible_subset BOX_sub)
             qed auto
 
             have eq: "\<And>box. (\<lambda>D. box (\<eta> (tag D)) (tag D)) ` \<G> = (\<lambda>t. box (\<eta> t) t) ` tag ` \<G>"
               by (simp add: image_comp)
             have "measure lebesgue (BOX2 (\<eta> t) t) * 3 ^ DIM('a)
                 = measure lebesgue (BOX (\<eta> t) t) * (2*3) ^ DIM('a)"
               if "t \<in> tag ` \<G>" for t
             proof -
               have "content (cbox (t - \<eta> t *\<^sub>R One) (t + \<eta> t *\<^sub>R One))
                   = content (cbox t (t + \<eta> t *\<^sub>R One)) * 2 ^ DIM('a)"
                 using that by (simp add: algebra_simps content_cbox_if box_eq_empty)
               then show ?thesis
                 by (simp add: BOX2_def BOX_def flip: power_mult_distrib)
             qed
             then have "measure lebesgue (\<Union>(\<Phi>2 ` \<G>)) * 3 ^ DIM('a) = measure lebesgue (\<Union>(\<Phi> ` \<G>)) * 6 ^ DIM('a)"
               unfolding \<Phi>_def \<Phi>2_def eq
               by (simp add: measure_negligible_finite_Union_image
                   \<open>finite \<G>\<close> BOX2_m BOX_m BOX2_disj BOX_disj sum_distrib_right
                   del: UN_simps)
             also have "\<dots> \<le> e/2"
             proof -
               have "\<mu> * measure lebesgue (\<Union>D\<in>\<G>. \<Phi> D) \<le> \<mu> * (\<Sum>D \<in> \<Phi>`\<G>. measure lebesgue D)"
                 using \<open>\<mu> > 0\<close> \<open>finite \<G>\<close> by (force simp: BOX_m \<Phi>_def fmeasurableD intro: measure_Union_le)
               also have "\<dots> = (\<Sum>D \<in> \<Phi>`\<G>. measure lebesgue D * \<mu>)"
                 by (metis mult.commute sum_distrib_right)
               also have "\<dots> \<le> (\<Sum>(x, K) \<in> (\<lambda>D. (tag D, \<Phi> D)) ` \<G>.  norm (content K *\<^sub>R f x - integral K f))"
               proof (rule sum_le_included; clarify?)
                 fix D
                 assume "D \<in> \<G>"
                 then have "\<eta> (tag D) > 0"
                   using \<open>\<F> \<subseteq> \<D>\<close> \<open>\<G> \<subseteq> \<F>\<close> h0 tag_in_E by auto
                 then have m_\<Phi>: "measure lebesgue (\<Phi> D) > 0"
                   by (simp add: \<Phi>_def BOX_def algebra_simps)
                 have "\<mu> \<le> norm (i (\<eta>(tag D)) (tag D) - f(tag D))"
                   using \<mu>_le \<open>D \<in> \<G>\<close> \<open>\<F> \<subseteq> \<D>\<close> \<open>\<G> \<subseteq> \<F>\<close> tag_in_E by auto
                 also have "\<dots> = norm ((content (\<Phi> D) *\<^sub>R f(tag D) - integral (\<Phi> D) f) /\<^sub>R measure lebesgue (\<Phi> D))"
                   using m_\<Phi>
                   unfolding i_def \<Phi>_def BOX_def
                   by (simp add: algebra_simps content_cbox_plus norm_minus_commute)
                 finally have "measure lebesgue (\<Phi> D) * \<mu> \<le> norm (content (\<Phi> D) *\<^sub>R f(tag D) - integral (\<Phi> D) f)"
                   using m_\<Phi> by simp (simp add: field_simps)
                 then show "\<exists>y\<in>(\<lambda>D. (tag D, \<Phi> D)) ` \<G>.
                         snd y = \<Phi> D \<and> measure lebesgue (\<Phi> D) * \<mu> \<le> (case y of (x, k) \<Rightarrow> norm (content k *\<^sub>R f x - integral k f))"
                   using \<open>D \<in> \<G>\<close> by auto
               qed (use \<open>finite \<G>\<close> in auto)
               also have "\<dots> < ?ee"
               proof (rule \<gamma>)
                 show "(\<lambda>D. (tag D, \<Phi> D)) ` \<G> tagged_partial_division_of cbox (a - One) (b + One)"
                   unfolding tagged_partial_division_of_def
                 proof (intro conjI allI impI ; clarify ?)
                   show "tag D \<in> \<Phi> D"
                     if "D \<in> \<G>" for D
                     using that \<open>\<F> \<subseteq> \<D>\<close> \<open>\<G> \<subseteq> \<F>\<close> h0 tag_in_E
                     by (auto simp: \<Phi>_def BOX_def mem_box algebra_simps eucl_less_le_not_le in_mono)
                   show "y \<in> cbox (a - One) (b + One)" if "D \<in> \<G>" "y \<in> \<Phi> D" for D y
                     using that BOX_cbox \<Phi>_def \<open>\<F> \<subseteq> \<D>\<close> \<open>\<G> \<subseteq> \<F>\<close> tag_in_E by blast
                   show "tag D = tag E \<and> \<Phi> D = \<Phi> E"
                     if "D \<in> \<G>" "E \<in> \<G>" and ne: "interior (\<Phi> D) \<inter> interior (\<Phi> E) \<noteq> {}" for D E
                   proof -
                     have "BOX2 (\<eta> (tag D)) (tag D) \<inter> BOX2 (\<eta> (tag E)) (tag E) = {} \<or> tag E = tag D"
                       using DISJ2 \<open>D \<in> \<G>\<close> \<open>E \<in> \<G>\<close> by force
                     then have "BOX (\<eta> (tag D)) (tag D) \<inter> BOX (\<eta> (tag E)) (tag E) = {} \<or> tag E = tag D"
                       using BOX_sub by blast
                     then show "tag D = tag E \<and> \<Phi> D = \<Phi> E"
                       by (metis \<Phi>_def interior_Int interior_empty ne)
                   qed
                 qed (use \<open>finite \<G>\<close> \<Phi>_def BOX_def in auto)
                 show "\<gamma> fine (\<lambda>D. (tag D, \<Phi> D)) ` \<G>"
                   unfolding fine_def \<Phi>_def using BOX_\<gamma> \<open>\<F> \<subseteq> \<D>\<close> \<open>\<G> \<subseteq> \<F>\<close> tag_in_E by blast
               qed
               finally show ?thesis
                 using \<open>\<mu> > 0\<close> by (auto simp: field_split_simps)
           qed
             finally show ?thesis .
           qed
           moreover
           have "measure lebesgue (\<Union>\<F>) \<le> measure lebesgue (\<Union>(\<Phi>2`\<F>))"
           proof (rule measure_mono_fmeasurable)
             have "D \<subseteq> ball (tag D) (\<eta>(tag D))" if "D \<in> \<F>" for D
               using \<open>\<F> \<subseteq> \<D>\<close> sub_ball_tag that by blast
             moreover have "ball (tag D) (\<eta>(tag D)) \<subseteq> BOX2 (\<eta> (tag D)) (tag D)" if "D \<in> \<F>" for D
             proof (clarsimp simp: \<Phi>2_def BOX2_def mem_box algebra_simps dist_norm)
               fix x and i::'a
               assume "norm (tag D - x) < \<eta> (tag D)" and "i \<in> Basis"
               then have "\<bar>tag D \<bullet> i - x \<bullet> i\<bar> \<le> \<eta> (tag D)"
                 by (metis eucl_less_le_not_le inner_commute inner_diff_right norm_bound_Basis_le)
               then show "tag D \<bullet> i \<le> x \<bullet> i + \<eta> (tag D) \<and> x \<bullet> i \<le> \<eta> (tag D) + tag D \<bullet> i"
                 by (simp add: abs_diff_le_iff)
             qed
             ultimately show "\<Union>\<F> \<subseteq> \<Union>(\<Phi>2`\<F>)"
               by (force simp: \<Phi>2_def)
             show "\<Union>\<F> \<in> sets lebesgue"
               using \<open>finite \<F>\<close> \<open>\<D> \<subseteq> sets lebesgue\<close> \<open>\<F> \<subseteq> \<D>\<close> by blast
             show "\<Union>(\<Phi>2`\<F>) \<in> lmeasurable"
               unfolding \<Phi>2_def BOX2_def using \<open>finite \<F>\<close> by blast
           qed
           ultimately
           have "measure lebesgue (\<Union>\<F>) \<le> e/2"
             by (auto simp: field_split_simps)
           then show "measure lebesgue (\<Union>\<D>) \<le> e"
             using \<F> by linarith
         qed
       qed
     qed
     then have "\<And>j. negligible {x. \<Psi> x (inverse(real j + 1))}"
       using negligible_on_intervals
       by (metis (full_types) inverse_positive_iff_positive le_add_same_cancel1 linorder_not_le nat_le_real_less not_add_less1 of_nat_0)
     then have "negligible ?M"
       by auto
     moreover have "?N \<subseteq> ?M"
     proof (clarsimp simp: dist_norm)
       fix y e
       assume "0 < e"
         and ye [rule_format]: "\<Psi> y e"
       then obtain k where k: "0 < k" "inverse (real k + 1) < e"
         by (metis One_nat_def add.commute less_add_same_cancel2 less_imp_inverse_less less_trans neq0_conv of_nat_1 of_nat_Suc reals_Archimedean zero_less_one)
       with ye show "\<exists>n. \<Psi> y (inverse (real n + 1))"
         apply (rule_tac x=k in exI)
         unfolding \<Psi>_def
         by (force intro: less_le_trans)
     qed
     ultimately show "negligible ?N"
       by (blast intro: negligible_subset)
     show "\<not> \<Psi> x e" if "x \<notin> ?N \<and> 0 < e" for x e
       using that by blast
   qed
   with that show ?thesis
     unfolding i_def BOX_def \<Psi>_def by (fastforce simp add: not_le)
 qed
 
 
 subsection\<open>HOL Light measurability\<close>
 
 definition measurable_on :: "('a::euclidean_space \<Rightarrow> 'b::real_normed_vector) \<Rightarrow> 'a set \<Rightarrow> bool"
   (infixr "measurable'_on" 46)
   where "f measurable_on S \<equiv>
         \<exists>N g. negligible N \<and>
               (\<forall>n. continuous_on UNIV (g n)) \<and>
               (\<forall>x. x \<notin> N \<longrightarrow> (\<lambda>n. g n x) \<longlonglongrightarrow> (if x \<in> S then f x else 0))"
 
 lemma measurable_on_UNIV:
   "(\<lambda>x.  if x \<in> S then f x else 0) measurable_on UNIV \<longleftrightarrow> f measurable_on S"
   by (auto simp: measurable_on_def)
 
 lemma measurable_on_spike_set:
   assumes f: "f measurable_on S" and neg: "negligible ((S - T) \<union> (T - S))"
   shows "f measurable_on T"
 proof -
   obtain N and F
     where N: "negligible N"
       and conF: "\<And>n. continuous_on UNIV (F n)"
       and tendsF: "\<And>x. x \<notin> N \<Longrightarrow> (\<lambda>n. F n x) \<longlonglongrightarrow> (if x \<in> S then f x else 0)"
     using f by (auto simp: measurable_on_def)
   show ?thesis
     unfolding measurable_on_def
   proof (intro exI conjI allI impI)
     show "continuous_on UNIV (\<lambda>x. F n x)" for n
       by (intro conF continuous_intros)
     show "negligible (N \<union> (S - T) \<union> (T - S))"
       by (metis (full_types) N neg negligible_Un_eq)
     show "(\<lambda>n. F n x) \<longlonglongrightarrow> (if x \<in> T then f x else 0)"
       if "x \<notin> (N \<union> (S - T) \<union> (T - S))" for x
       using that tendsF [of x] by auto
   qed
 qed
 
 text\<open> Various common equivalent forms of function measurability.                \<close>
 
 lemma measurable_on_0 [simp]: "(\<lambda>x. 0) measurable_on S"
   unfolding measurable_on_def
 proof (intro exI conjI allI impI)
   show "(\<lambda>n. 0) \<longlonglongrightarrow> (if x \<in> S then 0::'b else 0)" for x
     by force
 qed auto
 
 lemma measurable_on_scaleR_const:
   assumes f: "f measurable_on S"
   shows "(\<lambda>x. c *\<^sub>R f x) measurable_on S"
 proof -
   obtain NF and F
     where NF: "negligible NF"
       and conF: "\<And>n. continuous_on UNIV (F n)"
       and tendsF: "\<And>x. x \<notin> NF \<Longrightarrow> (\<lambda>n. F n x) \<longlonglongrightarrow> (if x \<in> S then f x else 0)"
     using f by (auto simp: measurable_on_def)
   show ?thesis
     unfolding measurable_on_def
   proof (intro exI conjI allI impI)
     show "continuous_on UNIV (\<lambda>x. c *\<^sub>R F n x)" for n
       by (intro conF continuous_intros)
     show "(\<lambda>n. c *\<^sub>R F n x) \<longlonglongrightarrow> (if x \<in> S then c *\<^sub>R f x else 0)"
       if "x \<notin> NF" for x
       using tendsto_scaleR [OF tendsto_const tendsF, of x] that by auto
   qed (auto simp: NF)
 qed
 
 
 lemma measurable_on_cmul:
   fixes c :: real
   assumes "f measurable_on S"
   shows "(\<lambda>x. c * f x) measurable_on S"
   using measurable_on_scaleR_const [OF assms] by simp
 
 lemma measurable_on_cdivide:
   fixes c :: real
   assumes "f measurable_on S"
   shows "(\<lambda>x. f x / c) measurable_on S"
 proof (cases "c=0")
   case False
   then show ?thesis
     using measurable_on_cmul [of f S "1/c"]
     by (simp add: assms)
 qed auto
 
 
 lemma measurable_on_minus:
    "f measurable_on S \<Longrightarrow> (\<lambda>x. -(f x)) measurable_on S"
   using measurable_on_scaleR_const [of f S "-1"] by auto
 
 
 lemma continuous_imp_measurable_on:
    "continuous_on UNIV f \<Longrightarrow> f measurable_on UNIV"
   unfolding measurable_on_def
   apply (rule_tac x="{}" in exI)
   apply (rule_tac x="\<lambda>n. f" in exI, auto)
   done
 
 proposition integrable_subintervals_imp_measurable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "\<And>a b. f integrable_on cbox a b"
   shows "f measurable_on UNIV"
 proof -
   define BOX where "BOX \<equiv> \<lambda>h. \<lambda>x::'a. cbox x (x + h *\<^sub>R One)"
   define i where "i \<equiv> \<lambda>h x. integral (BOX h x) f /\<^sub>R h ^ DIM('a)"
   obtain N where "negligible N"
     and k: "\<And>x e. \<lbrakk>x \<notin> N; 0 < e\<rbrakk>
             \<Longrightarrow> \<exists>d>0. \<forall>h. 0 < h \<and> h < d \<longrightarrow>
                   norm (integral (cbox x (x + h *\<^sub>R One)) f /\<^sub>R h ^ DIM('a) - f x) < e"
     using integrable_ccontinuous_explicit assms by blast
   show ?thesis
     unfolding measurable_on_def
   proof (intro exI conjI allI impI)
     show "continuous_on UNIV ((\<lambda>n x. i (inverse(Suc n)) x) n)" for n
     proof (clarsimp simp: continuous_on_iff)
       show "\<exists>d>0. \<forall>x'. dist x' x < d \<longrightarrow> dist (i (inverse (1 + real n)) x') (i (inverse (1 + real n)) x) < e"
         if "0 < e"
         for x e
       proof -
         let ?e = "e / (1 + real n) ^ DIM('a)"
         have "?e > 0"
           using \<open>e > 0\<close> by auto
         moreover have "x \<in> cbox (x - 2 *\<^sub>R One) (x + 2 *\<^sub>R One)"
           by (simp add: mem_box inner_diff_left inner_left_distrib)
         moreover have "x + One /\<^sub>R real (Suc n) \<in> cbox (x - 2 *\<^sub>R One) (x + 2 *\<^sub>R One)"
           by (auto simp: mem_box inner_diff_left inner_left_distrib field_simps)
         ultimately obtain \<delta> where "\<delta> > 0"
           and \<delta>: "\<And>c' d'. \<lbrakk>c' \<in> cbox (x - 2 *\<^sub>R One) (x + 2 *\<^sub>R One);
                            d' \<in> cbox (x - 2 *\<^sub>R One) (x + 2 *\<^sub>R One);
                            norm(c' - x) \<le> \<delta>; norm(d' - (x + One /\<^sub>R Suc n)) \<le> \<delta>\<rbrakk>
                           \<Longrightarrow> norm(integral(cbox c' d') f - integral(cbox x (x + One /\<^sub>R Suc n)) f) < ?e"
           by (blast intro: indefinite_integral_continuous [of f _ _ x] assms)
         show ?thesis
         proof (intro exI impI conjI allI)
           show "min \<delta> 1 > 0"
             using \<open>\<delta> > 0\<close> by auto
           show "dist (i (inverse (1 + real n)) y) (i (inverse (1 + real n)) x) < e"
             if "dist y x < min \<delta> 1" for y
           proof -
             have no: "norm (y - x) < 1"
               using that by (auto simp: dist_norm)
             have le1: "inverse (1 + real n) \<le> 1"
               by (auto simp: field_split_simps)
             have "norm (integral (cbox y (y + One /\<^sub>R real (Suc n))) f
                 - integral (cbox x (x + One /\<^sub>R real (Suc n))) f)
                 < e / (1 + real n) ^ DIM('a)"
             proof (rule \<delta>)
               show "y \<in> cbox (x - 2 *\<^sub>R One) (x + 2 *\<^sub>R One)"
                 using no by (auto simp: mem_box algebra_simps dest: Basis_le_norm [of _ "y-x"])
               show "y + One /\<^sub>R real (Suc n) \<in> cbox (x - 2 *\<^sub>R One) (x + 2 *\<^sub>R One)"
               proof (simp add: dist_norm mem_box algebra_simps, intro ballI conjI)
                 fix i::'a
                 assume "i \<in> Basis"
                 then have 1: "\<bar>y \<bullet> i - x \<bullet> i\<bar> < 1"
                   by (metis inner_commute inner_diff_right no norm_bound_Basis_lt)
                 moreover have "\<dots> < (2 + inverse (1 + real n))" "1 \<le> 2 - inverse (1 + real n)"
                   by (auto simp: field_simps)
                 ultimately show "x \<bullet> i \<le> y \<bullet> i + (2 + inverse (1 + real n))"
                                 "y \<bullet> i + inverse (1 + real n) \<le> x \<bullet> i + 2"
                   by linarith+
               qed
               show "norm (y - x) \<le> \<delta>" "norm (y + One /\<^sub>R real (Suc n) - (x + One /\<^sub>R real (Suc n))) \<le> \<delta>"
                 using that by (auto simp: dist_norm)
             qed
             then show ?thesis
               using that by (simp add: dist_norm i_def BOX_def flip: scaleR_diff_right) (simp add: field_simps)
           qed
         qed
       qed
     qed
     show "negligible N"
       by (simp add: \<open>negligible N\<close>)
     show "(\<lambda>n. i (inverse (Suc n)) x) \<longlonglongrightarrow> (if x \<in> UNIV then f x else 0)"
       if "x \<notin> N" for x
       unfolding lim_sequentially
     proof clarsimp
       show "\<exists>no. \<forall>n\<ge>no. dist (i (inverse (1 + real n)) x) (f x) < e"
         if "0 < e" for e
       proof -
         obtain d where "d > 0"
           and d: "\<And>h. \<lbrakk>0 < h; h < d\<rbrakk> \<Longrightarrow>
               norm (integral (cbox x (x + h *\<^sub>R One)) f /\<^sub>R h ^ DIM('a) - f x) < e"
           using k [of x e] \<open>x \<notin> N\<close> \<open>0 < e\<close> by blast
         then obtain M where M: "M \<noteq> 0" "0 < inverse (real M)" "inverse (real M) < d"
           using real_arch_invD by auto
         show ?thesis
         proof (intro exI allI impI)
           show "dist (i (inverse (1 + real n)) x) (f x) < e"
             if "M \<le> n" for n
           proof -
             have *: "0 < inverse (1 + real n)" "inverse (1 + real n) \<le> inverse M"
               using that \<open>M \<noteq> 0\<close> by auto
             show ?thesis
               using that M
               apply (simp add: i_def BOX_def dist_norm)
               apply (blast intro: le_less_trans * d)
               done
           qed
         qed
       qed
     qed
   qed
 qed
 
 
 subsection\<open>Composing continuous and measurable functions; a few variants\<close>
 
 lemma measurable_on_compose_continuous:
    assumes f: "f measurable_on UNIV" and g: "continuous_on UNIV g"
    shows "(g \<circ> f) measurable_on UNIV"
 proof -
   obtain N and F
     where "negligible N"
       and conF: "\<And>n. continuous_on UNIV (F n)"
       and tendsF: "\<And>x. x \<notin> N \<Longrightarrow> (\<lambda>n. F n x) \<longlonglongrightarrow> f x"
     using f by (auto simp: measurable_on_def)
   show ?thesis
     unfolding measurable_on_def
   proof (intro exI conjI allI impI)
     show "negligible N"
       by fact
     show "continuous_on UNIV (g \<circ> (F n))" for n
       using conF continuous_on_compose continuous_on_subset g by blast
     show "(\<lambda>n. (g \<circ> F n) x) \<longlonglongrightarrow> (if x \<in> UNIV then (g \<circ> f) x else 0)"
       if "x \<notin> N" for x :: 'a
       using that g tendsF by (auto simp: continuous_on_def intro: tendsto_compose)
   qed
 qed
 
 lemma measurable_on_compose_continuous_0:
    assumes f: "f measurable_on S" and g: "continuous_on UNIV g" and "g 0 = 0"
    shows "(g \<circ> f) measurable_on S"
 proof -
   have f': "(\<lambda>x. if x \<in> S then f x else 0) measurable_on UNIV"
     using f measurable_on_UNIV by blast
   show ?thesis
     using measurable_on_compose_continuous [OF f' g]
     by (simp add: measurable_on_UNIV o_def if_distrib \<open>g 0 = 0\<close> cong: if_cong)
 qed
 
 
 lemma measurable_on_compose_continuous_box:
   assumes fm: "f measurable_on UNIV" and fab: "\<And>x. f x \<in> box a b"
     and contg: "continuous_on (box a b) g"
   shows "(g \<circ> f) measurable_on UNIV"
 proof -
   have "\<exists>\<gamma>. (\<forall>n. continuous_on UNIV (\<gamma> n)) \<and> (\<forall>x. x \<notin> N \<longrightarrow> (\<lambda>n. \<gamma> n x) \<longlonglongrightarrow> g (f x))"
     if "negligible N"
       and conth [rule_format]: "\<forall>n. continuous_on UNIV (\<lambda>x. h n x)"
       and tends [rule_format]: "\<forall>x. x \<notin> N \<longrightarrow> (\<lambda>n. h n x) \<longlonglongrightarrow> f x"
     for N and h :: "nat \<Rightarrow> 'a \<Rightarrow> 'b"
   proof -
     define \<theta> where "\<theta> \<equiv> \<lambda>n x. (\<Sum>i\<in>Basis. (max (a\<bullet>i + (b\<bullet>i - a\<bullet>i) / real (n+2))
                                             (min ((h n x)\<bullet>i)
                                                  (b\<bullet>i - (b\<bullet>i - a\<bullet>i) / real (n+2)))) *\<^sub>R i)"
     have aibi: "\<And>i. i \<in> Basis \<Longrightarrow> a \<bullet> i < b \<bullet> i"
       using box_ne_empty(2) fab by auto
     then have *: "\<And>i n. i \<in> Basis \<Longrightarrow> a \<bullet> i + real n * (a \<bullet> i) < b \<bullet> i + real n * (b \<bullet> i)"
       by (meson add_mono_thms_linordered_field(3) less_eq_real_def mult_left_mono of_nat_0_le_iff)
     show ?thesis
     proof (intro exI conjI allI impI)
       show "continuous_on UNIV (g \<circ> (\<theta> n))" for n :: nat
         unfolding \<theta>_def
         apply (intro continuous_on_compose2 [OF contg] continuous_intros conth)
         apply (auto simp: aibi * mem_box less_max_iff_disj min_less_iff_disj field_split_simps)
         done
       show "(\<lambda>n. (g \<circ> \<theta> n) x) \<longlonglongrightarrow> g (f x)"
         if "x \<notin> N" for x
         unfolding o_def
       proof (rule isCont_tendsto_compose [where g=g])
         show "isCont g (f x)"
           using contg fab continuous_on_eq_continuous_at by blast
         have "(\<lambda>n. \<theta> n x) \<longlonglongrightarrow> (\<Sum>i\<in>Basis. max (a \<bullet> i) (min (f x \<bullet> i) (b \<bullet> i)) *\<^sub>R i)"
           unfolding \<theta>_def
         proof (intro tendsto_intros \<open>x \<notin> N\<close> tends)
           fix i::'b
           assume "i \<in> Basis"
           have a: "(\<lambda>n. a \<bullet> i + (b \<bullet> i - a \<bullet> i) / real n) \<longlonglongrightarrow> a\<bullet>i + 0"
             by (intro tendsto_add lim_const_over_n tendsto_const)
           show "(\<lambda>n. a \<bullet> i + (b \<bullet> i - a \<bullet> i) / real (n + 2)) \<longlonglongrightarrow> a \<bullet> i"
             using LIMSEQ_ignore_initial_segment [where k=2, OF a] by simp
           have b: "(\<lambda>n. b\<bullet>i - (b \<bullet> i - a \<bullet> i) / (real n)) \<longlonglongrightarrow> b\<bullet>i - 0"
             by (intro tendsto_diff lim_const_over_n tendsto_const)
           show "(\<lambda>n. b \<bullet> i - (b \<bullet> i - a \<bullet> i) / real (n + 2)) \<longlonglongrightarrow> b \<bullet> i"
             using LIMSEQ_ignore_initial_segment [where k=2, OF b] by simp
         qed
         also have "(\<Sum>i\<in>Basis. max (a \<bullet> i) (min (f x \<bullet> i) (b \<bullet> i)) *\<^sub>R i) = (\<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i)"
           apply (rule sum.cong)
           using fab
            apply auto
           apply (intro order_antisym)
            apply (auto simp: mem_box)
           using less_imp_le apply blast
           by (metis (full_types) linear max_less_iff_conj min.bounded_iff not_le)
         also have "\<dots> = f x"
           using euclidean_representation by blast
         finally show "(\<lambda>n. \<theta> n x) \<longlonglongrightarrow> f x" .
       qed
     qed
   qed
   then show ?thesis
     using fm by (auto simp: measurable_on_def)
 qed
 
 lemma measurable_on_Pair:
   assumes f: "f measurable_on S" and g: "g measurable_on S"
   shows "(\<lambda>x. (f x, g x)) measurable_on S"
 proof -
   obtain NF and F
     where NF: "negligible NF"
       and conF: "\<And>n. continuous_on UNIV (F n)"
       and tendsF: "\<And>x. x \<notin> NF \<Longrightarrow> (\<lambda>n. F n x) \<longlonglongrightarrow> (if x \<in> S then f x else 0)"
     using f by (auto simp: measurable_on_def)
   obtain NG and G
     where NG: "negligible NG"
       and conG: "\<And>n. continuous_on UNIV (G n)"
       and tendsG: "\<And>x. x \<notin> NG \<Longrightarrow> (\<lambda>n. G n x) \<longlonglongrightarrow> (if x \<in> S then g x else 0)"
     using g by (auto simp: measurable_on_def)
   show ?thesis
     unfolding measurable_on_def
   proof (intro exI conjI allI impI)
     show "negligible (NF \<union> NG)"
       by (simp add: NF NG)
     show "continuous_on UNIV (\<lambda>x. (F n x, G n x))" for n
       using conF conG continuous_on_Pair by blast
     show "(\<lambda>n. (F n x, G n x)) \<longlonglongrightarrow> (if x \<in> S then (f x, g x) else 0)"
       if "x \<notin> NF \<union> NG" for x
       using tendsto_Pair [OF tendsF tendsG, of x x] that unfolding zero_prod_def
       by (simp add: split: if_split_asm)
   qed
 qed
 
 lemma measurable_on_combine:
   assumes f: "f measurable_on S" and g: "g measurable_on S"
     and h: "continuous_on UNIV (\<lambda>x. h (fst x) (snd x))" and "h 0 0 = 0"
   shows "(\<lambda>x. h (f x) (g x)) measurable_on S"
 proof -
   have *: "(\<lambda>x. h (f x) (g x)) = (\<lambda>x. h (fst x) (snd x)) \<circ> (\<lambda>x. (f x, g x))"
     by auto
   show ?thesis
     unfolding * by (auto simp: measurable_on_compose_continuous_0 measurable_on_Pair assms)
 qed
 
 lemma measurable_on_add:
   assumes f: "f measurable_on S" and g: "g measurable_on S"
   shows "(\<lambda>x. f x + g x) measurable_on S"
   by (intro continuous_intros measurable_on_combine [OF assms]) auto
 
 lemma measurable_on_diff:
   assumes f: "f measurable_on S" and g: "g measurable_on S"
   shows "(\<lambda>x. f x - g x) measurable_on S"
   by (intro continuous_intros measurable_on_combine [OF assms]) auto
 
 lemma measurable_on_scaleR:
   assumes f: "f measurable_on S" and g: "g measurable_on S"
   shows "(\<lambda>x. f x *\<^sub>R g x) measurable_on S"
   by (intro continuous_intros measurable_on_combine [OF assms]) auto
 
 lemma measurable_on_sum:
   assumes "finite I" "\<And>i. i \<in> I \<Longrightarrow> f i measurable_on S"
   shows "(\<lambda>x. sum  (\<lambda>i. f i x) I) measurable_on S"
   using assms by (induction I) (auto simp: measurable_on_add)
 
 lemma measurable_on_spike:
   assumes f: "f measurable_on T" and "negligible S" and gf: "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "g measurable_on T"
 proof -
   obtain NF and F
     where NF: "negligible NF"
       and conF: "\<And>n. continuous_on UNIV (F n)"
       and tendsF: "\<And>x. x \<notin> NF \<Longrightarrow> (\<lambda>n. F n x) \<longlonglongrightarrow> (if x \<in> T then f x else 0)"
     using f by (auto simp: measurable_on_def)
   show ?thesis
     unfolding measurable_on_def
   proof (intro exI conjI allI impI)
     show "negligible (NF \<union> S)"
       by (simp add: NF \<open>negligible S\<close>)
     show "\<And>x. x \<notin> NF \<union> S \<Longrightarrow> (\<lambda>n. F n x) \<longlonglongrightarrow> (if x \<in> T then g x else 0)"
       by (metis (full_types) Diff_iff Un_iff gf tendsF)
   qed (auto simp: conF)
 qed
 
 proposition indicator_measurable_on:
   assumes "S \<in> sets lebesgue"
   shows "indicat_real S measurable_on UNIV"
 proof -
   { fix n::nat
     let ?\<epsilon> = "(1::real) / (2 * 2^n)"
     have \<epsilon>: "?\<epsilon> > 0"
       by auto
     obtain T where "closed T" "T \<subseteq> S" "S-T \<in> lmeasurable" and ST: "emeasure lebesgue (S - T) < ?\<epsilon>"
       by (meson \<epsilon> assms sets_lebesgue_inner_closed)
     obtain U where "open U" "S \<subseteq> U" "(U - S) \<in> lmeasurable" and US: "emeasure lebesgue (U - S) < ?\<epsilon>"
       by (meson \<epsilon> assms sets_lebesgue_outer_open)
     have eq: "-T \<inter> U = (S-T) \<union> (U - S)"
       using \<open>T \<subseteq> S\<close> \<open>S \<subseteq> U\<close> by auto
     have "emeasure lebesgue ((S-T) \<union> (U - S)) \<le> emeasure lebesgue (S - T) + emeasure lebesgue (U - S)"
       using \<open>S - T \<in> lmeasurable\<close> \<open>U - S \<in> lmeasurable\<close> emeasure_subadditive by blast
     also have "\<dots> < ?\<epsilon> + ?\<epsilon>"
       using ST US add_mono_ennreal by metis
     finally have le: "emeasure lebesgue (-T \<inter> U) < ennreal (1 / 2^n)"
       by (simp add: eq)
     have 1: "continuous_on (T \<union> -U) (indicat_real S)"
-      unfolding indicator_def
+      unfolding indicator_def of_bool_def
     proof (rule continuous_on_cases [OF \<open>closed T\<close>])
       show "closed (- U)"
         using \<open>open U\<close> by blast
       show "continuous_on T (\<lambda>x. 1::real)" "continuous_on (- U) (\<lambda>x. 0::real)"
         by (auto simp: continuous_on)
       show "\<forall>x. x \<in> T \<and> x \<notin> S \<or> x \<in> - U \<and> x \<in> S \<longrightarrow> (1::real) = 0"
         using \<open>T \<subseteq> S\<close> \<open>S \<subseteq> U\<close> by auto
     qed
     have 2: "closedin (top_of_set UNIV) (T \<union> -U)"
       using \<open>closed T\<close> \<open>open U\<close> by auto
     obtain g where "continuous_on UNIV g" "\<And>x. x \<in> T \<union> -U \<Longrightarrow> g x = indicat_real S x" "\<And>x. norm(g x) \<le> 1"
       by (rule Tietze [OF 1 2, of 1]) auto
     with le have "\<exists>g E. continuous_on UNIV g \<and> (\<forall>x \<in> -E. g x = indicat_real S x) \<and>
                         (\<forall>x. norm(g x) \<le> 1) \<and> E \<in> sets lebesgue \<and> emeasure lebesgue E < ennreal (1 / 2^n)"
       apply (rule_tac x=g in exI)
       apply (rule_tac x="-T \<inter> U" in exI)
       using \<open>S - T \<in> lmeasurable\<close> \<open>U - S \<in> lmeasurable\<close> eq by auto
   }
   then obtain g E where cont: "\<And>n. continuous_on UNIV (g n)"
     and geq: "\<And>n x. x \<in> - E n \<Longrightarrow> g n x = indicat_real S x"
     and ng1: "\<And>n x. norm(g n x) \<le> 1"
     and Eset: "\<And>n. E n \<in> sets lebesgue"
     and Em: "\<And>n. emeasure lebesgue (E n) < ennreal (1 / 2^n)"
     by metis
   have null: "limsup E \<in> null_sets lebesgue"
   proof (rule borel_cantelli_limsup1 [OF Eset])
     show "emeasure lebesgue (E n) < \<infinity>" for n
       by (metis Em infinity_ennreal_def order.asym top.not_eq_extremum)
     show "summable (\<lambda>n. measure lebesgue (E n))"
     proof (rule summable_comparison_test' [OF summable_geometric, of "1/2" 0])
       show "norm (measure lebesgue (E n)) \<le> (1/2) ^ n"  for n
         using Em [of n] by (simp add: measure_def enn2real_leI power_one_over)
     qed auto
   qed
   have tends: "(\<lambda>n. g n x) \<longlonglongrightarrow> indicat_real S x" if "x \<notin> limsup E" for x
   proof -
     have "\<forall>\<^sub>F n in sequentially. x \<in> - E n"
       using that by (simp add: mem_limsup_iff not_frequently)
     then show ?thesis
       unfolding tendsto_iff dist_real_def
       by (simp add: eventually_mono geq)
   qed
   show ?thesis
     unfolding measurable_on_def
   proof (intro exI conjI allI impI)
     show "negligible (limsup E)"
       using negligible_iff_null_sets null by blast
     show "continuous_on UNIV (g n)" for n
       using cont by blast
   qed (use tends in auto)
 qed
 
 lemma measurable_on_restrict:
   assumes f: "f measurable_on UNIV" and S: "S \<in> sets lebesgue"
   shows "(\<lambda>x. if x \<in> S then f x else 0) measurable_on UNIV"
 proof -
   have "indicat_real S measurable_on UNIV"
     by (simp add: S indicator_measurable_on)
   then show ?thesis
     using measurable_on_scaleR [OF _ f, of "indicat_real S"]
     by (simp add: indicator_scaleR_eq_if)
 qed
 
 lemma measurable_on_const_UNIV: "(\<lambda>x. k) measurable_on UNIV"
   by (simp add: continuous_imp_measurable_on)
 
 lemma measurable_on_const [simp]: "S \<in> sets lebesgue \<Longrightarrow> (\<lambda>x. k) measurable_on S"
   using measurable_on_UNIV measurable_on_const_UNIV measurable_on_restrict by blast
 
 lemma simple_function_indicator_representation_real:
   fixes f ::"'a \<Rightarrow> real"
   assumes f: "simple_function M f" and x: "x \<in> space M" and nn: "\<And>x. f x \<ge> 0"
   shows "f x = (\<Sum>y \<in> f ` space M. y * indicator (f -` {y} \<inter> space M) x)"
 proof -
   have f': "simple_function M (ennreal \<circ> f)"
     by (simp add: f)
   have *: "f x =
      enn2real
       (\<Sum>y\<in> ennreal ` f ` space M.
          y * indicator ((ennreal \<circ> f) -` {y} \<inter> space M) x)"
     using arg_cong [OF simple_function_indicator_representation [OF f' x], of enn2real, simplified nn o_def] nn
     unfolding o_def image_comp
     by (metis enn2real_ennreal)
   have "enn2real (\<Sum>y\<in>ennreal ` f ` space M. if ennreal (f x) = y \<and> x \<in> space M then y else 0)
       = sum (enn2real \<circ> (\<lambda>y. if ennreal (f x) = y \<and> x \<in> space M then y else 0))
             (ennreal ` f ` space M)"
     by (rule enn2real_sum) auto
   also have "\<dots> = sum (enn2real \<circ> (\<lambda>y. if ennreal (f x) = y \<and> x \<in> space M then y else 0) \<circ> ennreal)
                    (f ` space M)"
     by (rule sum.reindex) (use nn in \<open>auto simp: inj_on_def intro: sum.cong\<close>)
   also have "\<dots> = (\<Sum>y\<in>f ` space M. if f x = y \<and> x \<in> space M then y else 0)"
     using nn
     by (auto simp: inj_on_def intro: sum.cong)
   finally show ?thesis
-    by (subst *) (simp add: enn2real_sum indicator_def if_distrib cong: if_cong)
+    by (subst *) (simp add: enn2real_sum indicator_def of_bool_def if_distrib cong: if_cong)
 qed
 
 lemma\<^marker>\<open>tag important\<close> simple_function_induct_real
     [consumes 1, case_names cong set mult add, induct set: simple_function]:
   fixes u :: "'a \<Rightarrow> real"
   assumes u: "simple_function M u"
   assumes cong: "\<And>f g. simple_function M f \<Longrightarrow> simple_function M g \<Longrightarrow> (AE x in M. f x = g x) \<Longrightarrow> P f \<Longrightarrow> P g"
   assumes set: "\<And>A. A \<in> sets M \<Longrightarrow> P (indicator A)"
   assumes mult: "\<And>u c. P u \<Longrightarrow> P (\<lambda>x. c * u x)"
   assumes add: "\<And>u v. P u \<Longrightarrow> P v \<Longrightarrow> P (\<lambda>x. u x + v x)"
   and nn: "\<And>x. u x \<ge> 0"
   shows "P u"
 proof (rule cong)
   from AE_space show "AE x in M. (\<Sum>y\<in>u ` space M. y * indicator (u -` {y} \<inter> space M) x) = u x"
   proof eventually_elim
     fix x assume x: "x \<in> space M"
     from simple_function_indicator_representation_real[OF u x] nn
     show "(\<Sum>y\<in>u ` space M. y * indicator (u -` {y} \<inter> space M) x) = u x"
       by metis
   qed
 next
   from u have "finite (u ` space M)"
     unfolding simple_function_def by auto
   then show "P (\<lambda>x. \<Sum>y\<in>u ` space M. y * indicator (u -` {y} \<inter> space M) x)"
   proof induct
     case empty
     then show ?case
       using set[of "{}"] by (simp add: indicator_def[abs_def])
   next
     case (insert a F)
     have eq: "\<Sum> {y. u x = y \<and> (y = a \<or> y \<in> F) \<and> x \<in> space M}
             = (if u x = a \<and> x \<in> space M then a else 0) + \<Sum> {y. u x = y \<and> y \<in> F \<and> x \<in> space M}" for x
     proof (cases "x \<in> space M")
       case True
       have *: "{y. u x = y \<and> (y = a \<or> y \<in> F)} = {y. u x = a \<and> y = a} \<union> {y. u x = y \<and> y \<in> F}"
         by auto
       show ?thesis
         using insert by (simp add: * True)
     qed auto
     have a: "P (\<lambda>x. a * indicator (u -` {a} \<inter> space M) x)"
     proof (intro mult set)
       show "u -` {a} \<inter> space M \<in> sets M"
         using u by auto
     qed
     show ?case
       using nn insert a
       by (simp add: eq indicator_times_eq_if [where f = "\<lambda>x. a"] add)
   qed
 next
   show "simple_function M (\<lambda>x. (\<Sum>y\<in>u ` space M. y * indicator (u -` {y} \<inter> space M) x))"
     apply (subst simple_function_cong)
     apply (rule simple_function_indicator_representation_real[symmetric])
     apply (auto intro: u nn)
     done
 qed fact
 
 proposition simple_function_measurable_on_UNIV:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f: "simple_function lebesgue f" and nn: "\<And>x. f x \<ge> 0"
   shows "f measurable_on UNIV"
   using f
 proof (induction f)
   case (cong f g)
   then obtain N where "negligible N" "{x. g x \<noteq> f x} \<subseteq> N"
     by (auto simp: eventually_ae_filter_negligible eq_commute)
   then show ?case
     by (blast intro: measurable_on_spike cong)
 next
   case (set S)
   then show ?case
     by (simp add: indicator_measurable_on)
 next
   case (mult u c)
   then show ?case
     by (simp add: measurable_on_cmul)
   case (add u v)
   then show ?case
     by (simp add: measurable_on_add)
 qed (auto simp: nn)
 
 lemma simple_function_lebesgue_if:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f: "simple_function lebesgue f" and S: "S \<in> sets lebesgue"
   shows "simple_function lebesgue (\<lambda>x. if x \<in> S then f x else 0)"
 proof -
   have ffin: "finite (range f)" and fsets: "\<forall>x. f -` {f x} \<in> sets lebesgue"
     using f by (auto simp: simple_function_def)
   have "finite (f ` S)"
     by (meson finite_subset subset_image_iff ffin top_greatest)
   moreover have "finite ((\<lambda>x. 0::real) ` T)" for T :: "'a set"
     by (auto simp: image_def)
   moreover have if_sets: "(\<lambda>x. if x \<in> S then f x else 0) -` {f a} \<in> sets lebesgue" for a
   proof -
     have *: "(\<lambda>x. if x \<in> S then f x else 0) -` {f a}
            = (if f a = 0 then -S \<union> f -` {f a} else (f -` {f a}) \<inter> S)"
       by (auto simp: split: if_split_asm)
     show ?thesis
       unfolding * by (metis Compl_in_sets_lebesgue S sets.Int sets.Un fsets)
   qed
   moreover have "(\<lambda>x. if x \<in> S then f x else 0) -` {0} \<in> sets lebesgue"
   proof (cases "0 \<in> range f")
     case True
     then show ?thesis
       by (metis (no_types, lifting) if_sets rangeE)
   next
     case False
     then have "(\<lambda>x. if x \<in> S then f x else 0) -` {0} = -S"
       by auto
     then show ?thesis
       by (simp add: Compl_in_sets_lebesgue S)
   qed
   ultimately show ?thesis
     by (auto simp: simple_function_def)
 qed
 
 corollary simple_function_measurable_on:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f: "simple_function lebesgue f" and nn: "\<And>x. f x \<ge> 0" and S: "S \<in> sets lebesgue"
   shows "f measurable_on S"
   by (simp add: measurable_on_UNIV [symmetric, of f] S f simple_function_lebesgue_if nn simple_function_measurable_on_UNIV)
 
 lemma
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::ordered_euclidean_space"
   assumes f: "f measurable_on S" and g: "g measurable_on S"
   shows measurable_on_sup: "(\<lambda>x. sup (f x) (g x)) measurable_on S"
   and   measurable_on_inf: "(\<lambda>x. inf (f x) (g x)) measurable_on S"
 proof -
   obtain NF and F
     where NF: "negligible NF"
       and conF: "\<And>n. continuous_on UNIV (F n)"
       and tendsF: "\<And>x. x \<notin> NF \<Longrightarrow> (\<lambda>n. F n x) \<longlonglongrightarrow> (if x \<in> S then f x else 0)"
     using f by (auto simp: measurable_on_def)
   obtain NG and G
     where NG: "negligible NG"
       and conG: "\<And>n. continuous_on UNIV (G n)"
       and tendsG: "\<And>x. x \<notin> NG \<Longrightarrow> (\<lambda>n. G n x) \<longlonglongrightarrow> (if x \<in> S then g x else 0)"
     using g by (auto simp: measurable_on_def)
   show "(\<lambda>x. sup (f x) (g x)) measurable_on S"
     unfolding measurable_on_def
   proof (intro exI conjI allI impI)
     show "continuous_on UNIV (\<lambda>x. sup (F n x) (G n x))" for n
       unfolding sup_max eucl_sup  by (intro conF conG continuous_intros)
     show "(\<lambda>n. sup (F n x) (G n x)) \<longlonglongrightarrow> (if x \<in> S then sup (f x) (g x) else 0)"
       if "x \<notin> NF \<union> NG" for x
       using tendsto_sup [OF tendsF tendsG, of x x] that by auto
   qed (simp add: NF NG)
   show "(\<lambda>x. inf (f x) (g x)) measurable_on S"
     unfolding measurable_on_def
   proof (intro exI conjI allI impI)
     show "continuous_on UNIV (\<lambda>x. inf (F n x) (G n x))" for n
       unfolding inf_min eucl_inf  by (intro conF conG continuous_intros)
     show "(\<lambda>n. inf (F n x) (G n x)) \<longlonglongrightarrow> (if x \<in> S then inf (f x) (g x) else 0)"
       if "x \<notin> NF \<union> NG" for x
       using tendsto_inf [OF tendsF tendsG, of x x] that by auto
   qed (simp add: NF NG)
 qed
 
 proposition measurable_on_componentwise_UNIV:
   "f measurable_on UNIV \<longleftrightarrow> (\<forall>i\<in>Basis. (\<lambda>x. (f x \<bullet> i) *\<^sub>R i) measurable_on UNIV)"
   (is "?lhs = ?rhs")
 proof
   assume L: ?lhs
   show ?rhs
   proof
     fix i::'b
     assume "i \<in> Basis"
     have cont: "continuous_on UNIV (\<lambda>x. (x \<bullet> i) *\<^sub>R i)"
       by (intro continuous_intros)
     show "(\<lambda>x. (f x \<bullet> i) *\<^sub>R i) measurable_on UNIV"
       using measurable_on_compose_continuous [OF L cont]
       by (simp add: o_def)
   qed
 next
   assume ?rhs
   then have "\<exists>N g. negligible N \<and>
               (\<forall>n. continuous_on UNIV (g n)) \<and>
               (\<forall>x. x \<notin> N \<longrightarrow> (\<lambda>n. g n x) \<longlonglongrightarrow> (f x \<bullet> i) *\<^sub>R i)"
     if "i \<in> Basis" for i
     by (simp add: measurable_on_def that)
   then obtain N g where N: "\<And>i. i \<in> Basis \<Longrightarrow> negligible (N i)"
         and cont: "\<And>i n. i \<in> Basis \<Longrightarrow> continuous_on UNIV (g i n)"
         and tends: "\<And>i x. \<lbrakk>i \<in> Basis; x \<notin> N i\<rbrakk> \<Longrightarrow> (\<lambda>n. g i n x) \<longlonglongrightarrow> (f x \<bullet> i) *\<^sub>R i"
     by metis
   show ?lhs
     unfolding measurable_on_def
   proof (intro exI conjI allI impI)
     show "negligible (\<Union>i \<in> Basis. N i)"
       using N eucl.finite_Basis by blast
     show "continuous_on UNIV (\<lambda>x. (\<Sum>i\<in>Basis. g i n x))" for n
       by (intro continuous_intros cont)
   next
     fix x
     assume "x \<notin> (\<Union>i \<in> Basis. N i)"
     then have "\<And>i. i \<in> Basis \<Longrightarrow> x \<notin> N i"
       by auto
     then have "(\<lambda>n. (\<Sum>i\<in>Basis. g i n x)) \<longlonglongrightarrow> (\<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i)"
       by (intro tends tendsto_intros)
     then show "(\<lambda>n. (\<Sum>i\<in>Basis. g i n x)) \<longlonglongrightarrow> (if x \<in> UNIV then f x else 0)"
       by (simp add: euclidean_representation)
   qed
 qed
 
 corollary measurable_on_componentwise:
   "f measurable_on S \<longleftrightarrow> (\<forall>i\<in>Basis. (\<lambda>x. (f x \<bullet> i) *\<^sub>R i) measurable_on S)"
   apply (subst measurable_on_UNIV [symmetric])
   apply (subst measurable_on_componentwise_UNIV)
   apply (simp add: measurable_on_UNIV if_distrib [of "\<lambda>x. inner x _"] if_distrib [of "\<lambda>x. scaleR x _"] cong: if_cong)
   done
 
 
 (*FIXME: avoid duplication of proofs WRT borel_measurable_implies_simple_function_sequence*)
 lemma\<^marker>\<open>tag important\<close> borel_measurable_implies_simple_function_sequence_real:
   fixes u :: "'a \<Rightarrow> real"
   assumes u[measurable]: "u \<in> borel_measurable M" and nn: "\<And>x. u x \<ge> 0"
   shows "\<exists>f. incseq f \<and> (\<forall>i. simple_function M (f i)) \<and> (\<forall>x. bdd_above (range (\<lambda>i. f i x))) \<and>
              (\<forall>i x. 0 \<le> f i x) \<and> u = (SUP i. f i)"
 proof -
   define f where [abs_def]:
     "f i x = real_of_int (floor ((min i (u x)) * 2^i)) / 2^i" for i x
 
   have [simp]: "0 \<le> f i x" for i x
     by (auto simp: f_def intro!: divide_nonneg_nonneg mult_nonneg_nonneg nn)
 
   have *: "2^n * real_of_int x = real_of_int (2^n * x)" for n x
     by simp
 
   have "real_of_int \<lfloor>real i * 2 ^ i\<rfloor> = real_of_int \<lfloor>i * 2 ^ i\<rfloor>" for i
     by (intro arg_cong[where f=real_of_int]) simp
   then have [simp]: "real_of_int \<lfloor>real i * 2 ^ i\<rfloor> = i * 2 ^ i" for i
     unfolding floor_of_nat by simp
 
   have bdd: "bdd_above (range (\<lambda>i. f i x))" for x
     by (rule bdd_aboveI [where M = "u x"]) (auto simp: f_def field_simps min_def)
 
   have "incseq f"
   proof (intro monoI le_funI)
     fix m n :: nat and x assume "m \<le> n"
     moreover
     { fix d :: nat
       have "\<lfloor>2^d::real\<rfloor> * \<lfloor>2^m * (min (of_nat m) (u x))\<rfloor> \<le> \<lfloor>2^d * (2^m * (min (of_nat m) (u x)))\<rfloor>"
         by (rule le_mult_floor) (auto simp: nn)
       also have "\<dots> \<le> \<lfloor>2^d * (2^m *  (min (of_nat d + of_nat m) (u x)))\<rfloor>"
         by (intro floor_mono mult_mono min.mono)
            (auto simp: nn min_less_iff_disj of_nat_less_top)
       finally have "f m x \<le> f(m + d) x"
         unfolding f_def
         by (auto simp: field_simps power_add * simp del: of_int_mult) }
     ultimately show "f m x \<le> f n x"
       by (auto simp: le_iff_add)
   qed
   then have inc_f: "incseq (\<lambda>i. f i x)" for x
     by (auto simp: incseq_def le_fun_def)
   moreover
   have "simple_function M (f i)" for i
   proof (rule simple_function_borel_measurable)
     have "\<lfloor>(min (of_nat i) (u x)) * 2 ^ i\<rfloor> \<le> \<lfloor>int i * 2 ^ i\<rfloor>" for x
       by (auto split: split_min intro!: floor_mono)
     then have "f i ` space M \<subseteq> (\<lambda>n. real_of_int n / 2^i) ` {0 .. of_nat i * 2^i}"
       unfolding floor_of_int by (auto simp: f_def nn intro!: imageI)
     then show "finite (f i ` space M)"
       by (rule finite_subset) auto
     show "f i \<in> borel_measurable M"
       unfolding f_def enn2real_def by measurable
   qed
   moreover
   { fix x
     have "(SUP i. (f i x)) = u x"
     proof -
       obtain n where "u x \<le> of_nat n" using real_arch_simple by auto
       then have min_eq_r: "\<forall>\<^sub>F i in sequentially. min (real i) (u x) = u x"
         by (auto simp: eventually_sequentially intro!: exI[of _ n] split: split_min)
       have "(\<lambda>i. real_of_int \<lfloor>min (real i) (u x) * 2^i\<rfloor> / 2^i) \<longlonglongrightarrow> u x"
       proof (rule tendsto_sandwich)
         show "(\<lambda>n. u x - (1/2)^n) \<longlonglongrightarrow> u x"
           by (auto intro!: tendsto_eq_intros LIMSEQ_power_zero)
         show "\<forall>\<^sub>F n in sequentially. real_of_int \<lfloor>min (real n) (u x) * 2 ^ n\<rfloor> / 2 ^ n \<le> u x"
           using min_eq_r by eventually_elim (auto simp: field_simps)
         have *: "u x * (2 ^ n * 2 ^ n) \<le> 2^n + 2^n * real_of_int \<lfloor>u x * 2 ^ n\<rfloor>" for n
           using real_of_int_floor_ge_diff_one[of "u x * 2^n", THEN mult_left_mono, of "2^n"]
           by (auto simp: field_simps)
         show "\<forall>\<^sub>F n in sequentially. u x - (1/2)^n \<le> real_of_int \<lfloor>min (real n) (u x) * 2 ^ n\<rfloor> / 2 ^ n"
           using min_eq_r by eventually_elim (insert *, auto simp: field_simps)
       qed auto
       then have "(\<lambda>i. (f i x)) \<longlonglongrightarrow> u x"
         by (simp add: f_def)
       from LIMSEQ_unique LIMSEQ_incseq_SUP [OF bdd inc_f] this
       show ?thesis
         by blast
     qed }
   ultimately show ?thesis
     by (intro exI [of _ "\<lambda>i x. f i x"]) (auto simp: \<open>incseq f\<close> bdd image_comp)
 qed
 
 
 lemma homeomorphic_open_interval_UNIV:
   fixes a b:: real
   assumes "a < b"
   shows "{a<..<b} homeomorphic (UNIV::real set)"
 proof -
   have "{a<..<b} = ball ((b+a) / 2) ((b-a) / 2)"
     using assms
     by (auto simp: dist_real_def abs_if field_split_simps split: if_split_asm)
   then show ?thesis
     by (simp add: homeomorphic_ball_UNIV assms)
 qed
 
 proposition homeomorphic_box_UNIV:
   fixes a b:: "'a::euclidean_space"
   assumes "box a b \<noteq> {}"
   shows "box a b homeomorphic (UNIV::'a set)"
 proof -
   have "{a \<bullet> i <..<b \<bullet> i} homeomorphic (UNIV::real set)" if "i \<in> Basis" for i
     using assms box_ne_empty that by (blast intro: homeomorphic_open_interval_UNIV)
   then have "\<exists>f g. (\<forall>x. a \<bullet> i < x \<and> x < b \<bullet> i \<longrightarrow> g (f x) = x) \<and>
                    (\<forall>y. a \<bullet> i < g y \<and> g y < b \<bullet> i \<and> f(g y) = y) \<and>
                    continuous_on {a \<bullet> i<..<b \<bullet> i} f \<and>
                    continuous_on (UNIV::real set) g"
     if "i \<in> Basis" for i
     using that by (auto simp: homeomorphic_minimal mem_box Ball_def)
   then obtain f g where gf: "\<And>i x. \<lbrakk>i \<in> Basis; a \<bullet> i < x; x < b \<bullet> i\<rbrakk> \<Longrightarrow> g i (f i x) = x"
               and fg: "\<And>i y. i \<in> Basis \<Longrightarrow> a \<bullet> i < g i y \<and> g i y < b \<bullet> i \<and> f i (g i y) = y"
               and contf: "\<And>i. i \<in> Basis \<Longrightarrow> continuous_on {a \<bullet> i<..<b \<bullet> i} (f i)"
               and contg: "\<And>i. i \<in> Basis \<Longrightarrow> continuous_on (UNIV::real set) (g i)"
     by metis
   define F where "F \<equiv> \<lambda>x. \<Sum>i\<in>Basis. (f i (x \<bullet> i)) *\<^sub>R i"
   define G where "G \<equiv> \<lambda>x. \<Sum>i\<in>Basis. (g i (x \<bullet> i)) *\<^sub>R i"
   show ?thesis
     unfolding homeomorphic_minimal
   proof (intro exI conjI ballI)
     show "G y \<in> box a b" for y
       using fg by (simp add: G_def mem_box)
     show "G (F x) = x" if "x \<in> box a b" for x
       using that by (simp add: F_def G_def gf mem_box euclidean_representation)
     show "F (G y) = y" for y
       by (simp add: F_def G_def fg mem_box euclidean_representation)
     show "continuous_on (box a b) F"
       unfolding F_def
     proof (intro continuous_intros continuous_on_compose2 [OF contf continuous_on_inner])
       show "(\<lambda>x. x \<bullet> i) ` box a b \<subseteq> {a \<bullet> i<..<b \<bullet> i}" if "i \<in> Basis" for i
         using that by (auto simp: mem_box)
     qed
     show "continuous_on UNIV G"
       unfolding G_def
       by (intro continuous_intros continuous_on_compose2 [OF contg continuous_on_inner]) auto
   qed auto
 qed
 
 
 
 lemma diff_null_sets_lebesgue: "\<lbrakk>N \<in> null_sets (lebesgue_on S); X-N \<in> sets (lebesgue_on S); N \<subseteq> X\<rbrakk>
     \<Longrightarrow> X \<in> sets (lebesgue_on S)"
   by (metis Int_Diff_Un inf.commute inf.orderE null_setsD2 sets.Un)
 
 lemma borel_measurable_diff_null:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes N: "N \<in> null_sets (lebesgue_on S)" and S: "S \<in> sets lebesgue"
   shows "f \<in> borel_measurable (lebesgue_on (S-N)) \<longleftrightarrow> f \<in> borel_measurable (lebesgue_on S)"
   unfolding in_borel_measurable space_lebesgue_on sets_restrict_UNIV
 proof (intro ball_cong iffI)
   show "f -` T \<inter> S \<in> sets (lebesgue_on S)"
     if "f -` T \<inter> (S-N) \<in> sets (lebesgue_on (S-N))" for T
   proof -
     have "N \<inter> S = N"
       by (metis N S inf.orderE null_sets_restrict_space)
     moreover have "N \<inter> S \<in> sets lebesgue"
       by (metis N S inf.orderE null_setsD2 null_sets_restrict_space)
     moreover have "f -` T \<inter> S \<inter> (f -` T \<inter> N) \<in> sets lebesgue"
       by (metis N S completion.complete inf.absorb2 inf_le2 inf_mono null_sets_restrict_space)
     ultimately show ?thesis
       by (metis Diff_Int_distrib Int_Diff_Un S inf_le2 sets.Diff sets.Un sets_restrict_space_iff space_lebesgue_on space_restrict_space that)
   qed
   show "f -` T \<inter> (S-N) \<in> sets (lebesgue_on (S-N))"
     if "f -` T \<inter> S \<in> sets (lebesgue_on S)" for T
   proof -
     have "(S - N) \<inter> f -` T = (S - N) \<inter> (f -` T \<inter> S)"
       by blast
     then have "(S - N) \<inter> f -` T \<in> sets.restricted_space lebesgue (S - N)"
       by (metis S image_iff sets.Int_space_eq2 sets_restrict_space_iff that)
     then show ?thesis
       by (simp add: inf.commute sets_restrict_space)
   qed
 qed auto
 
 lemma lebesgue_measurable_diff_null:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "N \<in> null_sets lebesgue"
   shows "f \<in> borel_measurable (lebesgue_on (-N)) \<longleftrightarrow> f \<in> borel_measurable lebesgue"
   by (simp add: Compl_eq_Diff_UNIV assms borel_measurable_diff_null lebesgue_on_UNIV_eq)
 
 
 
 proposition measurable_on_imp_borel_measurable_lebesgue_UNIV:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f measurable_on UNIV"
   shows "f \<in> borel_measurable lebesgue"
 proof -
   obtain N and F
     where NF: "negligible N"
       and conF: "\<And>n. continuous_on UNIV (F n)"
       and tendsF: "\<And>x. x \<notin> N \<Longrightarrow> (\<lambda>n. F n x) \<longlonglongrightarrow> f x"
     using assms by (auto simp: measurable_on_def)
   obtain N where "N \<in> null_sets lebesgue" "f \<in> borel_measurable (lebesgue_on (-N))"
   proof
     show "f \<in> borel_measurable (lebesgue_on (- N))"
     proof (rule borel_measurable_LIMSEQ_metric)
       show "F i \<in> borel_measurable (lebesgue_on (- N))" for i
         by (meson Compl_in_sets_lebesgue NF conF continuous_imp_measurable_on_sets_lebesgue continuous_on_subset negligible_imp_sets subset_UNIV)
       show "(\<lambda>i. F i x) \<longlonglongrightarrow> f x" if "x \<in> space (lebesgue_on (- N))" for x
         using that
         by (simp add: tendsF)
     qed
     show "N \<in> null_sets lebesgue"
       using NF negligible_iff_null_sets by blast
   qed
   then show ?thesis
     using lebesgue_measurable_diff_null by blast
 qed
 
 corollary measurable_on_imp_borel_measurable_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f measurable_on S" and S: "S \<in> sets lebesgue"
   shows "f \<in> borel_measurable (lebesgue_on S)"
 proof -
   have "(\<lambda>x. if x \<in> S then f x else 0) measurable_on UNIV"
     using assms(1) measurable_on_UNIV by blast
   then show ?thesis
     by (simp add: borel_measurable_if_D measurable_on_imp_borel_measurable_lebesgue_UNIV)
 qed
 
 
 proposition measurable_on_limit:
   fixes f :: "nat \<Rightarrow> 'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "\<And>n. f n measurable_on S" and N: "negligible N"
     and lim: "\<And>x. x \<in> S - N \<Longrightarrow> (\<lambda>n. f n x) \<longlonglongrightarrow> g x"
   shows "g measurable_on S"
 proof -
   have "box (0::'b) One homeomorphic (UNIV::'b set)"
     by (simp add: homeomorphic_box_UNIV)
   then obtain h h':: "'b\<Rightarrow>'b" where hh': "\<And>x. x \<in> box 0 One \<Longrightarrow> h (h' x) = x"
                   and h'im:  "h' ` box 0 One = UNIV"
                   and conth: "continuous_on UNIV h"
                   and conth': "continuous_on (box 0 One) h'"
                   and h'h:   "\<And>y. h' (h y) = y"
                   and rangeh: "range h = box 0 One"
     by (auto simp: homeomorphic_def homeomorphism_def)
   have "norm y \<le> DIM('b)" if y: "y \<in> box 0 One" for y::'b
   proof -
     have y01: "0 < y \<bullet> i" "y \<bullet> i < 1" if "i \<in> Basis" for i
       using that y by (auto simp: mem_box)
     have "norm y \<le> (\<Sum>i\<in>Basis. \<bar>y \<bullet> i\<bar>)"
       using norm_le_l1 by blast
     also have "\<dots> \<le> (\<Sum>i::'b\<in>Basis. 1)"
     proof (rule sum_mono)
       show "\<bar>y \<bullet> i\<bar> \<le> 1" if "i \<in> Basis" for i
         using y01 that by fastforce
     qed
     also have "\<dots> \<le> DIM('b)"
       by auto
     finally show ?thesis .
   qed
   then have norm_le: "norm(h y) \<le> DIM('b)" for y
     by (metis UNIV_I image_eqI rangeh)
   have "(h' \<circ> (h \<circ> (\<lambda>x. if x \<in> S then g x else 0))) measurable_on UNIV"
   proof (rule measurable_on_compose_continuous_box)
     let ?\<chi> =  "h \<circ> (\<lambda>x. if x \<in> S then g x else 0)"
     let ?f = "\<lambda>n. h \<circ> (\<lambda>x. if x \<in> S then f n x else 0)"
     show "?\<chi> measurable_on UNIV"
     proof (rule integrable_subintervals_imp_measurable)
       show "?\<chi> integrable_on cbox a b" for a b
       proof (rule integrable_spike_set)
         show "?\<chi> integrable_on (cbox a b - N)"
         proof (rule dominated_convergence_integrable)
           show const: "(\<lambda>x. DIM('b)) integrable_on cbox a b - N"
             by (simp add: N has_integral_iff integrable_const integrable_negligible integrable_setdiff negligible_diff)
           show "norm ((h \<circ> (\<lambda>x. if x \<in> S then g x else 0)) x) \<le> DIM('b)" if "x \<in> cbox a b - N" for x
             using that norm_le  by (simp add: o_def)
           show "(\<lambda>k. ?f k x) \<longlonglongrightarrow> ?\<chi> x" if "x \<in> cbox a b - N" for x
             using that lim [of x] conth
             by (auto simp: continuous_on_def intro: tendsto_compose)
           show "(?f n) absolutely_integrable_on cbox a b - N" for n
           proof (rule measurable_bounded_by_integrable_imp_absolutely_integrable)
             show "?f n \<in> borel_measurable (lebesgue_on (cbox a b - N))"
             proof (rule measurable_on_imp_borel_measurable_lebesgue [OF measurable_on_spike_set])
               show "?f n measurable_on cbox a b"
                 unfolding measurable_on_UNIV [symmetric, of _ "cbox a b"]
               proof (rule measurable_on_restrict)
                 have f': "(\<lambda>x. if x \<in> S then f n x else 0) measurable_on UNIV"
                   by (simp add: f measurable_on_UNIV)
                 show "?f n measurable_on UNIV"
                   using measurable_on_compose_continuous [OF f' conth] by auto
               qed auto
               show "negligible (sym_diff (cbox a b) (cbox a b - N))"
                 by (auto intro: negligible_subset [OF N])
               show "cbox a b - N \<in> sets lebesgue"
                 by (simp add: N negligible_imp_sets sets.Diff)
             qed
             show "cbox a b - N \<in> sets lebesgue"
               by (simp add: N negligible_imp_sets sets.Diff)
             show "norm (?f n x) \<le> DIM('b)"
               if "x \<in> cbox a b - N" for x
               using that local.norm_le by simp
           qed (auto simp: const)
         qed
         show "negligible {x \<in> cbox a b - N - cbox a b. ?\<chi> x \<noteq> 0}"
           by (auto simp: empty_imp_negligible)
         have "{x \<in> cbox a b - (cbox a b - N). ?\<chi> x \<noteq> 0} \<subseteq> N"
           by auto
         then show "negligible {x \<in> cbox a b - (cbox a b - N). ?\<chi> x \<noteq> 0}"
           using N negligible_subset by blast
       qed
     qed
     show "?\<chi> x \<in> box 0 One" for x
       using rangeh by auto
     show "continuous_on (box 0 One) h'"
       by (rule conth')
   qed
   then show ?thesis
     by (simp add: o_def h'h measurable_on_UNIV)
 qed
 
 
 lemma measurable_on_if_simple_function_limit:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows  "\<lbrakk>\<And>n. g n measurable_on UNIV; \<And>n. finite (range (g n)); \<And>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x\<rbrakk>
    \<Longrightarrow> f measurable_on UNIV"
   by (force intro: measurable_on_limit [where N="{}"])
 
 
 lemma lebesgue_measurable_imp_measurable_on_nnreal_UNIV:
   fixes u :: "'a::euclidean_space \<Rightarrow> real"
   assumes u: "u \<in> borel_measurable lebesgue" and nn: "\<And>x. u x \<ge> 0"
   shows "u measurable_on UNIV"
 proof -
   obtain f where "incseq f" and f: "\<forall>i. simple_function lebesgue (f i)"
     and bdd: "\<And>x. bdd_above (range (\<lambda>i. f i x))"
     and nnf: "\<And>i x. 0 \<le> f i x" and *: "u = (SUP i. f i)"
     using borel_measurable_implies_simple_function_sequence_real nn u by metis
   show ?thesis
     unfolding *
   proof (rule measurable_on_if_simple_function_limit [of concl: "Sup (range f)"])
     show "(f i) measurable_on UNIV" for i
       by (simp add: f nnf simple_function_measurable_on_UNIV)
     show "finite (range (f i))" for i
       by (metis f simple_function_def space_borel space_completion space_lborel)
     show "(\<lambda>i. f i x) \<longlonglongrightarrow> Sup (range f) x" for x
     proof -
       have "incseq (\<lambda>i. f i x)"
         using \<open>incseq f\<close> apply (auto simp: incseq_def)
         by (simp add: le_funD)
       then show ?thesis
         by (metis SUP_apply bdd LIMSEQ_incseq_SUP)
     qed
   qed
 qed
 
 lemma lebesgue_measurable_imp_measurable_on_nnreal:
   fixes u :: "'a::euclidean_space \<Rightarrow> real"
   assumes "u \<in> borel_measurable lebesgue" "\<And>x. u x \<ge> 0""S \<in> sets lebesgue"
   shows "u measurable_on S"
   unfolding measurable_on_UNIV [symmetric, of u]
   using assms
   by (auto intro: lebesgue_measurable_imp_measurable_on_nnreal_UNIV)
 
 lemma lebesgue_measurable_imp_measurable_on_real:
   fixes u :: "'a::euclidean_space \<Rightarrow> real"
   assumes u: "u \<in> borel_measurable lebesgue" and S: "S \<in> sets lebesgue"
   shows "u measurable_on S"
 proof -
   let ?f = "\<lambda>x. \<bar>u x\<bar> + u x"
   let ?g = "\<lambda>x. \<bar>u x\<bar> - u x"
   have "?f measurable_on S" "?g measurable_on S"
     using S u by (auto intro: lebesgue_measurable_imp_measurable_on_nnreal)
   then have "(\<lambda>x. (?f x - ?g x) / 2) measurable_on S"
     using measurable_on_cdivide measurable_on_diff by blast
   then show ?thesis
     by auto
 qed
 
 
 proposition lebesgue_measurable_imp_measurable_on:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f \<in> borel_measurable lebesgue" and S: "S \<in> sets lebesgue"
   shows "f measurable_on S"
   unfolding measurable_on_componentwise [of f]
 proof
   fix i::'b
   assume "i \<in> Basis"
   have "(\<lambda>x. (f x \<bullet> i)) \<in> borel_measurable lebesgue"
     using \<open>i \<in> Basis\<close> borel_measurable_euclidean_space f by blast
   then have "(\<lambda>x. (f x \<bullet> i)) measurable_on S"
     using S lebesgue_measurable_imp_measurable_on_real by blast
   then show "(\<lambda>x. (f x \<bullet> i) *\<^sub>R i) measurable_on S"
     by (intro measurable_on_scaleR measurable_on_const S)
 qed
 
 proposition measurable_on_iff_borel_measurable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue"
   shows "f measurable_on S \<longleftrightarrow> f \<in> borel_measurable (lebesgue_on S)" (is "?lhs = ?rhs")
 proof
   show "f \<in> borel_measurable (lebesgue_on S)"
     if "f measurable_on S"
     using that by (simp add: assms measurable_on_imp_borel_measurable_lebesgue)
 next
   assume "f \<in> borel_measurable (lebesgue_on S)"
   then have "(\<lambda>a. if a \<in> S then f a else 0) measurable_on UNIV"
     by (simp add: assms borel_measurable_if lebesgue_measurable_imp_measurable_on)
   then show "f measurable_on S"
     using measurable_on_UNIV by blast
 qed
 
 subsection \<open>Measurability on generalisations of the binary product\<close>
 
 lemma measurable_on_bilinear:
   fixes h :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::euclidean_space"
   assumes h: "bilinear h" and f: "f measurable_on S" and g: "g measurable_on S"
   shows "(\<lambda>x. h (f x) (g x)) measurable_on S"
 proof (rule measurable_on_combine [where h = h])
   show "continuous_on UNIV (\<lambda>x. h (fst x) (snd x))"
     by (simp add: bilinear_continuous_on_compose [OF continuous_on_fst continuous_on_snd h])
   show "h 0 0 = 0"
   by (simp add: bilinear_lzero h)
 qed (auto intro: assms)
 
 lemma borel_measurable_bilinear:
   fixes h :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::euclidean_space"
   assumes "bilinear h" "f \<in> borel_measurable (lebesgue_on S)" "g \<in> borel_measurable (lebesgue_on S)"
     and S: "S \<in> sets lebesgue"
   shows "(\<lambda>x. h (f x) (g x)) \<in> borel_measurable (lebesgue_on S)"
   using assms measurable_on_bilinear [of h f S g]
   by (simp flip: measurable_on_iff_borel_measurable)
 
 lemma absolutely_integrable_bounded_measurable_product:
   fixes h :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::euclidean_space"
   assumes "bilinear h" and f: "f \<in> borel_measurable (lebesgue_on S)" "S \<in> sets lebesgue"
     and bou: "bounded (f ` S)" and g: "g absolutely_integrable_on S"
   shows "(\<lambda>x. h (f x) (g x)) absolutely_integrable_on S"
 proof -
   obtain B where "B > 0" and B: "\<And>x y. norm (h x y) \<le> B * norm x * norm y"
     using bilinear_bounded_pos \<open>bilinear h\<close> by blast
   obtain C where "C > 0" and C: "\<And>x. x \<in> S \<Longrightarrow> norm (f x) \<le> C"
     using bounded_pos by (metis bou imageI)
   show ?thesis
   proof (rule measurable_bounded_by_integrable_imp_absolutely_integrable [OF _ \<open>S \<in> sets lebesgue\<close>])
     show "norm (h (f x) (g x)) \<le> B * C * norm(g x)" if "x \<in> S" for x
       by (meson less_le mult_left_mono mult_right_mono norm_ge_zero order_trans that \<open>B > 0\<close> B C)
     show "(\<lambda>x. h (f x) (g x)) \<in> borel_measurable (lebesgue_on S)"
       using \<open>bilinear h\<close> f g
       by (blast intro: borel_measurable_bilinear dest: absolutely_integrable_measurable)
     show "(\<lambda>x. B * C * norm(g x)) integrable_on S"
       using \<open>0 < B\<close> \<open>0 < C\<close> absolutely_integrable_on_def g by auto
   qed
 qed
 
 lemma absolutely_integrable_bounded_measurable_product_real:
   fixes f :: "real \<Rightarrow> real"
   assumes "f \<in> borel_measurable (lebesgue_on S)" "S \<in> sets lebesgue"
       and "bounded (f ` S)" and "g absolutely_integrable_on S"
   shows "(\<lambda>x. f x * g x) absolutely_integrable_on S"
   using absolutely_integrable_bounded_measurable_product bilinear_times assms by blast
 
 
 lemma borel_measurable_AE:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f \<in> borel_measurable lebesgue" and ae: "AE x in lebesgue. f x = g x"
   shows "g \<in> borel_measurable lebesgue"
 proof -
   obtain N where N: "N \<in> null_sets lebesgue" "\<And>x. x \<notin> N \<Longrightarrow> f x = g x"
     using ae unfolding completion.AE_iff_null_sets by auto
   have "f measurable_on UNIV"
     by (simp add: assms lebesgue_measurable_imp_measurable_on)
   then have "g measurable_on UNIV"
     by (metis Diff_iff N measurable_on_spike negligible_iff_null_sets)
   then show ?thesis
     using measurable_on_imp_borel_measurable_lebesgue_UNIV by blast
 qed
 
 lemma has_bochner_integral_combine:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "a \<le> c" "c \<le> b"
     and ac: "has_bochner_integral (lebesgue_on {a..c}) f i"
     and cb: "has_bochner_integral (lebesgue_on {c..b}) f j"
   shows "has_bochner_integral (lebesgue_on {a..b}) f(i + j)"
 proof -
   have i: "has_bochner_integral lebesgue (\<lambda>x. indicator {a..c} x *\<^sub>R f x) i"
    and j: "has_bochner_integral lebesgue (\<lambda>x. indicator {c..b} x *\<^sub>R f x) j"
     using assms  by (auto simp: has_bochner_integral_restrict_space)
   have AE: "AE x in lebesgue. indicat_real {a..c} x *\<^sub>R f x + indicat_real {c..b} x *\<^sub>R f x = indicat_real {a..b} x *\<^sub>R f x"
   proof (rule AE_I')
     have eq: "indicat_real {a..c} x *\<^sub>R f x + indicat_real {c..b} x *\<^sub>R f x = indicat_real {a..b} x *\<^sub>R f x" if "x \<noteq> c" for x
       using assms that by (auto simp: indicator_def)
     then show "{x \<in> space lebesgue. indicat_real {a..c} x *\<^sub>R f x + indicat_real {c..b} x *\<^sub>R f x \<noteq> indicat_real {a..b} x *\<^sub>R f x} \<subseteq> {c}"
       by auto
   qed auto
   have "has_bochner_integral lebesgue (\<lambda>x. indicator {a..b} x *\<^sub>R f x) (i + j)"
   proof (rule has_bochner_integralI_AE [OF has_bochner_integral_add [OF i j] _ AE])
     have eq: "indicat_real {a..c} x *\<^sub>R f x + indicat_real {c..b} x *\<^sub>R f x = indicat_real {a..b} x *\<^sub>R f x" if "x \<noteq> c" for x
       using assms that by (auto simp: indicator_def)
     show "(\<lambda>x. indicat_real {a..b} x *\<^sub>R f x) \<in> borel_measurable lebesgue"
     proof (rule borel_measurable_AE [OF borel_measurable_add AE])
       show "(\<lambda>x. indicator {a..c} x *\<^sub>R f x) \<in> borel_measurable lebesgue"
            "(\<lambda>x. indicator {c..b} x *\<^sub>R f x) \<in> borel_measurable lebesgue"
         using i j by auto
     qed
   qed
   then show ?thesis
     by (simp add: has_bochner_integral_restrict_space)
 qed
 
 lemma integrable_combine:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "integrable (lebesgue_on {a..c}) f" "integrable (lebesgue_on {c..b}) f"
     and "a \<le> c" "c \<le> b"
   shows "integrable (lebesgue_on {a..b}) f"
   using assms has_bochner_integral_combine has_bochner_integral_iff by blast
 
 lemma integral_combine:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes f: "integrable (lebesgue_on {a..b}) f" and "a \<le> c" "c \<le> b"
   shows "integral\<^sup>L (lebesgue_on {a..b}) f = integral\<^sup>L (lebesgue_on {a..c}) f + integral\<^sup>L (lebesgue_on {c..b}) f"
 proof -
   have i: "has_bochner_integral (lebesgue_on {a..c}) f(integral\<^sup>L (lebesgue_on {a..c}) f)"
     using integrable_subinterval \<open>c \<le> b\<close> f has_bochner_integral_iff by fastforce
   have j: "has_bochner_integral (lebesgue_on {c..b}) f(integral\<^sup>L (lebesgue_on {c..b}) f)"
     using integrable_subinterval \<open>a \<le> c\<close> f has_bochner_integral_iff by fastforce
   show ?thesis
     by (meson \<open>a \<le> c\<close> \<open>c \<le> b\<close> has_bochner_integral_combine has_bochner_integral_iff i j)
 qed
 
 lemma has_bochner_integral_null [intro]:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "N \<in> null_sets lebesgue"
   shows "has_bochner_integral (lebesgue_on N) f 0"
   unfolding has_bochner_integral_iff \<comment>\<open>strange that the proof's so long\<close>
 proof
   show "integrable (lebesgue_on N) f"
   proof (subst integrable_restrict_space)
     show "N \<inter> space lebesgue \<in> sets lebesgue"
       using assms by force
     show "integrable lebesgue (\<lambda>x. indicat_real N x *\<^sub>R f x)"
     proof (rule integrable_cong_AE_imp)
       show "integrable lebesgue (\<lambda>x. 0)"
         by simp
       show *: "AE x in lebesgue. 0 = indicat_real N x *\<^sub>R f x"
         using assms
         by (simp add: indicator_def completion.null_sets_iff_AE eventually_mono)
       show "(\<lambda>x. indicat_real N x *\<^sub>R f x) \<in> borel_measurable lebesgue"
         by (auto intro: borel_measurable_AE [OF _ *])
     qed
   qed
   show "integral\<^sup>L (lebesgue_on N) f = 0"
   proof (rule integral_eq_zero_AE)
     show "AE x in lebesgue_on N. f x = 0"
       by (rule AE_I' [where N=N]) (auto simp: assms null_setsD2 null_sets_restrict_space)
   qed
 qed
 
 lemma has_bochner_integral_null_eq[simp]:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "N \<in> null_sets lebesgue"
   shows "has_bochner_integral (lebesgue_on N) f i \<longleftrightarrow> i = 0"
   using assms has_bochner_integral_eq by blast
 
 end
diff --git a/src/HOL/Analysis/Henstock_Kurzweil_Integration.thy b/src/HOL/Analysis/Henstock_Kurzweil_Integration.thy
--- a/src/HOL/Analysis/Henstock_Kurzweil_Integration.thy
+++ b/src/HOL/Analysis/Henstock_Kurzweil_Integration.thy
@@ -1,7591 +1,7591 @@
 (*  Author:     John Harrison
     Author:     Robert Himmelmann, TU Muenchen (Translation from HOL light)
                 Huge cleanup by LCP
 *)
 
 section \<open>Henstock-Kurzweil Gauge Integration in Many Dimensions\<close>
 
 theory Henstock_Kurzweil_Integration
 imports
   Lebesgue_Measure Tagged_Division
 begin
 
 lemma norm_diff2: "\<lbrakk>y = y1 + y2; x = x1 + x2; e = e1 + e2; norm(y1 - x1) \<le> e1; norm(y2 - x2) \<le> e2\<rbrakk>
   \<Longrightarrow> norm(y-x) \<le> e"
   using norm_triangle_mono [of "y1 - x1" "e1" "y2 - x2" "e2"]
   by (simp add: add_diff_add)
 
 lemma setcomp_dot1: "{z. P (z \<bullet> (i,0))} = {(x,y). P(x \<bullet> i)}"
   by auto
 
 lemma setcomp_dot2: "{z. P (z \<bullet> (0,i))} = {(x,y). P(y \<bullet> i)}"
   by auto
 
 lemma Sigma_Int_Paircomp1: "(Sigma A B) \<inter> {(x, y). P x} = Sigma (A \<inter> {x. P x}) B"
   by blast
 
 lemma Sigma_Int_Paircomp2: "(Sigma A B) \<inter> {(x, y). P y} = Sigma A (\<lambda>z. B z \<inter> {y. P y})"
   by blast
 (* END MOVE *)
 
 subsection \<open>Content (length, area, volume...) of an interval\<close>
 
 abbreviation content :: "'a::euclidean_space set \<Rightarrow> real"
   where "content s \<equiv> measure lborel s"
 
 lemma content_cbox_cases:
   "content (cbox a b) = (if \<forall>i\<in>Basis. a\<bullet>i \<le> b\<bullet>i then prod (\<lambda>i. b\<bullet>i - a\<bullet>i) Basis else 0)"
   by (simp add: measure_lborel_cbox_eq inner_diff)
 
 lemma content_cbox: "\<forall>i\<in>Basis. a\<bullet>i \<le> b\<bullet>i \<Longrightarrow> content (cbox a b) = (\<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i)"
   unfolding content_cbox_cases by simp
 
 lemma content_cbox': "cbox a b \<noteq> {} \<Longrightarrow> content (cbox a b) = (\<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i)"
   by (simp add: box_ne_empty inner_diff)
 
 lemma content_cbox_if: "content (cbox a b) = (if cbox a b = {} then 0 else \<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i)"
   by (simp add: content_cbox')
 
 lemma content_cbox_cart:
    "cbox a b \<noteq> {} \<Longrightarrow> content(cbox a b) = prod (\<lambda>i. b$i - a$i) UNIV"
   by (simp add: content_cbox_if Basis_vec_def cart_eq_inner_axis axis_eq_axis prod.UNION_disjoint)
 
 lemma content_cbox_if_cart:
    "content(cbox a b) = (if cbox a b = {} then 0 else prod (\<lambda>i. b$i - a$i) UNIV)"
   by (simp add: content_cbox_cart)
 
 lemma content_division_of:
   assumes "K \<in> \<D>" "\<D> division_of S"
   shows "content K = (\<Prod>i \<in> Basis. interval_upperbound K \<bullet> i - interval_lowerbound K \<bullet> i)"
 proof -
   obtain a b where "K = cbox a b"
     using cbox_division_memE assms by metis
   then show ?thesis
     using assms by (force simp: division_of_def content_cbox')
 qed
 
 lemma content_real: "a \<le> b \<Longrightarrow> content {a..b} = b - a"
   by simp
 
 lemma abs_eq_content: "\<bar>y - x\<bar> = (if x\<le>y then content {x..y} else content {y..x})"
   by (auto simp: content_real)
 
 lemma content_singleton: "content {a} = 0"
   by simp
 
 lemma content_unit[iff]: "content (cbox 0 (One::'a::euclidean_space)) = 1"
   by simp
 
 lemma content_pos_le [iff]: "0 \<le> content X"
   by simp
 
 corollary\<^marker>\<open>tag unimportant\<close> content_nonneg [simp]: "\<not> content (cbox a b) < 0"
   using not_le by blast
 
 lemma content_pos_lt: "\<forall>i\<in>Basis. a\<bullet>i < b\<bullet>i \<Longrightarrow> 0 < content (cbox a b)"
   by (auto simp: less_imp_le inner_diff box_eq_empty intro!: prod_pos)
 
 lemma content_eq_0: "content (cbox a b) = 0 \<longleftrightarrow> (\<exists>i\<in>Basis. b\<bullet>i \<le> a\<bullet>i)"
   by (auto simp: content_cbox_cases not_le intro: less_imp_le antisym eq_refl)
 
 lemma content_eq_0_interior: "content (cbox a b) = 0 \<longleftrightarrow> interior(cbox a b) = {}"
   unfolding content_eq_0 interior_cbox box_eq_empty by auto
 
 lemma content_pos_lt_eq: "0 < content (cbox a (b::'a::euclidean_space)) \<longleftrightarrow> (\<forall>i\<in>Basis. a\<bullet>i < b\<bullet>i)"
   by (auto simp add: content_cbox_cases less_le prod_nonneg)
 
 lemma content_empty [simp]: "content {} = 0"
   by simp
 
 lemma content_real_if [simp]: "content {a..b} = (if a \<le> b then b - a else 0)"
   by (simp add: content_real)
 
 lemma content_subset: "cbox a b \<subseteq> cbox c d \<Longrightarrow> content (cbox a b) \<le> content (cbox c d)"
   unfolding measure_def
   by (intro enn2real_mono emeasure_mono) (auto simp: emeasure_lborel_cbox_eq)
 
 lemma content_lt_nz: "0 < content (cbox a b) \<longleftrightarrow> content (cbox a b) \<noteq> 0"
   unfolding content_pos_lt_eq content_eq_0 unfolding not_ex not_le by fastforce
 
 lemma content_Pair: "content (cbox (a,c) (b,d)) = content (cbox a b) * content (cbox c d)"
   unfolding measure_lborel_cbox_eq Basis_prod_def
   apply (subst prod.union_disjoint)
   apply (auto simp: bex_Un ball_Un)
   apply (subst (1 2) prod.reindex_nontrivial)
   apply auto
   done
 
 lemma content_cbox_pair_eq0_D:
    "content (cbox (a,c) (b,d)) = 0 \<Longrightarrow> content (cbox a b) = 0 \<or> content (cbox c d) = 0"
   by (simp add: content_Pair)
 
 lemma content_cbox_plus:
   fixes x :: "'a::euclidean_space"
   shows "content(cbox x (x + h *\<^sub>R One)) = (if h \<ge> 0 then h ^ DIM('a) else 0)"
   by (simp add: algebra_simps content_cbox_if box_eq_empty)
 
 lemma content_0_subset: "content(cbox a b) = 0 \<Longrightarrow> s \<subseteq> cbox a b \<Longrightarrow> content s = 0"
   using emeasure_mono[of s "cbox a b" lborel]
   by (auto simp: measure_def enn2real_eq_0_iff emeasure_lborel_cbox_eq)
 
 lemma content_ball_pos:
   assumes "r > 0"
   shows   "content (ball c r) > 0"
 proof -
   from rational_boxes[OF assms, of c] obtain a b where ab: "c \<in> box a b" "box a b \<subseteq> ball c r"
     by auto
   from ab have "0 < content (box a b)"
     by (subst measure_lborel_box_eq) (auto intro!: prod_pos simp: algebra_simps box_def)
   have "emeasure lborel (box a b) \<le> emeasure lborel (ball c r)"
     using ab by (intro emeasure_mono) auto
   also have "emeasure lborel (box a b) = ennreal (content (box a b))"
     using emeasure_lborel_box_finite[of a b] by (intro emeasure_eq_ennreal_measure) auto
   also have "emeasure lborel (ball c r) = ennreal (content (ball c r))"
     using emeasure_lborel_ball_finite[of c r] by (intro emeasure_eq_ennreal_measure) auto
   finally show ?thesis
     using \<open>content (box a b) > 0\<close> by simp
 qed
 
 lemma content_cball_pos:
   assumes "r > 0"
   shows   "content (cball c r) > 0"
 proof -
   from rational_boxes[OF assms, of c] obtain a b where ab: "c \<in> box a b" "box a b \<subseteq> ball c r"
     by auto
   from ab have "0 < content (box a b)"
     by (subst measure_lborel_box_eq) (auto intro!: prod_pos simp: algebra_simps box_def)
   have "emeasure lborel (box a b) \<le> emeasure lborel (ball c r)"
     using ab by (intro emeasure_mono) auto
   also have "\<dots> \<le> emeasure lborel (cball c r)"
     by (intro emeasure_mono) auto
   also have "emeasure lborel (box a b) = ennreal (content (box a b))"
     using emeasure_lborel_box_finite[of a b] by (intro emeasure_eq_ennreal_measure) auto
   also have "emeasure lborel (cball c r) = ennreal (content (cball c r))"
     using emeasure_lborel_cball_finite[of c r] by (intro emeasure_eq_ennreal_measure) auto
   finally show ?thesis
     using \<open>content (box a b) > 0\<close> by simp
 qed
 
 lemma content_split:
   fixes a :: "'a::euclidean_space"
   assumes "k \<in> Basis"
   shows "content (cbox a b) = content(cbox a b \<inter> {x. x\<bullet>k \<le> c}) + content(cbox a b \<inter> {x. x\<bullet>k \<ge> c})"
   \<comment> \<open>Prove using measure theory\<close>
 proof (cases "\<forall>i\<in>Basis. a \<bullet> i \<le> b \<bullet> i")
   case True
   have 1: "\<And>X Y Z. (\<Prod>i\<in>Basis. Z i (if i = k then X else Y i)) = Z k X * (\<Prod>i\<in>Basis-{k}. Z i (Y i))"
     by (simp add: if_distrib prod.delta_remove assms)
   note simps = interval_split[OF assms] content_cbox_cases
   have 2: "(\<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i) = (\<Prod>i\<in>Basis-{k}. b\<bullet>i - a\<bullet>i) * (b\<bullet>k - a\<bullet>k)"
     by (metis (no_types, lifting) assms finite_Basis mult.commute prod.remove)
   have "\<And>x. min (b \<bullet> k) c = max (a \<bullet> k) c \<Longrightarrow>
     x * (b\<bullet>k - a\<bullet>k) = x * (max (a \<bullet> k) c - a \<bullet> k) + x * (b \<bullet> k - max (a \<bullet> k) c)"
     by  (auto simp add: field_simps)
   moreover
   have **: "(\<Prod>i\<in>Basis. ((\<Sum>i\<in>Basis. (if i = k then min (b \<bullet> k) c else b \<bullet> i) *\<^sub>R i) \<bullet> i - a \<bullet> i)) =
       (\<Prod>i\<in>Basis. (if i = k then min (b \<bullet> k) c else b \<bullet> i) - a \<bullet> i)"
     "(\<Prod>i\<in>Basis. b \<bullet> i - ((\<Sum>i\<in>Basis. (if i = k then max (a \<bullet> k) c else a \<bullet> i) *\<^sub>R i) \<bullet> i)) =
       (\<Prod>i\<in>Basis. b \<bullet> i - (if i = k then max (a \<bullet> k) c else a \<bullet> i))"
     by (auto intro!: prod.cong)
   have "\<not> a \<bullet> k \<le> c \<Longrightarrow> \<not> c \<le> b \<bullet> k \<Longrightarrow> False"
     unfolding not_le using True assms by auto
   ultimately show ?thesis
     using assms unfolding simps ** 1[of "\<lambda>i x. b\<bullet>i - x"] 1[of "\<lambda>i x. x - a\<bullet>i"] 2
     by auto
 next
   case False
   then have "cbox a b = {}"
     unfolding box_eq_empty by (auto simp: not_le)
   then show ?thesis
     by (auto simp: not_le)
 qed
 
 lemma division_of_content_0:
   assumes "content (cbox a b) = 0" "d division_of (cbox a b)" "K \<in> d"
   shows "content K = 0"
   unfolding forall_in_division[OF assms(2)]
   by (meson assms content_0_subset division_of_def)
 
 lemma sum_content_null:
   assumes "content (cbox a b) = 0"
     and "p tagged_division_of (cbox a b)"
   shows "(\<Sum>(x,K)\<in>p. content K *\<^sub>R f x) = (0::'a::real_normed_vector)"
 proof (rule sum.neutral, rule)
   fix y
   assume y: "y \<in> p"
   obtain x K where xk: "y = (x, K)"
     using surj_pair[of y] by blast
   then obtain c d where k: "K = cbox c d" "K \<subseteq> cbox a b"
     by (metis assms(2) tagged_division_ofD(3) tagged_division_ofD(4) y)
   have "(\<lambda>(x',K'). content K' *\<^sub>R f x') y = content K *\<^sub>R f x"
     unfolding xk by auto
   also have "\<dots> = 0"
     using assms(1) content_0_subset k(2) by auto
   finally show "(\<lambda>(x, k). content k *\<^sub>R f x) y = 0" .
 qed
 
 global_interpretation sum_content: operative plus 0 content
   rewrites "comm_monoid_set.F plus 0 = sum"
 proof -
   interpret operative plus 0 content
     by standard (auto simp add: content_split [symmetric] content_eq_0_interior)
   show "operative plus 0 content"
     by standard
   show "comm_monoid_set.F plus 0 = sum"
     by (simp add: sum_def)
 qed
 
 lemma additive_content_division: "d division_of (cbox a b) \<Longrightarrow> sum content d = content (cbox a b)"
   by (fact sum_content.division)
 
 lemma additive_content_tagged_division:
   "d tagged_division_of (cbox a b) \<Longrightarrow> sum (\<lambda>(x,l). content l) d = content (cbox a b)"
   by (fact sum_content.tagged_division)
 
 lemma subadditive_content_division:
   assumes "\<D> division_of S" "S \<subseteq> cbox a b"
   shows "sum content \<D> \<le> content(cbox a b)"
 proof -
   have "\<D> division_of \<Union>\<D>" "\<Union>\<D> \<subseteq> cbox a b"
     using assms by auto
   then obtain \<D>' where "\<D> \<subseteq> \<D>'" "\<D>' division_of cbox a b"
     using partial_division_extend_interval by metis
   then have "sum content \<D> \<le> sum content \<D>'"
     using sum_mono2 by blast
   also have "... \<le> content(cbox a b)"
     by (simp add: \<open>\<D>' division_of cbox a b\<close> additive_content_division less_eq_real_def)
   finally show ?thesis .
 qed
 
 lemma content_real_eq_0: "content {a..b::real} = 0 \<longleftrightarrow> a \<ge> b"
   by (metis atLeastatMost_empty_iff2 content_empty content_real diff_self eq_iff le_cases le_iff_diff_le_0)
 
 lemma property_empty_interval: "\<forall>a b. content (cbox a b) = 0 \<longrightarrow> P (cbox a b) \<Longrightarrow> P {}"
   using content_empty unfolding empty_as_interval by auto
 
 lemma interval_bounds_nz_content [simp]:
   assumes "content (cbox a b) \<noteq> 0"
   shows "interval_upperbound (cbox a b) = b"
     and "interval_lowerbound (cbox a b) = a"
   by (metis assms content_empty interval_bounds')+
 
 subsection \<open>Gauge integral\<close>
 
 text \<open>Case distinction to define it first on compact intervals first, then use a limit. This is only
 much later unified. In Fremlin: Measure Theory, Volume 4I this is generalized using residual sets.\<close>
 
 definition has_integral :: "('n::euclidean_space \<Rightarrow> 'b::real_normed_vector) \<Rightarrow> 'b \<Rightarrow> 'n set \<Rightarrow> bool"
   (infixr "has'_integral" 46)
   where "(f has_integral I) s \<longleftrightarrow>
     (if \<exists>a b. s = cbox a b
       then ((\<lambda>p. \<Sum>(x,k)\<in>p. content k *\<^sub>R f x) \<longlongrightarrow> I) (division_filter s)
       else (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
         (\<exists>z. ((\<lambda>p. \<Sum>(x,k)\<in>p. content k *\<^sub>R (if x \<in> s then f x else 0)) \<longlongrightarrow> z) (division_filter (cbox a b)) \<and>
           norm (z - I) < e)))"
 
 lemma has_integral_cbox:
   "(f has_integral I) (cbox a b) \<longleftrightarrow> ((\<lambda>p. \<Sum>(x,k)\<in>p. content k *\<^sub>R f x) \<longlongrightarrow> I) (division_filter (cbox a b))"
   by (auto simp add: has_integral_def)
 
 lemma has_integral:
   "(f has_integral y) (cbox a b) \<longleftrightarrow>
     (\<forall>e>0. \<exists>\<gamma>. gauge \<gamma> \<and>
       (\<forall>\<D>. \<D> tagged_division_of (cbox a b) \<and> \<gamma> fine \<D> \<longrightarrow>
         norm (sum (\<lambda>(x,k). content(k) *\<^sub>R f x) \<D> - y) < e))"
   by (auto simp: dist_norm eventually_division_filter has_integral_def tendsto_iff)
 
 lemma has_integral_real:
   "(f has_integral y) {a..b::real} \<longleftrightarrow>
     (\<forall>e>0. \<exists>\<gamma>. gauge \<gamma> \<and>
       (\<forall>\<D>. \<D> tagged_division_of {a..b} \<and> \<gamma> fine \<D> \<longrightarrow>
         norm (sum (\<lambda>(x,k). content(k) *\<^sub>R f x) \<D> - y) < e))"
   unfolding box_real[symmetric] by (rule has_integral)
 
 lemma has_integralD[dest]:
   assumes "(f has_integral y) (cbox a b)"
     and "e > 0"
   obtains \<gamma>
     where "gauge \<gamma>"
       and "\<And>\<D>. \<D> tagged_division_of (cbox a b) \<Longrightarrow> \<gamma> fine \<D> \<Longrightarrow>
         norm ((\<Sum>(x,k)\<in>\<D>. content k *\<^sub>R f x) - y) < e"
   using assms unfolding has_integral by auto
 
 lemma has_integral_alt:
   "(f has_integral y) i \<longleftrightarrow>
     (if \<exists>a b. i = cbox a b
      then (f has_integral y) i
      else (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       (\<exists>z. ((\<lambda>x. if x \<in> i then f x else 0) has_integral z) (cbox a b) \<and> norm (z - y) < e)))"
   by (subst has_integral_def) (auto simp add: has_integral_cbox)
 
 lemma has_integral_altD:
   assumes "(f has_integral y) i"
     and "\<not> (\<exists>a b. i = cbox a b)"
     and "e>0"
   obtains B where "B > 0"
     and "\<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       (\<exists>z. ((\<lambda>x. if x \<in> i then f(x) else 0) has_integral z) (cbox a b) \<and> norm(z - y) < e)"
   using assms has_integral_alt[of f y i] by auto
 
 definition integrable_on (infixr "integrable'_on" 46)
   where "f integrable_on i \<longleftrightarrow> (\<exists>y. (f has_integral y) i)"
 
 definition "integral i f = (SOME y. (f has_integral y) i \<or> \<not> f integrable_on i \<and> y=0)"
 
 lemma integrable_integral[intro]: "f integrable_on i \<Longrightarrow> (f has_integral (integral i f)) i"
   unfolding integrable_on_def integral_def by (metis (mono_tags, lifting) someI_ex)
 
 lemma not_integrable_integral: "\<not> f integrable_on i \<Longrightarrow> integral i f = 0"
   unfolding integrable_on_def integral_def by blast
 
 lemma has_integral_integrable[dest]: "(f has_integral i) s \<Longrightarrow> f integrable_on s"
   unfolding integrable_on_def by auto
 
 lemma has_integral_integral: "f integrable_on s \<longleftrightarrow> (f has_integral (integral s f)) s"
   by auto
 
 subsection \<open>Basic theorems about integrals\<close>
 
 lemma has_integral_eq_rhs: "(f has_integral j) S \<Longrightarrow> i = j \<Longrightarrow> (f has_integral i) S"
   by (rule forw_subst)
 
 lemma has_integral_unique_cbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   shows "(f has_integral k1) (cbox a b) \<Longrightarrow> (f has_integral k2) (cbox a b) \<Longrightarrow> k1 = k2"
     by (auto simp: has_integral_cbox intro: tendsto_unique[OF division_filter_not_empty])    
 
 lemma has_integral_unique:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral k1) i" "(f has_integral k2) i"
   shows "k1 = k2"
 proof (rule ccontr)
   let ?e = "norm (k1 - k2)/2"
   let ?F = "(\<lambda>x. if x \<in> i then f x else 0)"
   assume "k1 \<noteq> k2"
   then have e: "?e > 0"
     by auto
   have nonbox: "\<not> (\<exists>a b. i = cbox a b)"
     using \<open>k1 \<noteq> k2\<close> assms has_integral_unique_cbox by blast
   obtain B1 where B1:
       "0 < B1"
       "\<And>a b. ball 0 B1 \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?F has_integral z) (cbox a b) \<and> norm (z - k1) < norm (k1 - k2)/2"
     by (rule has_integral_altD[OF assms(1) nonbox,OF e]) blast
   obtain B2 where B2:
       "0 < B2"
       "\<And>a b. ball 0 B2 \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?F has_integral z) (cbox a b) \<and> norm (z - k2) < norm (k1 - k2)/2"
     by (rule has_integral_altD[OF assms(2) nonbox,OF e]) blast
   obtain a b :: 'n where ab: "ball 0 B1 \<subseteq> cbox a b" "ball 0 B2 \<subseteq> cbox a b"
     by (metis Un_subset_iff bounded_Un bounded_ball bounded_subset_cbox_symmetric)
   obtain w where w: "(?F has_integral w) (cbox a b)" "norm (w - k1) < norm (k1 - k2)/2"
     using B1(2)[OF ab(1)] by blast
   obtain z where z: "(?F has_integral z) (cbox a b)" "norm (z - k2) < norm (k1 - k2)/2"
     using B2(2)[OF ab(2)] by blast
   have "z = w"
     using has_integral_unique_cbox[OF w(1) z(1)] by auto
   then have "norm (k1 - k2) \<le> norm (z - k2) + norm (w - k1)"
     using norm_triangle_ineq4 [of "k1 - w" "k2 - z"]
     by (auto simp add: norm_minus_commute)
   also have "\<dots> < norm (k1 - k2)/2 + norm (k1 - k2)/2"
     by (metis add_strict_mono z(2) w(2))
   finally show False by auto
 qed
 
 lemma integral_unique [intro]: "(f has_integral y) k \<Longrightarrow> integral k f = y"
   unfolding integral_def
   by (rule some_equality) (auto intro: has_integral_unique)
 
 lemma has_integral_iff: "(f has_integral i) S \<longleftrightarrow> (f integrable_on S \<and> integral S f = i)"
   by blast
 
 lemma eq_integralD: "integral k f = y \<Longrightarrow> (f has_integral y) k \<or> \<not> f integrable_on k \<and> y=0"
   unfolding integral_def integrable_on_def
   apply (erule subst)
   apply (rule someI_ex)
   by blast
 
 lemma has_integral_const [intro]:
   fixes a b :: "'a::euclidean_space"
   shows "((\<lambda>x. c) has_integral (content (cbox a b) *\<^sub>R c)) (cbox a b)"
   using eventually_division_filter_tagged_division[of "cbox a b"]
      additive_content_tagged_division[of _ a b]
   by (auto simp: has_integral_cbox split_beta' scaleR_sum_left[symmetric]
            elim!: eventually_mono intro!: tendsto_cong[THEN iffD1, OF _ tendsto_const])
 
 lemma has_integral_const_real [intro]:
   fixes a b :: real
   shows "((\<lambda>x. c) has_integral (content {a..b} *\<^sub>R c)) {a..b}"
   by (metis box_real(2) has_integral_const)
 
 lemma has_integral_integrable_integral: "(f has_integral i) s \<longleftrightarrow> f integrable_on s \<and> integral s f = i"
   by blast
 
 lemma integral_const [simp]:
   fixes a b :: "'a::euclidean_space"
   shows "integral (cbox a b) (\<lambda>x. c) = content (cbox a b) *\<^sub>R c"
   by (rule integral_unique) (rule has_integral_const)
 
 lemma integral_const_real [simp]:
   fixes a b :: real
   shows "integral {a..b} (\<lambda>x. c) = content {a..b} *\<^sub>R c"
   by (metis box_real(2) integral_const)
 
 lemma has_integral_is_0_cbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "\<And>x. x \<in> cbox a b \<Longrightarrow> f x = 0"
   shows "(f has_integral 0) (cbox a b)"
     unfolding has_integral_cbox
     using eventually_division_filter_tagged_division[of "cbox a b"] assms
     by (subst tendsto_cong[where g="\<lambda>_. 0"])
        (auto elim!: eventually_mono intro!: sum.neutral simp: tag_in_interval)
 
 lemma has_integral_is_0:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "\<And>x. x \<in> S \<Longrightarrow> f x = 0"
   shows "(f has_integral 0) S"
 proof (cases "(\<exists>a b. S = cbox a b)")
   case True with assms has_integral_is_0_cbox show ?thesis
     by blast
 next
   case False
   have *: "(\<lambda>x. if x \<in> S then f x else 0) = (\<lambda>x. 0)"
     by (auto simp add: assms)
   show ?thesis
     using has_integral_is_0_cbox False
     by (subst has_integral_alt) (force simp add: *)
 qed
 
 lemma has_integral_0[simp]: "((\<lambda>x::'n::euclidean_space. 0) has_integral 0) S"
   by (rule has_integral_is_0) auto
 
 lemma has_integral_0_eq[simp]: "((\<lambda>x. 0) has_integral i) S \<longleftrightarrow> i = 0"
   using has_integral_unique[OF has_integral_0] by auto
 
 lemma has_integral_linear_cbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes f: "(f has_integral y) (cbox a b)"
     and h: "bounded_linear h"
   shows "((h \<circ> f) has_integral (h y)) (cbox a b)"
 proof -
   interpret bounded_linear h using h .
   show ?thesis
     unfolding has_integral_cbox using tendsto [OF f [unfolded has_integral_cbox]]
     by (simp add: sum scaleR split_beta')
 qed
 
 lemma has_integral_linear:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes f: "(f has_integral y) S"
     and h: "bounded_linear h"
   shows "((h \<circ> f) has_integral (h y)) S"
 proof (cases "(\<exists>a b. S = cbox a b)")
   case True with f h has_integral_linear_cbox show ?thesis 
     by blast
 next
   case False
   interpret bounded_linear h using h .
   from pos_bounded obtain B where B: "0 < B" "\<And>x. norm (h x) \<le> norm x * B"
     by blast
   let ?S = "\<lambda>f x. if x \<in> S then f x else 0"
   show ?thesis
   proof (subst has_integral_alt, clarsimp simp: False)
     fix e :: real
     assume e: "e > 0"
     have *: "0 < e/B" using e B(1) by simp
     obtain M where M:
       "M > 0"
       "\<And>a b. ball 0 M \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?S f has_integral z) (cbox a b) \<and> norm (z - y) < e/B"
       using has_integral_altD[OF f False *] by blast
     show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       (\<exists>z. (?S(h \<circ> f) has_integral z) (cbox a b) \<and> norm (z - h y) < e)"
     proof (rule exI, intro allI conjI impI)
       show "M > 0" using M by metis
     next
       fix a b::'n
       assume sb: "ball 0 M \<subseteq> cbox a b"
       obtain z where z: "(?S f has_integral z) (cbox a b)" "norm (z - y) < e/B"
         using M(2)[OF sb] by blast
       have *: "?S(h \<circ> f) = h \<circ> ?S f"
         using zero by auto
       show "\<exists>z. (?S(h \<circ> f) has_integral z) (cbox a b) \<and> norm (z - h y) < e"
       proof (intro exI conjI)
         show "(?S(h \<circ> f) has_integral h z) (cbox a b)"
           by (simp add: * has_integral_linear_cbox[OF z(1) h])
         show "norm (h z - h y) < e"
           by (metis B diff le_less_trans pos_less_divide_eq z(2))
       qed
     qed
   qed
 qed
 
 lemma has_integral_scaleR_left:
   "(f has_integral y) S \<Longrightarrow> ((\<lambda>x. f x *\<^sub>R c) has_integral (y *\<^sub>R c)) S"
   using has_integral_linear[OF _ bounded_linear_scaleR_left] by (simp add: comp_def)
 
 lemma integrable_on_scaleR_left:
   assumes "f integrable_on A"
   shows "(\<lambda>x. f x *\<^sub>R y) integrable_on A"
   using assms has_integral_scaleR_left unfolding integrable_on_def by blast
 
 lemma has_integral_mult_left:
   fixes c :: "_ :: real_normed_algebra"
   shows "(f has_integral y) S \<Longrightarrow> ((\<lambda>x. f x * c) has_integral (y * c)) S"
   using has_integral_linear[OF _ bounded_linear_mult_left] by (simp add: comp_def)
 
 lemma has_integral_divide:
   fixes c :: "_ :: real_normed_div_algebra"
   shows "(f has_integral y) S \<Longrightarrow> ((\<lambda>x. f x / c) has_integral (y / c)) S"
   unfolding divide_inverse by (simp add: has_integral_mult_left)
 
 text\<open>The case analysis eliminates the condition \<^term>\<open>f integrable_on S\<close> at the cost
      of the type class constraint \<open>division_ring\<close>\<close>
 corollary integral_mult_left [simp]:
   fixes c:: "'a::{real_normed_algebra,division_ring}"
   shows "integral S (\<lambda>x. f x * c) = integral S f * c"
 proof (cases "f integrable_on S \<or> c = 0")
   case True then show ?thesis
     by (force intro: has_integral_mult_left)
 next
   case False then have "\<not> (\<lambda>x. f x * c) integrable_on S"
     using has_integral_mult_left [of "(\<lambda>x. f x * c)" _ S "inverse c"]
     by (auto simp add: mult.assoc)
   with False show ?thesis by (simp add: not_integrable_integral)
 qed
 
 corollary integral_mult_right [simp]:
   fixes c:: "'a::{real_normed_field}"
   shows "integral S (\<lambda>x. c * f x) = c * integral S f"
 by (simp add: mult.commute [of c])
 
 corollary integral_divide [simp]:
   fixes z :: "'a::real_normed_field"
   shows "integral S (\<lambda>x. f x / z) = integral S (\<lambda>x. f x) / z"
 using integral_mult_left [of S f "inverse z"]
   by (simp add: divide_inverse_commute)
 
 lemma has_integral_mult_right:
   fixes c :: "'a :: real_normed_algebra"
   shows "(f has_integral y) i \<Longrightarrow> ((\<lambda>x. c * f x) has_integral (c * y)) i"
   using has_integral_linear[OF _ bounded_linear_mult_right] by (simp add: comp_def)
 
 lemma has_integral_cmul: "(f has_integral k) S \<Longrightarrow> ((\<lambda>x. c *\<^sub>R f x) has_integral (c *\<^sub>R k)) S"
   unfolding o_def[symmetric]
   by (metis has_integral_linear bounded_linear_scaleR_right)
 
 lemma has_integral_cmult_real:
   fixes c :: real
   assumes "c \<noteq> 0 \<Longrightarrow> (f has_integral x) A"
   shows "((\<lambda>x. c * f x) has_integral c * x) A"
 proof (cases "c = 0")
   case True
   then show ?thesis by simp
 next
   case False
   from has_integral_cmul[OF assms[OF this], of c] show ?thesis
     unfolding real_scaleR_def .
 qed
 
 lemma has_integral_neg: "(f has_integral k) S \<Longrightarrow> ((\<lambda>x. -(f x)) has_integral -k) S"
   by (drule_tac c="-1" in has_integral_cmul) auto
 
 lemma has_integral_neg_iff: "((\<lambda>x. - f x) has_integral k) S \<longleftrightarrow> (f has_integral - k) S"
   using has_integral_neg[of f "- k"] has_integral_neg[of "\<lambda>x. - f x" k] by auto
 
 lemma has_integral_add_cbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral k) (cbox a b)" "(g has_integral l) (cbox a b)"
   shows "((\<lambda>x. f x + g x) has_integral (k + l)) (cbox a b)"
   using assms
     unfolding has_integral_cbox
     by (simp add: split_beta' scaleR_add_right sum.distrib[abs_def] tendsto_add)
 
 lemma has_integral_add:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes f: "(f has_integral k) S" and g: "(g has_integral l) S"
   shows "((\<lambda>x. f x + g x) has_integral (k + l)) S"
 proof (cases "\<exists>a b. S = cbox a b")
   case True with has_integral_add_cbox assms show ?thesis
     by blast 
 next
   let ?S = "\<lambda>f x. if x \<in> S then f x else 0"
   case False
   then show ?thesis
   proof (subst has_integral_alt, clarsimp, goal_cases)
     case (1 e)
     then have e2: "e/2 > 0"
       by auto
     obtain Bf where "0 < Bf"
       and Bf: "\<And>a b. ball 0 Bf \<subseteq> cbox a b \<Longrightarrow>
                      \<exists>z. (?S f has_integral z) (cbox a b) \<and> norm (z - k) < e/2"
       using has_integral_altD[OF f False e2] by blast
     obtain Bg where "0 < Bg"
       and Bg: "\<And>a b. ball 0 Bg \<subseteq> (cbox a b) \<Longrightarrow>
                      \<exists>z. (?S g has_integral z) (cbox a b) \<and> norm (z - l) < e/2"
       using has_integral_altD[OF g False e2] by blast
     show ?case
     proof (rule_tac x="max Bf Bg" in exI, clarsimp simp add: max.strict_coboundedI1 \<open>0 < Bf\<close>)
       fix a b
       assume "ball 0 (max Bf Bg) \<subseteq> cbox a (b::'n)"
       then have fs: "ball 0 Bf \<subseteq> cbox a (b::'n)" and gs: "ball 0 Bg \<subseteq> cbox a (b::'n)"
         by auto
       obtain w where w: "(?S f has_integral w) (cbox a b)" "norm (w - k) < e/2"
         using Bf[OF fs] by blast
       obtain z where z: "(?S g has_integral z) (cbox a b)" "norm (z - l) < e/2"
         using Bg[OF gs] by blast
       have *: "\<And>x. (if x \<in> S then f x + g x else 0) = (?S f x) + (?S g x)"
         by auto
       show "\<exists>z. (?S(\<lambda>x. f x + g x) has_integral z) (cbox a b) \<and> norm (z - (k + l)) < e"
       proof (intro exI conjI)
         show "(?S(\<lambda>x. f x + g x) has_integral (w + z)) (cbox a b)"
           by (simp add: has_integral_add_cbox[OF w(1) z(1), unfolded *[symmetric]])
         show "norm (w + z - (k + l)) < e"
           by (metis dist_norm dist_triangle_add_half w(2) z(2))
       qed
     qed
   qed
 qed
 
 lemma has_integral_diff:
   "(f has_integral k) S \<Longrightarrow> (g has_integral l) S \<Longrightarrow>
     ((\<lambda>x. f x - g x) has_integral (k - l)) S"
   using has_integral_add[OF _ has_integral_neg, of f k S g l]
   by (auto simp: algebra_simps)
 
 lemma integral_0 [simp]:
   "integral S (\<lambda>x::'n::euclidean_space. 0::'m::real_normed_vector) = 0"
   by (rule integral_unique has_integral_0)+
 
 lemma integral_add: "f integrable_on S \<Longrightarrow> g integrable_on S \<Longrightarrow>
     integral S (\<lambda>x. f x + g x) = integral S f + integral S g"
   by (rule integral_unique) (metis integrable_integral has_integral_add)
 
 lemma integral_cmul [simp]: "integral S (\<lambda>x. c *\<^sub>R f x) = c *\<^sub>R integral S f"
 proof (cases "f integrable_on S \<or> c = 0")
   case True with has_integral_cmul integrable_integral show ?thesis
     by fastforce
 next
   case False then have "\<not> (\<lambda>x. c *\<^sub>R f x) integrable_on S"
     using has_integral_cmul [of "(\<lambda>x. c *\<^sub>R f x)" _ S "inverse c"] by auto
   with False show ?thesis by (simp add: not_integrable_integral)
 qed
 
 lemma integral_mult:
   fixes K::real
   shows "f integrable_on X \<Longrightarrow> K * integral X f = integral X (\<lambda>x. K * f x)"
   unfolding real_scaleR_def[symmetric] integral_cmul ..
 
 lemma integral_neg [simp]: "integral S (\<lambda>x. - f x) = - integral S f"
 proof (cases "f integrable_on S")
   case True then show ?thesis
     by (simp add: has_integral_neg integrable_integral integral_unique)
 next
   case False then have "\<not> (\<lambda>x. - f x) integrable_on S"
     using has_integral_neg [of "(\<lambda>x. - f x)" _ S ] by auto
   with False show ?thesis by (simp add: not_integrable_integral)
 qed
 
 lemma integral_diff: "f integrable_on S \<Longrightarrow> g integrable_on S \<Longrightarrow>
     integral S (\<lambda>x. f x - g x) = integral S f - integral S g"
   by (rule integral_unique) (metis integrable_integral has_integral_diff)
 
 lemma integrable_0: "(\<lambda>x. 0) integrable_on S"
   unfolding integrable_on_def using has_integral_0 by auto
 
 lemma integrable_add: "f integrable_on S \<Longrightarrow> g integrable_on S \<Longrightarrow> (\<lambda>x. f x + g x) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_add)
 
 lemma integrable_cmul: "f integrable_on S \<Longrightarrow> (\<lambda>x. c *\<^sub>R f(x)) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_cmul)
 
 lemma integrable_on_scaleR_iff [simp]:
   fixes c :: real
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. c *\<^sub>R f x) integrable_on S \<longleftrightarrow> f integrable_on S"
   using integrable_cmul[of "\<lambda>x. c *\<^sub>R f x" S "1 / c"] integrable_cmul[of f S c] \<open>c \<noteq> 0\<close>
   by auto
 
 lemma integrable_on_cmult_iff [simp]:
   fixes c :: real
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. c * f x) integrable_on S \<longleftrightarrow> f integrable_on S"
   using integrable_on_scaleR_iff [of c f] assms by simp
 
 lemma integrable_on_cmult_left:
   assumes "f integrable_on S"
   shows "(\<lambda>x. of_real c * f x) integrable_on S"
     using integrable_cmul[of f S "of_real c"] assms
     by (simp add: scaleR_conv_of_real)
 
 lemma integrable_neg: "f integrable_on S \<Longrightarrow> (\<lambda>x. -f(x)) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_neg)
 
 lemma integrable_neg_iff: "(\<lambda>x. -f(x)) integrable_on S \<longleftrightarrow> f integrable_on S"
   using integrable_neg by fastforce
 
 lemma integrable_diff:
   "f integrable_on S \<Longrightarrow> g integrable_on S \<Longrightarrow> (\<lambda>x. f x - g x) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_diff)
 
 lemma integrable_linear:
   "f integrable_on S \<Longrightarrow> bounded_linear h \<Longrightarrow> (h \<circ> f) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_linear)
 
 lemma integral_linear:
   "f integrable_on S \<Longrightarrow> bounded_linear h \<Longrightarrow> integral S (h \<circ> f) = h (integral S f)"
   by (meson has_integral_iff has_integral_linear)
 
 lemma integrable_on_cnj_iff:
   "(\<lambda>x. cnj (f x)) integrable_on A \<longleftrightarrow> f integrable_on A"
   using integrable_linear[OF _ bounded_linear_cnj, of f A]
         integrable_linear[OF _ bounded_linear_cnj, of "cnj \<circ> f" A]
   by (auto simp: o_def)
 
 lemma integral_cnj: "cnj (integral A f) = integral A (\<lambda>x. cnj (f x))"
   by (cases "f integrable_on A")
      (simp_all add: integral_linear[OF _ bounded_linear_cnj, symmetric]
                     o_def integrable_on_cnj_iff not_integrable_integral)
 
 lemma integral_component_eq[simp]:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "f integrable_on S"
   shows "integral S (\<lambda>x. f x \<bullet> k) = integral S f \<bullet> k"
   unfolding integral_linear[OF assms(1) bounded_linear_inner_left,unfolded o_def] ..
 
 lemma has_integral_sum:
   assumes "finite T"
     and "\<And>a. a \<in> T \<Longrightarrow> ((f a) has_integral (i a)) S"
   shows "((\<lambda>x. sum (\<lambda>a. f a x) T) has_integral (sum i T)) S"
   using assms(1) subset_refl[of T]
 proof (induct rule: finite_subset_induct)
   case empty
   then show ?case by auto
 next
   case (insert x F)
   with assms show ?case
     by (simp add: has_integral_add)
 qed
 
 lemma integral_sum:
   "\<lbrakk>finite I;  \<And>a. a \<in> I \<Longrightarrow> f a integrable_on S\<rbrakk> \<Longrightarrow>
    integral S (\<lambda>x. \<Sum>a\<in>I. f a x) = (\<Sum>a\<in>I. integral S (f a))"
   by (simp add: has_integral_sum integrable_integral integral_unique)
 
 lemma integrable_sum:
   "\<lbrakk>finite I;  \<And>a. a \<in> I \<Longrightarrow> f a integrable_on S\<rbrakk> \<Longrightarrow> (\<lambda>x. \<Sum>a\<in>I. f a x) integrable_on S"
   unfolding integrable_on_def using has_integral_sum[of I] by metis
 
 lemma has_integral_eq:
   assumes "\<And>x. x \<in> s \<Longrightarrow> f x = g x"
     and "(f has_integral k) s"
   shows "(g has_integral k) s"
   using has_integral_diff[OF assms(2), of "\<lambda>x. f x - g x" 0]
   using has_integral_is_0[of s "\<lambda>x. f x - g x"]
   using assms(1)
   by auto
 
 lemma integrable_eq: "\<lbrakk>f integrable_on s; \<And>x. x \<in> s \<Longrightarrow> f x = g x\<rbrakk> \<Longrightarrow> g integrable_on s"
   unfolding integrable_on_def
   using has_integral_eq[of s f g] has_integral_eq by blast
 
 lemma has_integral_cong:
   assumes "\<And>x. x \<in> s \<Longrightarrow> f x = g x"
   shows "(f has_integral i) s = (g has_integral i) s"
   using has_integral_eq[of s f g] has_integral_eq[of s g f] assms
   by auto
 
 lemma integral_cong:
   assumes "\<And>x. x \<in> s \<Longrightarrow> f x = g x"
   shows "integral s f = integral s g"
   unfolding integral_def
 by (metis (full_types, hide_lams) assms has_integral_cong integrable_eq)
 
 lemma integrable_on_cmult_left_iff [simp]:
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. of_real c * f x) integrable_on s \<longleftrightarrow> f integrable_on s"
         (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then have "(\<lambda>x. of_real (1 / c) * (of_real c * f x)) integrable_on s"
     using integrable_cmul[of "\<lambda>x. of_real c * f x" s "1 / of_real c"]
     by (simp add: scaleR_conv_of_real)
   then have "(\<lambda>x. (of_real (1 / c) * of_real c * f x)) integrable_on s"
     by (simp add: algebra_simps)
   with \<open>c \<noteq> 0\<close> show ?rhs
     by (metis (no_types, lifting) integrable_eq mult.left_neutral nonzero_divide_eq_eq of_real_1 of_real_mult)
 qed (blast intro: integrable_on_cmult_left)
 
 lemma integrable_on_cmult_right:
   fixes f :: "_ \<Rightarrow> 'b :: {comm_ring,real_algebra_1,real_normed_vector}"
   assumes "f integrable_on s"
   shows "(\<lambda>x. f x * of_real c) integrable_on s"
 using integrable_on_cmult_left [OF assms] by (simp add: mult.commute)
 
 lemma integrable_on_cmult_right_iff [simp]:
   fixes f :: "_ \<Rightarrow> 'b :: {comm_ring,real_algebra_1,real_normed_vector}"
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. f x * of_real c) integrable_on s \<longleftrightarrow> f integrable_on s"
 using integrable_on_cmult_left_iff [OF assms] by (simp add: mult.commute)
 
 lemma integrable_on_cdivide:
   fixes f :: "_ \<Rightarrow> 'b :: real_normed_field"
   assumes "f integrable_on s"
   shows "(\<lambda>x. f x / of_real c) integrable_on s"
 by (simp add: integrable_on_cmult_right divide_inverse assms flip: of_real_inverse)
 
 lemma integrable_on_cdivide_iff [simp]:
   fixes f :: "_ \<Rightarrow> 'b :: real_normed_field"
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. f x / of_real c) integrable_on s \<longleftrightarrow> f integrable_on s"
 by (simp add: divide_inverse assms flip: of_real_inverse)
 
 lemma has_integral_null [intro]: "content(cbox a b) = 0 \<Longrightarrow> (f has_integral 0) (cbox a b)"
   unfolding has_integral_cbox
   using eventually_division_filter_tagged_division[of "cbox a b"]
   by (subst tendsto_cong[where g="\<lambda>_. 0"]) (auto elim: eventually_mono intro: sum_content_null)
 
 lemma has_integral_null_real [intro]: "content {a..b::real} = 0 \<Longrightarrow> (f has_integral 0) {a..b}"
   by (metis box_real(2) has_integral_null)
 
 lemma has_integral_null_eq[simp]: "content (cbox a b) = 0 \<Longrightarrow> (f has_integral i) (cbox a b) \<longleftrightarrow> i = 0"
   by (auto simp add: has_integral_null dest!: integral_unique)
 
 lemma integral_null [simp]: "content (cbox a b) = 0 \<Longrightarrow> integral (cbox a b) f = 0"
   by (metis has_integral_null integral_unique)
 
 lemma integrable_on_null [intro]: "content (cbox a b) = 0 \<Longrightarrow> f integrable_on (cbox a b)"
   by (simp add: has_integral_integrable)
 
 lemma has_integral_empty[intro]: "(f has_integral 0) {}"
   by (meson ex_in_conv has_integral_is_0)
 
 lemma has_integral_empty_eq[simp]: "(f has_integral i) {} \<longleftrightarrow> i = 0"
   by (auto simp add: has_integral_empty has_integral_unique)
 
 lemma integrable_on_empty[intro]: "f integrable_on {}"
   unfolding integrable_on_def by auto
 
 lemma integral_empty[simp]: "integral {} f = 0"
   by (rule integral_unique) (rule has_integral_empty)
 
 lemma has_integral_refl[intro]:
   fixes a :: "'a::euclidean_space"
   shows "(f has_integral 0) (cbox a a)"
     and "(f has_integral 0) {a}"
 proof -
   show "(f has_integral 0) (cbox a a)"
      by (rule has_integral_null) simp
   then show "(f has_integral 0) {a}"
     by simp
 qed
 
 lemma integrable_on_refl[intro]: "f integrable_on cbox a a"
   unfolding integrable_on_def by auto
 
 lemma integral_refl [simp]: "integral (cbox a a) f = 0"
   by (rule integral_unique) auto
 
 lemma integral_singleton [simp]: "integral {a} f = 0"
   by auto
 
 lemma integral_blinfun_apply:
   assumes "f integrable_on s"
   shows "integral s (\<lambda>x. blinfun_apply h (f x)) = blinfun_apply h (integral s f)"
   by (subst integral_linear[symmetric, OF assms blinfun.bounded_linear_right]) (simp add: o_def)
 
 lemma blinfun_apply_integral:
   assumes "f integrable_on s"
   shows "blinfun_apply (integral s f) x = integral s (\<lambda>y. blinfun_apply (f y) x)"
   by (metis (no_types, lifting) assms blinfun.prod_left.rep_eq integral_blinfun_apply integral_cong)
 
 lemma has_integral_componentwise_iff:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "(f has_integral y) A \<longleftrightarrow> (\<forall>b\<in>Basis. ((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A)"
 proof safe
   fix b :: 'b assume "(f has_integral y) A"
   from has_integral_linear[OF this(1) bounded_linear_inner_left, of b]
     show "((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A" by (simp add: o_def)
 next
   assume "(\<forall>b\<in>Basis. ((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A)"
   hence "\<forall>b\<in>Basis. (((\<lambda>x. x *\<^sub>R b) \<circ> (\<lambda>x. f x \<bullet> b)) has_integral ((y \<bullet> b) *\<^sub>R b)) A"
     by (intro ballI has_integral_linear) (simp_all add: bounded_linear_scaleR_left)
   hence "((\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) has_integral (\<Sum>b\<in>Basis. (y \<bullet> b) *\<^sub>R b)) A"
     by (intro has_integral_sum) (simp_all add: o_def)
   thus "(f has_integral y) A" by (simp add: euclidean_representation)
 qed
 
 lemma has_integral_componentwise:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "(\<And>b. b \<in> Basis \<Longrightarrow> ((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A) \<Longrightarrow> (f has_integral y) A"
   by (subst has_integral_componentwise_iff) blast
 
 lemma integrable_componentwise_iff:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "f integrable_on A \<longleftrightarrow> (\<forall>b\<in>Basis. (\<lambda>x. f x \<bullet> b) integrable_on A)"
 proof
   assume "f integrable_on A"
   then obtain y where "(f has_integral y) A" by (auto simp: integrable_on_def)
   hence "(\<forall>b\<in>Basis. ((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A)"
     by (subst (asm) has_integral_componentwise_iff)
   thus "(\<forall>b\<in>Basis. (\<lambda>x. f x \<bullet> b) integrable_on A)" by (auto simp: integrable_on_def)
 next
   assume "(\<forall>b\<in>Basis. (\<lambda>x. f x \<bullet> b) integrable_on A)"
   then obtain y where "\<forall>b\<in>Basis. ((\<lambda>x. f x \<bullet> b) has_integral y b) A"
     unfolding integrable_on_def by (subst (asm) bchoice_iff) blast
   hence "\<forall>b\<in>Basis. (((\<lambda>x. x *\<^sub>R b) \<circ> (\<lambda>x. f x \<bullet> b)) has_integral (y b *\<^sub>R b)) A"
     by (intro ballI has_integral_linear) (simp_all add: bounded_linear_scaleR_left)
   hence "((\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) has_integral (\<Sum>b\<in>Basis. y b *\<^sub>R b)) A"
     by (intro has_integral_sum) (simp_all add: o_def)
   thus "f integrable_on A" by (auto simp: integrable_on_def o_def euclidean_representation)
 qed
 
 lemma integrable_componentwise:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "(\<And>b. b \<in> Basis \<Longrightarrow> (\<lambda>x. f x \<bullet> b) integrable_on A) \<Longrightarrow> f integrable_on A"
   by (subst integrable_componentwise_iff) blast
 
 lemma integral_componentwise:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes "f integrable_on A"
   shows "integral A f = (\<Sum>b\<in>Basis. integral A (\<lambda>x. (f x \<bullet> b) *\<^sub>R b))"
 proof -
   from assms have integrable: "\<forall>b\<in>Basis. (\<lambda>x. x *\<^sub>R b) \<circ> (\<lambda>x. (f x \<bullet> b)) integrable_on A"
     by (subst (asm) integrable_componentwise_iff, intro integrable_linear ballI)
        (simp_all add: bounded_linear_scaleR_left)
   have "integral A f = integral A (\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b)"
     by (simp add: euclidean_representation)
   also from integrable have "\<dots> = (\<Sum>a\<in>Basis. integral A (\<lambda>x. (f x \<bullet> a) *\<^sub>R a))"
     by (subst integral_sum) (simp_all add: o_def)
   finally show ?thesis .
 qed
 
 lemma integrable_component:
   "f integrable_on A \<Longrightarrow> (\<lambda>x. f x \<bullet> (y :: 'b :: euclidean_space)) integrable_on A"
   by (drule integrable_linear[OF _ bounded_linear_inner_left[of y]]) (simp add: o_def)
 
 
 
 subsection \<open>Cauchy-type criterion for integrability\<close>
 
 proposition integrable_Cauchy:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::{real_normed_vector,complete_space}"
   shows "f integrable_on cbox a b \<longleftrightarrow>
         (\<forall>e>0. \<exists>\<gamma>. gauge \<gamma> \<and>
           (\<forall>\<D>1 \<D>2. \<D>1 tagged_division_of (cbox a b) \<and> \<gamma> fine \<D>1 \<and>
             \<D>2 tagged_division_of (cbox a b) \<and> \<gamma> fine \<D>2 \<longrightarrow>
             norm ((\<Sum>(x,K)\<in>\<D>1. content K *\<^sub>R f x) - (\<Sum>(x,K)\<in>\<D>2. content K *\<^sub>R f x)) < e))"
   (is "?l = (\<forall>e>0. \<exists>\<gamma>. ?P e \<gamma>)")
 proof (intro iffI allI impI)
   assume ?l
   then obtain y
     where y: "\<And>e. e > 0 \<Longrightarrow>
         \<exists>\<gamma>. gauge \<gamma> \<and>
             (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                  norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - y) < e)"
     by (auto simp: integrable_on_def has_integral)
   show "\<exists>\<gamma>. ?P e \<gamma>" if "e > 0" for e
   proof -
     have "e/2 > 0" using that by auto
     with y obtain \<gamma> where "gauge \<gamma>"
       and \<gamma>: "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<Longrightarrow>
                   norm ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f x) - y) < e/2"
       by meson
     show ?thesis
     apply (rule_tac x=\<gamma> in exI, clarsimp simp: \<open>gauge \<gamma>\<close>)
         by (blast intro!: \<gamma> dist_triangle_half_l[where y=y,unfolded dist_norm])
     qed
 next
   assume "\<forall>e>0. \<exists>\<gamma>. ?P e \<gamma>"
   then have "\<forall>n::nat. \<exists>\<gamma>. ?P (1 / (n + 1)) \<gamma>"
     by auto
   then obtain \<gamma> :: "nat \<Rightarrow> 'n \<Rightarrow> 'n set" where \<gamma>:
     "\<And>m. gauge (\<gamma> m)"
     "\<And>m \<D>1 \<D>2. \<lbrakk>\<D>1 tagged_division_of cbox a b;
               \<gamma> m fine \<D>1; \<D>2 tagged_division_of cbox a b; \<gamma> m fine \<D>2\<rbrakk>
               \<Longrightarrow> norm ((\<Sum>(x,K) \<in> \<D>1. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> \<D>2. content K *\<^sub>R f x))
                   < 1 / (m + 1)"
     by metis
   have "gauge (\<lambda>x. \<Inter>{\<gamma> i x |i. i \<in> {0..n}})" for n
     using \<gamma> by (intro gauge_Inter) auto
   then have "\<forall>n. \<exists>p. p tagged_division_of (cbox a b) \<and> (\<lambda>x. \<Inter>{\<gamma> i x |i. i \<in> {0..n}}) fine p"
     by (meson fine_division_exists)
   then obtain p where p: "\<And>z. p z tagged_division_of cbox a b"
                          "\<And>z. (\<lambda>x. \<Inter>{\<gamma> i x |i. i \<in> {0..z}}) fine p z"
     by meson
   have dp: "\<And>i n. i\<le>n \<Longrightarrow> \<gamma> i fine p n"
     using p unfolding fine_Inter
     using atLeastAtMost_iff by blast
   have "Cauchy (\<lambda>n. sum (\<lambda>(x,K). content K *\<^sub>R (f x)) (p n))"
   proof (rule CauchyI)
     fix e::real
     assume "0 < e"
     then obtain N where "N \<noteq> 0" and N: "inverse (real N) < e"
       using real_arch_inverse[of e] by blast
     show "\<exists>M. \<forall>m\<ge>M. \<forall>n\<ge>M. norm ((\<Sum>(x,K) \<in> p m. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x)) < e"
     proof (intro exI allI impI)
       fix m n
       assume mn: "N \<le> m" "N \<le> n"
       have "norm ((\<Sum>(x,K) \<in> p m. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x)) < 1 / (real N + 1)"
         by (simp add: p(1) dp mn \<gamma>)
       also have "... < e"
         using  N \<open>N \<noteq> 0\<close> \<open>0 < e\<close> by (auto simp: field_simps)
       finally show "norm ((\<Sum>(x,K) \<in> p m. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x)) < e" .
     qed
   qed
   then obtain y where y: "\<exists>no. \<forall>n\<ge>no. norm ((\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x) - y) < r" if "r > 0" for r
     by (auto simp: convergent_eq_Cauchy[symmetric] dest: LIMSEQ_D)
   show ?l
     unfolding integrable_on_def has_integral
   proof (rule_tac x=y in exI, clarify)
     fix e :: real
     assume "e>0"
     then have e2: "e/2 > 0" by auto
     then obtain N1::nat where N1: "N1 \<noteq> 0" "inverse (real N1) < e/2"
       using real_arch_inverse by blast
     obtain N2::nat where N2: "\<And>n. n \<ge> N2 \<Longrightarrow> norm ((\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x) - y) < e/2"
       using y[OF e2] by metis
     show "\<exists>\<gamma>. gauge \<gamma> \<and>
               (\<forall>\<D>. \<D> tagged_division_of (cbox a b) \<and> \<gamma> fine \<D> \<longrightarrow>
                 norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - y) < e)"
     proof (intro exI conjI allI impI)
       show "gauge (\<gamma> (N1+N2))"
         using \<gamma> by auto
       show "norm ((\<Sum>(x,K) \<in> q. content K *\<^sub>R f x) - y) < e"
            if "q tagged_division_of cbox a b \<and> \<gamma> (N1+N2) fine q" for q
       proof (rule norm_triangle_half_r)
         have "norm ((\<Sum>(x,K) \<in> p (N1+N2). content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> q. content K *\<^sub>R f x))
                < 1 / (real (N1+N2) + 1)"
           by (rule \<gamma>; simp add: dp p that)
         also have "... < e/2"
           using N1 \<open>0 < e\<close> by (auto simp: field_simps intro: less_le_trans)
         finally show "norm ((\<Sum>(x,K) \<in> p (N1+N2). content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> q. content K *\<^sub>R f x)) < e/2" .
         show "norm ((\<Sum>(x,K) \<in> p (N1+N2). content K *\<^sub>R f x) - y) < e/2"
           using N2 le_add_same_cancel2 by blast
       qed
     qed
   qed
 qed
 
 
 subsection \<open>Additivity of integral on abutting intervals\<close>
 
 lemma tagged_division_split_left_inj_content:
   assumes \<D>: "\<D> tagged_division_of S"
     and "(x1, K1) \<in> \<D>" "(x2, K2) \<in> \<D>" "K1 \<noteq> K2" "K1 \<inter> {x. x\<bullet>k \<le> c} = K2 \<inter> {x. x\<bullet>k \<le> c}" "k \<in> Basis"
   shows "content (K1 \<inter> {x. x\<bullet>k \<le> c}) = 0"
 proof -
   from tagged_division_ofD(4)[OF \<D> \<open>(x1, K1) \<in> \<D>\<close>] obtain a b where K1: "K1 = cbox a b"
     by auto
   then have "interior (K1 \<inter> {x. x \<bullet> k \<le> c}) = {}"
     by (metis tagged_division_split_left_inj assms)
   then show ?thesis
     unfolding K1 interval_split[OF \<open>k \<in> Basis\<close>] by (auto simp: content_eq_0_interior)
 qed
 
 lemma tagged_division_split_right_inj_content:
   assumes \<D>: "\<D> tagged_division_of S"
     and "(x1, K1) \<in> \<D>" "(x2, K2) \<in> \<D>" "K1 \<noteq> K2" "K1 \<inter> {x. x\<bullet>k \<ge> c} = K2 \<inter> {x. x\<bullet>k \<ge> c}" "k \<in> Basis"
   shows "content (K1 \<inter> {x. x\<bullet>k \<ge> c}) = 0"
 proof -
   from tagged_division_ofD(4)[OF \<D> \<open>(x1, K1) \<in> \<D>\<close>] obtain a b where K1: "K1 = cbox a b"
     by auto
   then have "interior (K1 \<inter> {x. c \<le> x \<bullet> k}) = {}"
     by (metis tagged_division_split_right_inj assms)
   then show ?thesis
     unfolding K1 interval_split[OF \<open>k \<in> Basis\<close>]
     by (auto simp: content_eq_0_interior)
 qed
 
 
 proposition has_integral_split:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes fi: "(f has_integral i) (cbox a b \<inter> {x. x\<bullet>k \<le> c})"
       and fj: "(f has_integral j) (cbox a b \<inter> {x. x\<bullet>k \<ge> c})"
       and k: "k \<in> Basis"
 shows "(f has_integral (i + j)) (cbox a b)"
   unfolding has_integral
 proof clarify
   fix e::real
   assume "0 < e"
   then have e: "e/2 > 0"
     by auto
     obtain \<gamma>1 where \<gamma>1: "gauge \<gamma>1"
       and \<gamma>1norm:
         "\<And>\<D>. \<lbrakk>\<D> tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c}; \<gamma>1 fine \<D>\<rbrakk>
              \<Longrightarrow> norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - i) < e/2"
        apply (rule has_integralD[OF fi[unfolded interval_split[OF k]] e])
        apply (simp add: interval_split[symmetric] k)
       done
     obtain \<gamma>2 where \<gamma>2: "gauge \<gamma>2"
       and \<gamma>2norm:
         "\<And>\<D>. \<lbrakk>\<D> tagged_division_of cbox a b \<inter> {x. c \<le> x \<bullet> k}; \<gamma>2 fine \<D>\<rbrakk>
              \<Longrightarrow> norm ((\<Sum>(x, k) \<in> \<D>. content k *\<^sub>R f x) - j) < e/2"
        apply (rule has_integralD[OF fj[unfolded interval_split[OF k]] e])
        apply (simp add: interval_split[symmetric] k)
        done
   let ?\<gamma> = "\<lambda>x. if x\<bullet>k = c then (\<gamma>1 x \<inter> \<gamma>2 x) else ball x \<bar>x\<bullet>k - c\<bar> \<inter> \<gamma>1 x \<inter> \<gamma>2 x"
   have "gauge ?\<gamma>"
     using \<gamma>1 \<gamma>2 unfolding gauge_def by auto
   then show "\<exists>\<gamma>. gauge \<gamma> \<and>
                  (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                       norm ((\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R f x) - (i + j)) < e)"
   proof (rule_tac x="?\<gamma>" in exI, safe)
     fix p
     assume p: "p tagged_division_of (cbox a b)" and "?\<gamma> fine p"
     have ab_eqp: "cbox a b = \<Union>{K. \<exists>x. (x, K) \<in> p}"
       using p by blast
     have xk_le_c: "x\<bullet>k \<le> c" if as: "(x,K) \<in> p" and K: "K \<inter> {x. x\<bullet>k \<le> c} \<noteq> {}" for x K
     proof (rule ccontr)
       assume **: "\<not> x \<bullet> k \<le> c"
       then have "K \<subseteq> ball x \<bar>x \<bullet> k - c\<bar>"
         using \<open>?\<gamma> fine p\<close> as by (fastforce simp: not_le algebra_simps)
       with K obtain y where y: "y \<in> ball x \<bar>x \<bullet> k - c\<bar>" "y\<bullet>k \<le> c"
         by blast
       then have "\<bar>x \<bullet> k - y \<bullet> k\<bar> < \<bar>x \<bullet> k - c\<bar>"
         using Basis_le_norm[OF k, of "x - y"]
         by (auto simp add: dist_norm inner_diff_left intro: le_less_trans)
       with y show False
         using ** by (auto simp add: field_simps)
     qed
     have xk_ge_c: "x\<bullet>k \<ge> c" if as: "(x,K) \<in> p" and K: "K \<inter> {x. x\<bullet>k \<ge> c} \<noteq> {}" for x K
     proof (rule ccontr)
       assume **: "\<not> x \<bullet> k \<ge> c"
       then have "K \<subseteq> ball x \<bar>x \<bullet> k - c\<bar>"
         using \<open>?\<gamma> fine p\<close> as by (fastforce simp: not_le algebra_simps)
       with K obtain y where y: "y \<in> ball x \<bar>x \<bullet> k - c\<bar>" "y\<bullet>k \<ge> c"
         by blast
       then have "\<bar>x \<bullet> k - y \<bullet> k\<bar> < \<bar>x \<bullet> k - c\<bar>"
         using Basis_le_norm[OF k, of "x - y"]
         by (auto simp add: dist_norm inner_diff_left intro: le_less_trans)
       with y show False
         using ** by (auto simp add: field_simps)
     qed
     have fin_finite: "finite {(x,f K) | x K. (x,K) \<in> s \<and> P x K}"
       if "finite s" for s and f :: "'a set \<Rightarrow> 'a set" and P :: "'a \<Rightarrow> 'a set \<Rightarrow> bool"
     proof -
       from that have "finite ((\<lambda>(x,K). (x, f K)) ` s)"
         by auto
       then show ?thesis
         by (rule rev_finite_subset) auto
     qed
     { fix \<G> :: "'a set \<Rightarrow> 'a set"
       fix i :: "'a \<times> 'a set"
       assume "i \<in> (\<lambda>(x, k). (x, \<G> k)) ` p - {(x, \<G> k) |x k. (x, k) \<in> p \<and> \<G> k \<noteq> {}}"
       then obtain x K where xk: "i = (x, \<G> K)"  "(x,K) \<in> p"
                                  "(x, \<G> K) \<notin> {(x, \<G> K) |x K. (x,K) \<in> p \<and> \<G> K \<noteq> {}}"
         by auto
       have "content (\<G> K) = 0"
         using xk using content_empty by auto
       then have "(\<lambda>(x,K). content K *\<^sub>R f x) i = 0"
         unfolding xk split_conv by auto
     } note [simp] = this
     have "finite p"
       using p by blast
     let ?M1 = "{(x, K \<inter> {x. x\<bullet>k \<le> c}) |x K. (x,K) \<in> p \<and> K \<inter> {x. x\<bullet>k \<le> c} \<noteq> {}}"
     have \<gamma>1_fine: "\<gamma>1 fine ?M1"
       using \<open>?\<gamma> fine p\<close> by (fastforce simp: fine_def split: if_split_asm)
     have "norm ((\<Sum>(x, k)\<in>?M1. content k *\<^sub>R f x) - i) < e/2"
     proof (rule \<gamma>1norm [OF tagged_division_ofI \<gamma>1_fine])
       show "finite ?M1"
         by (rule fin_finite) (use p in blast)
       show "\<Union>{k. \<exists>x. (x, k) \<in> ?M1} = cbox a b \<inter> {x. x\<bullet>k \<le> c}"
         by (auto simp: ab_eqp)
 
       fix x L
       assume xL: "(x, L) \<in> ?M1"
       then obtain x' L' where xL': "x = x'" "L = L' \<inter> {x. x \<bullet> k \<le> c}"
                                    "(x', L') \<in> p" "L' \<inter> {x. x \<bullet> k \<le> c} \<noteq> {}"
         by blast
       then obtain a' b' where ab': "L' = cbox a' b'"
         using p by blast
       show "x \<in> L" "L \<subseteq> cbox a b \<inter> {x. x \<bullet> k \<le> c}"
         using p xk_le_c xL' by auto
       show "\<exists>a b. L = cbox a b"
         using p xL' ab' by (auto simp add: interval_split[OF k,where c=c])
 
       fix y R
       assume yR: "(y, R) \<in> ?M1"
       then obtain y' R' where yR': "y = y'" "R = R' \<inter> {x. x \<bullet> k \<le> c}"
                                    "(y', R') \<in> p" "R' \<inter> {x. x \<bullet> k \<le> c} \<noteq> {}"
         by blast
       assume as: "(x, L) \<noteq> (y, R)"
       show "interior L \<inter> interior R = {}"
       proof (cases "L' = R' \<longrightarrow> x' = y'")
         case False
         have "interior R' = {}"
           by (metis (no_types) False Pair_inject inf.idem tagged_division_ofD(5) [OF p] xL'(3) yR'(3))
         then show ?thesis
           using yR' by simp
       next
         case True
         then have "L' \<noteq> R'"
           using as unfolding xL' yR' by auto
         have "interior L' \<inter> interior R' = {}"
           by (metis (no_types) Pair_inject \<open>L' \<noteq> R'\<close> p tagged_division_ofD(5) xL'(3) yR'(3))
         then show ?thesis
           using xL'(2) yR'(2) by auto
       qed
     qed
     moreover
     let ?M2 = "{(x,K \<inter> {x. x\<bullet>k \<ge> c}) |x K. (x,K) \<in> p \<and> K \<inter> {x. x\<bullet>k \<ge> c} \<noteq> {}}"
     have \<gamma>2_fine: "\<gamma>2 fine ?M2"
       using \<open>?\<gamma> fine p\<close> by (fastforce simp: fine_def split: if_split_asm)
     have "norm ((\<Sum>(x, k)\<in>?M2. content k *\<^sub>R f x) - j) < e/2"
     proof (rule \<gamma>2norm [OF tagged_division_ofI \<gamma>2_fine])
       show "finite ?M2"
         by (rule fin_finite) (use p in blast)
       show "\<Union>{k. \<exists>x. (x, k) \<in> ?M2} = cbox a b \<inter> {x. x\<bullet>k \<ge> c}"
         by (auto simp: ab_eqp)
 
       fix x L
       assume xL: "(x, L) \<in> ?M2"
       then obtain x' L' where xL': "x = x'" "L = L' \<inter> {x. x \<bullet> k \<ge> c}"
                                    "(x', L') \<in> p" "L' \<inter> {x. x \<bullet> k \<ge> c} \<noteq> {}"
         by blast
       then obtain a' b' where ab': "L' = cbox a' b'"
         using p by blast
       show "x \<in> L" "L \<subseteq> cbox a b \<inter> {x. x \<bullet> k \<ge> c}"
         using p xk_ge_c xL' by auto
       show "\<exists>a b. L = cbox a b"
         using p xL' ab' by (auto simp add: interval_split[OF k,where c=c])
 
       fix y R
       assume yR: "(y, R) \<in> ?M2"
       then obtain y' R' where yR': "y = y'" "R = R' \<inter> {x. x \<bullet> k \<ge> c}"
                                    "(y', R') \<in> p" "R' \<inter> {x. x \<bullet> k \<ge> c} \<noteq> {}"
         by blast
       assume as: "(x, L) \<noteq> (y, R)"
       show "interior L \<inter> interior R = {}"
       proof (cases "L' = R' \<longrightarrow> x' = y'")
         case False
         have "interior R' = {}"
           by (metis (no_types) False Pair_inject inf.idem tagged_division_ofD(5) [OF p] xL'(3) yR'(3))
         then show ?thesis
           using yR' by simp
       next
         case True
         then have "L' \<noteq> R'"
           using as unfolding xL' yR' by auto
         have "interior L' \<inter> interior R' = {}"
           by (metis (no_types) Pair_inject \<open>L' \<noteq> R'\<close> p tagged_division_ofD(5) xL'(3) yR'(3))
         then show ?thesis
           using xL'(2) yR'(2) by auto
       qed
     qed
     ultimately
     have "norm (((\<Sum>(x,K) \<in> ?M1. content K *\<^sub>R f x) - i) + ((\<Sum>(x,K) \<in> ?M2. content K *\<^sub>R f x) - j)) < e/2 + e/2"
       using norm_add_less by blast
     moreover have "((\<Sum>(x,K) \<in> ?M1. content K *\<^sub>R f x) - i) +
                    ((\<Sum>(x,K) \<in> ?M2. content K *\<^sub>R f x) - j) =
                    (\<Sum>(x, ka)\<in>p. content ka *\<^sub>R f x) - (i + j)"
     proof -
       have eq0: "\<And>x y. x = (0::real) \<Longrightarrow> x *\<^sub>R (y::'b) = 0"
          by auto
       have cont_eq: "\<And>g. (\<lambda>(x,l). content l *\<^sub>R f x) \<circ> (\<lambda>(x,l). (x,g l)) = (\<lambda>(x,l). content (g l) *\<^sub>R f x)"
         by auto
       have *: "\<And>\<G> :: 'a set \<Rightarrow> 'a set.
                   (\<Sum>(x,K)\<in>{(x, \<G> K) |x K. (x,K) \<in> p \<and> \<G> K \<noteq> {}}. content K *\<^sub>R f x) =
                   (\<Sum>(x,K)\<in>(\<lambda>(x,K). (x, \<G> K)) ` p. content K *\<^sub>R f x)"
         by (rule sum.mono_neutral_left) (auto simp: \<open>finite p\<close>)
       have "((\<Sum>(x, k)\<in>?M1. content k *\<^sub>R f x) - i) + ((\<Sum>(x, k)\<in>?M2. content k *\<^sub>R f x) - j) =
         (\<Sum>(x, k)\<in>?M1. content k *\<^sub>R f x) + (\<Sum>(x, k)\<in>?M2. content k *\<^sub>R f x) - (i + j)"
         by auto
       moreover have "\<dots> = (\<Sum>(x,K) \<in> p. content (K \<inter> {x. x \<bullet> k \<le> c}) *\<^sub>R f x) +
         (\<Sum>(x,K) \<in> p. content (K \<inter> {x. c \<le> x \<bullet> k}) *\<^sub>R f x) - (i + j)"
         unfolding *
         apply (subst (1 2) sum.reindex_nontrivial)
            apply (auto intro!: k p eq0 tagged_division_split_left_inj_content tagged_division_split_right_inj_content
                        simp: cont_eq \<open>finite p\<close>)
         done
       moreover have "\<And>x. x \<in> p \<Longrightarrow> (\<lambda>(a,B). content (B \<inter> {a. a \<bullet> k \<le> c}) *\<^sub>R f a) x +
                                 (\<lambda>(a,B). content (B \<inter> {a. c \<le> a \<bullet> k}) *\<^sub>R f a) x =
                                 (\<lambda>(a,B). content B *\<^sub>R f a) x"
       proof clarify
         fix a B
         assume "(a, B) \<in> p"
         with p obtain u v where uv: "B = cbox u v" by blast
         then show "content (B \<inter> {x. x \<bullet> k \<le> c}) *\<^sub>R f a + content (B \<inter> {x. c \<le> x \<bullet> k}) *\<^sub>R f a = content B *\<^sub>R f a"
           by (auto simp: scaleR_left_distrib uv content_split[OF k,of u v c])
       qed
       ultimately show ?thesis
         by (auto simp: sum.distrib[symmetric])
       qed
     ultimately show "norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - (i + j)) < e"
       by auto
   qed
 qed
 
 
 subsection \<open>A sort of converse, integrability on subintervals\<close>
 
 lemma has_integral_separate_sides:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes f: "(f has_integral i) (cbox a b)"
     and "e > 0"
     and k: "k \<in> Basis"
   obtains d where "gauge d"
     "\<forall>p1 p2. p1 tagged_division_of (cbox a b \<inter> {x. x\<bullet>k \<le> c}) \<and> d fine p1 \<and>
         p2 tagged_division_of (cbox a b \<inter> {x. x\<bullet>k \<ge> c}) \<and> d fine p2 \<longrightarrow>
         norm ((sum (\<lambda>(x,k). content k *\<^sub>R f x) p1 + sum (\<lambda>(x,k). content k *\<^sub>R f x) p2) - i) < e"
 proof -
   obtain \<gamma> where d: "gauge \<gamma>"
       "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma> fine p\<rbrakk>
             \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) < e"
     using has_integralD[OF f \<open>e > 0\<close>] by metis
   { fix p1 p2
     assume tdiv1: "p1 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<le> c}" and "\<gamma> fine p1"
     note p1=tagged_division_ofD[OF this(1)] 
     assume tdiv2: "p2 tagged_division_of (cbox a b) \<inter> {x. c \<le> x \<bullet> k}" and "\<gamma> fine p2"
     note p2=tagged_division_ofD[OF this(1)] 
     note tagged_division_Un_interval[OF tdiv1 tdiv2] 
     note p12 = tagged_division_ofD[OF this] this
     { fix a b
       assume ab: "(a, b) \<in> p1 \<inter> p2"
       have "(a, b) \<in> p1"
         using ab by auto
       obtain u v where uv: "b = cbox u v"
         using \<open>(a, b) \<in> p1\<close> p1(4) by moura
       have "b \<subseteq> {x. x\<bullet>k = c}"
         using ab p1(3)[of a b] p2(3)[of a b] by fastforce
       moreover
       have "interior {x::'a. x \<bullet> k = c} = {}"
       proof (rule ccontr)
         assume "\<not> ?thesis"
         then obtain x where x: "x \<in> interior {x::'a. x\<bullet>k = c}"
           by auto
         then obtain \<epsilon> where "0 < \<epsilon>" and \<epsilon>: "ball x \<epsilon> \<subseteq> {x. x \<bullet> k = c}"
           using mem_interior by metis
         have x: "x\<bullet>k = c"
           using x interior_subset by fastforce
         have *: "\<And>i. i \<in> Basis \<Longrightarrow> \<bar>(x - (x + (\<epsilon>/2) *\<^sub>R k)) \<bullet> i\<bar> = (if i = k then \<epsilon>/2 else 0)"
           using \<open>0 < \<epsilon>\<close> k by (auto simp: inner_simps inner_not_same_Basis)
         have "(\<Sum>i\<in>Basis. \<bar>(x - (x + (\<epsilon>/2 ) *\<^sub>R k)) \<bullet> i\<bar>) =
               (\<Sum>i\<in>Basis. (if i = k then \<epsilon>/2 else 0))"
           using "*" by (blast intro: sum.cong)
         also have "\<dots> < \<epsilon>"
           by (subst sum.delta) (use \<open>0 < \<epsilon>\<close> in auto)
         finally have "x + (\<epsilon>/2) *\<^sub>R k \<in> ball x \<epsilon>"
           unfolding mem_ball dist_norm by(rule le_less_trans[OF norm_le_l1])
         then have "x + (\<epsilon>/2) *\<^sub>R k \<in> {x. x\<bullet>k = c}"
           using \<epsilon> by auto
         then show False
           using \<open>0 < \<epsilon>\<close> x k by (auto simp: inner_simps)
       qed
       ultimately have "content b = 0"
         unfolding uv content_eq_0_interior
         using interior_mono by blast
       then have "content b *\<^sub>R f a = 0"
         by auto
     }
     then have "norm ((\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) + (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x) - i) =
                norm ((\<Sum>(x, k)\<in>p1 \<union> p2. content k *\<^sub>R f x) - i)"
       by (subst sum.union_inter_neutral) (auto simp: p1 p2)
     also have "\<dots> < e"
       using d(2) p12 by (simp add: fine_Un k \<open>\<gamma> fine p1\<close> \<open>\<gamma> fine p2\<close>)
     finally have "norm ((\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) + (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x) - i) < e" .
    }
   then show ?thesis
     using d(1) that by auto
 qed
 
 lemma integrable_split [intro]:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::{real_normed_vector,complete_space}"
   assumes f: "f integrable_on cbox a b"
       and k: "k \<in> Basis"
     shows "f integrable_on (cbox a b \<inter> {x. x\<bullet>k \<le> c})"   (is ?thesis1)
     and   "f integrable_on (cbox a b \<inter> {x. x\<bullet>k \<ge> c})"   (is ?thesis2)
 proof -
   obtain y where y: "(f has_integral y) (cbox a b)"
     using f by blast
   define a' where "a' = (\<Sum>i\<in>Basis. (if i = k then max (a\<bullet>k) c else a\<bullet>i)*\<^sub>R i)"
   define b' where "b' = (\<Sum>i\<in>Basis. (if i = k then min (b\<bullet>k) c else b\<bullet>i)*\<^sub>R i)"
   have "\<exists>d. gauge d \<and>
             (\<forall>p1 p2. p1 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c} \<and> d fine p1 \<and>
                      p2 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c} \<and> d fine p2 \<longrightarrow>
                      norm ((\<Sum>(x,K) \<in> p1. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p2. content K *\<^sub>R f x)) < e)"
     if "e > 0" for e
   proof -
     have "e/2 > 0" using that by auto
   with has_integral_separate_sides[OF y this k, of c]
   obtain d
     where "gauge d"
          and d: "\<And>p1 p2. \<lbrakk>p1 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c}; d fine p1;
                           p2 tagged_division_of cbox a b \<inter> {x. c \<le> x \<bullet> k}; d fine p2\<rbrakk>
                   \<Longrightarrow> norm ((\<Sum>(x,K)\<in>p1. content K *\<^sub>R f x) + (\<Sum>(x,K)\<in>p2. content K *\<^sub>R f x) - y) < e/2"
     by metis
   show ?thesis
     proof (rule_tac x=d in exI, clarsimp simp add: \<open>gauge d\<close>)
       fix p1 p2
       assume as: "p1 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<le> c}" "d fine p1"
                  "p2 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<le> c}" "d fine p2"
       show "norm ((\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) - (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x)) < e"
       proof (rule fine_division_exists[OF \<open>gauge d\<close>, of a' b])
         fix p
         assume "p tagged_division_of cbox a' b" "d fine p"
         then show ?thesis
           using as norm_triangle_half_l[OF d[of p1 p] d[of p2 p]]
           unfolding interval_split[OF k] b'_def[symmetric] a'_def[symmetric]
           by (auto simp add: algebra_simps)
       qed
     qed
   qed
   with f show ?thesis1
     by (simp add: interval_split[OF k] integrable_Cauchy)
   have "\<exists>d. gauge d \<and>
             (\<forall>p1 p2. p1 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<ge> c} \<and> d fine p1 \<and>
                      p2 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<ge> c} \<and> d fine p2 \<longrightarrow>
                      norm ((\<Sum>(x,K) \<in> p1. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p2. content K *\<^sub>R f x)) < e)"
     if "e > 0" for e
   proof -
     have "e/2 > 0" using that by auto
   with has_integral_separate_sides[OF y this k, of c]
   obtain d
     where "gauge d"
          and d: "\<And>p1 p2. \<lbrakk>p1 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c}; d fine p1;
                           p2 tagged_division_of cbox a b \<inter> {x. c \<le> x \<bullet> k}; d fine p2\<rbrakk>
                   \<Longrightarrow> norm ((\<Sum>(x,K)\<in>p1. content K *\<^sub>R f x) + (\<Sum>(x,K)\<in>p2. content K *\<^sub>R f x) - y) < e/2"
     by metis
   show ?thesis
     proof (rule_tac x=d in exI, clarsimp simp add: \<open>gauge d\<close>)
       fix p1 p2
       assume as: "p1 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<ge> c}" "d fine p1"
                  "p2 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<ge> c}" "d fine p2"
       show "norm ((\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) - (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x)) < e"
       proof (rule fine_division_exists[OF \<open>gauge d\<close>, of a b'])
         fix p
         assume "p tagged_division_of cbox a b'" "d fine p"
         then show ?thesis
           using as norm_triangle_half_l[OF d[of p p1] d[of p p2]]
           unfolding interval_split[OF k] b'_def[symmetric] a'_def[symmetric]
           by (auto simp add: algebra_simps)
       qed
     qed
   qed
   with f show ?thesis2
     by (simp add: interval_split[OF k] integrable_Cauchy)
 qed
 
 lemma operative_integralI:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   shows "operative (lift_option (+)) (Some 0)
     (\<lambda>i. if f integrable_on i then Some (integral i f) else None)"
 proof -
   interpret comm_monoid "lift_option plus" "Some (0::'b)"
     by (rule comm_monoid_lift_option)
       (rule add.comm_monoid_axioms)
   show ?thesis
   proof
     fix a b c
     fix k :: 'a
     assume k: "k \<in> Basis"
     show "(if f integrable_on cbox a b then Some (integral (cbox a b) f) else None) =
           lift_option (+) (if f integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c} then Some (integral (cbox a b \<inter> {x. x \<bullet> k \<le> c}) f) else None)
           (if f integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k} then Some (integral (cbox a b \<inter> {x. c \<le> x \<bullet> k}) f) else None)"
     proof (cases "f integrable_on cbox a b")
       case True
       with k show ?thesis
         by (auto simp: integrable_split intro: integral_unique [OF has_integral_split[OF _ _ k]])
     next
     case False
       have "\<not> (f integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c}) \<or> \<not> ( f integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k})"
       proof (rule ccontr)
         assume "\<not> ?thesis"
         then have "f integrable_on cbox a b"
           unfolding integrable_on_def
           apply (rule_tac x="integral (cbox a b \<inter> {x. x \<bullet> k \<le> c}) f + integral (cbox a b \<inter> {x. x \<bullet> k \<ge> c}) f" in exI)
           apply (auto intro: has_integral_split[OF _ _ k])
           done
         then show False
           using False by auto
       qed
       then show ?thesis
         using False by auto
     qed
   next
     fix a b :: 'a
     assume "box a b = {}"
     then show "(if f integrable_on cbox a b then Some (integral (cbox a b) f) else None) = Some 0"
       using has_integral_null_eq
       by (auto simp: integrable_on_null content_eq_0_interior)
   qed
 qed
 
 subsection \<open>Bounds on the norm of Riemann sums and the integral itself\<close>
 
 lemma dsum_bound:
   assumes p: "p division_of (cbox a b)"
     and "norm c \<le> e"
   shows "norm (sum (\<lambda>l. content l *\<^sub>R c) p) \<le> e * content(cbox a b)"
 proof -
   have sumeq: "(\<Sum>i\<in>p. \<bar>content i\<bar>) = sum content p"
     by simp
   have e: "0 \<le> e"
     using assms(2) norm_ge_zero order_trans by blast
   have "norm (sum (\<lambda>l. content l *\<^sub>R c) p) \<le> (\<Sum>i\<in>p. norm (content i *\<^sub>R c))"
     using norm_sum by blast
   also have "...  \<le> e * (\<Sum>i\<in>p. \<bar>content i\<bar>)"
     by (simp add: sum_distrib_left[symmetric] mult.commute assms(2) mult_right_mono sum_nonneg)
   also have "... \<le> e * content (cbox a b)"
     by (metis additive_content_division p eq_iff sumeq)
   finally show ?thesis .
 qed
 
 lemma rsum_bound:
   assumes p: "p tagged_division_of (cbox a b)"
       and "\<forall>x\<in>cbox a b. norm (f x) \<le> e"
     shows "norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p) \<le> e * content (cbox a b)"
 proof (cases "cbox a b = {}")
   case True show ?thesis
     using p unfolding True tagged_division_of_trivial by auto
 next
   case False
   then have e: "e \<ge> 0"
     by (meson ex_in_conv assms(2) norm_ge_zero order_trans)
   have sum_le: "sum (content \<circ> snd) p \<le> content (cbox a b)"
     unfolding additive_content_tagged_division[OF p, symmetric] split_def
     by (auto intro: eq_refl)
   have con: "\<And>xk. xk \<in> p \<Longrightarrow> 0 \<le> content (snd xk)"
     using tagged_division_ofD(4) [OF p] content_pos_le
     by force
   have "norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p) \<le> (\<Sum>i\<in>p. norm (case i of (x, k) \<Rightarrow> content k *\<^sub>R f x))"
     by (rule norm_sum)
   also have "...  \<le> e * content (cbox a b)"
   proof -
     have "\<And>xk. xk \<in> p \<Longrightarrow> norm (f (fst xk)) \<le> e"
       using assms(2) p tag_in_interval by force
     moreover have "(\<Sum>i\<in>p. \<bar>content (snd i)\<bar> * e) \<le> e * content (cbox a b)"
       unfolding sum_distrib_right[symmetric]
       using con sum_le by (auto simp: mult.commute intro: mult_left_mono [OF _ e])
     ultimately show ?thesis
       unfolding split_def norm_scaleR
       by (metis (no_types, lifting) mult_left_mono[OF _ abs_ge_zero]   order_trans[OF sum_mono])
   qed
   finally show ?thesis .
 qed
 
 lemma rsum_diff_bound:
   assumes "p tagged_division_of (cbox a b)"
     and "\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e"
   shows "norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p - sum (\<lambda>(x,k). content k *\<^sub>R g x) p) \<le>
          e * content (cbox a b)"
   using order_trans[OF _ rsum_bound[OF assms]]
   by (simp add: split_def scaleR_diff_right sum_subtractf eq_refl)
 
 lemma has_integral_bound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "0 \<le> B"
       and f: "(f has_integral i) (cbox a b)"
       and "\<And>x. x\<in>cbox a b \<Longrightarrow> norm (f x) \<le> B"
     shows "norm i \<le> B * content (cbox a b)"
 proof (rule ccontr)
   assume "\<not> ?thesis"
   then have "norm i - B * content (cbox a b) > 0"
     by auto
   with f[unfolded has_integral]
   obtain \<gamma> where "gauge \<gamma>" and \<gamma>:
     "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma> fine p\<rbrakk>
           \<Longrightarrow> norm ((\<Sum>(x, K)\<in>p. content K *\<^sub>R f x) - i) < norm i - B * content (cbox a b)"
     by metis
   then obtain p where p: "p tagged_division_of cbox a b" and "\<gamma> fine p"
     using fine_division_exists by blast
   have "\<And>s B. norm s \<le> B \<Longrightarrow> \<not> norm (s - i) < norm i - B"
     unfolding not_less
     by (metis diff_left_mono dist_commute dist_norm norm_triangle_ineq2 order_trans)
   then show False
     using \<gamma> [OF p \<open>\<gamma> fine p\<close>] rsum_bound[OF p] assms by metis
 qed
 
 corollary integrable_bound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "0 \<le> B"
       and "f integrable_on (cbox a b)"
       and "\<And>x. x\<in>cbox a b \<Longrightarrow> norm (f x) \<le> B"
     shows "norm (integral (cbox a b) f) \<le> B * content (cbox a b)"
 by (metis integrable_integral has_integral_bound assms)
 
 
 subsection \<open>Similar theorems about relationship among components\<close>
 
 lemma rsum_component_le:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes p: "p tagged_division_of (cbox a b)"
       and "\<And>x. x \<in> cbox a b \<Longrightarrow> (f x)\<bullet>i \<le> (g x)\<bullet>i"
     shows "(\<Sum>(x, K)\<in>p. content K *\<^sub>R f x) \<bullet> i \<le> (\<Sum>(x, K)\<in>p. content K *\<^sub>R g x) \<bullet> i"
 unfolding inner_sum_left
 proof (rule sum_mono, clarify)
   fix x K
   assume ab: "(x, K) \<in> p"
   with p obtain u v where K: "K = cbox u v"
     by blast
   then show "(content K *\<^sub>R f x) \<bullet> i \<le> (content K *\<^sub>R g x) \<bullet> i"
     by (metis ab assms inner_scaleR_left measure_nonneg mult_left_mono tag_in_interval)
 qed
 
 lemma has_integral_component_le:
   fixes f g :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes k: "k \<in> Basis"
   assumes "(f has_integral i) S" "(g has_integral j) S"
     and f_le_g: "\<And>x. x \<in> S \<Longrightarrow> (f x)\<bullet>k \<le> (g x)\<bullet>k"
   shows "i\<bullet>k \<le> j\<bullet>k"
 proof -
   have ik_le_jk: "i\<bullet>k \<le> j\<bullet>k"
     if f_i: "(f has_integral i) (cbox a b)"
     and g_j: "(g has_integral j) (cbox a b)"
     and le: "\<forall>x\<in>cbox a b. (f x)\<bullet>k \<le> (g x)\<bullet>k"
     for a b i and j :: 'b and f g :: "'a \<Rightarrow> 'b"
   proof (rule ccontr)
     assume "\<not> ?thesis"
     then have *: "0 < (i\<bullet>k - j\<bullet>k) / 3"
       by auto
     obtain \<gamma>1 where "gauge \<gamma>1" 
       and \<gamma>1: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma>1 fine p\<rbrakk>
                 \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) < (i \<bullet> k - j \<bullet> k) / 3"
       using f_i[unfolded has_integral,rule_format,OF *] by fastforce 
     obtain \<gamma>2 where "gauge \<gamma>2" 
       and \<gamma>2: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma>2 fine p\<rbrakk>
                 \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R g x) - j) < (i \<bullet> k - j \<bullet> k) / 3"
       using g_j[unfolded has_integral,rule_format,OF *] by fastforce 
     obtain p where p: "p tagged_division_of cbox a b" and "\<gamma>1 fine p" "\<gamma>2 fine p"
        using fine_division_exists[OF gauge_Int[OF \<open>gauge \<gamma>1\<close> \<open>gauge \<gamma>2\<close>], of a b] unfolding fine_Int
        by metis
     then have "\<bar>((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) \<bullet> k\<bar> < (i \<bullet> k - j \<bullet> k) / 3"
          "\<bar>((\<Sum>(x, k)\<in>p. content k *\<^sub>R g x) - j) \<bullet> k\<bar> < (i \<bullet> k - j \<bullet> k) / 3"
       using le_less_trans[OF Basis_le_norm[OF k]] k \<gamma>1 \<gamma>2 by metis+ 
     then show False
       unfolding inner_simps
       using rsum_component_le[OF p] le
       by (fastforce simp add: abs_real_def split: if_split_asm)
   qed
   show ?thesis
   proof (cases "\<exists>a b. S = cbox a b")
     case True
     with ik_le_jk assms show ?thesis
       by auto
   next
     case False
     show ?thesis
     proof (rule ccontr)
       assume "\<not> i\<bullet>k \<le> j\<bullet>k"
       then have ij: "(i\<bullet>k - j\<bullet>k) / 3 > 0"
         by auto
       obtain B1 where "0 < B1" 
            and B1: "\<And>a b. ball 0 B1 \<subseteq> cbox a b \<Longrightarrow>
                     \<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b) \<and>
                         norm (z - i) < (i \<bullet> k - j \<bullet> k) / 3"
         using has_integral_altD[OF _ False ij] assms by blast
       obtain B2 where "0 < B2" 
            and B2: "\<And>a b. ball 0 B2 \<subseteq> cbox a b \<Longrightarrow>
                     \<exists>z. ((\<lambda>x. if x \<in> S then g x else 0) has_integral z) (cbox a b) \<and>
                         norm (z - j) < (i \<bullet> k - j \<bullet> k) / 3"
         using has_integral_altD[OF _ False ij] assms by blast
       have "bounded (ball 0 B1 \<union> ball (0::'a) B2)"
         unfolding bounded_Un by(rule conjI bounded_ball)+
       from bounded_subset_cbox_symmetric[OF this] 
       obtain a b::'a where ab: "ball 0 B1 \<subseteq> cbox a b" "ball 0 B2 \<subseteq> cbox a b"
         by (meson Un_subset_iff)
       then obtain w1 w2 where int_w1: "((\<lambda>x. if x \<in> S then f x else 0) has_integral w1) (cbox a b)"
                         and norm_w1:  "norm (w1 - i) < (i \<bullet> k - j \<bullet> k) / 3"
                         and int_w2: "((\<lambda>x. if x \<in> S then g x else 0) has_integral w2) (cbox a b)"
                         and norm_w2: "norm (w2 - j) < (i \<bullet> k - j \<bullet> k) / 3"
         using B1 B2 by blast
       have *: "\<And>w1 w2 j i::real .\<bar>w1 - i\<bar> < (i - j) / 3 \<Longrightarrow> \<bar>w2 - j\<bar> < (i - j) / 3 \<Longrightarrow> w1 \<le> w2 \<Longrightarrow> False"
         by (simp add: abs_real_def split: if_split_asm)
       have "\<bar>(w1 - i) \<bullet> k\<bar> < (i \<bullet> k - j \<bullet> k) / 3"
            "\<bar>(w2 - j) \<bullet> k\<bar> < (i \<bullet> k - j \<bullet> k) / 3"
         using Basis_le_norm k le_less_trans norm_w1 norm_w2 by blast+
       moreover
       have "w1\<bullet>k \<le> w2\<bullet>k"
         using ik_le_jk int_w1 int_w2 f_le_g by auto
       ultimately show False
         unfolding inner_simps by(rule *)
     qed
   qed
 qed
 
 lemma integral_component_le:
   fixes g f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "k \<in> Basis"
     and "f integrable_on S" "g integrable_on S"
     and "\<And>x. x \<in> S \<Longrightarrow> (f x)\<bullet>k \<le> (g x)\<bullet>k"
   shows "(integral S f)\<bullet>k \<le> (integral S g)\<bullet>k"
   using has_integral_component_le assms by blast
 
 lemma has_integral_component_nonneg:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "k \<in> Basis"
     and "(f has_integral i) S"
     and "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> (f x)\<bullet>k"
   shows "0 \<le> i\<bullet>k"
   using has_integral_component_le[OF assms(1) has_integral_0 assms(2)]
   using assms(3-)
   by auto
 
 lemma integral_component_nonneg:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "k \<in> Basis"
     and  "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> (f x)\<bullet>k"
   shows "0 \<le> (integral S f)\<bullet>k"
 proof (cases "f integrable_on S")
   case True show ?thesis
     using True assms has_integral_component_nonneg by blast
 next
   case False then show ?thesis by (simp add: not_integrable_integral)
 qed
 
 lemma has_integral_component_neg:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "k \<in> Basis"
     and "(f has_integral i) S"
     and "\<And>x. x \<in> S \<Longrightarrow> (f x)\<bullet>k \<le> 0"
   shows "i\<bullet>k \<le> 0"
   using has_integral_component_le[OF assms(1,2) has_integral_0] assms(2-)
   by auto
 
 lemma has_integral_component_lbound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "(f has_integral i) (cbox a b)"
     and "\<forall>x\<in>cbox a b. B \<le> f(x)\<bullet>k"
     and "k \<in> Basis"
   shows "B * content (cbox a b) \<le> i\<bullet>k"
   using has_integral_component_le[OF assms(3) has_integral_const assms(1),of "(\<Sum>i\<in>Basis. B *\<^sub>R i)::'b"] assms(2-)
   by (auto simp add: field_simps)
 
 lemma has_integral_component_ubound:
   fixes f::"'a::euclidean_space => 'b::euclidean_space"
   assumes "(f has_integral i) (cbox a b)"
     and "\<forall>x\<in>cbox a b. f x\<bullet>k \<le> B"
     and "k \<in> Basis"
   shows "i\<bullet>k \<le> B * content (cbox a b)"
   using has_integral_component_le[OF assms(3,1) has_integral_const, of "\<Sum>i\<in>Basis. B *\<^sub>R i"] assms(2-)
   by (auto simp add: field_simps)
 
 lemma integral_component_lbound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f integrable_on cbox a b"
     and "\<forall>x\<in>cbox a b. B \<le> f(x)\<bullet>k"
     and "k \<in> Basis"
   shows "B * content (cbox a b) \<le> (integral(cbox a b) f)\<bullet>k"
   using assms has_integral_component_lbound by blast
 
 lemma integral_component_lbound_real:
   assumes "f integrable_on {a ::real..b}"
     and "\<forall>x\<in>{a..b}. B \<le> f(x)\<bullet>k"
     and "k \<in> Basis"
   shows "B * content {a..b} \<le> (integral {a..b} f)\<bullet>k"
   using assms
   by (metis box_real(2) integral_component_lbound)
 
 lemma integral_component_ubound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f integrable_on cbox a b"
     and "\<forall>x\<in>cbox a b. f x\<bullet>k \<le> B"
     and "k \<in> Basis"
   shows "(integral (cbox a b) f)\<bullet>k \<le> B * content (cbox a b)"
   using assms has_integral_component_ubound by blast
 
 lemma integral_component_ubound_real:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "f integrable_on {a..b}"
     and "\<forall>x\<in>{a..b}. f x\<bullet>k \<le> B"
     and "k \<in> Basis"
   shows "(integral {a..b} f)\<bullet>k \<le> B * content {a..b}"
   using assms
   by (metis box_real(2) integral_component_ubound)
 
 subsection \<open>Uniform limit of integrable functions is integrable\<close>
 
 lemma real_arch_invD:
   "0 < (e::real) \<Longrightarrow> (\<exists>n::nat. n \<noteq> 0 \<and> 0 < inverse (real n) \<and> inverse (real n) < e)"
   by (subst(asm) real_arch_inverse)
 
 
 lemma integrable_uniform_limit:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "\<And>e. e > 0 \<Longrightarrow> \<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
   shows "f integrable_on cbox a b"
 proof (cases "content (cbox a b) > 0")
   case False then show ?thesis
     using has_integral_null by (simp add: content_lt_nz integrable_on_def)
 next
   case True
   have "1 / (real n + 1) > 0" for n
     by auto
   then have "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> 1 / (real n + 1)) \<and> g integrable_on cbox a b" for n
     using assms by blast
   then obtain g where g_near_f: "\<And>n x. x \<in> cbox a b \<Longrightarrow> norm (f x - g n x) \<le> 1 / (real n + 1)"
                   and int_g: "\<And>n. g n integrable_on cbox a b"
     by metis
   then obtain h where h: "\<And>n. (g n has_integral h n) (cbox a b)"
     unfolding integrable_on_def by metis
   have "Cauchy h"
     unfolding Cauchy_def
   proof clarify
     fix e :: real
     assume "e>0"
     then have "e/4 / content (cbox a b) > 0"
       using True by (auto simp: field_simps)
     then obtain M where "M \<noteq> 0" and M: "1 / (real M) < e/4 / content (cbox a b)"
       by (metis inverse_eq_divide real_arch_inverse)
     show "\<exists>M. \<forall>m\<ge>M. \<forall>n\<ge>M. dist (h m) (h n) < e"
     proof (rule exI [where x=M], clarify)
       fix m n
       assume m: "M \<le> m" and n: "M \<le> n"
       have "e/4>0" using \<open>e>0\<close> by auto
       then obtain gm gn where "gauge gm" "gauge gn"
               and gm: "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> gm fine \<D> 
                             \<Longrightarrow> norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g m x) - h m) < e/4"
               and gn: "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> gn fine \<D> \<Longrightarrow>
                       norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g n x) - h n) < e/4"
         using h[unfolded has_integral] by meson
       then obtain \<D> where \<D>: "\<D> tagged_division_of cbox a b" "(\<lambda>x. gm x \<inter> gn x) fine \<D>"
         by (metis (full_types) fine_division_exists gauge_Int)
       have triangle3: "norm (i1 - i2) < e"
         if no: "norm(s2 - s1) \<le> e/2" "norm (s1 - i1) < e/4" "norm (s2 - i2) < e/4" for s1 s2 i1 and i2::'b
       proof -
         have "norm (i1 - i2) \<le> norm (i1 - s1) + norm (s1 - s2) + norm (s2 - i2)"
           using norm_triangle_ineq[of "i1 - s1" "s1 - i2"]
           using norm_triangle_ineq[of "s1 - s2" "s2 - i2"]
           by (auto simp: algebra_simps)
         also have "\<dots> < e"
           using no by (auto simp: algebra_simps norm_minus_commute)
         finally show ?thesis .
       qed
       have finep: "gm fine \<D>" "gn fine \<D>"
         using fine_Int \<D>  by auto
       have norm_le: "norm (g n x - g m x) \<le> 2 / real M" if x: "x \<in> cbox a b" for x
       proof -
         have "norm (f x - g n x) + norm (f x - g m x) \<le> 1 / (real n + 1) + 1 / (real m + 1)"          
           using g_near_f[OF x, of n] g_near_f[OF x, of m] by simp
         also have "\<dots> \<le> 1 / (real M) + 1 / (real M)"
           using \<open>M \<noteq> 0\<close> m n by (intro add_mono; force simp: field_split_simps)
         also have "\<dots> = 2 / real M"
           by auto
         finally show "norm (g n x - g m x) \<le> 2 / real M"
           using norm_triangle_le[of "g n x - f x" "f x - g m x" "2 / real M"]
           by (auto simp: algebra_simps simp add: norm_minus_commute)
       qed
       have "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g n x) - (\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g m x)) \<le> 2 / real M * content (cbox a b)"
         by (blast intro: norm_le rsum_diff_bound[OF \<D>(1), where e="2 / real M"])
       also have "... \<le> e/2"
         using M True
         by (auto simp: field_simps)
       finally have le_e2: "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g n x) - (\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g m x)) \<le> e/2" .
       then show "dist (h m) (h n) < e"
         unfolding dist_norm using gm gn \<D> finep by (auto intro!: triangle3)
     qed
   qed
   then obtain s where s: "h \<longlonglongrightarrow> s"
     using convergent_eq_Cauchy[symmetric] by blast
   show ?thesis
     unfolding integrable_on_def has_integral
   proof (rule_tac x=s in exI, clarify)
     fix e::real
     assume e: "0 < e"
     then have "e/3 > 0" by auto
     then obtain N1 where N1: "\<forall>n\<ge>N1. norm (h n - s) < e/3"
       using LIMSEQ_D [OF s] by metis
     from e True have "e/3 / content (cbox a b) > 0"
       by (auto simp: field_simps)
     then obtain N2 :: nat
          where "N2 \<noteq> 0" and N2: "1 / (real N2) < e/3 / content (cbox a b)"
       by (metis inverse_eq_divide real_arch_inverse)
     obtain g' where "gauge g'"
             and g': "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> g' fine \<D> \<Longrightarrow>
                     norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g (N1 + N2) x) - h (N1 + N2)) < e/3"
       by (metis h has_integral \<open>e/3 > 0\<close>)
     have *: "norm (sf - s) < e" 
         if no: "norm (sf - sg) \<le> e/3" "norm(h - s) < e/3" "norm (sg - h) < e/3" for sf sg h
     proof -
       have "norm (sf - s) \<le> norm (sf - sg) + norm (sg - h) + norm (h - s)"
         using norm_triangle_ineq[of "sf - sg" "sg - s"]
         using norm_triangle_ineq[of "sg -  h" " h - s"]
         by (auto simp: algebra_simps)
       also have "\<dots> < e"
         using no by (auto simp: algebra_simps norm_minus_commute)
       finally show ?thesis .
     qed
     { fix \<D>
       assume ptag: "\<D> tagged_division_of (cbox a b)" and "g' fine \<D>"
       then have norm_less: "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g (N1 + N2) x) - h (N1 + N2)) < e/3"
         using g' by blast
       have "content (cbox a b) < e/3 * (of_nat N2)"
         using \<open>N2 \<noteq> 0\<close> N2 using True by (auto simp: field_split_simps)
       moreover have "e/3 * of_nat N2 \<le> e/3 * (of_nat (N1 + N2) + 1)"
         using \<open>e>0\<close> by auto
       ultimately have "content (cbox a b) < e/3 * (of_nat (N1 + N2) + 1)"
         by linarith
       then have le_e3: "1 / (real (N1 + N2) + 1) * content (cbox a b) \<le> e/3"
         unfolding inverse_eq_divide
         by (auto simp: field_simps)
       have ne3: "norm (h (N1 + N2) - s) < e/3"
         using N1 by auto
       have "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g (N1 + N2) x))
             \<le> 1 / (real (N1 + N2) + 1) * content (cbox a b)"
         by (blast intro: g_near_f rsum_diff_bound[OF ptag])
       then have "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - s) < e"
         by (rule *[OF order_trans [OF _ le_e3] ne3 norm_less])
     }
     then show "\<exists>d. gauge d \<and>
              (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> d fine \<D> \<longrightarrow> norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - s) < e)"
       by (blast intro: g' \<open>gauge g'\<close>)
   qed
 qed
 
 lemmas integrable_uniform_limit_real = integrable_uniform_limit [where 'a=real, simplified]
 
 
 subsection \<open>Negligible sets\<close>
 
 definition "negligible (s:: 'a::euclidean_space set) \<longleftrightarrow>
   (\<forall>a b. ((indicator s :: 'a\<Rightarrow>real) has_integral 0) (cbox a b))"
 
 
 subsubsection \<open>Negligibility of hyperplane\<close>
 
 lemma content_doublesplit:
   fixes a :: "'a::euclidean_space"
   assumes "0 < e"
     and k: "k \<in> Basis"
   obtains d where "0 < d" and "content (cbox a b \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d}) < e"
 proof cases
   assume *: "a \<bullet> k \<le> c \<and> c \<le> b \<bullet> k \<and> (\<forall>j\<in>Basis. a \<bullet> j \<le> b \<bullet> j)"
   define a' where "a' d = (\<Sum>j\<in>Basis. (if j = k then max (a\<bullet>j) (c - d) else a\<bullet>j) *\<^sub>R j)" for d
   define b' where "b' d = (\<Sum>j\<in>Basis. (if j = k then min (b\<bullet>j) (c + d) else b\<bullet>j) *\<^sub>R j)" for d
 
   have "((\<lambda>d. \<Prod>j\<in>Basis. (b' d - a' d) \<bullet> j) \<longlongrightarrow> (\<Prod>j\<in>Basis. (b' 0 - a' 0) \<bullet> j)) (at_right 0)"
     by (auto simp: b'_def a'_def intro!: tendsto_min tendsto_max tendsto_eq_intros)
   also have "(\<Prod>j\<in>Basis. (b' 0 - a' 0) \<bullet> j) = 0"
     using k *
     by (intro prod_zero bexI[OF _ k])
        (auto simp: b'_def a'_def inner_diff inner_sum_left inner_not_same_Basis intro!: sum.cong)
   also have "((\<lambda>d. \<Prod>j\<in>Basis. (b' d - a' d) \<bullet> j) \<longlongrightarrow> 0) (at_right 0) =
     ((\<lambda>d. content (cbox a b \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d})) \<longlongrightarrow> 0) (at_right 0)"
   proof (intro tendsto_cong eventually_at_rightI)
     fix d :: real assume d: "d \<in> {0<..<1}"
     have "cbox a b \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d} = cbox (a' d) (b' d)" for d
       using * d k by (auto simp add: cbox_def set_eq_iff Int_def ball_conj_distrib abs_diff_le_iff a'_def b'_def)
     moreover have "j \<in> Basis \<Longrightarrow> a' d \<bullet> j \<le> b' d \<bullet> j" for j
       using * d k by (auto simp: a'_def b'_def)
     ultimately show "(\<Prod>j\<in>Basis. (b' d - a' d) \<bullet> j) = content (cbox a b \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d})"
       by simp
   qed simp
   finally have "((\<lambda>d. content (cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})) \<longlongrightarrow> 0) (at_right 0)" .
   from order_tendstoD(2)[OF this \<open>0<e\<close>]
   obtain d' where "0 < d'" and d': "\<And>y. y > 0 \<Longrightarrow> y < d' \<Longrightarrow> content (cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> y}) < e"
     by (subst (asm) eventually_at_right[of _ 1]) auto
   show ?thesis
     by (rule that[of "d'/2"], insert \<open>0<d'\<close> d'[of "d'/2"], auto)
 next
   assume *: "\<not> (a \<bullet> k \<le> c \<and> c \<le> b \<bullet> k \<and> (\<forall>j\<in>Basis. a \<bullet> j \<le> b \<bullet> j))"
   then have "(\<exists>j\<in>Basis. b \<bullet> j < a \<bullet> j) \<or> (c < a \<bullet> k \<or> b \<bullet> k < c)"
     by (auto simp: not_le)
   show thesis
   proof cases
     assume "\<exists>j\<in>Basis. b \<bullet> j < a \<bullet> j"
     then have [simp]: "cbox a b = {}"
       using box_ne_empty(1)[of a b] by auto
     show ?thesis
       by (rule that[of 1]) (simp_all add: \<open>0<e\<close>)
   next
     assume "\<not> (\<exists>j\<in>Basis. b \<bullet> j < a \<bullet> j)"
     with * have "c < a \<bullet> k \<or> b \<bullet> k < c"
       by auto
     then show thesis
     proof
       assume c: "c < a \<bullet> k"
       moreover have "x \<in> cbox a b \<Longrightarrow> c \<le> x \<bullet> k" for x
         using k c by (auto simp: cbox_def)
       ultimately have "cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> (a \<bullet> k - c)/2} = {}"
         using k by (auto simp: cbox_def)
       with \<open>0<e\<close> c that[of "(a \<bullet> k - c)/2"] show ?thesis
         by auto
     next
       assume c: "b \<bullet> k < c"
       moreover have "x \<in> cbox a b \<Longrightarrow> x \<bullet> k \<le> c" for x
         using k c by (auto simp: cbox_def)
       ultimately have "cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> (c - b \<bullet> k)/2} = {}"
         using k by (auto simp: cbox_def)
       with \<open>0<e\<close> c that[of "(c - b \<bullet> k)/2"] show ?thesis
         by auto
     qed
   qed
 qed
 
 
 proposition negligible_standard_hyperplane[intro]:
   fixes k :: "'a::euclidean_space"
   assumes k: "k \<in> Basis"
   shows "negligible {x. x\<bullet>k = c}"
   unfolding negligible_def has_integral
 proof clarsimp
   fix a b and e::real assume "e > 0"
   with k obtain d where "0 < d" and d: "content (cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) < e"
     by (metis content_doublesplit)
   let ?i = "indicator {x::'a. x\<bullet>k = c} :: 'a\<Rightarrow>real"
   show "\<exists>\<gamma>. gauge \<gamma> \<and>
            (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                  \<bar>\<Sum>(x,K) \<in> \<D>. content K * ?i x\<bar> < e)"
   proof (intro exI, safe)
     show "gauge (\<lambda>x. ball x d)"
       using \<open>0 < d\<close> by blast
   next
     fix \<D>
     assume p: "\<D> tagged_division_of (cbox a b)" "(\<lambda>x. ball x d) fine \<D>"
     have "content L = content (L \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})" 
       if "(x, L) \<in> \<D>" "?i x \<noteq> 0" for x L
     proof -
       have xk: "x\<bullet>k = c"
         using that by (simp add: indicator_def split: if_split_asm)
       have "L \<subseteq> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}"
       proof 
         fix y
         assume y: "y \<in> L"
         have "L \<subseteq> ball x d"
           using p(2) that(1) by auto
         then have "norm (x - y) < d"
           by (simp add: dist_norm subset_iff y)
         then have "\<bar>(x - y) \<bullet> k\<bar> < d"
           using k norm_bound_Basis_lt by blast
         then show "y \<in> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}"
           unfolding inner_simps xk by auto
       qed 
       then show "content L = content (L \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})"
         by (metis inf.orderE)
     qed
     then have *: "(\<Sum>(x,K)\<in>\<D>. content K * ?i x) = (\<Sum>(x,K)\<in>\<D>. content (K \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d}) *\<^sub>R ?i x)"
       by (force simp add: split_paired_all intro!: sum.cong [OF refl])
     note p'= tagged_division_ofD[OF p(1)] and p''=division_of_tagged_division[OF p(1)]
     have "(\<Sum>(x,K)\<in>\<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) * indicator {x. x \<bullet> k = c} x) < e"
     proof -
       have "(\<Sum>(x,K)\<in>\<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) * ?i x) \<le> (\<Sum>(x,K)\<in>\<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}))"
         by (force simp add: indicator_def intro!: sum_mono)
       also have "\<dots> < e"
       proof (subst sum.over_tagged_division_lemma[OF p(1)])
         fix u v::'a
         assume "box u v = {}"
         then have *: "content (cbox u v) = 0"
           unfolding content_eq_0_interior by simp
         have "cbox u v \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<subseteq> cbox u v"
           by auto
         then have "content (cbox u v \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) \<le> content (cbox u v)"
           unfolding interval_doublesplit[OF k] by (rule content_subset)
         then show "content (cbox u v \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) = 0"
           unfolding * interval_doublesplit[OF k]
           by (blast intro: antisym)
       next
         have "(\<Sum>l\<in>snd ` \<D>. content (l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})) =
           sum content ((\<lambda>l. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})`{l\<in>snd ` \<D>. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}})"
         proof (subst (2) sum.reindex_nontrivial)
           fix x y assume "x \<in> {l \<in> snd ` \<D>. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}}" "y \<in> {l \<in> snd ` \<D>. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}}"
             "x \<noteq> y" and eq: "x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} = y \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}"
           then obtain x' y' where "(x', x) \<in> \<D>" "x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}" "(y', y) \<in> \<D>" "y \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}"
             by (auto)
           from p'(5)[OF \<open>(x', x) \<in> \<D>\<close> \<open>(y', y) \<in> \<D>\<close>] \<open>x \<noteq> y\<close> have "interior (x \<inter> y) = {}"
             by auto
           moreover have "interior ((x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) \<inter> (y \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})) \<subseteq> interior (x \<inter> y)"
             by (auto intro: interior_mono)
           ultimately have "interior (x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) = {}"
             by (auto simp: eq)
           then show "content (x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) = 0"
             using p'(4)[OF \<open>(x', x) \<in> \<D>\<close>] by (auto simp: interval_doublesplit[OF k] content_eq_0_interior simp del: interior_Int)
         qed (insert p'(1), auto intro!: sum.mono_neutral_right)
         also have "\<dots> \<le> norm (\<Sum>l\<in>(\<lambda>l. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})`{l\<in>snd ` \<D>. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}}. content l *\<^sub>R 1::real)"
           by simp
         also have "\<dots> \<le> 1 * content (cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})"
           using division_doublesplit[OF p'' k, unfolded interval_doublesplit[OF k]]
           unfolding interval_doublesplit[OF k] by (intro dsum_bound) auto
         also have "\<dots> < e"
           using d by simp
         finally show "(\<Sum>K\<in>snd ` \<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})) < e" .
       qed
       finally show "(\<Sum>(x, K)\<in>\<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) * ?i x) < e" .
     qed
     then show "\<bar>\<Sum>(x, K)\<in>\<D>. content K * ?i x\<bar> < e"
       unfolding *  by (simp add: sum_nonneg split: prod.split)
   qed
 qed
 
 corollary negligible_standard_hyperplane_cart:
   fixes k :: "'a::finite"
   shows "negligible {x. x$k = (0::real)}"
   by (simp add: cart_eq_inner_axis negligible_standard_hyperplane)
 
 
 subsubsection \<open>Hence the main theorem about negligible sets\<close>
 
 
 lemma has_integral_negligible_cbox:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes negs: "negligible S"
     and 0: "\<And>x. x \<notin> S \<Longrightarrow> f x = 0"
   shows "(f has_integral 0) (cbox a b)"
   unfolding has_integral
 proof clarify
   fix e::real
   assume "e > 0"
   then have nn_gt0: "e/2 / ((real n+1) * (2 ^ n)) > 0" for n
     by simp
   then have "\<exists>\<gamma>. gauge \<gamma> \<and>
                  (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                       \<bar>\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R indicator S x\<bar>
                       < e/2 / ((real n + 1) * 2 ^ n))" for n
     using negs [unfolded negligible_def has_integral] by auto
   then obtain \<gamma> where 
     gd: "\<And>n. gauge (\<gamma> n)"
     and \<gamma>: "\<And>n \<D>. \<lbrakk>\<D> tagged_division_of cbox a b; \<gamma> n fine \<D>\<rbrakk>
                   \<Longrightarrow> \<bar>\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R indicator S x\<bar> < e/2 / ((real n + 1) * 2 ^ n)"
     by metis
   show "\<exists>\<gamma>. gauge \<gamma> \<and>
              (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                   norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - 0) < e)"
   proof (intro exI, safe)
     show "gauge (\<lambda>x. \<gamma> (nat \<lfloor>norm (f x)\<rfloor>) x)"
       using gd by (auto simp: gauge_def)
 
     show "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - 0) < e"
       if "\<D> tagged_division_of (cbox a b)" "(\<lambda>x. \<gamma> (nat \<lfloor>norm (f x)\<rfloor>) x) fine \<D>" for \<D>
     proof (cases "\<D> = {}")
       case True with \<open>0 < e\<close> show ?thesis by simp
     next
       case False
       obtain N where "Max ((\<lambda>(x, K). norm (f x)) ` \<D>) \<le> real N"
         using real_arch_simple by blast
       then have N: "\<And>x. x \<in> (\<lambda>(x, K). norm (f x)) ` \<D> \<Longrightarrow> x \<le> real N"
         by (meson Max_ge that(1) dual_order.trans finite_imageI tagged_division_of_finite)
       have "\<forall>i. \<exists>q. q tagged_division_of (cbox a b) \<and> (\<gamma> i) fine q \<and> (\<forall>(x,K) \<in> \<D>. K \<subseteq> (\<gamma> i) x \<longrightarrow> (x, K) \<in> q)"
         by (auto intro: tagged_division_finer[OF that(1) gd])
       from choice[OF this] 
       obtain q where q: "\<And>n. q n tagged_division_of cbox a b"
                         "\<And>n. \<gamma> n fine q n"
                         "\<And>n x K. \<lbrakk>(x, K) \<in> \<D>; K \<subseteq> \<gamma> n x\<rbrakk> \<Longrightarrow> (x, K) \<in> q n"
         by fastforce
       have "finite \<D>"
         using that(1) by blast
       then have sum_le_inc: "\<lbrakk>finite T; \<And>x y. (x,y) \<in> T \<Longrightarrow> (0::real) \<le> g(x,y);
                       \<And>y. y\<in>\<D> \<Longrightarrow> \<exists>x. (x,y) \<in> T \<and> f(y) \<le> g(x,y)\<rbrakk> \<Longrightarrow> sum f \<D> \<le> sum g T" for f g T
         by (rule sum_le_included[of \<D> T g snd f]; force)
       have "norm (\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) \<le> (\<Sum>(x,K) \<in> \<D>. norm (content K *\<^sub>R f x))"
         unfolding split_def by (rule norm_sum)
       also have "... \<le> (\<Sum>(i, j) \<in> Sigma {..N + 1} q.
                           (real i + 1) * (case j of (x, K) \<Rightarrow> content K *\<^sub>R indicator S x))"
       proof (rule sum_le_inc, safe)
         show "finite (Sigma {..N+1} q)"
           by (meson finite_SigmaI finite_atMost tagged_division_of_finite q(1)) 
       next
         fix x K
         assume xk: "(x, K) \<in> \<D>"
         define n where "n = nat \<lfloor>norm (f x)\<rfloor>"
         have *: "norm (f x) \<in> (\<lambda>(x, K). norm (f x)) ` \<D>"
           using xk by auto
         have nfx: "real n \<le> norm (f x)" "norm (f x) \<le> real n + 1"
           unfolding n_def by auto
         then have "n \<in> {0..N + 1}"
           using N[OF *] by auto
         moreover have "K \<subseteq> \<gamma> (nat \<lfloor>norm (f x)\<rfloor>) x"
           using that(2) xk by auto
         moreover then have "(x, K) \<in> q (nat \<lfloor>norm (f x)\<rfloor>)"
           by (simp add: q(3) xk)
         moreover then have "(x, K) \<in> q n"
           using n_def by blast
         moreover
         have "norm (content K *\<^sub>R f x) \<le> (real n + 1) * (content K * indicator S x)"
         proof (cases "x \<in> S")
           case False
           then show ?thesis by (simp add: 0)
         next
           case True
           have *: "content K \<ge> 0"
             using tagged_division_ofD(4)[OF that(1) xk] by auto
           moreover have "content K * norm (f x) \<le> content K * (real n + 1)"
             by (simp add: mult_left_mono nfx(2))
           ultimately show ?thesis
             using nfx True by (auto simp: field_simps)
         qed
         ultimately show "\<exists>y. (y, x, K) \<in> (Sigma {..N + 1} q) \<and> norm (content K *\<^sub>R f x) \<le>
           (real y + 1) * (content K *\<^sub>R indicator S x)"
           by force
       qed auto
       also have "... = (\<Sum>i\<le>N + 1. \<Sum>j\<in>q i. (real i + 1) * (case j of (x, K) \<Rightarrow> content K *\<^sub>R indicator S x))"
         using q(1) by (intro sum_Sigma_product [symmetric]) auto
       also have "... \<le> (\<Sum>i\<le>N + 1. (real i + 1) * \<bar>\<Sum>(x,K) \<in> q i. content K *\<^sub>R indicator S x\<bar>)"
         by (rule sum_mono) (simp add: sum_distrib_left [symmetric])
       also have "... \<le> (\<Sum>i\<le>N + 1. e/2/2 ^ i)"
       proof (rule sum_mono)
         show "(real i + 1) * \<bar>\<Sum>(x,K) \<in> q i. content K *\<^sub>R indicator S x\<bar> \<le> e/2/2 ^ i"
           if "i \<in> {..N + 1}" for i
           using \<gamma>[of "q i" i] q by (simp add: divide_simps mult.left_commute)
       qed
       also have "... = e/2 * (\<Sum>i\<le>N + 1. (1/2) ^ i)"
         unfolding sum_distrib_left by (metis divide_inverse inverse_eq_divide power_one_over)
       also have "\<dots> < e/2 * 2"
       proof (rule mult_strict_left_mono)
         have "sum (power (1/2)) {..N + 1} = sum (power (1/2::real)) {..<N + 2}"
           using lessThan_Suc_atMost by auto
         also have "... < 2"
           by (auto simp: geometric_sum)
         finally show "sum (power (1/2::real)) {..N + 1} < 2" .
       qed (use \<open>0 < e\<close> in auto)
       finally  show ?thesis by auto
     qed
   qed
 qed
 
 
 proposition has_integral_negligible:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes negs: "negligible S"
     and "\<And>x. x \<in> (T - S) \<Longrightarrow> f x = 0"
   shows "(f has_integral 0) T"
 proof (cases "\<exists>a b. T = cbox a b")
   case True
   then have "((\<lambda>x. if x \<in> T then f x else 0) has_integral 0) T"
     using assms by (auto intro!: has_integral_negligible_cbox)
   then show ?thesis
     by (rule has_integral_eq [rotated]) auto
 next
   case False
   let ?f = "(\<lambda>x. if x \<in> T then f x else 0)"
   have "((\<lambda>x. if x \<in> T then f x else 0) has_integral 0) T"
     apply (auto simp: False has_integral_alt [of ?f])
     apply (rule_tac x=1 in exI, auto)
     apply (rule_tac x=0 in exI, simp add: has_integral_negligible_cbox [OF negs] assms)
     done
   then show ?thesis
     by (rule_tac f="?f" in has_integral_eq) auto
 qed
 
 lemma
   assumes "negligible S"
   shows integrable_negligible: "f integrable_on S" and integral_negligible: "integral S f = 0"
   using has_integral_negligible [OF assms]
   by (auto simp: has_integral_iff)
 
 lemma has_integral_spike:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "negligible S"
     and gf: "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
     and fint: "(f has_integral y) T"
   shows "(g has_integral y) T"
 proof -
   have *: "(g has_integral y) (cbox a b)"
        if "(f has_integral y) (cbox a b)" "\<forall>x \<in> cbox a b - S. g x = f x" for a b f and g:: "'b \<Rightarrow> 'a" and y
   proof -
     have "((\<lambda>x. f x + (g x - f x)) has_integral (y + 0)) (cbox a b)"
       using that by (intro has_integral_add has_integral_negligible) (auto intro!: \<open>negligible S\<close>)
     then show ?thesis
       by auto
   qed
   have \<section>: "\<And>a b z. \<lbrakk>\<And>x. x \<in> T \<and> x \<notin> S \<Longrightarrow> g x = f x;
                      ((\<lambda>x. if x \<in> T then f x else 0) has_integral z) (cbox a b)\<rbrakk>
                     \<Longrightarrow> ((\<lambda>x. if x \<in> T then g x else 0) has_integral z) (cbox a b)"
       by (auto dest!: *[where f="\<lambda>x. if x\<in>T then f x else 0" and g="\<lambda>x. if x \<in> T then g x else 0"])
   show ?thesis
     using fint gf
     apply (subst has_integral_alt)
     apply (subst (asm) has_integral_alt)
     apply (auto split: if_split_asm)
      apply (blast dest: *)
     using \<section> by meson
 qed
 
 lemma has_integral_spike_eq:
   assumes "negligible S"
     and gf: "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "(f has_integral y) T \<longleftrightarrow> (g has_integral y) T"
     using has_integral_spike [OF \<open>negligible S\<close>] gf
     by metis
 
 lemma integrable_spike:
   assumes "f integrable_on T" "negligible S" "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
     shows "g integrable_on T"
   using assms unfolding integrable_on_def by (blast intro: has_integral_spike)
 
 lemma integral_spike:
   assumes "negligible S"
     and "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "integral T f = integral T g"
   using has_integral_spike_eq[OF assms]
     by (auto simp: integral_def integrable_on_def)
 
 
 subsection \<open>Some other trivialities about negligible sets\<close>
 
 lemma negligible_subset:
   assumes "negligible s" "t \<subseteq> s"
   shows "negligible t"
   unfolding negligible_def
     by (metis (no_types) Diff_iff assms contra_subsetD has_integral_negligible indicator_simps(2))
 
 lemma negligible_diff[intro?]:
   assumes "negligible s"
   shows "negligible (s - t)"
   using assms by (meson Diff_subset negligible_subset)
 
 lemma negligible_Int:
   assumes "negligible s \<or> negligible t"
   shows "negligible (s \<inter> t)"
   using assms negligible_subset by force
 
 lemma negligible_Un:
   assumes "negligible S" and T: "negligible T"
   shows "negligible (S \<union> T)"
 proof -
   have "(indicat_real (S \<union> T) has_integral 0) (cbox a b)"
     if S0: "(indicat_real S has_integral 0) (cbox a b)" 
       and  "(indicat_real T has_integral 0) (cbox a b)" for a b
   proof (subst has_integral_spike_eq[OF T])
     show "indicat_real S x = indicat_real (S \<union> T) x" if "x \<in> cbox a b - T" for x
-      by (metis Diff_iff Un_iff indicator_def that)
+      using that by (simp add: indicator_def)
     show "(indicat_real S has_integral 0) (cbox a b)"
       by (simp add: S0)
   qed
   with assms show ?thesis
     unfolding negligible_def by blast
 qed
 
 lemma negligible_Un_eq[simp]: "negligible (s \<union> t) \<longleftrightarrow> negligible s \<and> negligible t"
   using negligible_Un negligible_subset by blast
 
 lemma negligible_sing[intro]: "negligible {a::'a::euclidean_space}"
   using negligible_standard_hyperplane[OF SOME_Basis, of "a \<bullet> (SOME i. i \<in> Basis)"] negligible_subset by blast
 
 lemma negligible_insert[simp]: "negligible (insert a s) \<longleftrightarrow> negligible s"
   by (metis insert_is_Un negligible_Un_eq negligible_sing)
 
 lemma negligible_empty[iff]: "negligible {}"
   using negligible_insert by blast
 
 text\<open>Useful in this form for backchaining\<close>
 lemma empty_imp_negligible: "S = {} \<Longrightarrow> negligible S"
   by simp
 
 lemma negligible_finite[intro]:
   assumes "finite s"
   shows "negligible s"
   using assms by (induct s) auto
 
 lemma negligible_Union[intro]:
   assumes "finite \<T>"
     and "\<And>t. t \<in> \<T> \<Longrightarrow> negligible t"
   shows "negligible(\<Union>\<T>)"
   using assms by induct auto
 
 lemma negligible: "negligible S \<longleftrightarrow> (\<forall>T. (indicat_real S has_integral 0) T)"
 proof (intro iffI allI)
   fix T
   assume "negligible S"
   then show "(indicator S has_integral 0) T"
     by (meson Diff_iff has_integral_negligible indicator_simps(2))
 qed (simp add: negligible_def)
 
 subsection \<open>Finite case of the spike theorem is quite commonly needed\<close>
 
 lemma has_integral_spike_finite:
   assumes "finite S"
     and "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
     and "(f has_integral y) T"
   shows "(g has_integral y) T"
   using assms has_integral_spike negligible_finite by blast
 
 lemma has_integral_spike_finite_eq:
   assumes "finite S"
     and "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "((f has_integral y) T \<longleftrightarrow> (g has_integral y) T)"
   by (metis assms has_integral_spike_finite)
 
 lemma integrable_spike_finite:
   assumes "finite S"
     and "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
     and "f integrable_on T"
   shows "g integrable_on T"
   using assms has_integral_spike_finite by blast
 
 lemma has_integral_bound_spike_finite:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "0 \<le> B" "finite S"
       and f: "(f has_integral i) (cbox a b)"
       and leB: "\<And>x. x \<in> cbox a b - S \<Longrightarrow> norm (f x) \<le> B"
     shows "norm i \<le> B * content (cbox a b)"
 proof -
   define g where "g \<equiv> (\<lambda>x. if x \<in> S then 0 else f x)"
   then have "\<And>x. x \<in> cbox a b - S \<Longrightarrow> norm (g x) \<le> B"
     using leB by simp
   moreover have "(g has_integral i) (cbox a b)"
     using has_integral_spike_finite [OF \<open>finite S\<close> _ f]
     by (simp add: g_def)
   ultimately show ?thesis
     by (simp add: \<open>0 \<le> B\<close> g_def has_integral_bound)
 qed
 
 corollary has_integral_bound_real:
   fixes f :: "real \<Rightarrow> 'b::real_normed_vector"
   assumes "0 \<le> B" "finite S"
       and "(f has_integral i) {a..b}"
       and "\<And>x. x \<in> {a..b} - S \<Longrightarrow> norm (f x) \<le> B"
     shows "norm i \<le> B * content {a..b}"
   by (metis assms box_real(2) has_integral_bound_spike_finite)
 
 
 subsection \<open>In particular, the boundary of an interval is negligible\<close>
 
 lemma negligible_frontier_interval: "negligible(cbox (a::'a::euclidean_space) b - box a b)"
 proof -
   let ?A = "\<Union>((\<lambda>k. {x. x\<bullet>k = a\<bullet>k} \<union> {x::'a. x\<bullet>k = b\<bullet>k}) ` Basis)"
   have "negligible ?A"
     by (force simp add: negligible_Union[OF finite_imageI])
   moreover have "cbox a b - box a b \<subseteq> ?A"
     by (force simp add: mem_box)
   ultimately show ?thesis
     by (rule negligible_subset)
 qed
 
 lemma has_integral_spike_interior:
   assumes f: "(f has_integral y) (cbox a b)" and gf: "\<And>x. x \<in> box a b \<Longrightarrow> g x = f x"
   shows "(g has_integral y) (cbox a b)"
   by (meson Diff_iff gf has_integral_spike[OF negligible_frontier_interval _ f])
   
 lemma has_integral_spike_interior_eq:
   assumes "\<And>x. x \<in> box a b \<Longrightarrow> g x = f x"
   shows "(f has_integral y) (cbox a b) \<longleftrightarrow> (g has_integral y) (cbox a b)"
   by (metis assms has_integral_spike_interior)
 
 lemma integrable_spike_interior:
   assumes "\<And>x. x \<in> box a b \<Longrightarrow> g x = f x"
     and "f integrable_on cbox a b"
   shows "g integrable_on cbox a b"
   using assms has_integral_spike_interior_eq by blast
 
 
 subsection \<open>Integrability of continuous functions\<close>
 
 lemma operative_approximableI:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "0 \<le> e"
   shows "operative conj True (\<lambda>i. \<exists>g. (\<forall>x\<in>i. norm (f x - g (x::'b)) \<le> e) \<and> g integrable_on i)"
 proof -
   interpret comm_monoid conj True
     by standard auto
   show ?thesis
   proof (standard, safe)
     fix a b :: 'b
     show "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
       if "box a b = {}" for a b
       using assms that
       by (metis content_eq_0_interior integrable_on_null interior_cbox norm_zero right_minus_eq)
     {
       fix c g and k :: 'b
       assume fg: "\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e" and g: "g integrable_on cbox a b"
       assume k: "k \<in> Basis"
       show "\<exists>g. (\<forall>x\<in>cbox a b \<inter> {x. x \<bullet> k \<le> c}. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c}"
            "\<exists>g. (\<forall>x\<in>cbox a b \<inter> {x. c \<le> x \<bullet> k}. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k}"
         using fg g k by auto
     }
     show "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
       if fg1: "\<forall>x\<in>cbox a b \<inter> {x. x \<bullet> k \<le> c}. norm (f x - g1 x) \<le> e" 
         and g1: "g1 integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c}"
         and fg2: "\<forall>x\<in>cbox a b \<inter> {x. c \<le> x \<bullet> k}. norm (f x - g2 x) \<le> e" 
         and g2: "g2 integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k}" 
         and k: "k \<in> Basis"
       for c k g1 g2
     proof -
       let ?g = "\<lambda>x. if x\<bullet>k = c then f x else if x\<bullet>k \<le> c then g1 x else g2 x"
       show "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
       proof (intro exI conjI ballI)
         show "norm (f x - ?g x) \<le> e" if "x \<in> cbox a b" for x
           by (auto simp: that assms fg1 fg2)
         show "?g integrable_on cbox a b"
         proof -
           have "?g integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c}" "?g integrable_on cbox a b \<inter> {x. x \<bullet> k \<ge> c}"
             by(rule integrable_spike[OF _ negligible_standard_hyperplane[of k c]], use k g1 g2 in auto)+
           with has_integral_split[OF _ _ k] show ?thesis
             unfolding integrable_on_def by blast
         qed
       qed
     qed
   qed
 qed
 
 lemma comm_monoid_set_F_and: "comm_monoid_set.F (\<and>) True f s \<longleftrightarrow> (finite s \<longrightarrow> (\<forall>x\<in>s. f x))"
 proof -
   interpret bool: comm_monoid_set \<open>(\<and>)\<close> True ..
   show ?thesis
     by (induction s rule: infinite_finite_induct) auto
 qed
 
 lemma approximable_on_division:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "0 \<le> e"
     and d: "d division_of (cbox a b)"
     and f: "\<forall>i\<in>d. \<exists>g. (\<forall>x\<in>i. norm (f x - g x) \<le> e) \<and> g integrable_on i"
   obtains g where "\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e" "g integrable_on cbox a b"
 proof -
   interpret operative conj True "\<lambda>i. \<exists>g. (\<forall>x\<in>i. norm (f x - g (x::'b)) \<le> e) \<and> g integrable_on i"
     using \<open>0 \<le> e\<close> by (rule operative_approximableI)
   from f local.division [OF d] that show thesis
     by auto
 qed
 
 lemma integrable_continuous:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "continuous_on (cbox a b) f"
   shows "f integrable_on cbox a b"
 proof (rule integrable_uniform_limit)
   fix e :: real
   assume e: "e > 0"
   then obtain d where "0 < d" and d: "\<And>x x'. \<lbrakk>x \<in> cbox a b; x' \<in> cbox a b; dist x' x < d\<rbrakk> \<Longrightarrow> dist (f x') (f x) < e"
     using compact_uniformly_continuous[OF assms compact_cbox] unfolding uniformly_continuous_on_def by metis
   obtain p where ptag: "p tagged_division_of cbox a b" and finep: "(\<lambda>x. ball x d) fine p"
     using fine_division_exists[OF gauge_ball[OF \<open>0 < d\<close>], of a b] .
   have *: "\<forall>i\<in>snd ` p. \<exists>g. (\<forall>x\<in>i. norm (f x - g x) \<le> e) \<and> g integrable_on i"
   proof (safe, unfold snd_conv)
     fix x l
     assume as: "(x, l) \<in> p"
     obtain a b where l: "l = cbox a b"
       using as ptag by blast
     then have x: "x \<in> cbox a b"
       using as ptag by auto
     show "\<exists>g. (\<forall>x\<in>l. norm (f x - g x) \<le> e) \<and> g integrable_on l"
     proof (intro exI conjI strip)
       show "(\<lambda>y. f x) integrable_on l"
         unfolding integrable_on_def l by blast
     next
       fix y
       assume y: "y \<in> l"
       then have "y \<in> ball x d"
         using as finep by fastforce
       then show "norm (f y - f x) \<le> e"
         using d x y as l
         by (metis dist_commute dist_norm less_imp_le mem_ball ptag subsetCE tagged_division_ofD(3))
     qed
   qed
   from e have "e \<ge> 0"
     by auto
   from approximable_on_division[OF this division_of_tagged_division[OF ptag] *]
   show "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
     by metis
 qed
 
 lemma integrable_continuous_interval:
   fixes f :: "'b::ordered_euclidean_space \<Rightarrow> 'a::banach"
   assumes "continuous_on {a..b} f"
   shows "f integrable_on {a..b}"
   by (metis assms integrable_continuous interval_cbox)
 
 lemmas integrable_continuous_real = integrable_continuous_interval[where 'b=real]
 
 lemma integrable_continuous_closed_segment:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "continuous_on (closed_segment a b) f"
   shows "f integrable_on (closed_segment a b)"
   using assms
   by (auto intro!: integrable_continuous_interval simp: closed_segment_eq_real_ivl)
 
 
 subsection \<open>Specialization of additivity to one dimension\<close>
 
 
 subsection \<open>A useful lemma allowing us to factor out the content size\<close>
 
 lemma has_integral_factor_content:
   "(f has_integral i) (cbox a b) \<longleftrightarrow>
     (\<forall>e>0. \<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of (cbox a b) \<and> d fine p \<longrightarrow>
       norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p - i) \<le> e * content (cbox a b)))"
 proof (cases "content (cbox a b) = 0")
   case True
   have "\<And>e p. p tagged_division_of cbox a b \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x)) \<le> e * content (cbox a b)"
     unfolding sum_content_null[OF True] True by force
   moreover have "i = 0" 
     if "\<And>e. e > 0 \<Longrightarrow> \<exists>d. gauge d \<and>
               (\<forall>p. p tagged_division_of cbox a b \<and>
                    d fine p \<longrightarrow>
                    norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) \<le> e * content (cbox a b))"
     using that [of 1]
     by (force simp add: True sum_content_null[OF True] intro: fine_division_exists[of _ a b])
   ultimately show ?thesis
     unfolding has_integral_null_eq[OF True]
     by (force simp add: )
 next
   case False
   then have F: "0 < content (cbox a b)"
     using zero_less_measure_iff by blast
   let ?P = "\<lambda>e opp. \<exists>d. gauge d \<and>
     (\<forall>p. p tagged_division_of (cbox a b) \<and> d fine p \<longrightarrow> opp (norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i)) e)"
   show ?thesis
   proof (subst has_integral, safe)
     fix e :: real
     assume e: "e > 0"
     show "?P (e * content (cbox a b)) (\<le>)" if \<section>[rule_format]: "\<forall>\<epsilon>>0. ?P \<epsilon> (<)"
       using \<section> [of "e * content (cbox a b)"]
       by (meson F e less_imp_le mult_pos_pos)
     show "?P e (<)" if \<section>[rule_format]:  "\<forall>\<epsilon>>0. ?P (\<epsilon> * content (cbox a b)) (\<le>)"
       using \<section> [of "e/2 / content (cbox a b)"]
         using F e by (force simp add: algebra_simps)
   qed
 qed
 
 lemma has_integral_factor_content_real:
   "(f has_integral i) {a..b::real} \<longleftrightarrow>
     (\<forall>e>0. \<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of {a..b}  \<and> d fine p \<longrightarrow>
       norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p - i) \<le> e * content {a..b} ))"
   unfolding box_real[symmetric]
   by (rule has_integral_factor_content)
 
 
 subsection \<open>Fundamental theorem of calculus\<close>
 
 lemma interval_bounds_real:
   fixes q b :: real
   assumes "a \<le> b"
   shows "Sup {a..b} = b"
     and "Inf {a..b} = a"
   using assms by auto
 
 theorem fundamental_theorem_of_calculus:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "a \<le> b" 
       and vecd: "\<And>x. x \<in> {a..b} \<Longrightarrow> (f has_vector_derivative f' x) (at x within {a..b})"
   shows "(f' has_integral (f b - f a)) {a..b}"
   unfolding has_integral_factor_content box_real[symmetric]
 proof safe
   fix e :: real
   assume "e > 0"
   then have "\<forall>x. \<exists>d>0. x \<in> {a..b} \<longrightarrow>
          (\<forall>y\<in>{a..b}. norm (y-x) < d \<longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e * norm (y-x))"
     using vecd[unfolded has_vector_derivative_def has_derivative_within_alt] by blast
   then obtain d where d: "\<And>x. 0 < d x"
                  "\<And>x y. \<lbrakk>x \<in> {a..b}; y \<in> {a..b}; norm (y-x) < d x\<rbrakk>
                         \<Longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e * norm (y-x)"
     by metis  
   show "\<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of (cbox a b) \<and> d fine p \<longrightarrow>
     norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f' x) - (f b - f a)) \<le> e * content (cbox a b))"
   proof (rule exI, safe)
     show "gauge (\<lambda>x. ball x (d x))"
       using d(1) gauge_ball_dependent by blast
   next
     fix p
     assume ptag: "p tagged_division_of cbox a b" and finep: "(\<lambda>x. ball x (d x)) fine p"
     have ba: "b - a = (\<Sum>(x,K)\<in>p. Sup K - Inf K)" "f b - f a = (\<Sum>(x,K)\<in>p. f(Sup K) - f(Inf K))"
       using additive_tagged_division_1[where f= "\<lambda>x. x"] additive_tagged_division_1[where f= f]
             \<open>a \<le> b\<close> ptag by auto
     have "norm (\<Sum>(x, K) \<in> p. (content K *\<^sub>R f' x) - (f (Sup K) - f (Inf K)))
           \<le> (\<Sum>n\<in>p. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))"
     proof (rule sum_norm_le,safe)
       fix x K
       assume "(x, K) \<in> p"
       then have "x \<in> K" and kab: "K \<subseteq> cbox a b"
         using ptag by blast+
       then obtain u v where k: "K = cbox u v" and "x \<in> K" and kab: "K \<subseteq> cbox a b"
         using ptag \<open>(x, K) \<in> p\<close> by auto 
       have "u \<le> v"
         using \<open>x \<in> K\<close> unfolding k by auto
       have ball: "\<forall>y\<in>K. y \<in> ball x (d x)"
         using finep \<open>(x, K) \<in> p\<close> by blast
       have "u \<in> K" "v \<in> K"
         by (simp_all add: \<open>u \<le> v\<close> k)
       have "norm ((v - u) *\<^sub>R f' x - (f v - f u)) = norm (f u - f x - (u - x) *\<^sub>R f' x - (f v - f x - (v - x) *\<^sub>R f' x))"
         by (auto simp add: algebra_simps)
       also have "... \<le> norm (f u - f x - (u - x) *\<^sub>R f' x) + norm (f v - f x - (v - x) *\<^sub>R f' x)"
         by (rule norm_triangle_ineq4)
       finally have "norm ((v - u) *\<^sub>R f' x - (f v - f u)) \<le>
         norm (f u - f x - (u - x) *\<^sub>R f' x) + norm (f v - f x - (v - x) *\<^sub>R f' x)" .
       also have "\<dots> \<le> e * norm (u - x) + e * norm (v - x)"
       proof (rule add_mono)
         show "norm (f u - f x - (u - x) *\<^sub>R f' x) \<le> e * norm (u - x)"
         proof (rule d)
           show "norm (u - x) < d x"
             using \<open>u \<in> K\<close> ball by (auto simp add: dist_real_def)
         qed (use \<open>x \<in> K\<close> \<open>u \<in> K\<close> kab in auto)
         show "norm (f v - f x - (v - x) *\<^sub>R f' x) \<le> e * norm (v - x)"
         proof (rule d)
           show "norm (v - x) < d x"
             using \<open>v \<in> K\<close> ball by (auto simp add: dist_real_def)
         qed (use \<open>x \<in> K\<close> \<open>v \<in> K\<close> kab in auto)
       qed
       also have "\<dots> \<le> e * (Sup K - Inf K)"
         using \<open>x \<in> K\<close> by (auto simp: k interval_bounds_real[OF \<open>u \<le> v\<close>] field_simps)
       finally show "norm (content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) \<le> e * (Sup K - Inf K)"
         using \<open>u \<le> v\<close> by (simp add: k)
     qed
     with \<open>a \<le> b\<close> show "norm ((\<Sum>(x, K)\<in>p. content K *\<^sub>R f' x) - (f b - f a)) \<le> e * content (cbox a b)"
       by (auto simp: ba split_def sum_subtractf [symmetric] sum_distrib_left)
   qed
 qed
 
 lemma ident_has_integral:
   fixes a::real
   assumes "a \<le> b"
   shows "((\<lambda>x. x) has_integral (b\<^sup>2 - a\<^sup>2)/2) {a..b}"
 proof -
   have "((\<lambda>x. x) has_integral inverse 2 * b\<^sup>2 - inverse 2 * a\<^sup>2) {a..b}"
     unfolding power2_eq_square
     by (rule fundamental_theorem_of_calculus [OF assms] derivative_eq_intros | simp)+
   then show ?thesis
     by (simp add: field_simps)
 qed
 
 lemma integral_ident [simp]:
   fixes a::real
   assumes "a \<le> b"
   shows "integral {a..b} (\<lambda>x. x) = (if a \<le> b then (b\<^sup>2 - a\<^sup>2)/2 else 0)"
   by (metis assms ident_has_integral integral_unique)
 
 lemma ident_integrable_on:
   fixes a::real
   shows "(\<lambda>x. x) integrable_on {a..b}"
 by (metis atLeastatMost_empty_iff integrable_on_def has_integral_empty ident_has_integral)
 
 lemma integral_sin [simp]:
   fixes a::real
   assumes "a \<le> b" shows "integral {a..b} sin = cos a - cos b"
 proof -
   have "(sin has_integral (- cos b - - cos a)) {a..b}"
   proof (rule fundamental_theorem_of_calculus)
     show "((\<lambda>a. - cos a) has_vector_derivative sin x) (at x within {a..b})" for x
       unfolding has_field_derivative_iff_has_vector_derivative [symmetric]
       by (rule derivative_eq_intros | force)+
   qed (use assms in auto)
   then show ?thesis
     by (simp add: integral_unique)
 qed
 
 lemma integral_cos [simp]:
   fixes a::real
   assumes "a \<le> b" shows "integral {a..b} cos = sin b - sin a"
 proof -
   have "(cos has_integral (sin b - sin a)) {a..b}"
   proof (rule fundamental_theorem_of_calculus)
     show "(sin has_vector_derivative cos x) (at x within {a..b})" for x
       unfolding has_field_derivative_iff_has_vector_derivative [symmetric]
       by (rule derivative_eq_intros | force)+
   qed (use assms in auto)
   then show ?thesis
     by (simp add: integral_unique)
 qed
 
 lemma has_integral_sin_nx: "((\<lambda>x. sin(real_of_int n * x)) has_integral 0) {-pi..pi}"
 proof (cases "n = 0")
   case False
   have "((\<lambda>x. sin (n * x)) has_integral (- cos (n * pi)/n - - cos (n * - pi)/n)) {-pi..pi}"
   proof (rule fundamental_theorem_of_calculus)
     show "((\<lambda>x. - cos (n * x) / n) has_vector_derivative sin (n * a)) (at a within {-pi..pi})"
       if "a \<in> {-pi..pi}" for a :: real
       using that False
       unfolding has_vector_derivative_def
       by (intro derivative_eq_intros | force)+
   qed auto
   then show ?thesis
     by simp
 qed auto
 
 lemma integral_sin_nx:
    "integral {-pi..pi} (\<lambda>x. sin(x * real_of_int n)) = 0"
   using has_integral_sin_nx [of n] by (force simp: mult.commute)
 
 lemma has_integral_cos_nx:
   "((\<lambda>x. cos(real_of_int n * x)) has_integral (if n = 0 then 2 * pi else 0)) {-pi..pi}"
 proof (cases "n = 0")
   case True
   then show ?thesis
     using has_integral_const_real [of "1::real" "-pi" pi] by auto
 next
   case False
   have "((\<lambda>x. cos (n * x)) has_integral (sin (n * pi)/n - sin (n * - pi)/n)) {-pi..pi}"
   proof (rule fundamental_theorem_of_calculus)
     show "((\<lambda>x. sin (n * x) / n) has_vector_derivative cos (n * x)) (at x within {-pi..pi})"
       if "x \<in> {-pi..pi}"
       for x :: real
       using that False
       unfolding has_vector_derivative_def
       by (intro derivative_eq_intros | force)+
   qed auto
   with False show ?thesis
     by (simp add: mult.commute)
 qed
 
 lemma integral_cos_nx:
    "integral {-pi..pi} (\<lambda>x. cos(x * real_of_int n)) = (if n = 0 then 2 * pi else 0)"
   using has_integral_cos_nx [of n] by (force simp: mult.commute)
 
 
 subsection \<open>Taylor series expansion\<close>
 
 lemma mvt_integral:
   fixes f::"'a::real_normed_vector\<Rightarrow>'b::banach"
   assumes f'[derivative_intros]:
     "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   assumes line_in: "\<And>t. t \<in> {0..1} \<Longrightarrow> x + t *\<^sub>R y \<in> S"
   shows "f (x + y) - f x = integral {0..1} (\<lambda>t. f' (x + t *\<^sub>R y) y)" (is ?th1)
 proof -
   from assms have subset: "(\<lambda>xa. x + xa *\<^sub>R y) ` {0..1} \<subseteq> S" by auto
   note [derivative_intros] =
     has_derivative_subset[OF _ subset]
     has_derivative_in_compose[where f="(\<lambda>xa. x + xa *\<^sub>R y)" and g = f]
   note [continuous_intros] =
     continuous_on_compose2[where f="(\<lambda>xa. x + xa *\<^sub>R y)"]
     continuous_on_subset[OF _ subset]
   have "\<And>t. t \<in> {0..1} \<Longrightarrow>
     ((\<lambda>t. f (x + t *\<^sub>R y)) has_vector_derivative f' (x + t *\<^sub>R y) y)
     (at t within {0..1})"
     using assms
     by (auto simp: has_vector_derivative_def
         linear_cmul[OF has_derivative_linear[OF f'], symmetric]
       intro!: derivative_eq_intros)
   from fundamental_theorem_of_calculus[rule_format, OF _ this]
   show ?th1
     by (auto intro!: integral_unique[symmetric])
 qed
 
 lemma (in bounded_bilinear) sum_prod_derivatives_has_vector_derivative:
   assumes "p>0"
   and f0: "Df 0 = f"
   and Df: "\<And>m t. m < p \<Longrightarrow> a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (Df m has_vector_derivative Df (Suc m) t) (at t within {a..b})"
   and g0: "Dg 0 = g"
   and Dg: "\<And>m t. m < p \<Longrightarrow> a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (Dg m has_vector_derivative Dg (Suc m) t) (at t within {a..b})"
   and ivl: "a \<le> t" "t \<le> b"
   shows "((\<lambda>t. \<Sum>i<p. (-1)^i *\<^sub>R prod (Df i t) (Dg (p - Suc i) t))
     has_vector_derivative
       prod (f t) (Dg p t) - (-1)^p *\<^sub>R prod (Df p t) (g t))
     (at t within {a..b})"
   using assms
 proof cases
   assume p: "p \<noteq> 1"
   define p' where "p' = p - 2"
   from assms p have p': "{..<p} = {..Suc p'}" "p = Suc (Suc p')"
     by (auto simp: p'_def)
   have *: "\<And>i. i \<le> p' \<Longrightarrow> Suc (Suc p' - i) = (Suc (Suc p') - i)"
     by auto
   let ?f = "\<lambda>i. (-1) ^ i *\<^sub>R (prod (Df i t) (Dg ((p - i)) t))"
   have "(\<Sum>i<p. (-1) ^ i *\<^sub>R (prod (Df i t) (Dg (Suc (p - Suc i)) t) +
     prod (Df (Suc i) t) (Dg (p - Suc i) t))) =
     (\<Sum>i\<le>(Suc p'). ?f i - ?f (Suc i))"
     by (auto simp: algebra_simps p'(2) numeral_2_eq_2 * lessThan_Suc_atMost)
   also note sum_telescope
   finally
   have "(\<Sum>i<p. (-1) ^ i *\<^sub>R (prod (Df i t) (Dg (Suc (p - Suc i)) t) +
     prod (Df (Suc i) t) (Dg (p - Suc i) t)))
     = prod (f t) (Dg p t) - (- 1) ^ p *\<^sub>R prod (Df p t) (g t)"
     unfolding p'[symmetric]
     by (simp add: assms)
   thus ?thesis
     using assms
     by (auto intro!: derivative_eq_intros has_vector_derivative)
 qed (auto intro!: derivative_eq_intros has_vector_derivative)
 
 lemma
   fixes f::"real\<Rightarrow>'a::banach"
   assumes "p>0"
   and f0: "Df 0 = f"
   and Df: "\<And>m t. m < p \<Longrightarrow> a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (Df m has_vector_derivative Df (Suc m) t) (at t within {a..b})"
   and ivl: "a \<le> b"
   defines "i \<equiv> \<lambda>x. ((b - x) ^ (p - 1) / fact (p - 1)) *\<^sub>R Df p x"
   shows Taylor_has_integral:
     "(i has_integral f b - (\<Sum>i<p. ((b-a) ^ i / fact i) *\<^sub>R Df i a)) {a..b}"
   and Taylor_integral:
     "f b = (\<Sum>i<p. ((b-a) ^ i / fact i) *\<^sub>R Df i a) + integral {a..b} i"
   and Taylor_integrable:
     "i integrable_on {a..b}"
 proof goal_cases
   case 1
   interpret bounded_bilinear "scaleR::real\<Rightarrow>'a\<Rightarrow>'a"
     by (rule bounded_bilinear_scaleR)
   define g where "g s = (b - s)^(p - 1)/fact (p - 1)" for s
   define Dg where [abs_def]:
     "Dg n s = (if n < p then (-1)^n * (b - s)^(p - 1 - n) / fact (p - 1 - n) else 0)" for n s
   have g0: "Dg 0 = g"
     using \<open>p > 0\<close>
     by (auto simp add: Dg_def field_split_simps g_def split: if_split_asm)
   {
     fix m
     assume "p > Suc m"
     hence "p - Suc m = Suc (p - Suc (Suc m))"
       by auto
     hence "real (p - Suc m) * fact (p - Suc (Suc m)) = fact (p - Suc m)"
       by auto
   } note fact_eq = this
   have Dg: "\<And>m t. m < p \<Longrightarrow> a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (Dg m has_vector_derivative Dg (Suc m) t) (at t within {a..b})"
     unfolding Dg_def
     by (auto intro!: derivative_eq_intros simp: has_vector_derivative_def fact_eq field_split_simps)
   let ?sum = "\<lambda>t. \<Sum>i<p. (- 1) ^ i *\<^sub>R Dg i t *\<^sub>R Df (p - Suc i) t"
   from sum_prod_derivatives_has_vector_derivative[of _ Dg _ _ _ Df,
       OF \<open>p > 0\<close> g0 Dg f0 Df]
   have deriv: "\<And>t. a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (?sum has_vector_derivative
       g t *\<^sub>R Df p t - (- 1) ^ p *\<^sub>R Dg p t *\<^sub>R f t) (at t within {a..b})"
     by auto
   from fundamental_theorem_of_calculus[rule_format, OF \<open>a \<le> b\<close> deriv]
   have "(i has_integral ?sum b - ?sum a) {a..b}"
     using atLeastatMost_empty'[simp del]
     by (simp add: i_def g_def Dg_def)
   also
   have one: "(- 1) ^ p' * (- 1) ^ p' = (1::real)"
     and "{..<p} \<inter> {i. p = Suc i} = {p - 1}"
     for p'
     using \<open>p > 0\<close>
     by (auto simp: power_mult_distrib[symmetric])
   then have "?sum b = f b"
     using Suc_pred'[OF \<open>p > 0\<close>]
     by (simp add: diff_eq_eq Dg_def power_0_left le_Suc_eq if_distrib
         if_distribR sum.If_cases f0)
   also
   have "{..<p} = (\<lambda>x. p - x - 1) ` {..<p}"
   proof safe
     fix x
     assume "x < p"
     thus "x \<in> (\<lambda>x. p - x - 1) ` {..<p}"
       by (auto intro!: image_eqI[where x = "p - x - 1"])
   qed simp
   from _ this
   have "?sum a = (\<Sum>i<p. ((b-a) ^ i / fact i) *\<^sub>R Df i a)"
     by (rule sum.reindex_cong) (auto simp add: inj_on_def Dg_def one)
   finally show c: ?case .
   case 2 show ?case using c integral_unique
     by (metis (lifting) add.commute diff_eq_eq integral_unique)
   case 3 show ?case using c by force
 qed
 
 
 subsection \<open>Only need trivial subintervals if the interval itself is trivial\<close>
 
 proposition division_of_nontrivial:
   fixes \<D> :: "'a::euclidean_space set set"
   assumes sdiv: "\<D> division_of (cbox a b)"
      and cont0: "content (cbox a b) \<noteq> 0"
   shows "{k. k \<in> \<D> \<and> content k \<noteq> 0} division_of (cbox a b)"
   using sdiv
 proof (induction "card \<D>" arbitrary: \<D> rule: less_induct)
   case less
   note \<D> = division_ofD[OF less.prems]
   {
     presume *: "{k \<in> \<D>. content k \<noteq> 0} \<noteq> \<D> \<Longrightarrow> ?case"
     then show ?case
       using less.prems by fastforce
   }
   assume noteq: "{k \<in> \<D>. content k \<noteq> 0} \<noteq> \<D>"
   then obtain K c d where "K \<in> \<D>" and contk: "content K = 0" and keq: "K = cbox c d"
     using \<D>(4) by blast 
   then have "card \<D> > 0"
     unfolding card_gt_0_iff using less by auto
   then have card: "card (\<D> - {K}) < card \<D>"
     using less \<open>K \<in> \<D>\<close> by (simp add: \<D>(1))
   have closed: "closed (\<Union>(\<D> - {K}))"
     using less.prems by auto
   have "x islimpt \<Union>(\<D> - {K})" if "x \<in> K" for x 
     unfolding islimpt_approachable
   proof (intro allI impI)
     fix e::real
     assume "e > 0"
     obtain i where i: "c\<bullet>i = d\<bullet>i" "i\<in>Basis"
       using contk \<D>(3) [OF \<open>K \<in> \<D>\<close>] unfolding box_ne_empty keq
       by (meson content_eq_0 dual_order.antisym)
     then have xi: "x\<bullet>i = d\<bullet>i"
       using \<open>x \<in> K\<close> unfolding keq mem_box by (metis antisym)
     define y where "y = (\<Sum>j\<in>Basis. (if j = i then if c\<bullet>i \<le> (a\<bullet>i + b\<bullet>i)/2 then c\<bullet>i +
       min e (b\<bullet>i - c\<bullet>i)/2 else c\<bullet>i - min e (c\<bullet>i - a\<bullet>i)/2 else x\<bullet>j) *\<^sub>R j)"
     show "\<exists>x'\<in>\<Union>(\<D> - {K}). x' \<noteq> x \<and> dist x' x < e"
     proof (intro bexI conjI)
       have "d \<in> cbox c d"
         using \<D>(3)[OF \<open>K \<in> \<D>\<close>] by (simp add: box_ne_empty(1) keq mem_box(2))
       then have "d \<in> cbox a b"
         using \<D>(2)[OF \<open>K \<in> \<D>\<close>] by (auto simp: keq)
       then have di: "a \<bullet> i \<le> d \<bullet> i \<and> d \<bullet> i \<le> b \<bullet> i"
         using \<open>i \<in> Basis\<close> mem_box(2) by blast
       then have xyi: "y\<bullet>i \<noteq> x\<bullet>i"
         unfolding y_def i xi using \<open>e > 0\<close> cont0 \<open>i \<in> Basis\<close>
         by (auto simp: content_eq_0 elim!: ballE[of _ _ i])
       then show "y \<noteq> x"
         unfolding euclidean_eq_iff[where 'a='a] using i by auto
       have "norm (y-x) \<le> (\<Sum>b\<in>Basis. \<bar>(y - x) \<bullet> b\<bar>)"
         by (rule norm_le_l1)
       also have "... = \<bar>(y - x) \<bullet> i\<bar> + (\<Sum>b \<in> Basis - {i}. \<bar>(y - x) \<bullet> b\<bar>)"
         by (meson finite_Basis i(2) sum.remove)
       also have "... <  e + sum (\<lambda>i. 0) Basis"
       proof (rule add_less_le_mono)
         show "\<bar>(y-x) \<bullet> i\<bar> < e"
           using di \<open>e > 0\<close> y_def i xi by (auto simp: inner_simps)
         show "(\<Sum>i\<in>Basis - {i}. \<bar>(y-x) \<bullet> i\<bar>) \<le> (\<Sum>i\<in>Basis. 0)"
           unfolding y_def by (auto simp: inner_simps)
       qed 
       finally have "norm (y-x) < e + sum (\<lambda>i. 0) Basis" .
       then show "dist y x < e"
         unfolding dist_norm by auto
       have "y \<notin> K"
         unfolding keq mem_box using i(1) i(2) xi xyi by fastforce
       moreover have "y \<in> \<Union>\<D>"
         using subsetD[OF \<D>(2)[OF \<open>K \<in> \<D>\<close>] \<open>x \<in> K\<close>] \<open>e > 0\<close> di i
         by (auto simp: \<D> mem_box y_def field_simps elim!: ballE[of _ _ i])
       ultimately show "y \<in> \<Union>(\<D> - {K})" by auto
     qed
   qed
   then have "K \<subseteq> \<Union>(\<D> - {K})"
     using closed closed_limpt by blast
   then have "\<Union>(\<D> - {K}) = cbox a b"
     unfolding \<D>(6)[symmetric] by auto
   then have "\<D> - {K} division_of cbox a b"
     by (metis Diff_subset less.prems division_of_subset \<D>(6))
   then have "{ka \<in> \<D> - {K}. content ka \<noteq> 0} division_of (cbox a b)"
     using card less.hyps by blast
   moreover have "{ka \<in> \<D> - {K}. content ka \<noteq> 0} = {K \<in> \<D>. content K \<noteq> 0}"
     using contk by auto
   ultimately show ?case by auto
 qed
 
 
 subsection \<open>Integrability on subintervals\<close>
 
 lemma operative_integrableI:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "0 \<le> e"
   shows "operative conj True (\<lambda>i. f integrable_on i)"
 proof -
   interpret comm_monoid conj True
   proof qed
   show ?thesis
   proof
     show "\<And>a b. box a b = {} \<Longrightarrow> (f integrable_on cbox a b) = True"
       by (simp add: content_eq_0_interior integrable_on_null)
     show "\<And>a b c k.
              k \<in> Basis \<Longrightarrow>
              (f integrable_on cbox a b) \<longleftrightarrow>
              (f integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c} \<and> f integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k})"
       unfolding integrable_on_def by (auto intro!: has_integral_split)
   qed
 qed
 
 lemma integrable_subinterval:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on cbox a b"
     and cd: "cbox c d \<subseteq> cbox a b"
   shows "f integrable_on cbox c d"
 proof -
   interpret operative conj True "\<lambda>i. f integrable_on i"
     using order_refl by (rule operative_integrableI)
   show ?thesis
   proof (cases "cbox c d = {}")
     case True
     then show ?thesis
       using division [symmetric] f by (auto simp: comm_monoid_set_F_and)
   next
     case False
     then show ?thesis
       by (metis cd comm_monoid_set_F_and division division_of_finite f partial_division_extend_1)
   qed
 qed
 
 lemma integrable_subinterval_real:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "f integrable_on {a..b}"
     and "{c..d} \<subseteq> {a..b}"
   shows "f integrable_on {c..d}"
   by (metis assms box_real(2) integrable_subinterval)
 
 subsection \<open>Combining adjacent intervals in 1 dimension\<close>
 
 lemma has_integral_combine:
   fixes a b c :: real and j :: "'a::banach"
   assumes "a \<le> c"
       and "c \<le> b"
       and ac: "(f has_integral i) {a..c}"
       and cb: "(f has_integral j) {c..b}"
   shows "(f has_integral (i + j)) {a..b}"
 proof -
   interpret operative_real "lift_option plus" "Some 0"
     "\<lambda>i. if f integrable_on i then Some (integral i f) else None"
     using operative_integralI by (rule operative_realI)
   from \<open>a \<le> c\<close> \<open>c \<le> b\<close> ac cb coalesce_less_eq
   have *: "lift_option (+)
              (if f integrable_on {a..c} then Some (integral {a..c} f) else None)
              (if f integrable_on {c..b} then Some (integral {c..b} f) else None) =
             (if f integrable_on {a..b} then Some (integral {a..b} f) else None)"
     by (auto simp: split: if_split_asm)
   then have "f integrable_on cbox a b"
     using ac cb by (auto split: if_split_asm)
   with *
   show ?thesis
     using ac cb by (auto simp add: integrable_on_def integral_unique split: if_split_asm)
 qed
 
 lemma integral_combine:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "a \<le> c"
     and "c \<le> b"
     and ab: "f integrable_on {a..b}"
   shows "integral {a..c} f + integral {c..b} f = integral {a..b} f"
 proof -
   have "(f has_integral integral {a..c} f) {a..c}"
     using ab \<open>c \<le> b\<close> integrable_subinterval_real by fastforce
   moreover
   have "(f has_integral integral {c..b} f) {c..b}"
     using ab \<open>a \<le> c\<close> integrable_subinterval_real by fastforce
   ultimately have "(f has_integral integral {a..c} f + integral {c..b} f) {a..b}"
     using \<open>a \<le> c\<close> \<open>c \<le> b\<close> has_integral_combine by blast
   then show ?thesis
     by (simp add: has_integral_integrable_integral)
 qed
 
 lemma integrable_combine:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "a \<le> c"
     and "c \<le> b"
     and "f integrable_on {a..c}"
     and "f integrable_on {c..b}"
   shows "f integrable_on {a..b}"
   using assms
   unfolding integrable_on_def
   by (auto intro!: has_integral_combine)
 
 lemma integral_minus_sets:
   fixes f::"real \<Rightarrow> 'a::banach"
   shows "c \<le> a \<Longrightarrow> c \<le> b \<Longrightarrow> f integrable_on {c .. max a b} \<Longrightarrow>
     integral {c .. a} f - integral {c .. b} f =
     (if a \<le> b then - integral {a .. b} f else integral {b .. a} f)"
   using integral_combine[of c a b f]  integral_combine[of c b a f]
   by (auto simp: algebra_simps max_def)
 
 lemma integral_minus_sets':
   fixes f::"real \<Rightarrow> 'a::banach"
   shows "c \<ge> a \<Longrightarrow> c \<ge> b \<Longrightarrow> f integrable_on {min a b .. c} \<Longrightarrow>
     integral {a .. c} f - integral {b .. c} f =
     (if a \<le> b then integral {a .. b} f else - integral {b .. a} f)"
   using integral_combine[of b a c f] integral_combine[of a b c f]
   by (auto simp: algebra_simps min_def)
 
 subsection \<open>Reduce integrability to "local" integrability\<close>
 
 lemma integrable_on_little_subintervals:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "\<forall>x\<in>cbox a b. \<exists>d>0. \<forall>u v. x \<in> cbox u v \<and> cbox u v \<subseteq> ball x d \<and> cbox u v \<subseteq> cbox a b \<longrightarrow>
     f integrable_on cbox u v"
   shows "f integrable_on cbox a b"
 proof -
   interpret operative conj True "\<lambda>i. f integrable_on i"
     using order_refl by (rule operative_integrableI)
   have "\<forall>x. \<exists>d>0. x\<in>cbox a b \<longrightarrow> (\<forall>u v. x \<in> cbox u v \<and> cbox u v \<subseteq> ball x d \<and> cbox u v \<subseteq> cbox a b \<longrightarrow>
     f integrable_on cbox u v)"
     using assms by (metis zero_less_one)
   then obtain d where d: "\<And>x. 0 < d x"
      "\<And>x u v. \<lbrakk>x \<in> cbox a b; x \<in> cbox u v; cbox u v \<subseteq> ball x (d x); cbox u v \<subseteq> cbox a b\<rbrakk> 
                \<Longrightarrow> f integrable_on cbox u v"
     by metis
   obtain p where p: "p tagged_division_of cbox a b" "(\<lambda>x. ball x (d x)) fine p"
     using fine_division_exists[OF gauge_ball_dependent,of d a b] d(1) by blast 
   then have sndp: "snd ` p division_of cbox a b"
     by (metis division_of_tagged_division)
   have "f integrable_on k" if "(x, k) \<in> p" for x k
     using tagged_division_ofD(2-4)[OF p(1) that] fineD[OF p(2) that] d[of x] by auto
   then show ?thesis
     unfolding division [symmetric, OF sndp] comm_monoid_set_F_and
     by auto
 qed
 
 
 subsection \<open>Second FTC or existence of antiderivative\<close>
 
 lemma integrable_const[intro]: "(\<lambda>x. c) integrable_on cbox a b"
   unfolding integrable_on_def by blast
 
 lemma integral_has_vector_derivative_continuous_at:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on {a..b}"
      and x: "x \<in> {a..b} - S"
      and "finite S"
      and fx: "continuous (at x within ({a..b} - S)) f"
  shows "((\<lambda>u. integral {a..u} f) has_vector_derivative f x) (at x within ({a..b} - S))"
 proof -
   let ?I = "\<lambda>a b. integral {a..b} f"
   { fix e::real
     assume "e > 0"
     obtain d where "d>0" and d: "\<And>x'. \<lbrakk>x' \<in> {a..b} - S; \<bar>x' - x\<bar> < d\<rbrakk> \<Longrightarrow> norm(f x' - f x) \<le> e"
       using \<open>e>0\<close> fx by (auto simp: continuous_within_eps_delta dist_norm less_imp_le)
     have "norm (integral {a..y} f - integral {a..x} f - (y-x) *\<^sub>R f x) \<le> e * \<bar>y - x\<bar>" (is "?lhs \<le> ?rhs")
            if y: "y \<in> {a..b} - S" and yx: "\<bar>y - x\<bar> < d" for y
     proof (cases "y < x")
       case False
       have "f integrable_on {a..y}"
         using f y by (simp add: integrable_subinterval_real)
       then have Idiff: "?I a y - ?I a x = ?I x y"
         using False x by (simp add: algebra_simps integral_combine)
       have fux_int: "((\<lambda>u. f u - f x) has_integral integral {x..y} f - (y-x) *\<^sub>R f x) {x..y}"
       proof (rule has_integral_diff)
         show "(f has_integral integral {x..y} f) {x..y}"
           using x y by (auto intro: integrable_integral [OF integrable_subinterval_real [OF f]])
         show "((\<lambda>u. f x) has_integral (y - x) *\<^sub>R f x) {x..y}"
           using has_integral_const_real [of "f x" x y] False by simp
       qed
       have "?lhs \<le> e * content {x..y}"
         using yx False d x y \<open>e>0\<close> assms 
         by (intro has_integral_bound_real[where f="(\<lambda>u. f u - f x)"]) (auto simp: Idiff fux_int)
       also have "... \<le> ?rhs"
         using False by auto
       finally show ?thesis .
     next
       case True
       have "f integrable_on {a..x}"
         using f x by (simp add: integrable_subinterval_real)
       then have Idiff: "?I a x - ?I a y = ?I y x"
         using True x y by (simp add: algebra_simps integral_combine)
       have fux_int: "((\<lambda>u. f u - f x) has_integral integral {y..x} f - (x - y) *\<^sub>R f x) {y..x}"
       proof (rule has_integral_diff)
         show "(f has_integral integral {y..x} f) {y..x}"
           using x y by (auto intro: integrable_integral [OF integrable_subinterval_real [OF f]])
         show "((\<lambda>u. f x) has_integral (x - y) *\<^sub>R f x) {y..x}"
           using has_integral_const_real [of "f x" y x] True by simp
       qed
       have "norm (integral {a..x} f - integral {a..y} f - (x - y) *\<^sub>R f x) \<le> e * content {y..x}"
         using yx True d x y \<open>e>0\<close> assms 
         by (intro has_integral_bound_real[where f="(\<lambda>u. f u - f x)"]) (auto simp: Idiff fux_int)
       also have "... \<le> e * \<bar>y - x\<bar>"
         using True by auto
       finally have "norm (integral {a..x} f - integral {a..y} f - (x - y) *\<^sub>R f x) \<le> e * \<bar>y - x\<bar>" .
       then show ?thesis
         by (simp add: algebra_simps norm_minus_commute)
     qed
     then have "\<exists>d>0. \<forall>y\<in>{a..b} - S. \<bar>y - x\<bar> < d \<longrightarrow> norm (integral {a..y} f - integral {a..x} f - (y-x) *\<^sub>R f x) \<le> e * \<bar>y - x\<bar>"
       using \<open>d>0\<close> by blast
   }
   then show ?thesis
     by (simp add: has_vector_derivative_def has_derivative_within_alt bounded_linear_scaleR_left)
 qed
 
 
 lemma integral_has_vector_derivative:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "continuous_on {a..b} f"
     and "x \<in> {a..b}"
   shows "((\<lambda>u. integral {a..u} f) has_vector_derivative f(x)) (at x within {a..b})"
 using assms integral_has_vector_derivative_continuous_at [OF integrable_continuous_real]
   by (fastforce simp: continuous_on_eq_continuous_within)
 
 lemma integral_has_real_derivative:
   assumes "continuous_on {a..b} g"
   assumes "t \<in> {a..b}"
   shows "((\<lambda>x. integral {a..x} g) has_real_derivative g t) (at t within {a..b})"
   using integral_has_vector_derivative[of a b g t] assms
   by (auto simp: has_field_derivative_iff_has_vector_derivative)
 
 lemma antiderivative_continuous:
   fixes q b :: real
   assumes "continuous_on {a..b} f"
   obtains g where "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_vector_derivative (f x::_::banach)) (at x within {a..b})"
   using integral_has_vector_derivative[OF assms] by auto
 
 subsection \<open>Combined fundamental theorem of calculus\<close>
 
 lemma antiderivative_integral_continuous:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "continuous_on {a..b} f"
   obtains g where "\<forall>u\<in>{a..b}. \<forall>v \<in> {a..b}. u \<le> v \<longrightarrow> (f has_integral (g v - g u)) {u..v}"
 proof -
   obtain g 
     where g: "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_vector_derivative f x) (at x within {a..b})" 
     using  antiderivative_continuous[OF assms] by metis
   have "(f has_integral g v - g u) {u..v}" if "u \<in> {a..b}" "v \<in> {a..b}" "u \<le> v" for u v
   proof -
     have "\<And>x. x \<in> cbox u v \<Longrightarrow> (g has_vector_derivative f x) (at x within cbox u v)"
       by (metis atLeastAtMost_iff atLeastatMost_subset_iff box_real(2) g
           has_vector_derivative_within_subset subsetCE that(1,2))
     then show ?thesis
       by (metis box_real(2) that(3) fundamental_theorem_of_calculus)
   qed
   then show ?thesis
     using that by blast
 qed
 
 
 subsection \<open>General "twiddling" for interval-to-interval function image\<close>
 
 lemma has_integral_twiddle:
   assumes "0 < r"
     and hg: "\<And>x. h(g x) = x"
     and gh: "\<And>x. g(h x) = x"
     and contg: "\<And>x. continuous (at x) g"
     and g: "\<And>u v. \<exists>w z. g ` cbox u v = cbox w z"
     and h: "\<And>u v. \<exists>w z. h ` cbox u v = cbox w z"
     and r: "\<And>u v. content(g ` cbox u v) = r * content (cbox u v)"
     and intfi: "(f has_integral i) (cbox a b)"
   shows "((\<lambda>x. f(g x)) has_integral (1 / r) *\<^sub>R i) (h ` cbox a b)"
 proof (cases "cbox a b = {}")
   case True
   then show ?thesis 
     using intfi by auto
 next
   case False
   obtain w z where wz: "h ` cbox a b = cbox w z"
     using h by blast
   have inj: "inj g" "inj h"
     using hg gh injI by metis+
   from h obtain ha hb where h_eq: "h ` cbox a b = cbox ha hb" by blast
   have "\<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of h ` cbox a b \<and> d fine p 
               \<longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f (g x)) - (1 / r) *\<^sub>R i) < e)"
     if "e > 0" for e
   proof -
     have "e * r > 0" using that \<open>0 < r\<close> by simp
     with intfi[unfolded has_integral]
     obtain d where "gauge d"
                and d: "\<And>p. p tagged_division_of cbox a b \<and> d fine p 
                         \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) < e * r" 
       by metis
     define d' where "d' x = g -` d (g x)" for x
     show ?thesis
     proof (rule_tac x=d' in exI, safe)
       show "gauge d'"
         using \<open>gauge d\<close> continuous_open_vimage[OF _ contg] by (auto simp: gauge_def d'_def)
     next
       fix p
       assume ptag: "p tagged_division_of h ` cbox a b" and finep: "d' fine p"
       note p = tagged_division_ofD[OF ptag]
       have gab: "g y \<in> cbox a b" if "y \<in> K" "(x, K) \<in> p" for x y K
         by (metis hg inj(2) inj_image_mem_iff p(3) subsetCE that that)
       have gimp: "(\<lambda>(x,K). (g x, g ` K)) ` p tagged_division_of (cbox a b) \<and> 
                   d fine (\<lambda>(x, k). (g x, g ` k)) ` p"
         unfolding tagged_division_of
       proof safe
         show "finite ((\<lambda>(x, k). (g x, g ` k)) ` p)"
           using ptag by auto
         show "d fine (\<lambda>(x, k). (g x, g ` k)) ` p"
           using finep unfolding fine_def d'_def by auto
       next
         fix x k
         assume xk: "(x, k) \<in> p"
         show "g x \<in> g ` k"
           using p(2)[OF xk] by auto
         show "\<exists>u v. g ` k = cbox u v"
           using p(4)[OF xk] using assms(5-6) by auto
         fix x' K' u
         assume xk': "(x', K') \<in> p" and u: "u \<in> interior (g ` k)" "u \<in> interior (g ` K')"
         have "interior k \<inter> interior K' \<noteq> {}"
         proof 
           assume "interior k \<inter> interior K' = {}"
           moreover have "u \<in> g ` (interior k \<inter> interior K')"
             using interior_image_subset[OF \<open>inj g\<close> contg] u
             unfolding image_Int[OF inj(1)] by blast
           ultimately show False by blast
         qed
         then have same: "(x, k) = (x', K')"
           using ptag xk' xk by blast
         then show "g x = g x'"
           by auto
         show "g u \<in> g ` K'"if "u \<in> k" for u
           using that same by auto
         show "g u \<in> g ` k"if "u \<in> K'" for u
           using that same by auto
       next
         fix x
         assume "x \<in> cbox a b"
         then have "h x \<in>  \<Union>{k. \<exists>x. (x, k) \<in> p}"
           using p(6) by auto
         then obtain X y where "h x \<in> X" "(y, X) \<in> p" by blast
         then show "x \<in> \<Union>{k. \<exists>x. (x, k) \<in> (\<lambda>(x, k). (g x, g ` k)) ` p}"
           by clarsimp (metis (no_types, lifting) gh image_eqI pair_imageI)
       qed (use gab in auto)
       have *: "inj_on (\<lambda>(x, k). (g x, g ` k)) p"
         using inj(1) unfolding inj_on_def by fastforce
       have "(\<Sum>(x,K)\<in>(\<lambda>(y,L). (g y, g ` L)) ` p. content K *\<^sub>R f x) 
           = (\<Sum>u\<in>p. case case u of (x,K) \<Rightarrow> (g x, g ` K) of (y,L) \<Rightarrow> content L *\<^sub>R f y)"
         by (metis (mono_tags, lifting) "*" sum.reindex_cong)
       also have "... = (\<Sum>(x,K)\<in>p. r *\<^sub>R content K *\<^sub>R f (g x))"
         using r by (auto intro!: * sum.cong simp: bij_betw_def dest!: p(4))
       finally
       have "(\<Sum>(x, K)\<in>(\<lambda>(x,K). (g x, g ` K)) ` p. content K *\<^sub>R f x) - i = r *\<^sub>R (\<Sum>(x,K)\<in>p. content K *\<^sub>R f (g x)) - i" 
         by (simp add: scaleR_right.sum split_def)
       also have "\<dots> = r *\<^sub>R ((\<Sum>(x,K)\<in>p. content K *\<^sub>R f (g x)) - (1 / r) *\<^sub>R i)" 
         using \<open>0 < r\<close> by (auto simp: scaleR_diff_right)
       finally show "norm ((\<Sum>(x,K)\<in>p. content K *\<^sub>R f (g x)) - (1 / r) *\<^sub>R i) < e"
         using d[OF gimp] \<open>0 < r\<close> by auto
     qed
   qed
   then show ?thesis
     by (auto simp: h_eq has_integral)
 qed
 
 
 subsection \<open>Special case of a basic affine transformation\<close>
 
 lemma AE_lborel_inner_neq:
   assumes k: "k \<in> Basis"
   shows "AE x in lborel. x \<bullet> k \<noteq> c"
 proof -
   interpret finite_product_sigma_finite "\<lambda>_. lborel" Basis
     proof qed simp
     have "emeasure lborel {x\<in>space lborel. x \<bullet> k = c} 
         = emeasure (\<Pi>\<^sub>M j::'a\<in>Basis. lborel) (\<Pi>\<^sub>E j\<in>Basis. if j = k then {c} else UNIV)"
     using k
     by (auto simp add: lborel_eq[where 'a='a] emeasure_distr intro!: arg_cong2[where f=emeasure])
        (auto simp: space_PiM PiE_iff extensional_def split: if_split_asm)
   also have "\<dots> = (\<Prod>j\<in>Basis. emeasure lborel (if j = k then {c} else UNIV))"
     by (intro measure_times) auto
   also have "\<dots> = 0"
     by (intro prod_zero bexI[OF _ k]) auto
   finally show ?thesis
     by (subst AE_iff_measurable[OF _ refl]) auto
 qed
 
 lemma content_image_stretch_interval:
   fixes m :: "'a::euclidean_space \<Rightarrow> real"
   defines "s f x \<equiv> (\<Sum>k::'a\<in>Basis. (f k * (x\<bullet>k)) *\<^sub>R k)"
   shows "content (s m ` cbox a b) = \<bar>\<Prod>k\<in>Basis. m k\<bar> * content (cbox a b)"
 proof cases
   have s[measurable]: "s f \<in> borel \<rightarrow>\<^sub>M borel" for f
     by (auto simp: s_def[abs_def])
   assume m: "\<forall>k\<in>Basis. m k \<noteq> 0"
   then have s_comp_s: "s (\<lambda>k. 1 / m k) \<circ> s m = id" "s m \<circ> s (\<lambda>k. 1 / m k) = id"
     by (auto simp: s_def[abs_def] fun_eq_iff euclidean_representation)
   then have "inv (s (\<lambda>k. 1 / m k)) = s m" "bij (s (\<lambda>k. 1 / m k))"
     by (auto intro: inv_unique_comp o_bij)
   then have eq: "s m ` cbox a b = s (\<lambda>k. 1 / m k) -` cbox a b"
     using bij_vimage_eq_inv_image[OF \<open>bij (s (\<lambda>k. 1 / m k))\<close>, of "cbox a b"] by auto
   show ?thesis
     using m unfolding eq measure_def
     by (subst lborel_affine_euclidean[where c=m and t=0])
        (simp_all add: emeasure_density measurable_sets_borel[OF s] abs_prod nn_integral_cmult
                       s_def[symmetric] emeasure_distr vimage_comp s_comp_s enn2real_mult prod_nonneg)
 next
   assume "\<not> (\<forall>k\<in>Basis. m k \<noteq> 0)"
   then obtain k where k: "k \<in> Basis" "m k = 0" by auto
   then have [simp]: "(\<Prod>k\<in>Basis. m k) = 0"
     by (intro prod_zero) auto
   have "emeasure lborel {x\<in>space lborel. x \<in> s m ` cbox a b} = 0"
   proof (rule emeasure_eq_0_AE)
     show "AE x in lborel. x \<notin> s m ` cbox a b"
       using AE_lborel_inner_neq[OF \<open>k\<in>Basis\<close>]
     proof eventually_elim
       show "x \<bullet> k \<noteq> 0 \<Longrightarrow> x \<notin> s m ` cbox a b " for x
         using k by (auto simp: s_def[abs_def] cbox_def)
     qed
   qed
   then show ?thesis
     by (simp add: measure_def)
 qed
 
 lemma interval_image_affinity_interval:
   "\<exists>u v. (\<lambda>x. m *\<^sub>R (x::'a::euclidean_space) + c) ` cbox a b = cbox u v"
   unfolding image_affinity_cbox
   by auto
 
 lemma content_image_affinity_cbox:
   "content((\<lambda>x::'a::euclidean_space. m *\<^sub>R x + c) ` cbox a b) =
     \<bar>m\<bar> ^ DIM('a) * content (cbox a b)" (is "?l = ?r")
 proof (cases "cbox a b = {}")
   case True then show ?thesis by simp
 next
   case False
   show ?thesis
   proof (cases "m \<ge> 0")
     case True
     with \<open>cbox a b \<noteq> {}\<close> have "cbox (m *\<^sub>R a + c) (m *\<^sub>R b + c) \<noteq> {}"
       by (simp add: box_ne_empty inner_left_distrib mult_left_mono)
     moreover from True have *: "\<And>i. (m *\<^sub>R b + c) \<bullet> i - (m *\<^sub>R a + c) \<bullet> i = m *\<^sub>R (b-a) \<bullet> i"
       by (simp add: inner_simps field_simps)
     ultimately show ?thesis
       by (simp add: image_affinity_cbox True content_cbox'
         prod.distrib inner_diff_left)
   next
     case False
     with \<open>cbox a b \<noteq> {}\<close> have "cbox (m *\<^sub>R b + c) (m *\<^sub>R a + c) \<noteq> {}"
       by (simp add: box_ne_empty inner_left_distrib mult_left_mono)
     moreover from False have *: "\<And>i. (m *\<^sub>R a + c) \<bullet> i - (m *\<^sub>R b + c) \<bullet> i = (-m) *\<^sub>R (b-a) \<bullet> i"
       by (simp add: inner_simps field_simps)
     ultimately show ?thesis using False
       by (simp add: image_affinity_cbox content_cbox'
         prod.distrib[symmetric] inner_diff_left flip: prod_constant)
   qed
 qed
 
 lemma has_integral_affinity:
   fixes a :: "'a::euclidean_space"
   assumes "(f has_integral i) (cbox a b)"
       and "m \<noteq> 0"
   shows "((\<lambda>x. f(m *\<^sub>R x + c)) has_integral (1 / (\<bar>m\<bar> ^ DIM('a))) *\<^sub>R i) ((\<lambda>x. (1 / m) *\<^sub>R x + -((1 / m) *\<^sub>R c)) ` cbox a b)"
 proof (rule has_integral_twiddle)
   show "\<exists>w z. (\<lambda>x. (1 / m) *\<^sub>R x + - ((1 / m) *\<^sub>R c)) ` cbox u v = cbox w z" 
        "\<exists>w z. (\<lambda>x. m *\<^sub>R x + c) ` cbox u v = cbox w z" for u v
     using interval_image_affinity_interval by blast+
   show "content ((\<lambda>x. m *\<^sub>R x + c) ` cbox u v) = \<bar>m\<bar> ^ DIM('a) * content (cbox u v)" for u v
     using content_image_affinity_cbox by blast
 qed (use assms zero_less_power in \<open>auto simp: field_simps\<close>)
 
 lemma integrable_affinity:
   assumes "f integrable_on cbox a b"
     and "m \<noteq> 0"
   shows "(\<lambda>x. f(m *\<^sub>R x + c)) integrable_on ((\<lambda>x. (1 / m) *\<^sub>R x + -((1/m) *\<^sub>R c)) ` cbox a b)"
   using has_integral_affinity assms
   unfolding integrable_on_def by blast
 
 lemmas has_integral_affinity01 = has_integral_affinity [of _ _ 0 "1::real", simplified]
 
 lemma integrable_on_affinity:
   assumes "m \<noteq> 0" "f integrable_on (cbox a b)"
   shows   "(\<lambda>x. f (m *\<^sub>R x + c)) integrable_on ((\<lambda>x. (1 / m) *\<^sub>R x - ((1 / m) *\<^sub>R c)) ` cbox a b)"
 proof -
   from assms obtain I where "(f has_integral I) (cbox a b)"
     by (auto simp: integrable_on_def)
   from has_integral_affinity[OF this assms(1), of c] show ?thesis
     by (auto simp: integrable_on_def)
 qed
 
 lemma has_integral_cmul_iff:
   assumes "c \<noteq> 0"
   shows   "((\<lambda>x. c *\<^sub>R f x) has_integral (c *\<^sub>R I)) A \<longleftrightarrow> (f has_integral I) A"
   using assms has_integral_cmul[of f I A c]
         has_integral_cmul[of "\<lambda>x. c *\<^sub>R f x" "c *\<^sub>R I" A "inverse c"] by (auto simp: field_simps)
 
 lemma has_integral_affinity':
   fixes a :: "'a::euclidean_space"
   assumes "(f has_integral i) (cbox a b)" and "m > 0"
   shows "((\<lambda>x. f(m *\<^sub>R x + c)) has_integral (i /\<^sub>R m ^ DIM('a)))
            (cbox ((a - c) /\<^sub>R m) ((b - c) /\<^sub>R m))"
 proof (cases "cbox a b = {}")
   case True
   hence "(cbox ((a - c) /\<^sub>R m) ((b - c) /\<^sub>R m)) = {}"
     using \<open>m > 0\<close> unfolding box_eq_empty by (auto simp: algebra_simps)
   with True and assms show ?thesis by simp
 next
   case False
   have "((\<lambda>x. f (m *\<^sub>R x + c)) has_integral (1 / \<bar>m\<bar> ^ DIM('a)) *\<^sub>R i)
           ((\<lambda>x. (1 / m) *\<^sub>R x + - ((1 / m) *\<^sub>R c)) ` cbox a b)"
     using assms by (intro has_integral_affinity) auto
   also have "((\<lambda>x. (1 / m) *\<^sub>R x + - ((1 / m) *\<^sub>R c)) ` cbox a b) =
                ((\<lambda>x.  - ((1 / m) *\<^sub>R c) + x) ` (\<lambda>x. (1 / m) *\<^sub>R x) ` cbox a b)"
     by (simp add: image_image algebra_simps)
   also have "(\<lambda>x. (1 / m) *\<^sub>R x) ` cbox a b = cbox ((1 / m) *\<^sub>R a) ((1 / m) *\<^sub>R b)" using \<open>m > 0\<close> False
     by (subst image_smult_cbox) simp_all
   also have "(\<lambda>x. - ((1 / m) *\<^sub>R c) + x) ` \<dots> = cbox ((a - c) /\<^sub>R m) ((b - c) /\<^sub>R m)"
     by (subst cbox_translation [symmetric]) (simp add: field_simps vector_add_divide_simps)
   finally show ?thesis using \<open>m > 0\<close> by (simp add: field_simps)
 qed
 
 lemma has_integral_affinity_iff:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: real_normed_vector"
   assumes "m > 0"
   shows   "((\<lambda>x. f (m *\<^sub>R x + c)) has_integral (I /\<^sub>R m ^ DIM('a)))
                (cbox ((a - c) /\<^sub>R m) ((b - c) /\<^sub>R m)) \<longleftrightarrow>
            (f has_integral I) (cbox a b)" (is "?lhs = ?rhs")
 proof
   assume ?lhs
   from has_integral_affinity'[OF this, of "1 / m" "-c /\<^sub>R m"] and \<open>m > 0\<close>
     show ?rhs by (simp add: vector_add_divide_simps) (simp add: field_simps)
 next
   assume ?rhs
   from has_integral_affinity'[OF this, of m c] and \<open>m > 0\<close>
   show ?lhs by simp
 qed
 
 
 subsection \<open>Special case of stretching coordinate axes separately\<close>
 
 lemma has_integral_stretch:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "(f has_integral i) (cbox a b)"
     and "\<forall>k\<in>Basis. m k \<noteq> 0"
   shows "((\<lambda>x. f (\<Sum>k\<in>Basis. (m k * (x\<bullet>k))*\<^sub>R k)) has_integral
          ((1/ \<bar>prod m Basis\<bar>) *\<^sub>R i)) ((\<lambda>x. (\<Sum>k\<in>Basis. (1 / m k * (x\<bullet>k))*\<^sub>R k)) ` cbox a b)"
   apply (rule has_integral_twiddle[where f=f])
   unfolding zero_less_abs_iff content_image_stretch_interval
   unfolding image_stretch_interval empty_as_interval euclidean_eq_iff[where 'a='a]
   using assms
   by auto
 
 lemma has_integral_stretch_real:
   fixes f :: "real \<Rightarrow> 'b::real_normed_vector"
   assumes "(f has_integral i) {a..b}" and "m \<noteq> 0"
   shows "((\<lambda>x. f (m * x)) has_integral (1 / \<bar>m\<bar>) *\<^sub>R i) ((\<lambda>x. x / m) ` {a..b})"
   using has_integral_stretch [of f i a b "\<lambda>b. m"] assms by simp
 
 lemma integrable_stretch:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "f integrable_on cbox a b"
     and "\<forall>k\<in>Basis. m k \<noteq> 0"
   shows "(\<lambda>x::'a. f (\<Sum>k\<in>Basis. (m k * (x\<bullet>k))*\<^sub>R k)) integrable_on
     ((\<lambda>x. \<Sum>k\<in>Basis. (1 / m k * (x\<bullet>k))*\<^sub>R k) ` cbox a b)"
   using assms unfolding integrable_on_def
   by (force dest: has_integral_stretch)
 
 lemma vec_lambda_eq_sum:
      "(\<chi> k. f k (x $ k)) = (\<Sum>k\<in>Basis. (f (axis_index k) (x \<bullet> k)) *\<^sub>R k)" (is "?lhs = ?rhs")
 proof -
   have "?lhs = (\<chi> k. f k (x \<bullet> axis k 1))"
     by (simp add: cart_eq_inner_axis)
   also have "... = (\<Sum>u\<in>UNIV. f u (x \<bullet> axis u 1) *\<^sub>R axis u 1)"
     by (simp add: vec_eq_iff axis_def if_distrib cong: if_cong)
   also have "... = ?rhs"
     by (simp add: Basis_vec_def UNION_singleton_eq_range sum.reindex axis_eq_axis inj_on_def)
   finally show ?thesis .
 qed
 
 lemma has_integral_stretch_cart:
   fixes m :: "'n::finite \<Rightarrow> real"
   assumes f: "(f has_integral i) (cbox a b)" and m: "\<And>k. m k \<noteq> 0"
   shows "((\<lambda>x. f(\<chi> k. m k * x$k)) has_integral i /\<^sub>R \<bar>prod m UNIV\<bar>)
             ((\<lambda>x. \<chi> k. x$k / m k) ` (cbox a b))"
 proof -
   have *: "\<forall>k:: real^'n \<in> Basis. m (axis_index k) \<noteq> 0"
     using axis_index by (simp add: m)
   have eqp: "(\<Prod>k:: real^'n \<in> Basis. m (axis_index k)) = prod m UNIV"
     by (simp add: Basis_vec_def UNION_singleton_eq_range prod.reindex axis_eq_axis inj_on_def)
   show ?thesis
     using has_integral_stretch [OF f *] vec_lambda_eq_sum [where f="\<lambda>i x. m i * x"] vec_lambda_eq_sum [where f="\<lambda>i x. x / m i"]
     by (simp add: field_simps eqp)
 qed
 
 lemma image_stretch_interval_cart:
   fixes m :: "'n::finite \<Rightarrow> real"
   shows "(\<lambda>x. \<chi> k. m k * x$k) ` cbox a b =
             (if cbox a b = {} then {}
             else cbox (\<chi> k. min (m k * a$k) (m k * b$k)) (\<chi> k. max (m k * a$k) (m k * b$k)))"
 proof -
   have *: "(\<Sum>k\<in>Basis. min (m (axis_index k) * (a \<bullet> k)) (m (axis_index k) * (b \<bullet> k)) *\<^sub>R k)
            = (\<chi> k. min (m k * a $ k) (m k * b $ k))"
           "(\<Sum>k\<in>Basis. max (m (axis_index k) * (a \<bullet> k)) (m (axis_index k) * (b \<bullet> k)) *\<^sub>R k)
            = (\<chi> k. max (m k * a $ k) (m k * b $ k))"
     apply (simp_all add: Basis_vec_def cart_eq_inner_axis UNION_singleton_eq_range sum.reindex axis_eq_axis inj_on_def)
     apply (simp_all add: vec_eq_iff axis_def if_distrib cong: if_cong)
     done
   show ?thesis
     by (simp add: vec_lambda_eq_sum [where f="\<lambda>i x. m i * x"] image_stretch_interval eq_cbox *)
 qed
 
 
 subsection \<open>even more special cases\<close>
 
 lemma uminus_interval_vector[simp]:
   fixes a b :: "'a::euclidean_space"
   shows "uminus ` cbox a b = cbox (-b) (-a)"
 proof -
   have "x \<in> uminus ` cbox a b" if "x \<in> cbox (- b) (- a)" for x
   proof -
     have "-x \<in> cbox a b"
       using that by (auto simp: mem_box)
     then show ?thesis
       by force
   qed
   then show ?thesis
     by (auto simp: mem_box)
 qed
 
 lemma has_integral_reflect_lemma[intro]:
   assumes "(f has_integral i) (cbox a b)"
   shows "((\<lambda>x. f(-x)) has_integral i) (cbox (-b) (-a))"
   using has_integral_affinity[OF assms, of "-1" 0]
   by auto
 
 lemma has_integral_reflect_lemma_real[intro]:
   assumes "(f has_integral i) {a..b::real}"
   shows "((\<lambda>x. f(-x)) has_integral i) {-b .. -a}"
   using assms
   unfolding box_real[symmetric]
   by (rule has_integral_reflect_lemma)
 
 lemma has_integral_reflect[simp]:
   "((\<lambda>x. f (-x)) has_integral i) (cbox (-b) (-a)) \<longleftrightarrow> (f has_integral i) (cbox a b)"
   by (auto dest: has_integral_reflect_lemma)
 
 lemma has_integral_reflect_real[simp]:
   fixes a b::real
   shows "((\<lambda>x. f (-x)) has_integral i) {-b..-a} \<longleftrightarrow> (f has_integral i) {a..b}"
   by (metis has_integral_reflect interval_cbox)
 
 lemma integrable_reflect[simp]: "(\<lambda>x. f(-x)) integrable_on cbox (-b) (-a) \<longleftrightarrow> f integrable_on cbox a b"
   unfolding integrable_on_def by auto
 
 lemma integrable_reflect_real[simp]: "(\<lambda>x. f(-x)) integrable_on {-b .. -a} \<longleftrightarrow> f integrable_on {a..b::real}"
   unfolding box_real[symmetric]
   by (rule integrable_reflect)
 
 lemma integral_reflect[simp]: "integral (cbox (-b) (-a)) (\<lambda>x. f (-x)) = integral (cbox a b) f"
   unfolding integral_def by auto
 
 lemma integral_reflect_real[simp]: "integral {-b .. -a} (\<lambda>x. f (-x)) = integral {a..b::real} f"
   unfolding box_real[symmetric]
   by (rule integral_reflect)
 
 subsection \<open>Stronger form of FCT; quite a tedious proof\<close>
 
 lemma split_minus[simp]: "(\<lambda>(x, k). f x k) x - (\<lambda>(x, k). g x k) x = (\<lambda>(x, k). f x k - g x k) x"
   by (simp add: split_def)
 
 theorem fundamental_theorem_of_calculus_interior:
   fixes f :: "real \<Rightarrow> 'a::real_normed_vector"
   assumes "a \<le> b"
     and contf: "continuous_on {a..b} f"
     and derf: "\<And>x. x \<in> {a <..< b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
   shows "(f' has_integral (f b - f a)) {a..b}"
 proof (cases "a = b")
   case True
   then have *: "cbox a b = {b}" "f b - f a = 0"
     by (auto simp add:  order_antisym)
   with True show ?thesis by auto
 next
   case False
   with \<open>a \<le> b\<close> have ab: "a < b" by arith
   show ?thesis
     unfolding has_integral_factor_content_real
   proof (intro allI impI)
     fix e :: real
     assume e: "e > 0"
     then have eba8: "(e * (b-a)) / 8 > 0"
       using ab by (auto simp add: field_simps)
     note derf_exp = derf[unfolded has_vector_derivative_def has_derivative_at_alt, THEN conjunct2, rule_format]
     have bounded: "\<And>x. x \<in> {a<..<b} \<Longrightarrow> bounded_linear (\<lambda>u. u *\<^sub>R f' x)"
       by (simp add: bounded_linear_scaleR_left)
     have "\<forall>x \<in> box a b. \<exists>d>0. \<forall>y. norm (y-x) < d \<longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e/2 * norm (y-x)"
       (is "\<forall>x \<in> box a b. ?Q x") \<comment>\<open>The explicit quantifier is required by the following step\<close>
     proof
       fix x assume "x \<in> box a b"
       with e show "?Q x"
         using derf_exp [of x "e/2"] by auto
     qed
     then obtain d where d: "\<And>x. 0 < d x"
       "\<And>x y. \<lbrakk>x \<in> box a b; norm (y-x) < d x\<rbrakk> \<Longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e/2 * norm (y-x)"
       unfolding bgauge_existence_lemma by metis
     have "bounded (f ` cbox a b)"
       using compact_cbox assms by (auto simp: compact_imp_bounded compact_continuous_image)
     then obtain B 
       where "0 < B" and B: "\<And>x. x \<in> f ` cbox a b \<Longrightarrow> norm x \<le> B"
       unfolding bounded_pos by metis
     obtain da where "0 < da"
       and da: "\<And>c. \<lbrakk>a \<le> c; {a..c} \<subseteq> {a..b}; {a..c} \<subseteq> ball a da\<rbrakk>
                           \<Longrightarrow> norm (content {a..c} *\<^sub>R f' a - (f c - f a)) \<le> (e * (b-a)) / 4"
     proof -
       have "continuous (at a within {a..b}) f"
         using contf continuous_on_eq_continuous_within by force
       with eba8 obtain k where "0 < k"
         and k: "\<And>x. \<lbrakk>x \<in> {a..b}; 0 < norm (x-a); norm (x-a) < k\<rbrakk> \<Longrightarrow> norm (f x - f a) < e * (b-a) / 8"
         unfolding continuous_within Lim_within dist_norm by metis
       obtain l where l: "0 < l" "norm (l *\<^sub>R f' a) \<le> e * (b-a) / 8" 
       proof (cases "f' a = 0")
         case True with ab e that show ?thesis by auto
       next
         case False
         show ?thesis
         proof
           show "norm ((e * (b - a) / 8 / norm (f' a)) *\<^sub>R f' a) \<le> e * (b - a) / 8"
                "0 < e * (b - a) / 8 / norm (f' a)"
             using False ab e by (auto simp add: field_simps)
         qed 
       qed
       have "norm (content {a..c} *\<^sub>R f' a - (f c - f a)) \<le> e * (b-a) / 4"
         if "a \<le> c" "{a..c} \<subseteq> {a..b}" and bmin: "{a..c} \<subseteq> ball a (min k l)" for c
       proof -
         have minkl: "\<bar>a - x\<bar> < min k l" if "x \<in> {a..c}" for x
           using bmin dist_real_def that by auto
         then have lel: "\<bar>c - a\<bar> \<le> \<bar>l\<bar>"
           using that by force
         have "norm ((c - a) *\<^sub>R f' a - (f c - f a)) \<le> norm ((c - a) *\<^sub>R f' a) + norm (f c - f a)"
           by (rule norm_triangle_ineq4)
         also have "\<dots> \<le> e * (b-a) / 8 + e * (b-a) / 8"
         proof (rule add_mono)
           have "norm ((c - a) *\<^sub>R f' a) \<le> norm (l *\<^sub>R f' a)"
             by (auto intro: mult_right_mono [OF lel])
           also have "... \<le> e * (b-a) / 8"
             by (rule l)
           finally show "norm ((c - a) *\<^sub>R f' a) \<le> e * (b-a) / 8" .
         next
           have "norm (f c - f a) < e * (b-a) / 8"
           proof (cases "a = c")
             case True then show ?thesis
               using eba8 by auto
           next
             case False show ?thesis
               by (rule k) (use minkl \<open>a \<le> c\<close> that False in auto)
           qed
           then show "norm (f c - f a) \<le> e * (b-a) / 8" by simp
         qed
         finally show "norm (content {a..c} *\<^sub>R f' a - (f c - f a)) \<le> e * (b-a) / 4"
           unfolding content_real[OF \<open>a \<le> c\<close>] by auto
       qed
       then show ?thesis
         by (rule_tac da="min k l" in that) (auto simp: l \<open>0 < k\<close>)
     qed
     obtain db where "0 < db"
       and db: "\<And>c. \<lbrakk>c \<le> b; {c..b} \<subseteq> {a..b}; {c..b} \<subseteq> ball b db\<rbrakk>
                           \<Longrightarrow> norm (content {c..b} *\<^sub>R f' b - (f b - f c)) \<le> (e * (b-a)) / 4"
     proof -
       have "continuous (at b within {a..b}) f"
         using contf continuous_on_eq_continuous_within by force
       with eba8 obtain k
         where "0 < k"
           and k: "\<And>x. \<lbrakk>x \<in> {a..b}; 0 < norm(x-b); norm(x-b) < k\<rbrakk>
                      \<Longrightarrow> norm (f b - f x) < e * (b-a) / 8"
         unfolding continuous_within Lim_within dist_norm norm_minus_commute by metis
       obtain l where l: "0 < l" "norm (l *\<^sub>R f' b) \<le> (e * (b-a)) / 8"
       proof (cases "f' b = 0")
         case True thus ?thesis 
           using ab e that by auto
       next
         case False show ?thesis
         proof
           show "norm ((e * (b - a) / 8 / norm (f' b)) *\<^sub>R f' b) \<le> e * (b - a) / 8" 
                "0 < e * (b - a) / 8 / norm (f' b)"
             using False ab e by (auto simp add: field_simps)
         qed
       qed
       have "norm (content {c..b} *\<^sub>R f' b - (f b - f c)) \<le> e * (b-a) / 4" 
         if "c \<le> b" "{c..b} \<subseteq> {a..b}" and bmin: "{c..b} \<subseteq> ball b (min k l)" for c
       proof -
         have minkl: "\<bar>b - x\<bar> < min k l" if "x \<in> {c..b}" for x
           using bmin dist_real_def that by auto
         then have lel: "\<bar>b - c\<bar> \<le> \<bar>l\<bar>"
           using that by force
         have "norm ((b - c) *\<^sub>R f' b - (f b - f c)) \<le> norm ((b - c) *\<^sub>R f' b) + norm (f b - f c)"
           by (rule norm_triangle_ineq4)
         also have "\<dots> \<le> e * (b-a) / 8 + e * (b-a) / 8"
         proof (rule add_mono)
           have "norm ((b - c) *\<^sub>R f' b) \<le> norm (l *\<^sub>R f' b)"
             by (auto intro: mult_right_mono [OF lel])
           also have "... \<le> e * (b-a) / 8"
             by (rule l)
           finally show "norm ((b - c) *\<^sub>R f' b) \<le> e * (b-a) / 8" .
         next
           have "norm (f b - f c) < e * (b-a) / 8"
           proof (cases "b = c")
             case True with eba8 show ?thesis
               by auto
           next
             case False show ?thesis
               by (rule k) (use minkl \<open>c \<le> b\<close> that False in auto)
           qed
           then show "norm (f b - f c) \<le> e * (b-a) / 8" by simp
         qed
         finally show "norm (content {c..b} *\<^sub>R f' b - (f b - f c)) \<le> e * (b-a) / 4"
           unfolding content_real[OF \<open>c \<le> b\<close>] by auto
       qed
       then show ?thesis
         by (rule_tac db="min k l" in that) (auto simp: l \<open>0 < k\<close>)
     qed
     let ?d = "(\<lambda>x. ball x (if x=a then da else if x=b then db else d x))"
     show "\<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of {a..b} \<and> d fine p \<longrightarrow>
               norm ((\<Sum>(x,K)\<in>p. content K *\<^sub>R f' x) - (f b - f a)) \<le> e * content {a..b})"
     proof (rule exI, safe)
       show "gauge ?d"
         using ab \<open>db > 0\<close> \<open>da > 0\<close> d(1) by (auto intro: gauge_ball_dependent)
     next
       fix p
       assume ptag: "p tagged_division_of {a..b}" and fine: "?d fine p"
       let ?A = "{t. fst t \<in> {a, b}}"
       note p = tagged_division_ofD[OF ptag]
       have pA: "p = (p \<inter> ?A) \<union> (p - ?A)" "finite (p \<inter> ?A)" "finite (p - ?A)" "(p \<inter> ?A) \<inter> (p - ?A) = {}"
         using ptag fine by auto
       have le_xz: "\<And>w x y z::real. y \<le> z/2 \<Longrightarrow> w - x \<le> z/2 \<Longrightarrow> w + y \<le> x + z"
         by arith
       have non: False if xk: "(x,K) \<in> p" and "x \<noteq> a" "x \<noteq> b"
         and less: "e * (Sup K - Inf K)/2 < norm (content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))"
       for x K
       proof -
         obtain u v where k: "K = cbox u v"
           using p(4) xk by blast
         then have "u \<le> v" and uv: "{u, v} \<subseteq> cbox u v"
           using p(2)[OF xk] by auto
         then have result: "e * (v - u)/2 < norm ((v - u) *\<^sub>R f' x - (f v - f u))"
           using less[unfolded k box_real interval_bounds_real content_real] by auto
         then have "x \<in> box a b"
           using p(2) p(3) \<open>x \<noteq> a\<close> \<open>x \<noteq> b\<close> xk by fastforce
         with d have *: "\<And>y. norm (y-x) < d x 
                 \<Longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e/2 * norm (y-x)"
           by metis
         have xd: "norm (u - x) < d x" "norm (v - x) < d x"
           using fineD[OF fine xk] \<open>x \<noteq> a\<close> \<open>x \<noteq> b\<close> uv 
           by (auto simp add: k subset_eq dist_commute dist_real_def)
         have "norm ((v - u) *\<^sub>R f' x - (f v - f u)) =
               norm ((f u - f x - (u - x) *\<^sub>R f' x) - (f v - f x - (v - x) *\<^sub>R f' x))"
           by (rule arg_cong[where f=norm]) (auto simp: scaleR_left.diff)
         also have "\<dots> \<le> e/2 * norm (u - x) + e/2 * norm (v - x)"
           by (metis norm_triangle_le_diff add_mono * xd)
         also have "\<dots> \<le> e/2 * norm (v - u)"
           using p(2)[OF xk] by (auto simp add: field_simps k)
         also have "\<dots> < norm ((v - u) *\<^sub>R f' x - (f v - f u))"
           using result by (simp add: \<open>u \<le> v\<close>)
         finally have "e * (v - u)/2 < e * (v - u)/2"
           using uv by auto
         then show False by auto
       qed
       have "norm (\<Sum>(x, K)\<in>p - ?A. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))
           \<le> (\<Sum>(x, K)\<in>p - ?A. norm (content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))))"
         by (auto intro: sum_norm_le)
       also have "... \<le> (\<Sum>n\<in>p - ?A. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k)/2)"
         using non by (fastforce intro: sum_mono)
       finally have I: "norm (\<Sum>(x, k)\<in>p - ?A.
                   content k *\<^sub>R f' x - (f (Sup k) - f (Inf k)))
              \<le> (\<Sum>n\<in>p - ?A. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))/2"
         by (simp add: sum_divide_distrib)
       have II: "norm (\<Sum>(x, k)\<in>p \<inter> ?A. content k *\<^sub>R f' x - (f (Sup k) - f (Inf k))) -
              (\<Sum>n\<in>p \<inter> ?A. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))
              \<le> (\<Sum>n\<in>p - ?A. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))/2"
       proof -
         have ge0: "0 \<le> e * (Sup k - Inf k)" if xkp: "(x, k) \<in> p \<inter> ?A" for x k
         proof -
           obtain u v where uv: "k = cbox u v"
             by (meson Int_iff xkp p(4))
           with p(2) that uv have "cbox u v \<noteq> {}"
             by blast
           then show "0 \<le> e * ((Sup k) - (Inf k))"
             unfolding uv using e by (auto simp add: field_simps)
         qed
         let ?B = "\<lambda>x. {t \<in> p. fst t = x \<and> content (snd t) \<noteq> 0}"
         let ?C = "{t \<in> p. fst t \<in> {a, b} \<and> content (snd t) \<noteq> 0}"
         have "norm (\<Sum>(x, k)\<in>p \<inter> {t. fst t \<in> {a, b}}. content k *\<^sub>R f' x - (f (Sup k) - f (Inf k))) \<le> e * (b-a)/2"
         proof -
           have *: "\<And>S f e. sum f S = sum f (p \<inter> ?C) \<Longrightarrow> norm (sum f (p \<inter> ?C)) \<le> e \<Longrightarrow> norm (sum f S) \<le> e"
             by auto
           have 1: "content K *\<^sub>R (f' x) - (f ((Sup K)) - f ((Inf K))) = 0"
             if "(x,K) \<in> p \<inter> {t. fst t \<in> {a, b}} - p \<inter> ?C" for x K
           proof -
             have xk: "(x,K) \<in> p" and k0: "content K = 0"
               using that by auto
             then obtain u v where uv: "K = cbox u v"
               using p(4) by blast
             then have "u = v"
               using xk k0 p(2) by force
             then show "content K *\<^sub>R (f' x) - (f ((Sup K)) - f ((Inf K))) = 0"
               using xk unfolding uv by auto
           qed
           have 2: "norm(\<Sum>(x,K)\<in>p \<inter> ?C. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))  \<le> e * (b-a)/2"
           proof -
             have norm_le: "norm (sum f S) \<le> e"
               if "\<And>x y. \<lbrakk>x \<in> S; y \<in> S\<rbrakk> \<Longrightarrow> x = y" "\<And>x. x \<in> S \<Longrightarrow> norm (f x) \<le> e" "e > 0"
               for S f and e :: real
             proof (cases "S = {}")
               case True
               with that show ?thesis by auto
             next
               case False then obtain x where "x \<in> S"
                 by auto
               then have "S = {x}"
                 using that(1) by auto
               then show ?thesis
                 using \<open>x \<in> S\<close> that(2) by auto
             qed
             have *: "p \<inter> ?C = ?B a \<union> ?B b"
               by blast
             then have "norm (\<Sum>(x,K)\<in>p \<inter> ?C. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) =
                        norm (\<Sum>(x,K) \<in> ?B a \<union> ?B b. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))"
               by simp
             also have "... = norm ((\<Sum>(x,K) \<in> ?B a. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) + 
                                    (\<Sum>(x,K) \<in> ?B b. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))))"
               using p(1) ab e by (subst sum.union_disjoint) auto
             also have "... \<le> e * (b - a) / 4 + e * (b - a) / 4"
             proof (rule norm_triangle_le [OF add_mono])
               have pa: "\<exists>v. k = cbox a v \<and> a \<le> v" if "(a, k) \<in> p" for k
                 using p(2) p(3) p(4) that by fastforce
               show "norm (\<Sum>(x,K) \<in> ?B a. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) \<le> e * (b - a) / 4"
               proof (intro norm_le; clarsimp)
                 fix K K'
                 assume K: "(a, K) \<in> p" "(a, K') \<in> p" and ne0: "content K \<noteq> 0" "content K' \<noteq> 0"
                 with pa obtain v v' where v: "K = cbox a v" "a \<le> v" and v': "K' = cbox a v'" "a \<le> v'"
                   by blast
                 let ?v = "min v v'"
                 have "box a ?v \<subseteq> K \<inter> K'"
                   unfolding v v' by (auto simp add: mem_box)
                 then have "interior (box a (min v v')) \<subseteq> interior K \<inter> interior K'"
                   using interior_Int interior_mono by blast
                 moreover have "(a + ?v)/2 \<in> box a ?v"
                   using ne0  unfolding v v' content_eq_0 not_le
                   by (auto simp add: mem_box)
                 ultimately have "(a + ?v)/2 \<in> interior K \<inter> interior K'"
                   unfolding interior_open[OF open_box] by auto
                 then show "K = K'"
                   using p(5)[OF K] by auto
               next
                 fix K 
                 assume K: "(a, K) \<in> p" and ne0: "content K \<noteq> 0"
                 show "norm (content c *\<^sub>R f' a - (f (Sup c) - f (Inf c))) * 4 \<le> e * (b-a)"
                   if "(a, c) \<in> p" and ne0: "content c \<noteq> 0" for c
                 proof -
                   obtain v where v: "c = cbox a v" and "a \<le> v"
                     using pa[OF \<open>(a, c) \<in> p\<close>] by metis 
                   then have "a \<in> {a..v}" "v \<le> b"
                     using p(3)[OF \<open>(a, c) \<in> p\<close>] by auto
                   moreover have "{a..v} \<subseteq> ball a da"
                     using fineD[OF \<open>?d fine p\<close> \<open>(a, c) \<in> p\<close>] by (simp add: v split: if_split_asm)
                   ultimately show ?thesis
                     unfolding v interval_bounds_real[OF \<open>a \<le> v\<close>] box_real
                     using da \<open>a \<le> v\<close> by auto
                 qed
               qed (use ab e in auto)
             next
               have pb: "\<exists>v. k = cbox v b \<and> b \<ge> v" if "(b, k) \<in> p" for k
                 using p(2) p(3) p(4) that by fastforce
               show "norm (\<Sum>(x,K) \<in> ?B b. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) \<le> e * (b - a) / 4"
               proof (intro norm_le; clarsimp)
                 fix K K'
                 assume K: "(b, K) \<in> p" "(b, K') \<in> p" and ne0: "content K \<noteq> 0" "content K' \<noteq> 0"
                 with pb obtain v v' where v: "K = cbox v b" "v \<le> b" and v': "K' = cbox v' b" "v' \<le> b"
                   by blast
                 let ?v = "max v v'"
                 have "box ?v b \<subseteq> K \<inter> K'"
                   unfolding v v' by (auto simp: mem_box)
                 then have "interior (box (max v v') b) \<subseteq> interior K \<inter> interior K'"
                   using interior_Int interior_mono by blast
                 moreover have " ((b + ?v)/2) \<in> box ?v b"
                   using ne0 unfolding v v' content_eq_0 not_le by (auto simp: mem_box)
                 ultimately have "((b + ?v)/2) \<in> interior K \<inter> interior K'"
                   unfolding interior_open[OF open_box] by auto
                 then show "K = K'"
                   using p(5)[OF K] by auto
               next
                 fix K 
                 assume K: "(b, K) \<in> p" and ne0: "content K \<noteq> 0"
                 show "norm (content c *\<^sub>R f' b - (f (Sup c) - f (Inf c))) * 4 \<le> e * (b-a)"
                   if "(b, c) \<in> p" and ne0: "content c \<noteq> 0" for c
                 proof -
                 obtain v where v: "c = cbox v b" and "v \<le> b"
                   using \<open>(b, c) \<in> p\<close> pb by blast
                 then have "v \<ge> a""b \<in> {v.. b}"  
                   using p(3)[OF \<open>(b, c) \<in> p\<close>] by auto
                 moreover have "{v..b} \<subseteq> ball b db"
                   using fineD[OF \<open>?d fine p\<close> \<open>(b, c) \<in> p\<close>] box_real(2) v False by force
                 ultimately show ?thesis
                   using db v by auto
                 qed
               qed (use ab e in auto)
             qed
             also have "... = e * (b-a)/2"
               by simp
             finally show "norm (\<Sum>(x,k)\<in>p \<inter> ?C.
                         content k *\<^sub>R f' x - (f (Sup k) - f (Inf k))) \<le> e * (b-a)/2" .
           qed
           show "norm (\<Sum>(x, k)\<in>p \<inter> ?A. content k *\<^sub>R f' x - (f ((Sup k)) - f ((Inf k)))) \<le> e * (b-a)/2"
             apply (rule * [OF sum.mono_neutral_right[OF pA(2)]])
             using 1 2 by (auto simp: split_paired_all)
         qed
         also have "... = (\<Sum>n\<in>p. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))/2"
           unfolding sum_distrib_left[symmetric]
           by (subst additive_tagged_division_1[OF \<open>a \<le> b\<close> ptag]) auto
         finally have norm_le: "norm (\<Sum>(x,K)\<in>p \<inter> {t. fst t \<in> {a, b}}. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))
                 \<le> (\<Sum>n\<in>p. e * (case n of (x, K) \<Rightarrow> Sup K - Inf K))/2" .
         have le2: "\<And>x s1 s2::real. 0 \<le> s1 \<Longrightarrow> x \<le> (s1 + s2)/2 \<Longrightarrow> x - s1 \<le> s2/2"
           by auto
         show ?thesis
           apply (rule le2 [OF sum_nonneg])
           using ge0 apply force
           by (metis (no_types, lifting) Diff_Diff_Int Diff_subset norm_le p(1) sum.subset_diff)
       qed
       note * = additive_tagged_division_1[OF assms(1) ptag, symmetric]
       have "norm (\<Sum>(x,K)\<in>p \<inter> ?A \<union> (p - ?A). content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))
                \<le> e * (\<Sum>(x,K)\<in>p \<inter> ?A \<union> (p - ?A). Sup K - Inf K)"
         unfolding sum_distrib_left
         unfolding sum.union_disjoint[OF pA(2-)]
         using le_xz norm_triangle_le I II by blast
       then
       show "norm ((\<Sum>(x,K)\<in>p. content K *\<^sub>R f' x) - (f b - f a)) \<le> e * content {a..b}"
         by (simp only: content_real[OF \<open>a \<le> b\<close>] *[of "\<lambda>x. x"] *[of f] sum_subtractf[symmetric] split_minus pA(1) [symmetric])
     qed
   qed
 qed
 
 
 subsection \<open>Stronger form with finite number of exceptional points\<close>
 
 lemma fundamental_theorem_of_calculus_interior_strong:
  fixes f :: "real \<Rightarrow> 'a::banach"
  assumes "finite S"
    and "a \<le> b" "\<And>x. x \<in> {a <..< b} - S \<Longrightarrow> (f has_vector_derivative f'(x)) (at x)"
    and "continuous_on {a .. b} f"
  shows "(f' has_integral (f b - f a)) {a .. b}"
   using assms
 proof (induction arbitrary: a b)
 case empty
   then show ?case
     using fundamental_theorem_of_calculus_interior by force
 next
 case (insert x S)
   show ?case
   proof (cases "x \<in> {a<..<b}")
     case False then show ?thesis
       using insert by blast
   next
     case True then have "a < x" "x < b"
       by auto
     have "(f' has_integral f x - f a) {a..x}" "(f' has_integral f b - f x) {x..b}"
       using \<open>continuous_on {a..b} f\<close> \<open>a < x\<close> \<open>x < b\<close> continuous_on_subset by (force simp: intro!: insert)+
     then have "(f' has_integral f x - f a + (f b - f x)) {a..b}"
       using \<open>a < x\<close> \<open>x < b\<close> has_integral_combine less_imp_le by blast
     then show ?thesis
       by simp
   qed
 qed
 
 corollary fundamental_theorem_of_calculus_strong:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "finite S"
     and "a \<le> b"
     and vec: "\<And>x. x \<in> {a..b} - S \<Longrightarrow> (f has_vector_derivative f'(x)) (at x)"
     and "continuous_on {a..b} f"
   shows "(f' has_integral (f b - f a)) {a..b}"
   by (rule fundamental_theorem_of_calculus_interior_strong [OF \<open>finite S\<close>]) (force simp: assms)+
 
 proposition indefinite_integral_continuous_left:
   fixes f:: "real \<Rightarrow> 'a::banach"
   assumes intf: "f integrable_on {a..b}" and "a < c" "c \<le> b" "e > 0"
   obtains d where "d > 0"
     and "\<forall>t. c - d < t \<and> t \<le> c \<longrightarrow> norm (integral {a..c} f - integral {a..t} f) < e"
 proof -
   obtain w where "w > 0" and w: "\<And>t. \<lbrakk>c - w < t; t < c\<rbrakk> \<Longrightarrow> norm (f c) * norm(c - t) < e/3"
   proof (cases "f c = 0")
     case False
     hence e3: "0 < e/3 / norm (f c)" using \<open>e>0\<close> by simp
     moreover have "norm (f c) * norm (c - t) < e/3" 
       if "t < c" and "c - e/3 / norm (f c) < t" for t
     proof -
       have "norm (c - t) < e/3 / norm (f c)"
         using that by auto
       then show "norm (f c) * norm (c - t) < e/3"
         by (metis e3 mult.commute norm_not_less_zero pos_less_divide_eq zero_less_divide_iff)
     qed
     ultimately show ?thesis
       using that by auto
   next
     case True then show ?thesis
       using \<open>e > 0\<close> that by auto
   qed
 
   let ?SUM = "\<lambda>p. (\<Sum>(x,K) \<in> p. content K *\<^sub>R f x)"
   have e3: "e/3 > 0"
     using \<open>e > 0\<close> by auto
   have "f integrable_on {a..c}"
     using \<open>a < c\<close> \<open>c \<le> b\<close> by (auto intro: integrable_subinterval_real[OF intf])
   then obtain d1 where "gauge d1" and d1:
     "\<And>p. \<lbrakk>p tagged_division_of {a..c}; d1 fine p\<rbrakk> \<Longrightarrow> norm (?SUM p - integral {a..c} f) < e/3"
     using integrable_integral has_integral_real e3 by metis
   define d where [abs_def]: "d x = ball x w \<inter> d1 x" for x
   have "gauge d"
     unfolding d_def using \<open>w > 0\<close> \<open>gauge d1\<close> by auto
   then obtain k where "0 < k" and k: "ball c k \<subseteq> d c"
     by (meson gauge_def open_contains_ball)
 
   let ?d = "min k (c - a)/2"
   show thesis
   proof (intro that[of ?d] allI impI, safe)
     show "?d > 0"
       using \<open>0 < k\<close> \<open>a < c\<close> by auto
   next
     fix t
     assume t: "c - ?d < t" "t \<le> c"
     show "norm (integral ({a..c}) f - integral ({a..t}) f) < e"
     proof (cases "t < c")
       case False with \<open>t \<le> c\<close> show ?thesis
         by (simp add: \<open>e > 0\<close>)
     next
       case True
       have "f integrable_on {a..t}"
         using \<open>t < c\<close> \<open>c \<le> b\<close> by (auto intro: integrable_subinterval_real[OF intf])
       then obtain d2 where d2: "gauge d2"
         "\<And>p. p tagged_division_of {a..t} \<and> d2 fine p \<Longrightarrow> norm (?SUM p - integral {a..t} f) < e/3"
         using integrable_integral has_integral_real e3 by metis
       define d3 where "d3 x = (if x \<le> t then d1 x \<inter> d2 x else d1 x)" for x
       have "gauge d3"
         using \<open>gauge d1\<close> \<open>gauge d2\<close> unfolding d3_def gauge_def by auto
       then obtain p where ptag: "p tagged_division_of {a..t}" and pfine: "d3 fine p"
         by (metis box_real(2) fine_division_exists)
       note p' = tagged_division_ofD[OF ptag]
       have pt: "(x,K)\<in>p \<Longrightarrow> x \<le> t" for x K
         by (meson atLeastAtMost_iff p'(2) p'(3) subsetCE)
       with pfine have "d2 fine p"
         unfolding fine_def d3_def by fastforce
       then have d2_fin: "norm (?SUM p - integral {a..t} f) < e/3"
         using d2(2) ptag by auto
       have eqs: "{a..c} \<inter> {x. x \<le> t} = {a..t}" "{a..c} \<inter> {x. x \<ge> t} = {t..c}"
         using t by (auto simp add: field_simps)
       have "p \<union> {(c, {t..c})} tagged_division_of {a..c}"
       proof (intro tagged_division_Un_interval_real)
         show "{(c, {t..c})} tagged_division_of {a..c} \<inter> {x. t \<le> x \<bullet> 1}"
           using \<open>t \<le> c\<close> by (auto simp: eqs tagged_division_of_self_real)
       qed (auto simp: eqs ptag)
       moreover
       have "d1 fine p \<union> {(c, {t..c})}"
         unfolding fine_def
       proof safe
         fix x K y
         assume "(x,K) \<in> p" and "y \<in> K" then show "y \<in> d1 x"
           by (metis Int_iff d3_def subsetD fineD pfine)
       next
         fix x assume "x \<in> {t..c}"
         then have "dist c x < k"
           using t(1) by (auto simp add: field_simps dist_real_def)
         with k show "x \<in> d1 c"
           unfolding d_def by auto
       qed  
       ultimately have d1_fin: "norm (?SUM(p \<union> {(c, {t..c})}) - integral {a..c} f) < e/3"
         using d1 by metis
       have SUMEQ: "?SUM(p \<union> {(c, {t..c})}) = (c - t) *\<^sub>R f c + ?SUM p"
       proof -
         have "?SUM(p \<union> {(c, {t..c})}) = (content{t..c} *\<^sub>R f c) + ?SUM p"
         proof (subst sum.union_disjoint)
           show "p \<inter> {(c, {t..c})} = {}"
             using \<open>t < c\<close> pt by force
         qed (use p'(1) in auto)
         also have "... = (c - t) *\<^sub>R f c + ?SUM p"
           using \<open>t \<le> c\<close> by auto
         finally show ?thesis .
       qed
       have "c - k < t"
         using \<open>k>0\<close> t(1) by (auto simp add: field_simps)
       moreover have "k \<le> w"
       proof (rule ccontr)
         assume "\<not> k \<le> w"
         then have "c + (k + w) / 2 \<notin> d c"
           by (auto simp add: field_simps not_le not_less dist_real_def d_def)
         then have "c + (k + w) / 2 \<notin> ball c k"
           using k by blast
         then show False
           using \<open>0 < w\<close> \<open>\<not> k \<le> w\<close> dist_real_def by auto
       qed
       ultimately have cwt: "c - w < t"
         by (auto simp add: field_simps)
       have eq: "integral {a..c} f - integral {a..t} f = -(((c - t) *\<^sub>R f c + ?SUM p) -
              integral {a..c} f) + (?SUM p - integral {a..t} f) + (c - t) *\<^sub>R f c"
         by auto
       have "norm (integral {a..c} f - integral {a..t} f) < e/3 + e/3 + e/3"
         unfolding eq
       proof (intro norm_triangle_lt add_strict_mono)
         show "norm (- ((c - t) *\<^sub>R f c + ?SUM p - integral {a..c} f)) < e/3"
           by (metis SUMEQ d1_fin norm_minus_cancel)
         show "norm (?SUM p - integral {a..t} f) < e/3"
           using d2_fin by blast
         show "norm ((c - t) *\<^sub>R f c) < e/3"
           using w cwt \<open>t < c\<close> by simp (simp add: field_simps)
       qed
       then show ?thesis by simp
     qed
   qed
 qed
 
 lemma indefinite_integral_continuous_right:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "f integrable_on {a..b}"
     and "a \<le> c"
     and "c < b"
     and "e > 0"
   obtains d where "0 < d"
     and "\<forall>t. c \<le> t \<and> t < c + d \<longrightarrow> norm (integral {a..c} f - integral {a..t} f) < e"
 proof -
   have intm: "(\<lambda>x. f (- x)) integrable_on {-b .. -a}" "- b < - c" "- c \<le> - a"
     using assms by auto
   from indefinite_integral_continuous_left[OF intm \<open>e>0\<close>]
   obtain d where "0 < d"
     and d: "\<And>t. \<lbrakk>- c - d < t; t \<le> -c\<rbrakk> 
              \<Longrightarrow> norm (integral {- b..- c} (\<lambda>x. f (-x)) - integral {- b..t} (\<lambda>x. f (-x))) < e"
     by metis
   let ?d = "min d (b - c)" 
   show ?thesis
   proof (intro that[of "?d"] allI impI)
     show "0 < ?d"
       using \<open>0 < d\<close> \<open>c < b\<close> by auto
     fix t :: real
     assume t: "c \<le> t \<and> t < c + ?d"
     have *: "integral {a..c} f = integral {a..b} f - integral {c..b} f"
             "integral {a..t} f = integral {a..b} f - integral {t..b} f"
       using assms t by (auto simp: algebra_simps integral_combine)
     have "(- c) - d < (- t)" "- t \<le> - c"
       using t by auto 
     from d[OF this] show "norm (integral {a..c} f - integral {a..t} f) < e"
       by (auto simp add: algebra_simps norm_minus_commute *)
   qed
 qed
 
 lemma indefinite_integral_continuous_1:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "f integrable_on {a..b}"
   shows "continuous_on {a..b} (\<lambda>x. integral {a..x} f)"
 proof -
   have "\<exists>d>0. \<forall>x'\<in>{a..b}. dist x' x < d \<longrightarrow> dist (integral {a..x'} f) (integral {a..x} f) < e" 
        if x: "x \<in> {a..b}" and "e > 0" for x e :: real
   proof (cases "a = b")
     case True
     with that show ?thesis by force
   next
     case False
     with x have "a < b" by force
     with x consider "x = a" | "x = b" | "a < x" "x < b"
       by force
     then show ?thesis 
     proof cases
       case 1 then show ?thesis
         by (force simp: dist_norm algebra_simps intro: indefinite_integral_continuous_right [OF assms _ \<open>a < b\<close> \<open>e > 0\<close>])
     next
       case 2 then show ?thesis
         by (force simp: dist_norm norm_minus_commute algebra_simps intro: indefinite_integral_continuous_left [OF assms \<open>a < b\<close> _ \<open>e > 0\<close>])
     next
       case 3
       obtain d1 where "0 < d1" 
         and d1: "\<And>t. \<lbrakk>x - d1 < t; t \<le> x\<rbrakk> \<Longrightarrow> norm (integral {a..x} f - integral {a..t} f) < e"
         using 3 by (auto intro: indefinite_integral_continuous_left [OF assms \<open>a < x\<close> _ \<open>e > 0\<close>])
       obtain d2 where "0 < d2" 
         and d2: "\<And>t. \<lbrakk>x \<le> t; t < x + d2\<rbrakk> \<Longrightarrow> norm (integral {a..x} f - integral {a..t} f) < e"
         using 3 by (auto intro: indefinite_integral_continuous_right [OF assms _ \<open>x < b\<close> \<open>e > 0\<close>])
       show ?thesis
       proof (intro exI ballI conjI impI)
         show "0 < min d1 d2"
           using \<open>0 < d1\<close> \<open>0 < d2\<close> by simp
         show "dist (integral {a..y} f) (integral {a..x} f) < e"
              if "y \<in> {a..b}" "dist y x < min d1 d2" for y
         proof (cases "y < x")
           case True
           with that d1 show ?thesis by (auto simp: dist_commute dist_norm)
         next
           case False
           with that d2 show ?thesis
             by (auto simp: dist_commute dist_norm)
         qed
       qed
     qed
   qed
   then show ?thesis
     by (auto simp: continuous_on_iff)
 qed
 
 lemma indefinite_integral_continuous_1':
   fixes f::"real \<Rightarrow> 'a::banach"
   assumes "f integrable_on {a..b}"
   shows "continuous_on {a..b} (\<lambda>x. integral {x..b} f)"
 proof -
   have "integral {a..b} f - integral {a..x} f = integral {x..b} f" if "x \<in> {a..b}" for x
     using integral_combine[OF _ _ assms, of x] that
     by (auto simp: algebra_simps)
   with _ show ?thesis
     by (rule continuous_on_eq) (auto intro!: continuous_intros indefinite_integral_continuous_1 assms)
 qed
 
 theorem integral_has_vector_derivative':
   fixes f :: "real \<Rightarrow> 'b::banach"
   assumes "continuous_on {a..b} f"
     and "x \<in> {a..b}"
   shows "((\<lambda>u. integral {u..b} f) has_vector_derivative - f x) (at x within {a..b})"
 proof -
   have *: "integral {x..b} f = integral {a .. b} f - integral {a .. x} f" if "a \<le> x" "x \<le> b" for x
     using integral_combine[of a x b for x, OF that integrable_continuous_real[OF assms(1)]]
     by (simp add: algebra_simps)
   show ?thesis
     using \<open>x \<in> _\<close> *
     by (rule has_vector_derivative_transform)
       (auto intro!: derivative_eq_intros assms integral_has_vector_derivative)
 qed
 
 lemma integral_has_real_derivative':
   assumes "continuous_on {a..b} g"
   assumes "t \<in> {a..b}"
   shows "((\<lambda>x. integral {x..b} g) has_real_derivative -g t) (at t within {a..b})"
   using integral_has_vector_derivative'[OF assms]
   by (auto simp: has_field_derivative_iff_has_vector_derivative)
 
 
 subsection \<open>This doesn't directly involve integration, but that gives an easy proof\<close>
 
 lemma has_derivative_zero_unique_strong_interval:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "finite k"
     and contf: "continuous_on {a..b} f"
     and "f a = y"
     and fder: "\<And>x. x \<in> {a..b} - k \<Longrightarrow> (f has_derivative (\<lambda>h. 0)) (at x within {a..b})"
     and x: "x \<in> {a..b}"
   shows "f x = y"
 proof -
   have "a \<le> b" "a \<le> x"
     using assms by auto
   have "((\<lambda>x. 0::'a) has_integral f x - f a) {a..x}"
   proof (rule fundamental_theorem_of_calculus_interior_strong[OF \<open>finite k\<close> \<open>a \<le> x\<close>]; clarify?)
     have "{a..x} \<subseteq> {a..b}"
       using x by auto
     then show "continuous_on {a..x} f"
       by (rule continuous_on_subset[OF contf])
     show "(f has_vector_derivative 0) (at z)" if z: "z \<in> {a<..<x}" and notin: "z \<notin> k" for z
       unfolding has_vector_derivative_def
     proof (simp add: at_within_open[OF z, symmetric])
       show "(f has_derivative (\<lambda>x. 0)) (at z within {a<..<x})"
         by (rule has_derivative_subset [OF fder]) (use x z notin in auto)
     qed
   qed
   from has_integral_unique[OF has_integral_0 this]
   show ?thesis
     unfolding assms by auto
 qed
 
 
 subsection \<open>Generalize a bit to any convex set\<close>
 
 lemma has_derivative_zero_unique_strong_convex:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "convex S" "finite K"
     and contf: "continuous_on S f"
     and "c \<in> S" "f c = y"
     and derf: "\<And>x. x \<in> S - K \<Longrightarrow> (f has_derivative (\<lambda>h. 0)) (at x within S)"
     and "x \<in> S"
   shows "f x = y"
 proof (cases "x = c")
   case True with \<open>f c = y\<close> show ?thesis
     by blast
 next
   case False
   let ?\<phi> = "\<lambda>u. (1 - u) *\<^sub>R c + u *\<^sub>R x"
   have contf': "continuous_on {0 ..1} (f \<circ> ?\<phi>)"
   proof (rule continuous_intros continuous_on_subset[OF contf])+
     show "(\<lambda>u. (1 - u) *\<^sub>R c + u *\<^sub>R x) ` {0..1} \<subseteq> S"
       using \<open>convex S\<close> \<open>x \<in> S\<close> \<open>c \<in> S\<close> by (auto simp add: convex_alt algebra_simps)
   qed
   have "t = u" if "?\<phi> t = ?\<phi> u" for t u
   proof -
     from that have "(t - u) *\<^sub>R x = (t - u) *\<^sub>R c"
       by (auto simp add: algebra_simps)
     then show ?thesis
       using \<open>x \<noteq> c\<close> by auto
   qed
   then have eq: "(SOME t. ?\<phi> t = ?\<phi> u) = u" for u
     by blast
   then have "(?\<phi> -` K) \<subseteq> (\<lambda>z. SOME t. ?\<phi> t = z) ` K"
     by (clarsimp simp: image_iff) (metis (no_types) eq)
   then have fin: "finite (?\<phi> -` K)"
     by (rule finite_surj[OF \<open>finite K\<close>])
 
   have derf': "((\<lambda>u. f (?\<phi> u)) has_derivative (\<lambda>h. 0)) (at t within {0..1})"
                if "t \<in> {0..1} - {t. ?\<phi> t \<in> K}" for t
   proof -
     have df: "(f has_derivative (\<lambda>h. 0)) (at (?\<phi> t) within ?\<phi> ` {0..1})"
       using \<open>convex S\<close> \<open>x \<in> S\<close> \<open>c \<in> S\<close> that 
       by (auto simp add: convex_alt algebra_simps intro: has_derivative_subset [OF derf])
     have "(f \<circ> ?\<phi> has_derivative (\<lambda>x. 0) \<circ> (\<lambda>z. (0 - z *\<^sub>R c) + z *\<^sub>R x)) (at t within {0..1})"
       by (rule derivative_eq_intros df | simp)+
     then show ?thesis
       unfolding o_def .
   qed
   have "(f \<circ> ?\<phi>) 1 = y"
     apply (rule has_derivative_zero_unique_strong_interval[OF fin contf'])
     unfolding o_def using \<open>f c = y\<close> derf' by auto
   then show ?thesis
     by auto
 qed
 
 
 text \<open>Also to any open connected set with finite set of exceptions. Could
  generalize to locally convex set with limpt-free set of exceptions.\<close>
 
 lemma has_derivative_zero_unique_strong_connected:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "connected S"
     and "open S"
     and "finite K"
     and contf: "continuous_on S f"
     and "c \<in> S"
     and "f c = y"
     and derf: "\<And>x. x \<in> S - K \<Longrightarrow> (f has_derivative (\<lambda>h. 0)) (at x within S)"
     and "x \<in> S"
   shows "f x = y"
 proof -
   have "\<exists>e>0. ball x e \<subseteq> (S \<inter> f -` {f x})" if "x \<in> S" for x
   proof -
     obtain e where "0 < e" and e: "ball x e \<subseteq> S"
       using \<open>x \<in> S\<close> \<open>open S\<close> open_contains_ball by blast
     have "ball x e \<subseteq> {u \<in> S. f u \<in> {f x}}"
     proof safe
       fix y
       assume y: "y \<in> ball x e"
       then show "y \<in> S"
         using e by auto
       show "f y = f x"
       proof (rule has_derivative_zero_unique_strong_convex[OF convex_ball \<open>finite K\<close>])
         show "continuous_on (ball x e) f"
           using contf continuous_on_subset e by blast
         show "(f has_derivative (\<lambda>h. 0)) (at u within ball x e)"
              if "u \<in> ball x e - K" for u
           by (metis Diff_iff contra_subsetD derf e has_derivative_subset that)
       qed (use y e \<open>0 < e\<close> in auto)
     qed
     then show "\<exists>e>0. ball x e \<subseteq> (S \<inter> f -` {f x})"
       using \<open>0 < e\<close> by blast
   qed
   then have "openin (top_of_set S) (S \<inter> f -` {y})"
     by (auto intro!: open_openin_trans[OF \<open>open S\<close>] simp: open_contains_ball)
   moreover have "closedin (top_of_set S) (S \<inter> f -` {y})"
     by (force intro!: continuous_closedin_preimage [OF contf])
   ultimately have "(S \<inter> f -` {y}) = {} \<or> (S \<inter> f -` {y}) = S"
     using \<open>connected S\<close> by (simp add: connected_clopen)
   then show ?thesis
     using \<open>x \<in> S\<close> \<open>f c = y\<close> \<open>c \<in> S\<close> by auto
 qed
 
 lemma has_derivative_zero_connected_constant:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "connected S"
       and "open S"
       and "finite k"
       and "continuous_on S f"
       and "\<forall>x\<in>(S - k). (f has_derivative (\<lambda>h. 0)) (at x within S)"
     obtains c where "\<And>x. x \<in> S \<Longrightarrow> f(x) = c"
 proof (cases "S = {}")
   case True
   then show ?thesis
     by (metis empty_iff that)
 next
   case False
   then obtain c where "c \<in> S"
     by (metis equals0I)
   then show ?thesis
     by (metis has_derivative_zero_unique_strong_connected assms that)
 qed
 
 lemma DERIV_zero_connected_constant:
   fixes f :: "'a::{real_normed_field,euclidean_space} \<Rightarrow> 'a"
   assumes "connected S"
       and "open S"
       and "finite K"
       and "continuous_on S f"
       and "\<forall>x\<in>(S - K). DERIV f x :> 0"
     obtains c where "\<And>x. x \<in> S \<Longrightarrow> f(x) = c"
   using has_derivative_zero_connected_constant [OF assms(1-4)] assms
   by (metis DERIV_const has_derivative_const Diff_iff at_within_open frechet_derivative_at has_field_derivative_def)
 
 
 subsection \<open>Integrating characteristic function of an interval\<close>
 
 lemma has_integral_restrict_open_subinterval:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes intf: "(f has_integral i) (cbox c d)"
     and cb: "cbox c d \<subseteq> cbox a b"
   shows "((\<lambda>x. if x \<in> box c d then f x else 0) has_integral i) (cbox a b)"
 proof (cases "cbox c d = {}")
   case True
   then have "box c d = {}"
     by (metis bot.extremum_uniqueI box_subset_cbox)
   then show ?thesis
     using True intf by auto
 next
   case False
   then obtain p where pdiv: "p division_of cbox a b" and inp: "cbox c d \<in> p"
     using cb partial_division_extend_1 by blast
   define g where [abs_def]: "g x = (if x \<in>box c d then f x else 0)" for x
   interpret operative "lift_option plus" "Some (0 :: 'b)"
     "\<lambda>i. if g integrable_on i then Some (integral i g) else None"
     by (fact operative_integralI)
   note operat = division [OF pdiv, symmetric]
   show ?thesis
   proof (cases "(g has_integral i) (cbox a b)")
     case True then show ?thesis
       by (simp add: g_def)
   next
     case False
     have iterate:"F (\<lambda>i. if g integrable_on i then Some (integral i g) else None) (p - {cbox c d}) = Some 0"
     proof (intro neutral ballI)
       fix x
       assume x: "x \<in> p - {cbox c d}"
       then have "x \<in> p"
         by auto
       then obtain u v where uv: "x = cbox u v"
         using pdiv by blast
       have "interior x \<inter> interior (cbox c d) = {}"
         using pdiv inp x by blast 
       then have "(g has_integral 0) x"
         unfolding uv using has_integral_spike_interior[where f="\<lambda>x. 0"]
         by (metis (no_types, lifting) disjoint_iff_not_equal g_def has_integral_0_eq interior_cbox)
       then show "(if g integrable_on x then Some (integral x g) else None) = Some 0"
         by auto
     qed
     interpret comm_monoid_set "lift_option plus" "Some (0 :: 'b)"
       by (intro comm_monoid_set.intro comm_monoid_lift_option add.comm_monoid_axioms)
     have intg: "g integrable_on cbox c d"
       using integrable_spike_interior[where f=f]
       by (meson g_def has_integral_integrable intf)
     moreover have "integral (cbox c d) g = i"
     proof (rule has_integral_unique[OF has_integral_spike_interior intf])
       show "\<And>x. x \<in> box c d \<Longrightarrow> f x = g x"
         by (auto simp: g_def)
       show "(g has_integral integral (cbox c d) g) (cbox c d)"
         by (rule integrable_integral[OF intg])
     qed
     ultimately have "F (\<lambda>A. if g integrable_on A then Some (integral A g) else None) p = Some i"
       by (metis (full_types, lifting) division_of_finite inp iterate pdiv remove right_neutral)
     then
     have "(g has_integral i) (cbox a b)"
       by (metis integrable_on_def integral_unique operat option.inject option.simps(3))
     with False show ?thesis
       by blast
   qed
 qed
 
 
 lemma has_integral_restrict_closed_subinterval:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "(f has_integral i) (cbox c d)"
     and "cbox c d \<subseteq> cbox a b"
   shows "((\<lambda>x. if x \<in> cbox c d then f x else 0) has_integral i) (cbox a b)"
 proof -
   note has_integral_restrict_open_subinterval[OF assms]
   note * = has_integral_spike[OF negligible_frontier_interval _ this]
   show ?thesis
     by (rule *[of c d]) (use box_subset_cbox[of c d] in auto)
 qed
 
 lemma has_integral_restrict_closed_subintervals_eq:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "cbox c d \<subseteq> cbox a b"
   shows "((\<lambda>x. if x \<in> cbox c d then f x else 0) has_integral i) (cbox a b) \<longleftrightarrow> (f has_integral i) (cbox c d)"
   (is "?l = ?r")
 proof (cases "cbox c d = {}")
   case False
   let ?g = "\<lambda>x. if x \<in> cbox c d then f x else 0"
   show ?thesis
   proof 
     assume ?l
     then have "?g integrable_on cbox c d"
       using assms has_integral_integrable integrable_subinterval by blast
     then have "f integrable_on cbox c d"
       by (rule integrable_eq) auto
     moreover then have "i = integral (cbox c d) f"
       by (meson \<open>((\<lambda>x. if x \<in> cbox c d then f x else 0) has_integral i) (cbox a b)\<close> assms has_integral_restrict_closed_subinterval has_integral_unique integrable_integral)
     ultimately show ?r by auto
   next
     assume ?r then show ?l
       by (rule has_integral_restrict_closed_subinterval[OF _ assms])
   qed
 qed auto
 
 
 text \<open>Hence we can apply the limit process uniformly to all integrals.\<close>
 
 lemma has_integral':
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "(f has_integral i) S \<longleftrightarrow>
     (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       (\<exists>z. ((\<lambda>x. if x \<in> S then f(x) else 0) has_integral z) (cbox a b) \<and> norm(z - i) < e))"
   (is "?l \<longleftrightarrow> (\<forall>e>0. ?r e)")
 proof (cases "\<exists>a b. S = cbox a b")
   case False then show ?thesis 
     by (simp add: has_integral_alt)
 next
   case True
   then obtain a b where S: "S = cbox a b"
     by blast 
   obtain B where " 0 < B" and B: "\<And>x. x \<in> cbox a b \<Longrightarrow> norm x \<le> B"
     using bounded_cbox[unfolded bounded_pos] by blast
   show ?thesis
   proof safe
     fix e :: real
     assume ?l and "e > 0"
     have "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) (cbox c d)"
       if "ball 0 (B+1) \<subseteq> cbox c d" for c d
         unfolding S using B that
         by (force intro: \<open>?l\<close>[unfolded S] has_integral_restrict_closed_subinterval)
     then show "?r e"
       by (meson \<open>0 < B\<close> \<open>0 < e\<close> add_pos_pos le_less_trans zero_less_one norm_pths(2))
   next
     assume as: "\<forall>e>0. ?r e"
     then obtain C 
       where C: "\<And>a b. ball 0 C \<subseteq> cbox a b \<Longrightarrow>
                 \<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b)"
       by (meson zero_less_one)
     define c :: 'n where "c = (\<Sum>i\<in>Basis. (- max B C) *\<^sub>R i)"
     define d :: 'n where "d = (\<Sum>i\<in>Basis. max B C *\<^sub>R i)"
     have "c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i" if "norm x \<le> B" "i \<in> Basis" for x i
       using that and Basis_le_norm[OF \<open>i\<in>Basis\<close>, of x]
       by (auto simp add: field_simps sum_negf c_def d_def)
     then have c_d: "cbox a b \<subseteq> cbox c d"
       by (meson B mem_box(2) subsetI)
     have "c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i"
       if x: "norm (0 - x) < C" and i: "i \<in> Basis" for x i
         using Basis_le_norm[OF i, of x] x i by (auto simp: sum_negf c_def d_def)
       then have "ball 0 C \<subseteq> cbox c d"
         by (auto simp: mem_box dist_norm)
     with C obtain y where y: "(f has_integral y) (cbox a b)"
       using c_d has_integral_restrict_closed_subintervals_eq S by blast
     have "y = i"
     proof (rule ccontr)
       assume "y \<noteq> i"
       then have "0 < norm (y - i)"
         by auto
       from as[rule_format,OF this]
       obtain C where C: "\<And>a b. ball 0 C \<subseteq> cbox a b \<Longrightarrow> 
            \<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b) \<and> norm (z-i) < norm (y-i)"
         by auto
       define c :: 'n where "c = (\<Sum>i\<in>Basis. (- max B C) *\<^sub>R i)"
       define d :: 'n where "d = (\<Sum>i\<in>Basis. max B C *\<^sub>R i)"
       have "c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i"
         if "norm x \<le> B" and "i \<in> Basis" for x i
           using that Basis_le_norm[of i x] by (auto simp add: field_simps sum_negf c_def d_def)
         then have c_d: "cbox a b \<subseteq> cbox c d"
         by (simp add: B mem_box(2) subset_eq)
       have "c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i" if "norm (0 - x) < C" and "i \<in> Basis" for x i
         using Basis_le_norm[of i x] that by (auto simp: sum_negf c_def d_def)
       then have "ball 0 C \<subseteq> cbox c d"
         by (auto simp: mem_box dist_norm)
       with C obtain z where z: "(f has_integral z) (cbox a b)" "norm (z-i) < norm (y-i)"
         using has_integral_restrict_closed_subintervals_eq[OF c_d] S by blast
       moreover then have "z = y" 
         by (blast intro: has_integral_unique[OF _ y])
       ultimately show False
         by auto
     qed
     then show ?l
       using y by (auto simp: S)
   qed
 qed
 
 lemma has_integral_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes fg: "(f has_integral i) S" "(g has_integral j) S"
     and le: "\<And>x. x \<in> S \<Longrightarrow> f x \<le> g x"
   shows "i \<le> j"
   using has_integral_component_le[OF _ fg, of 1] le  by auto
 
 lemma integral_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "f integrable_on S"
     and "g integrable_on S"
     and "\<And>x. x \<in> S \<Longrightarrow> f x \<le> g x"
   shows "integral S f \<le> integral S g"
   by (rule has_integral_le[OF assms(1,2)[unfolded has_integral_integral] assms(3)])
 
 lemma has_integral_nonneg:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "(f has_integral i) S"
     and "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f x"
   shows "0 \<le> i"
   using has_integral_component_nonneg[of 1 f i S]
   unfolding o_def
   using assms
   by auto
 
 lemma integral_nonneg:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes f: "f integrable_on S" and 0: "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f x"
   shows "0 \<le> integral S f"
   by (rule has_integral_nonneg[OF f[unfolded has_integral_integral] 0])
 
 
 text \<open>Hence a general restriction property.\<close>
 
 lemma has_integral_restrict [simp]:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   assumes "S \<subseteq> T"
   shows "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) T \<longleftrightarrow> (f has_integral i) S"
 proof -
   have *: "\<And>x. (if x \<in> T then if x \<in> S then f x else 0 else 0) =  (if x\<in>S then f x else 0)"
     using assms by auto
   show ?thesis
     apply (subst(2) has_integral')
     apply (subst has_integral')
       apply (simp add: *)
     done
 qed
 
 corollary has_integral_restrict_UNIV:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "((\<lambda>x. if x \<in> s then f x else 0) has_integral i) UNIV \<longleftrightarrow> (f has_integral i) s"
   by auto
 
 lemma has_integral_restrict_Int:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) T \<longleftrightarrow> (f has_integral i) (S \<inter> T)"
 proof -
   have "((\<lambda>x. if x \<in> T then if x \<in> S then f x else 0 else 0) has_integral i) UNIV =
         ((\<lambda>x. if x \<in> S \<inter> T then f x else 0) has_integral i) UNIV"
     by (rule has_integral_cong) auto
   then show ?thesis
     using has_integral_restrict_UNIV by fastforce
 qed
 
 lemma integral_restrict_Int:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "integral T (\<lambda>x. if x \<in> S then f x else 0) = integral (S \<inter> T) f"
   by (metis (no_types, lifting) has_integral_cong has_integral_restrict_Int integrable_integral integral_unique not_integrable_integral)
 
 lemma integrable_restrict_Int:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "(\<lambda>x. if x \<in> S then f x else 0) integrable_on T \<longleftrightarrow> f integrable_on (S \<inter> T)"
   using has_integral_restrict_Int by fastforce
 
 lemma has_integral_on_superset:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "(f has_integral i) S"
       and "\<And>x. x \<notin> S \<Longrightarrow> f x = 0"
       and "S \<subseteq> T"
     shows "(f has_integral i) T"
 proof -
   have "(\<lambda>x. if x \<in> S then f x else 0) = (\<lambda>x. if x \<in> T then f x else 0)"
     using assms by fastforce
   with f show ?thesis
     by (simp only: has_integral_restrict_UNIV [symmetric, of f])
 qed
 
 lemma integrable_on_superset:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on S"
     and "\<And>x. x \<notin> S \<Longrightarrow> f x = 0"
     and "S \<subseteq> t"
   shows "f integrable_on t"
   using assms
   unfolding integrable_on_def
   by (auto intro:has_integral_on_superset)
 
 lemma integral_restrict_UNIV:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "integral UNIV (\<lambda>x. if x \<in> S then f x else 0) = integral S f"
   by (simp add: integral_restrict_Int)
 
 lemma integrable_restrict_UNIV:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "(\<lambda>x. if x \<in> s then f x else 0) integrable_on UNIV \<longleftrightarrow> f integrable_on s"
   unfolding integrable_on_def
   by auto
 
 lemma has_integral_subset_component_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes k: "k \<in> Basis"
     and as: "S \<subseteq> T" "(f has_integral i) S" "(f has_integral j) T" "\<And>x. x\<in>T \<Longrightarrow> 0 \<le> f(x)\<bullet>k"
   shows "i\<bullet>k \<le> j\<bullet>k"
 proof -
   have \<section>: "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) UNIV"
           "((\<lambda>x. if x \<in> T then f x else 0) has_integral j) UNIV"
     by (simp_all add: assms)
   show ?thesis
     using as by (force intro!: has_integral_component_le[OF k \<section>])
 qed
 
 subsection\<open>Integrals on set differences\<close>
 
 lemma has_integral_setdiff:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes S: "(f has_integral i) S" and T: "(f has_integral j) T"
     and neg: "negligible (T - S)"
   shows "(f has_integral (i - j)) (S - T)"
 proof -
   show ?thesis
     unfolding has_integral_restrict_UNIV [symmetric, of f]
   proof (rule has_integral_spike [OF neg])
     have eq: "(\<lambda>x. (if x \<in> S then f x else 0) - (if x \<in> T then f x else 0)) =
             (\<lambda>x. if x \<in> T - S then - f x else if x \<in> S - T then f x else 0)"
       by (force simp add: )
     have "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) UNIV"
       "((\<lambda>x. if x \<in> T then f x else 0) has_integral j) UNIV"
       using S T has_integral_restrict_UNIV by auto
     from has_integral_diff [OF this]
     show "((\<lambda>x. if x \<in> T - S then - f x else if x \<in> S - T then f x else 0)
                    has_integral i-j) UNIV"
       by (simp add: eq)
   qed force
 qed
 
 lemma integral_setdiff:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "f integrable_on S" "f integrable_on T" "negligible(T - S)"
  shows "integral (S - T) f = integral S f - integral T f"
   by (rule integral_unique) (simp add: assms has_integral_setdiff integrable_integral)
 
 lemma integrable_setdiff:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "(f has_integral i) S" "(f has_integral j) T" "negligible (T - S)"
   shows "f integrable_on (S - T)"
   using has_integral_setdiff [OF assms]
   by (simp add: has_integral_iff)
 
 lemma negligible_setdiff [simp]: "T \<subseteq> S \<Longrightarrow> negligible (T - S)"
   by (metis Diff_eq_empty_iff negligible_empty)
 
 lemma negligible_on_intervals: "negligible s \<longleftrightarrow> (\<forall>a b. negligible(s \<inter> cbox a b))" (is "?l \<longleftrightarrow> ?r")
 proof
   assume R: ?r
   show ?l
     unfolding negligible_def
   proof safe
     fix a b
     have "negligible (s \<inter> cbox a b)"
       by (simp add: R)
     then show "(indicator s has_integral 0) (cbox a b)"
       by (meson Diff_iff Int_iff has_integral_negligible indicator_simps(2))
   qed
 qed (simp add: negligible_Int)
 
 lemma negligible_translation:
   assumes "negligible S"
     shows "negligible ((+) c ` S)"
 proof -
   have inj: "inj ((+) c)"
     by simp
   show ?thesis
   using assms
   proof (clarsimp simp: negligible_def)
     fix a b
     assume "\<forall>x y. (indicator S has_integral 0) (cbox x y)"
     then have *: "(indicator S has_integral 0) (cbox (a-c) (b-c))"
       by (meson Diff_iff assms has_integral_negligible indicator_simps(2))
     have eq: "indicator ((+) c ` S) = (\<lambda>x. indicator S (x - c))"
       by (force simp add: indicator_def)
     show "(indicator ((+) c ` S) has_integral 0) (cbox a b)"
       using has_integral_affinity [OF *, of 1 "-c"]
             cbox_translation [of "c" "-c+a" "-c+b"]
       by (simp add: eq) (simp add: ac_simps)
   qed
 qed
 
 lemma negligible_translation_rev:
   assumes "negligible ((+) c ` S)"
     shows "negligible S"
 by (metis negligible_translation [OF assms, of "-c"] translation_galois)
 
 lemma has_integral_spike_set_eq:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "(f has_integral y) S \<longleftrightarrow> (f has_integral y) T"
 proof -
   have "((\<lambda>x. if x \<in> S then f x else 0) has_integral y) UNIV =
         ((\<lambda>x. if x \<in> T then f x else 0) has_integral y) UNIV"
   proof (rule has_integral_spike_eq)
     show "negligible ({x \<in> S - T. f x \<noteq> 0} \<union> {x \<in> T - S. f x \<noteq> 0})"
       by (rule negligible_Un [OF assms])
   qed auto
   then show ?thesis
     by (simp add: has_integral_restrict_UNIV)
 qed
 
 corollary integral_spike_set:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "integral S f = integral T f"
   using has_integral_spike_set_eq [OF assms]
   by (metis eq_integralD integral_unique)
 
 lemma integrable_spike_set:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on S" and neg: "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "f integrable_on T"
   using has_integral_spike_set_eq [OF neg] f by blast
 
 lemma integrable_spike_set_eq:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "negligible ((S - T) \<union> (T - S))"
   shows "f integrable_on S \<longleftrightarrow> f integrable_on T"
   by (blast intro: integrable_spike_set assms negligible_subset)
 
 lemma integrable_on_insert_iff: "f integrable_on (insert x X) \<longleftrightarrow> f integrable_on X"
   for f::"_ \<Rightarrow> 'a::banach"
   by (rule integrable_spike_set_eq) (auto simp: insert_Diff_if)
 
 lemma has_integral_interior:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "negligible(frontier S) \<Longrightarrow> (f has_integral y) (interior S) \<longleftrightarrow> (f has_integral y) S"
   by (rule has_integral_spike_set_eq [OF empty_imp_negligible negligible_subset])
      (use interior_subset in \<open>auto simp: frontier_def closure_def\<close>)
 
 lemma has_integral_closure:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "negligible(frontier S) \<Longrightarrow> (f has_integral y) (closure S) \<longleftrightarrow> (f has_integral y) S"
   by (rule has_integral_spike_set_eq [OF negligible_subset empty_imp_negligible]) (auto simp: closure_Un_frontier )
 
 lemma has_integral_open_interval:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "(f has_integral y) (box a b) \<longleftrightarrow> (f has_integral y) (cbox a b)"
   unfolding interior_cbox [symmetric]
   by (metis frontier_cbox has_integral_interior negligible_frontier_interval)
 
 lemma integrable_on_open_interval:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "f integrable_on box a b \<longleftrightarrow> f integrable_on cbox a b"
   by (simp add: has_integral_open_interval integrable_on_def)
 
 lemma integral_open_interval:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "integral(box a b) f = integral(cbox a b) f"
   by (metis has_integral_integrable_integral has_integral_open_interval not_integrable_integral)
 
 
 subsection \<open>More lemmas that are useful later\<close>
 
 lemma has_integral_subset_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "s \<subseteq> t"
     and "(f has_integral i) s"
     and "(f has_integral j) t"
     and "\<forall>x\<in>t. 0 \<le> f x"
   shows "i \<le> j"
   using has_integral_subset_component_le[OF _ assms(1), of 1 f i j]
   using assms
   by auto
 
 lemma integral_subset_component_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "k \<in> Basis"
     and "s \<subseteq> t"
     and "f integrable_on s"
     and "f integrable_on t"
     and "\<forall>x \<in> t. 0 \<le> f x \<bullet> k"
   shows "(integral s f)\<bullet>k \<le> (integral t f)\<bullet>k"
   by (meson assms has_integral_subset_component_le integrable_integral)
 
 lemma integral_subset_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "s \<subseteq> t"
     and "f integrable_on s"
     and "f integrable_on t"
     and "\<forall>x \<in> t. 0 \<le> f x"
   shows "integral s f \<le> integral t f"
   using assms has_integral_subset_le by blast
 
 lemma has_integral_alt':
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "(f has_integral i) s \<longleftrightarrow> 
           (\<forall>a b. (\<lambda>x. if x \<in> s then f x else 0) integrable_on cbox a b) \<and>
           (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
             norm (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) - i) < e)"
   (is "?l = ?r")
 proof
   assume rhs: ?r
   show ?l
   proof (subst has_integral', intro allI impI)
     fix e::real
     assume "e > 0"
     from rhs[THEN conjunct2,rule_format,OF this] 
     show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
                    (\<exists>z. ((\<lambda>x. if x \<in> s then f x else 0) has_integral z)
                          (cbox a b) \<and> norm (z - i) < e)"
       by (simp add: has_integral_iff rhs)
   qed
 next
   let ?\<Phi> = "\<lambda>e a b. \<exists>z. ((\<lambda>x. if x \<in> s then f x else 0) has_integral z) (cbox a b) \<and> norm (z - i) < e"
   assume ?l 
   then have lhs: "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow> ?\<Phi> e a b" if "e > 0" for e
     using that has_integral'[of f] by auto
   let ?f = "\<lambda>x. if x \<in> s then f x else 0"
   show ?r
   proof (intro conjI allI impI)
     fix a b :: 'n
     from lhs[OF zero_less_one]
     obtain B where "0 < B" and B: "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> ?\<Phi> 1 a b"
       by blast
     let ?a = "\<Sum>i\<in>Basis. min (a\<bullet>i) (-B) *\<^sub>R i::'n"
     let ?b = "\<Sum>i\<in>Basis. max (b\<bullet>i) B *\<^sub>R i::'n"
     show "?f integrable_on cbox a b"
     proof (rule integrable_subinterval[of _ ?a ?b])
       have "?a \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> ?b \<bullet> i" if "norm (0 - x) < B" "i \<in> Basis" for x i
         using Basis_le_norm[of i x] that by (auto simp add:field_simps)
       then have "ball 0 B \<subseteq> cbox ?a ?b"
         by (auto simp: mem_box dist_norm)
       then show "?f integrable_on cbox ?a ?b"
         unfolding integrable_on_def using B by blast
       show "cbox a b \<subseteq> cbox ?a ?b"
         by (force simp: mem_box)
     qed
   
     fix e :: real
     assume "e > 0"
     with lhs show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       norm (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) - i) < e"
       by (metis (no_types, lifting) has_integral_integrable_integral)
   qed
 qed
 
 
 subsection \<open>Continuity of the integral (for a 1-dimensional interval)\<close>
 
 lemma integrable_alt:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "f integrable_on s \<longleftrightarrow>
     (\<forall>a b. (\<lambda>x. if x \<in> s then f x else 0) integrable_on cbox a b) \<and>
     (\<forall>e>0. \<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
     norm (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) -
       integral (cbox c d)  (\<lambda>x. if x \<in> s then f x else 0)) < e)"
   (is "?l = ?r")
 proof
   let ?F = "\<lambda>x. if x \<in> s then f x else 0"
   assume ?l
   then obtain y where intF: "\<And>a b. ?F integrable_on cbox a b"
           and y: "\<And>e. 0 < e \<Longrightarrow>
               \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow> norm (integral (cbox a b) ?F - y) < e"
     unfolding integrable_on_def has_integral_alt'[of f] by auto
   show ?r
   proof (intro conjI allI impI intF)
     fix e::real
     assume "e > 0"
     then have "e/2 > 0"
       by auto
     obtain B where "0 < B" 
        and B: "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> norm (integral (cbox a b) ?F - y) < e/2"
       using \<open>0 < e/2\<close> y by blast
     show "\<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
                   norm (integral (cbox a b) ?F - integral (cbox c d) ?F) < e"
     proof (intro conjI exI impI allI, rule \<open>0 < B\<close>)
       fix a b c d::'n
       assume sub: "ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d"
       show "norm (integral (cbox a b) ?F - integral (cbox c d) ?F) < e"
         using sub by (auto intro: norm_triangle_half_l dest: B)
     qed
   qed
 next
   let ?F = "\<lambda>x. if x \<in> s then f x else 0"
   assume rhs: ?r
   let ?cube = "\<lambda>n. cbox (\<Sum>i\<in>Basis. - real n *\<^sub>R i::'n) (\<Sum>i\<in>Basis. real n *\<^sub>R i)"
   have "Cauchy (\<lambda>n. integral (?cube n) ?F)"
     unfolding Cauchy_def
   proof (intro allI impI)
     fix e::real
     assume "e > 0"
     with rhs obtain B where "0 < B" 
       and B: "\<And>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d 
                         \<Longrightarrow> norm (integral (cbox a b) ?F - integral (cbox c d) ?F) < e"
       by blast
     obtain N where N: "B \<le> real N"
       using real_arch_simple by blast
     have "ball 0 B \<subseteq> ?cube n" if n: "n \<ge> N" for n
     proof -
       have "sum ((*\<^sub>R) (- real n)) Basis \<bullet> i \<le> x \<bullet> i \<and>
             x \<bullet> i \<le> sum ((*\<^sub>R) (real n)) Basis \<bullet> i"
         if "norm x < B" "i \<in> Basis" for x i::'n
           using Basis_le_norm[of i x] n N that by (auto simp add: field_simps sum_negf)
       then show ?thesis
         by (auto simp: mem_box dist_norm)
     qed
     then show "\<exists>M. \<forall>m\<ge>M. \<forall>n\<ge>M. dist (integral (?cube m) ?F) (integral (?cube n) ?F) < e"
       by (fastforce simp add: dist_norm intro!: B)
   qed
   then obtain i where i: "(\<lambda>n. integral (?cube n) ?F) \<longlonglongrightarrow> i"
     using convergent_eq_Cauchy by blast
   have "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow> norm (integral (cbox a b) ?F - i) < e"
     if "e > 0" for e
   proof -
     have *: "e/2 > 0" using that by auto
     then obtain N where N: "\<And>n. N \<le> n \<Longrightarrow> norm (i - integral (?cube n) ?F) < e/2"
       using i[THEN LIMSEQ_D, simplified norm_minus_commute] by meson
     obtain B where "0 < B" 
       and B: "\<And>a b c d. \<lbrakk>ball 0 B \<subseteq> cbox a b; ball 0 B \<subseteq> cbox c d\<rbrakk> \<Longrightarrow>
                   norm (integral (cbox a b) ?F - integral (cbox c d) ?F) < e/2"
       using rhs * by meson
     let ?B = "max (real N) B"
     show ?thesis
     proof (intro exI conjI allI impI)
       show "0 < ?B"
         using \<open>B > 0\<close> by auto
       fix a b :: 'n
       assume "ball 0 ?B \<subseteq> cbox a b"
       moreover obtain n where n: "max (real N) B \<le> real n"
         using real_arch_simple by blast
       moreover have "ball 0 B \<subseteq> ?cube n"
       proof 
         fix x :: 'n
         assume x: "x \<in> ball 0 B"
         have "\<lbrakk>norm (0 - x) < B; i \<in> Basis\<rbrakk>
               \<Longrightarrow> sum ((*\<^sub>R) (-n)) Basis \<bullet> i\<le> x \<bullet> i \<and> x \<bullet> i \<le> sum ((*\<^sub>R) n) Basis \<bullet> i" for i
           using Basis_le_norm[of i x] n by (auto simp add: field_simps sum_negf)
         then show "x \<in> ?cube n"
           using x by (auto simp: mem_box dist_norm)
       qed 
       ultimately show "norm (integral (cbox a b) ?F - i) < e"
         using norm_triangle_half_l [OF B N] by force
     qed
   qed
   then show ?l unfolding integrable_on_def has_integral_alt'[of f]
     using rhs by blast
 qed
 
 lemma integrable_altD:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on s"
   shows "\<And>a b. (\<lambda>x. if x \<in> s then f x else 0) integrable_on cbox a b"
     and "\<And>e. e > 0 \<Longrightarrow> \<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
       norm (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) - integral (cbox c d)  (\<lambda>x. if x \<in> s then f x else 0)) < e"
   using assms[unfolded integrable_alt[of f]] by auto
 
 lemma integrable_alt_subset:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   shows
      "f integrable_on S \<longleftrightarrow>
       (\<forall>a b. (\<lambda>x. if x \<in> S then f x else 0) integrable_on cbox a b) \<and>
       (\<forall>e>0. \<exists>B>0. \<forall>a b c d.
                       ball 0 B \<subseteq> cbox a b \<and> cbox a b \<subseteq> cbox c d
                       \<longrightarrow> norm(integral (cbox a b) (\<lambda>x. if x \<in> S then f x else 0) -
                                integral (cbox c d) (\<lambda>x. if x \<in> S then f x else 0)) < e)"
       (is "_ = ?rhs")
 proof -
   let ?g = "\<lambda>x. if x \<in> S then f x else 0"
   have "f integrable_on S \<longleftrightarrow>
         (\<forall>a b. ?g integrable_on cbox a b) \<and>
         (\<forall>e>0. \<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
            norm (integral (cbox a b) ?g - integral (cbox c d)  ?g) < e)"
     by (rule integrable_alt)
   also have "\<dots> = ?rhs"
   proof -
     { fix e :: "real"
       assume e: "\<And>e. e>0 \<Longrightarrow> \<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> cbox a b \<subseteq> cbox c d \<longrightarrow>
                                    norm (integral (cbox a b) ?g - integral (cbox c d) ?g) < e"
         and "e > 0"
       obtain B where "B > 0"
         and B: "\<And>a b c d. \<lbrakk>ball 0 B \<subseteq> cbox a b; cbox a b \<subseteq> cbox c d\<rbrakk> \<Longrightarrow>
                            norm (integral (cbox a b) ?g - integral (cbox c d) ?g) < e/2"
         using \<open>e > 0\<close> e [of "e/2"] by force
       have "\<exists>B>0. \<forall>a b c d.
                ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
                norm (integral (cbox a b) ?g - integral (cbox c d) ?g) < e"
       proof (intro exI allI conjI impI)
         fix a b c d :: "'a"
         let ?\<alpha> = "\<Sum>i\<in>Basis. max (a \<bullet> i) (c \<bullet> i) *\<^sub>R i"
         let ?\<beta> = "\<Sum>i\<in>Basis. min (b \<bullet> i) (d \<bullet> i) *\<^sub>R i"
         show "norm (integral (cbox a b) ?g - integral (cbox c d) ?g) < e"
           if ball: "ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d"
         proof -
           have B': "norm (integral (cbox a b \<inter> cbox c d) ?g - integral (cbox x y) ?g) < e/2"
             if "cbox a b \<inter> cbox c d \<subseteq> cbox x y" for x y
             using B [of ?\<alpha> ?\<beta> x y] ball that by (simp add: Int_interval [symmetric])
           show ?thesis
             using B' [of a b] B' [of c d] norm_triangle_half_r by blast
         qed
       qed (use \<open>B > 0\<close> in auto)}
     then show ?thesis
       by force
   qed
   finally show ?thesis .
 qed
 
 lemma integrable_on_subcbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes intf: "f integrable_on S"
     and sub: "cbox a b \<subseteq> S"
   shows "f integrable_on cbox a b"
 proof -
   have "(\<lambda>x. if x \<in> S then f x else 0) integrable_on cbox a b"
     by (simp add: intf integrable_altD(1))
 then show ?thesis
   by (metis (mono_tags) sub integrable_restrict_Int le_inf_iff order_refl subset_antisym)
 qed
 
 
 subsection \<open>A straddling criterion for integrability\<close>
 
 lemma integrable_straddle_interval:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "\<And>e. e>0 \<Longrightarrow> \<exists>g h i j. (g has_integral i) (cbox a b) \<and> (h has_integral j) (cbox a b) \<and>
                             \<bar>i - j\<bar> < e \<and> (\<forall>x\<in>cbox a b. (g x) \<le> f x \<and> f x \<le> h x)"
   shows "f integrable_on cbox a b"
 proof -
   have "\<exists>d. gauge d \<and>
             (\<forall>p1 p2. p1 tagged_division_of cbox a b \<and> d fine p1 \<and>
                      p2 tagged_division_of cbox a b \<and> d fine p2 \<longrightarrow>
                      \<bar>(\<Sum>(x,K)\<in>p1. content K *\<^sub>R f x) - (\<Sum>(x,K)\<in>p2. content K *\<^sub>R f x)\<bar> < e)"
     if "e > 0" for e
   proof -
     have e: "e/3 > 0"
       using that by auto
     then obtain g h i j where ij: "\<bar>i - j\<bar> < e/3"
             and "(g has_integral i) (cbox a b)"
             and "(h has_integral j) (cbox a b)"
             and fgh: "\<And>x. x \<in> cbox a b \<Longrightarrow> g x \<le> f x \<and> f x \<le> h x"
       using assms real_norm_def by metis
     then obtain d1 d2 where "gauge d1" "gauge d2"
             and d1: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; d1 fine p\<rbrakk> \<Longrightarrow>
                           \<bar>(\<Sum>(x,K)\<in>p. content K *\<^sub>R g x) - i\<bar> < e/3"
             and d2: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; d2 fine p\<rbrakk> \<Longrightarrow>
                           \<bar>(\<Sum>(x,K) \<in> p. content K *\<^sub>R h x) - j\<bar> < e/3"
       by (metis e has_integral real_norm_def)
     have "\<bar>(\<Sum>(x,K) \<in> p1. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p2. content K *\<^sub>R f x)\<bar> < e"
       if p1: "p1 tagged_division_of cbox a b" and 11: "d1 fine p1" and 21: "d2 fine p1"
        and p2: "p2 tagged_division_of cbox a b" and 12: "d1 fine p2" and 22: "d2 fine p2" for p1 p2
     proof -
       have *: "\<And>g1 g2 h1 h2 f1 f2.
                   \<lbrakk>\<bar>g2 - i\<bar> < e/3; \<bar>g1 - i\<bar> < e/3; \<bar>h2 - j\<bar> < e/3; \<bar>h1 - j\<bar> < e/3;
                    g1 - h2 \<le> f1 - f2; f1 - f2 \<le> h1 - g2\<rbrakk>
                   \<Longrightarrow> \<bar>f1 - f2\<bar> < e"
         using \<open>e > 0\<close> ij by arith
       have 0: "(\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) - (\<Sum>(x, k)\<in>p1. content k *\<^sub>R g x) \<ge> 0"
               "0 \<le> (\<Sum>(x, k)\<in>p2. content k *\<^sub>R h x) - (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x)"
               "(\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x) - (\<Sum>(x, k)\<in>p2. content k *\<^sub>R g x) \<ge> 0"
               "0 \<le> (\<Sum>(x, k)\<in>p1. content k *\<^sub>R h x) - (\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x)"
         unfolding sum_subtractf[symmetric]
            apply (auto intro!: sum_nonneg)
            apply (meson fgh measure_nonneg mult_left_mono tag_in_interval that sum_nonneg)+
         done
       show ?thesis
       proof (rule *)
         show "\<bar>(\<Sum>(x,K) \<in> p2. content K *\<^sub>R g x) - i\<bar> < e/3"
           by (rule d1[OF p2 12])
         show "\<bar>(\<Sum>(x,K) \<in> p1. content K *\<^sub>R g x) - i\<bar> < e/3"
           by (rule d1[OF p1 11])
         show "\<bar>(\<Sum>(x,K) \<in> p2. content K *\<^sub>R h x) - j\<bar> < e/3"
           by (rule d2[OF p2 22])
         show "\<bar>(\<Sum>(x,K) \<in> p1. content K *\<^sub>R h x) - j\<bar> < e/3"
           by (rule d2[OF p1 21])
       qed (use 0 in auto)
     qed
     then show ?thesis
       by (rule_tac x="\<lambda>x. d1 x \<inter> d2 x" in exI)
         (auto simp: fine_Int intro: \<open>gauge d1\<close> \<open>gauge d2\<close> d1 d2)
   qed
   then show ?thesis
     by (simp add: integrable_Cauchy)
 qed
 
 lemma integrable_straddle:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "\<And>e. e>0 \<Longrightarrow> \<exists>g h i j. (g has_integral i) s \<and> (h has_integral j) s \<and>
                      \<bar>i - j\<bar> < e \<and> (\<forall>x\<in>s. g x \<le> f x \<and> f x \<le> h x)"
   shows "f integrable_on s"
 proof -
   let ?fs = "(\<lambda>x. if x \<in> s then f x else 0)"
   have "?fs integrable_on cbox a b" for a b
   proof (rule integrable_straddle_interval)
     fix e::real
     assume "e > 0"
     then have *: "e/4 > 0"
       by auto
     with assms obtain g h i j where g: "(g has_integral i) s" and h: "(h has_integral j) s"
                  and ij: "\<bar>i - j\<bar> < e/4"
                  and fgh: "\<And>x. x \<in> s \<Longrightarrow> g x \<le> f x \<and> f x \<le> h x"
       by metis
     let ?gs = "(\<lambda>x. if x \<in> s then g x else 0)"
     let ?hs = "(\<lambda>x. if x \<in> s then h x else 0)"
     obtain Bg where Bg: "\<And>a b. ball 0 Bg \<subseteq> cbox a b \<Longrightarrow> \<bar>integral (cbox a b) ?gs - i\<bar> < e/4"
               and int_g: "\<And>a b. ?gs integrable_on cbox a b"
       using g * unfolding has_integral_alt' real_norm_def by meson
     obtain Bh where
           Bh: "\<And>a b. ball 0 Bh \<subseteq> cbox a b \<Longrightarrow> \<bar>integral (cbox a b) ?hs - j\<bar> < e/4"
          and int_h: "\<And>a b. ?hs integrable_on cbox a b"
       using h * unfolding has_integral_alt' real_norm_def by meson
     define c where "c = (\<Sum>i\<in>Basis. min (a\<bullet>i) (- (max Bg Bh)) *\<^sub>R i)"
     define d where "d = (\<Sum>i\<in>Basis. max (b\<bullet>i) (max Bg Bh) *\<^sub>R i)"
     have "\<lbrakk>norm (0 - x) < Bg; i \<in> Basis\<rbrakk> \<Longrightarrow> c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i" for x i
       using Basis_le_norm[of i x] unfolding c_def d_def by auto
     then have ballBg: "ball 0 Bg \<subseteq> cbox c d"
       by (auto simp: mem_box dist_norm)
     have "\<lbrakk>norm (0 - x) < Bh; i \<in> Basis\<rbrakk> \<Longrightarrow> c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i" for x i
       using Basis_le_norm[of i x] unfolding c_def d_def by auto
     then have ballBh: "ball 0 Bh \<subseteq> cbox c d"
       by (auto simp: mem_box dist_norm)
     have ab_cd: "cbox a b \<subseteq> cbox c d"
       by (auto simp: c_def d_def subset_box_imp)
     have **: "\<And>ch cg ag ah::real. \<lbrakk>\<bar>ah - ag\<bar> \<le> \<bar>ch - cg\<bar>; \<bar>cg - i\<bar> < e/4; \<bar>ch - j\<bar> < e/4\<rbrakk>
        \<Longrightarrow> \<bar>ag - ah\<bar> < e"
       using ij by arith
     show "\<exists>g h i j. (g has_integral i) (cbox a b) \<and> (h has_integral j) (cbox a b) \<and> \<bar>i - j\<bar> < e \<and>
           (\<forall>x\<in>cbox a b. g x \<le> (if x \<in> s then f x else 0) \<and>
                         (if x \<in> s then f x else 0) \<le> h x)"
     proof (intro exI ballI conjI)
       have eq: "\<And>x f g. (if x \<in> s then f x else 0) - (if x \<in> s then g x else 0) =
                        (if x \<in> s then f x - g x else (0::real))"
         by auto
       have int_hg: "(\<lambda>x. if x \<in> s then h x - g x else 0) integrable_on cbox a b"
                    "(\<lambda>x. if x \<in> s then h x - g x else 0) integrable_on cbox c d"
         by (metis (no_types) integrable_diff g h has_integral_integrable integrable_altD(1))+
       show "(?gs has_integral integral (cbox a b) ?gs) (cbox a b)"
            "(?hs has_integral integral (cbox a b) ?hs) (cbox a b)"
         by (intro integrable_integral int_g int_h)+
       then have "integral (cbox a b) ?gs \<le> integral (cbox a b) ?hs"
         using fgh by (force intro: has_integral_le)
       then have "0 \<le> integral (cbox a b) ?hs - integral (cbox a b) ?gs"
         by simp
       then have "\<bar>integral (cbox a b) ?hs - integral (cbox a b) ?gs\<bar>
               \<le> \<bar>integral (cbox c d) ?hs - integral (cbox c d) ?gs\<bar>"
         apply (simp add: integral_diff [symmetric] int_g int_h)
         apply (subst abs_of_nonneg[OF integral_nonneg[OF integrable_diff, OF int_h int_g]])
         using fgh apply (force simp: eq intro!: integral_subset_le [OF ab_cd int_hg])+
         done
       then show "\<bar>integral (cbox a b) ?gs - integral (cbox a b) ?hs\<bar> < e"
         using ** Bg ballBg Bh ballBh by blast
       show "\<And>x. x \<in> cbox a b \<Longrightarrow> ?gs x \<le> ?fs x" "\<And>x. x \<in> cbox a b \<Longrightarrow> ?fs x \<le> ?hs x"
         using fgh by auto
     qed
   qed
   then have int_f: "?fs integrable_on cbox a b" for a b
     by simp
   have "\<exists>B>0. \<forall>a b c d.
                   ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
                   abs (integral (cbox a b) ?fs - integral (cbox c d) ?fs) < e"
       if "0 < e" for e
   proof -
     have *: "e/3 > 0"
       using that by auto
     with assms obtain g h i j where g: "(g has_integral i) s" and h: "(h has_integral j) s"
                  and ij: "\<bar>i - j\<bar> < e/3"
                  and fgh: "\<And>x. x \<in> s \<Longrightarrow> g x \<le> f x \<and> f x \<le> h x"
       by metis
     let ?gs = "(\<lambda>x. if x \<in> s then g x else 0)"
     let ?hs = "(\<lambda>x. if x \<in> s then h x else 0)"
     obtain Bg where "Bg > 0"
               and Bg: "\<And>a b. ball 0 Bg \<subseteq> cbox a b \<Longrightarrow> \<bar>integral (cbox a b) ?gs - i\<bar> < e/3"
               and int_g: "\<And>a b. ?gs integrable_on cbox a b"
       using g * unfolding has_integral_alt' real_norm_def by meson
     obtain Bh where "Bh > 0"
               and Bh: "\<And>a b. ball 0 Bh \<subseteq> cbox a b \<Longrightarrow> \<bar>integral (cbox a b) ?hs - j\<bar> < e/3"
               and int_h: "\<And>a b. ?hs integrable_on cbox a b"
       using h * unfolding has_integral_alt' real_norm_def by meson
     { fix a b c d :: 'n
       assume as: "ball 0 (max Bg Bh) \<subseteq> cbox a b" "ball 0 (max Bg Bh) \<subseteq> cbox c d"
       have **: "ball 0 Bg \<subseteq> ball (0::'n) (max Bg Bh)" "ball 0 Bh \<subseteq> ball (0::'n) (max Bg Bh)"
         by auto
       have *: "\<And>ga gc ha hc fa fc. \<lbrakk>\<bar>ga - i\<bar> < e/3; \<bar>gc - i\<bar> < e/3; \<bar>ha - j\<bar> < e/3;
                      \<bar>hc - j\<bar> < e/3; ga \<le> fa; fa \<le> ha; gc \<le> fc; fc \<le> hc\<rbrakk> \<Longrightarrow>
         \<bar>fa - fc\<bar> < e"
         using ij by arith
       have "abs (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) - integral (cbox c d)
         (\<lambda>x. if x \<in> s then f x else 0)) < e"
       proof (rule *)
         show "\<bar>integral (cbox a b) ?gs - i\<bar> < e/3"
           using "**" Bg as by blast
         show "\<bar>integral (cbox c d) ?gs - i\<bar> < e/3"
           using "**" Bg as by blast
         show "\<bar>integral (cbox a b) ?hs - j\<bar> < e/3"
           using "**" Bh as by blast
         show "\<bar>integral (cbox c d) ?hs - j\<bar> < e/3"
           using "**" Bh as by blast
       qed (use int_f int_g int_h fgh in \<open>simp_all add: integral_le\<close>)
     }
     then show ?thesis
       apply (rule_tac x="max Bg Bh" in exI)
         using \<open>Bg > 0\<close> by auto
   qed
   then show ?thesis
     unfolding integrable_alt[of f] real_norm_def by (blast intro: int_f)
 qed
 
 
 subsection \<open>Adding integrals over several sets\<close>
 
 lemma has_integral_Un:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "(f has_integral i) S" "(f has_integral j) T"
     and neg: "negligible (S \<inter> T)"
   shows "(f has_integral (i + j)) (S \<union> T)"
   unfolding has_integral_restrict_UNIV[symmetric, of f]
 proof (rule has_integral_spike[OF neg])
   let ?f = "\<lambda>x. (if x \<in> S then f x else 0) + (if x \<in> T then f x else 0)"
   show "(?f has_integral i + j) UNIV"
     by (simp add: f has_integral_add)
 qed auto
 
 lemma integral_Un [simp]:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on S" "f integrable_on T" "negligible (S \<inter> T)"
   shows "integral (S \<union> T) f = integral S f + integral T f"
   by (simp add: has_integral_Un assms integrable_integral integral_unique)
 
 lemma integrable_Un:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b :: banach"
   assumes "negligible (A \<inter> B)" "f integrable_on A" "f integrable_on B"
   shows   "f integrable_on (A \<union> B)"
 proof -
   from assms obtain y z where "(f has_integral y) A" "(f has_integral z) B"
      by (auto simp: integrable_on_def)
   from has_integral_Un[OF this assms(1)] show ?thesis by (auto simp: integrable_on_def)
 qed
 
 lemma integrable_Un':
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b :: banach"
   assumes "f integrable_on A" "f integrable_on B" "negligible (A \<inter> B)" "C = A \<union> B"
   shows   "f integrable_on C"
   using integrable_Un[of A B f] assms by simp
 
 lemma has_integral_Union:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes \<T>: "finite \<T>"
     and int: "\<And>S. S \<in> \<T> \<Longrightarrow> (f has_integral (i S)) S"
     and neg: "pairwise (\<lambda>S S'. negligible (S \<inter> S')) \<T>"
   shows "(f has_integral (sum i \<T>)) (\<Union>\<T>)"
 proof -
   let ?\<U> = "((\<lambda>(a,b). a \<inter> b) ` {(a,b). a \<in> \<T> \<and> b \<in> {y. y \<in> \<T> \<and> a \<noteq> y}})"
   have "((\<lambda>x. if x \<in> \<Union>\<T> then f x else 0) has_integral sum i \<T>) UNIV"
   proof (rule has_integral_spike)
     show "negligible (\<Union>?\<U>)"
     proof (rule negligible_Union)
       have "finite (\<T> \<times> \<T>)"
         by (simp add: \<T>)
       moreover have "{(a, b). a \<in> \<T> \<and> b \<in> {y \<in> \<T>. a \<noteq> y}} \<subseteq> \<T> \<times> \<T>"
         by auto
       ultimately show "finite ?\<U>"
         by (blast intro: finite_subset[of _ "\<T> \<times> \<T>"])
       show "\<And>t. t \<in> ?\<U> \<Longrightarrow> negligible t"
         using neg unfolding pairwise_def by auto
     qed
   next
     show "(if x \<in> \<Union>\<T> then f x else 0) = (\<Sum>A\<in>\<T>. if x \<in> A then f x else 0)"
       if "x \<in> UNIV - (\<Union>?\<U>)" for x
     proof clarsimp
       fix S assume "S \<in> \<T>" "x \<in> S"
       moreover then have "\<forall>b\<in>\<T>. x \<in> b \<longleftrightarrow> b = S"
         using that by blast
       ultimately show "f x = (\<Sum>A\<in>\<T>. if x \<in> A then f x else 0)"
         by (simp add: sum.delta[OF \<T>])
     qed
   next
     show "((\<lambda>x. \<Sum>A\<in>\<T>. if x \<in> A then f x else 0) has_integral (\<Sum>A\<in>\<T>. i A)) UNIV"
       using int by (simp add: has_integral_restrict_UNIV has_integral_sum [OF \<T>])
   qed
   then show ?thesis
     using has_integral_restrict_UNIV by blast
 qed
 
 
 text \<open>In particular adding integrals over a division, maybe not of an interval.\<close>
 
 lemma has_integral_combine_division:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "\<D> division_of S"
     and "\<And>k. k \<in> \<D> \<Longrightarrow> (f has_integral (i k)) k"
   shows "(f has_integral (sum i \<D>)) S"
 proof -
   note \<D> = division_ofD[OF assms(1)]
   have neg: "negligible (S \<inter> s')" if "S \<in> \<D>" "s' \<in> \<D>" "S \<noteq> s'" for S s'
   proof -
     obtain a c b \<D> where obt: "S = cbox a b" "s' = cbox c \<D>"
       by (meson \<open>S \<in> \<D>\<close> \<open>s' \<in> \<D>\<close> \<D>(4))
     from \<D>(5)[OF that] show ?thesis
       unfolding obt interior_cbox
       by (metis (no_types, lifting) Diff_empty Int_interval box_Int_box negligible_frontier_interval)
   qed
   show ?thesis
     unfolding \<D>(6)[symmetric]
     by (auto intro: \<D> neg assms has_integral_Union pairwiseI)
 qed
 
 lemma integral_combine_division_bottomup:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "\<D> division_of S" "\<And>k. k \<in> \<D> \<Longrightarrow> f integrable_on k"
   shows "integral S f = sum (\<lambda>i. integral i f) \<D>"
   by (meson assms integral_unique has_integral_combine_division has_integral_integrable_integral)
 
 lemma has_integral_combine_division_topdown:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on S"
     and \<D>: "\<D> division_of K"
     and "K \<subseteq> S"
   shows "(f has_integral (sum (\<lambda>i. integral i f) \<D>)) K"
 proof -
   have "f integrable_on L" if "L \<in> \<D>" for L
   proof -
     have "L \<subseteq> S"
       using \<open>K \<subseteq> S\<close> \<D> that by blast
     then show "f integrable_on L"
       using that by (metis (no_types) f \<D> division_ofD(4) integrable_on_subcbox)
   qed
   then show ?thesis
     by (meson \<D> has_integral_combine_division has_integral_integrable_integral)
 qed
 
 lemma integral_combine_division_topdown:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on S"
     and "\<D> division_of S"
   shows "integral S f = sum (\<lambda>i. integral i f) \<D>"
   using assms has_integral_combine_division_topdown by blast
 
 lemma integrable_combine_division:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes \<D>: "\<D> division_of S"
     and f: "\<And>i. i \<in> \<D> \<Longrightarrow> f integrable_on i"
   shows "f integrable_on S"
   using f unfolding integrable_on_def by (metis has_integral_combine_division[OF \<D>])
 
 lemma integrable_on_subdivision:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes \<D>: "\<D> division_of i"
     and f: "f integrable_on S"
     and "i \<subseteq> S"
   shows "f integrable_on i"
 proof -
   have "f integrable_on i" if "i \<in> \<D>" for i
 proof -
   have "i \<subseteq> S"
     using assms that by auto
   then show "f integrable_on i"
     using that by (metis (no_types) \<D> f division_ofD(4) integrable_on_subcbox)
 qed
   then show ?thesis
     using \<D> integrable_combine_division by blast
 qed
 
 
 subsection \<open>Also tagged divisions\<close>
 
 lemma has_integral_combine_tagged_division:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "p tagged_division_of S"
     and "\<And>x k. (x,k) \<in> p \<Longrightarrow> (f has_integral (i k)) k"
   shows "(f has_integral (\<Sum>(x,k)\<in>p. i k)) S"
 proof -
   have *: "(f has_integral (\<Sum>k\<in>snd`p. integral k f)) S"
   proof -
     have "snd ` p division_of S"
       by (simp add: assms(1) division_of_tagged_division)
     with assms show ?thesis
       by (metis (mono_tags, lifting) has_integral_combine_division has_integral_integrable_integral imageE prod.collapse)
   qed
   also have "(\<Sum>k\<in>snd`p. integral k f) = (\<Sum>(x, k)\<in>p. integral k f)"
     by (intro sum.over_tagged_division_lemma[OF assms(1), symmetric] integral_null)
        (simp add: content_eq_0_interior)
   finally show ?thesis
     using assms by (auto simp add: has_integral_iff intro!: sum.cong)
 qed
 
 lemma integral_combine_tagged_division_bottomup:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes p: "p tagged_division_of (cbox a b)"
     and f: "\<And>x k. (x,k)\<in>p \<Longrightarrow> f integrable_on k"
   shows "integral (cbox a b) f = sum (\<lambda>(x,k). integral k f) p"
   by (simp add: has_integral_combine_tagged_division[OF p] integral_unique f integrable_integral)
 
 lemma has_integral_combine_tagged_division_topdown:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on cbox a b"
     and p: "p tagged_division_of (cbox a b)"
   shows "(f has_integral (sum (\<lambda>(x,K). integral K f) p)) (cbox a b)"
 proof -
   have "(f has_integral integral K f) K" if "(x,K) \<in> p" for x K
     by (metis assms integrable_integral integrable_on_subcbox tagged_division_ofD(3,4) that)
   then show ?thesis
     by (simp add: has_integral_combine_tagged_division p)
 qed
 
 lemma integral_combine_tagged_division_topdown:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on cbox a b"
     and "p tagged_division_of (cbox a b)"
   shows "integral (cbox a b) f = sum (\<lambda>(x,k). integral k f) p"
   using assms by (auto intro: integral_unique [OF has_integral_combine_tagged_division_topdown])
 
 
 subsection \<open>Henstock's lemma\<close>
 
 lemma Henstock_lemma_part1:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes intf: "f integrable_on cbox a b"
     and "e > 0"
     and "gauge d"
     and less_e: "\<And>p. \<lbrakk>p tagged_division_of (cbox a b); d fine p\<rbrakk> \<Longrightarrow>
                      norm (sum (\<lambda>(x,K). content K *\<^sub>R f x) p - integral(cbox a b) f) < e"
     and p: "p tagged_partial_division_of (cbox a b)" "d fine p"
   shows "norm (sum (\<lambda>(x,K). content K *\<^sub>R f x - integral K f) p) \<le> e" (is "?lhs \<le> e")
 proof (rule field_le_epsilon)
   fix k :: real
   assume "k > 0"
   let ?SUM = "\<lambda>p. (\<Sum>(x,K) \<in> p. content K *\<^sub>R f x)"
   note p' = tagged_partial_division_ofD[OF p(1)]
   have "\<Union>(snd ` p) \<subseteq> cbox a b"
     using p'(3) by fastforce
   then obtain q where q: "snd ` p \<subseteq> q" and qdiv: "q division_of cbox a b"
     by (meson p(1) partial_division_extend_interval partial_division_of_tagged_division)
   note q' = division_ofD[OF qdiv]
   define r where "r = q - snd ` p"
   have "snd ` p \<inter> r = {}"
     unfolding r_def by auto
   have "finite r"
     using q' unfolding r_def by auto
   have "\<exists>p. p tagged_division_of i \<and> d fine p \<and>
         norm (?SUM p - integral i f) < k / (real (card r) + 1)"
     if "i\<in>r" for i
   proof -
     have gt0: "k / (real (card r) + 1) > 0" using \<open>k > 0\<close> by simp
     have i: "i \<in> q"
       using that unfolding r_def by auto
     then obtain u v where uv: "i = cbox u v"
       using q'(4) by blast
     then have "cbox u v \<subseteq> cbox a b"
       using i q'(2) by auto  
     then have "f integrable_on cbox u v"
       by (rule integrable_subinterval[OF intf])
     with integrable_integral[OF this, unfolded has_integral[of f]]
     obtain dd where "gauge dd" and dd:
       "\<And>\<D>. \<lbrakk>\<D> tagged_division_of cbox u v; dd fine \<D>\<rbrakk> \<Longrightarrow>
     norm (?SUM \<D> - integral (cbox u v) f) < k / (real (card r) + 1)"
       using gt0 by auto
     with gauge_Int[OF \<open>gauge d\<close> \<open>gauge dd\<close>]
     obtain qq where qq: "qq tagged_division_of cbox u v" "(\<lambda>x. d x \<inter> dd x) fine qq"
       using fine_division_exists by blast
     with dd[of qq]  show ?thesis
       by (auto simp: fine_Int uv)
   qed
   then obtain qq where qq: "\<And>i. i \<in> r \<Longrightarrow> qq i tagged_division_of i \<and>
       d fine qq i \<and> norm (?SUM (qq i) - integral i f) < k / (real (card r) + 1)"
     by metis
 
   let ?p = "p \<union> \<Union>(qq ` r)"
   have "norm (?SUM ?p - integral (cbox a b) f) < e"
   proof (rule less_e)
     show "d fine ?p"
       by (metis (mono_tags, hide_lams) qq fine_Un fine_Union imageE p(2))
     note ptag = tagged_partial_division_of_Union_self[OF p(1)]
     have "p \<union> \<Union>(qq ` r) tagged_division_of \<Union>(snd ` p) \<union> \<Union>r"
     proof (rule tagged_division_Un[OF ptag tagged_division_Union [OF \<open>finite r\<close>]])
       show "\<And>i. i \<in> r \<Longrightarrow> qq i tagged_division_of i"
         using qq by auto
       show "\<And>i1 i2. \<lbrakk>i1 \<in> r; i2 \<in> r; i1 \<noteq> i2\<rbrakk> \<Longrightarrow> interior i1 \<inter> interior i2 = {}"
         by (simp add: q'(5) r_def)
       show "interior (\<Union>(snd ` p)) \<inter> interior (\<Union>r) = {}"
       proof (rule Int_interior_Union_intervals [OF \<open>finite r\<close>])
         show "open (interior (\<Union>(snd ` p)))"
           by blast
         show "\<And>T. T \<in> r \<Longrightarrow> \<exists>a b. T = cbox a b"
           by (simp add: q'(4) r_def)
         have "interior T \<inter> interior (\<Union>(snd ` p)) = {}" if "T \<in> r" for T
         proof (rule Int_interior_Union_intervals)
           show "\<And>U. U \<in> snd ` p \<Longrightarrow> \<exists>a b. U = cbox a b"
             using q q'(4) by blast
           show "\<And>U. U \<in> snd ` p \<Longrightarrow> interior T \<inter> interior U = {}"
             by (metis DiffE q q'(5) r_def subsetD that)
         qed (use p' in auto)
         then show "\<And>T. T \<in> r \<Longrightarrow> interior (\<Union>(snd ` p)) \<inter> interior T = {}"
           by (metis Int_commute)
       qed
     qed
     moreover have "\<Union>(snd ` p) \<union> \<Union>r = cbox a b" and "{qq i |i. i \<in> r} = qq ` r"
       using qdiv q unfolding Union_Un_distrib[symmetric] r_def by auto
     ultimately show "?p tagged_division_of (cbox a b)"
       by fastforce
   qed
   then have "norm (?SUM p + (?SUM (\<Union>(qq ` r))) - integral (cbox a b) f) < e"
   proof (subst sum.union_inter_neutral[symmetric, OF \<open>finite p\<close>], safe)
     show "content L *\<^sub>R f x = 0" if "(x, L) \<in> p" "(x, L) \<in> qq K" "K \<in> r" for x K L 
     proof -
       obtain u v where uv: "L = cbox u v"
         using \<open>(x,L) \<in> p\<close> p'(4) by blast
       have "L \<subseteq> K"
         using  qq[OF that(3)] tagged_division_ofD(3) \<open>(x,L) \<in> qq K\<close> by metis
       have "L \<in> snd ` p" 
         using \<open>(x,L) \<in> p\<close> image_iff by fastforce 
       then have "L \<in> q" "K \<in> q" "L \<noteq> K"
         using that(1,3) q(1) unfolding r_def by auto
       with q'(5) have "interior L = {}"
         using interior_mono[OF \<open>L \<subseteq> K\<close>] by blast
       then show "content L *\<^sub>R f x = 0"
         unfolding uv content_eq_0_interior[symmetric] by auto
     qed
     show "finite (\<Union>(qq ` r))"
       by (meson finite_UN qq \<open>finite r\<close> tagged_division_of_finite)
   qed
   moreover have "content M *\<^sub>R f x = 0" 
       if x: "(x,M) \<in> qq K" "(x,M) \<in> qq L" and KL: "qq K \<noteq> qq L" and r: "K \<in> r" "L \<in> r"
     for x M K L
   proof -
     note kl = tagged_division_ofD(3,4)[OF qq[THEN conjunct1]]
     obtain u v where uv: "M = cbox u v"
       using \<open>(x, M) \<in> qq L\<close> \<open>L \<in> r\<close> kl(2) by blast
     have empty: "interior (K \<inter> L) = {}"
       by (metis DiffD1 interior_Int q'(5) r_def KL r)
     have "interior M = {}"
       by (metis (no_types, lifting) Int_assoc empty inf.absorb_iff2 interior_Int kl(1) subset_empty x r)
     then show "content M *\<^sub>R f x = 0"
       unfolding uv content_eq_0_interior[symmetric]
       by auto
   qed 
   ultimately have "norm (?SUM p + sum ?SUM (qq ` r) - integral (cbox a b) f) < e"
     apply (subst (asm) sum.Union_comp)
     using qq by (force simp: split_paired_all)+
   moreover have "content M *\<^sub>R f x = 0" 
        if "K \<in> r" "L \<in> r" "K \<noteq> L" "qq K = qq L" "(x, M) \<in> qq K" for K L x M
     using tagged_division_ofD(6) qq that by (metis (no_types, lifting)) 
   ultimately have less_e: "norm (?SUM p + sum (?SUM \<circ> qq) r - integral (cbox a b) f) < e"
   proof (subst (asm) sum.reindex_nontrivial [OF \<open>finite r\<close>])
     qed (auto simp: split_paired_all sum.neutral)
   have norm_le: "norm (cp - ip) \<le> e + k"
                   if "norm ((cp + cr) - i) < e" "norm (cr - ir) < k" "ip + ir = i"
                   for ir ip i cr cp::'a
   proof -
     from that show ?thesis
       using norm_triangle_le[of "cp + cr - i" "- (cr - ir)"]
       unfolding that(3)[symmetric] norm_minus_cancel
       by (auto simp add: algebra_simps)
   qed
 
   have "?lhs =  norm (?SUM p - (\<Sum>(x, k)\<in>p. integral k f))"
     unfolding split_def sum_subtractf ..
   also have "\<dots> \<le> e + k"
   proof (rule norm_le[OF less_e])
     have lessk: "k * real (card r) / (1 + real (card r)) < k"
       using \<open>k>0\<close> by (auto simp add: field_simps)
     have "norm (sum (?SUM \<circ> qq) r - (\<Sum>k\<in>r. integral k f)) \<le> (\<Sum>x\<in>r. k / (real (card r) + 1))"
       unfolding sum_subtractf[symmetric] by (force dest: qq intro!: sum_norm_le)
     also have "... < k"
       by (simp add: lessk add.commute mult.commute)
     finally show "norm (sum (?SUM \<circ> qq) r - (\<Sum>k\<in>r. integral k f)) < k" .
   next
     from q(1) have [simp]: "snd ` p \<union> q = q" by auto
     have "integral l f = 0"
       if inp: "(x, l) \<in> p" "(y, m) \<in> p" and ne: "(x, l) \<noteq> (y, m)" and "l = m" for x l y m
     proof -
       obtain u v where uv: "l = cbox u v"
         using inp p'(4) by blast
       have "content (cbox u v) = 0"
         unfolding content_eq_0_interior using that p(1) uv
         by (auto dest: tagged_partial_division_ofD)
       then show ?thesis
         using uv by blast
     qed
     then have "(\<Sum>(x, K)\<in>p. integral K f) = (\<Sum>K\<in>snd ` p. integral K f)"
       apply (subst sum.reindex_nontrivial [OF \<open>finite p\<close>])
       unfolding split_paired_all split_def by auto
     then show "(\<Sum>(x, k)\<in>p. integral k f) + (\<Sum>k\<in>r. integral k f) = integral (cbox a b) f"
       unfolding integral_combine_division_topdown[OF intf qdiv] r_def
       using q'(1) p'(1) sum.union_disjoint [of "snd ` p" "q - snd ` p", symmetric]
         by simp
   qed
   finally show "?lhs \<le> e + k" .
 qed
 
 lemma Henstock_lemma_part2:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
   assumes fed: "f integrable_on cbox a b" "e > 0" "gauge d"
     and less_e: "\<And>\<D>. \<lbrakk>\<D> tagged_division_of (cbox a b); d fine \<D>\<rbrakk> \<Longrightarrow>
                      norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) \<D> - integral (cbox a b) f) < e"
     and tag: "p tagged_partial_division_of (cbox a b)"
     and "d fine p"
   shows "sum (\<lambda>(x,k). norm (content k *\<^sub>R f x - integral k f)) p \<le> 2 * real (DIM('n)) * e"
 proof -
   have "finite p"
     using tag tagged_partial_division_ofD by blast
   then show ?thesis
     unfolding split_def
   proof (rule sum_norm_allsubsets_bound)
     fix Q
     assume Q: "Q \<subseteq> p"
     then have fine: "d fine Q"
       by (simp add: \<open>d fine p\<close> fine_subset)
     show "norm (\<Sum>x\<in>Q. content (snd x) *\<^sub>R f (fst x) - integral (snd x) f) \<le> e"
       apply (rule Henstock_lemma_part1[OF fed less_e, unfolded split_def])
       using Q tag tagged_partial_division_subset by (force simp add: fine)+
   qed
 qed
 
 lemma Henstock_lemma:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
   assumes intf: "f integrable_on cbox a b"
     and "e > 0"
   obtains \<gamma> where "gauge \<gamma>"
     and "\<And>p. \<lbrakk>p tagged_partial_division_of (cbox a b); \<gamma> fine p\<rbrakk> \<Longrightarrow>
              sum (\<lambda>(x,k). norm(content k *\<^sub>R f x - integral k f)) p < e"
 proof -
   have *: "e/(2 * (real DIM('n) + 1)) > 0" using \<open>e > 0\<close> by simp
   with integrable_integral[OF intf, unfolded has_integral]
   obtain \<gamma> where "gauge \<gamma>"
     and \<gamma>: "\<And>\<D>. \<lbrakk>\<D> tagged_division_of cbox a b; \<gamma> fine \<D>\<rbrakk> \<Longrightarrow>
          norm ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f x) - integral (cbox a b) f)
          < e/(2 * (real DIM('n) + 1))"
     by metis
   show thesis
   proof (rule that [OF \<open>gauge \<gamma>\<close>])
     fix p
     assume p: "p tagged_partial_division_of cbox a b" "\<gamma> fine p"
     have "(\<Sum>(x,K)\<in>p. norm (content K *\<^sub>R f x - integral K f)) 
           \<le> 2 * real DIM('n) * (e/(2 * (real DIM('n) + 1)))"
       using Henstock_lemma_part2[OF intf * \<open>gauge \<gamma>\<close> \<gamma> p] by metis
     also have "... < e"
       using \<open>e > 0\<close> by (auto simp add: field_simps)
     finally
     show "(\<Sum>(x,K)\<in>p. norm (content K *\<^sub>R f x - integral K f)) < e" .
   qed
 qed
 
 
 subsection \<open>Monotone convergence (bounded interval first)\<close>
 
 lemma bounded_increasing_convergent:
   fixes f :: "nat \<Rightarrow> real"
   shows "\<lbrakk>bounded (range f); \<And>n. f n \<le> f (Suc n)\<rbrakk> \<Longrightarrow> \<exists>l. f \<longlonglongrightarrow> l"
   using Bseq_mono_convergent[of f] incseq_Suc_iff[of f]
   by (auto simp: image_def Bseq_eq_bounded convergent_def incseq_def)
 
 lemma monotone_convergence_interval:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real"
   assumes intf: "\<And>k. (f k) integrable_on cbox a b"
     and le: "\<And>k x. x \<in> cbox a b \<Longrightarrow> (f k x) \<le> f (Suc k) x"
     and fg: "\<And>x. x \<in> cbox a b \<Longrightarrow> ((\<lambda>k. f k x) \<longlongrightarrow> g x) sequentially"
     and bou: "bounded (range (\<lambda>k. integral (cbox a b) (f k)))"
   shows "g integrable_on cbox a b \<and> ((\<lambda>k. integral (cbox a b) (f k)) \<longlongrightarrow> integral (cbox a b) g) sequentially"
 proof (cases "content (cbox a b) = 0")
   case True then show ?thesis
     by auto
 next
   case False
   have fg1: "(f k x) \<le> (g x)" if x: "x \<in> cbox a b" for x k
   proof -
     have "\<forall>\<^sub>F j in sequentially. f k x \<le> f j x"
     proof (rule eventually_sequentiallyI [of k])
       show "\<And>j. k \<le> j \<Longrightarrow> f k x \<le> f j x"
         using le x by (force intro: transitive_stepwise_le)
     qed
     then show "f k x \<le> g x"
       using tendsto_lowerbound [OF fg] x trivial_limit_sequentially by blast
   qed
   have int_inc: "\<And>n. integral (cbox a b) (f n) \<le> integral (cbox a b) (f (Suc n))"
     by (metis integral_le intf le)
   then obtain i where i: "(\<lambda>k. integral (cbox a b) (f k)) \<longlonglongrightarrow> i"
     using bounded_increasing_convergent bou by blast
   have "\<And>k. \<forall>\<^sub>F x in sequentially. integral (cbox a b) (f k) \<le> integral (cbox a b) (f x)"
     unfolding eventually_sequentially
     by (force intro: transitive_stepwise_le int_inc)
   then have i': "\<And>k. (integral(cbox a b) (f k)) \<le> i"
     using tendsto_le [OF trivial_limit_sequentially i] by blast
   have "(g has_integral i) (cbox a b)"
     unfolding has_integral real_norm_def
   proof clarify
     fix e::real
     assume e: "e > 0"
     have "\<And>k. (\<exists>\<gamma>. gauge \<gamma> \<and> (\<forall>\<D>. \<D> tagged_division_of (cbox a b) \<and> \<gamma> fine \<D> \<longrightarrow>
       abs ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f k x) - integral (cbox a b) (f k)) < e/2 ^ (k + 2)))"
       using intf e by (auto simp: has_integral_integral has_integral)
     then obtain c where c: "\<And>x. gauge (c x)"
           "\<And>x \<D>. \<lbrakk>\<D> tagged_division_of cbox a b; c x fine \<D>\<rbrakk> \<Longrightarrow>
               abs ((\<Sum>(u,K)\<in>\<D>. content K *\<^sub>R f x u) - integral (cbox a b) (f x))
               < e/2 ^ (x + 2)"
       by metis
 
     have "\<exists>r. \<forall>k\<ge>r. 0 \<le> i - (integral (cbox a b) (f k)) \<and> i - (integral (cbox a b) (f k)) < e/4"
     proof -
       have "e/4 > 0"
         using e by auto
       show ?thesis
         using LIMSEQ_D [OF i \<open>e/4 > 0\<close>] i' by auto
     qed
     then obtain r where r: "\<And>k. r \<le> k \<Longrightarrow> 0 \<le> i - integral (cbox a b) (f k)"
                        "\<And>k. r \<le> k \<Longrightarrow> i - integral (cbox a b) (f k) < e/4" 
       by metis
     have "\<exists>n\<ge>r. \<forall>k\<ge>n. 0 \<le> (g x) - (f k x) \<and> (g x) - (f k x) < e/(4 * content(cbox a b))"
       if "x \<in> cbox a b" for x
     proof -
       have "e/(4 * content (cbox a b)) > 0"
         by (simp add: False content_lt_nz e)
       with fg that LIMSEQ_D
       obtain N where "\<forall>n\<ge>N. norm (f n x - g x) < e/(4 * content (cbox a b))"
         by metis
       then show "\<exists>n\<ge>r. \<forall>k\<ge>n. 0 \<le> g x - f k x \<and> g x - f k x < e/(4 * content (cbox a b))"
         apply (rule_tac x="N + r" in exI)
         using fg1[OF that] by (auto simp add: field_simps)
     qed
     then obtain m where r_le_m: "\<And>x. x \<in> cbox a b \<Longrightarrow> r \<le> m x"
        and m: "\<And>x k. \<lbrakk>x \<in> cbox a b; m x \<le> k\<rbrakk>
                      \<Longrightarrow> 0 \<le> g x - f k x \<and> g x - f k x < e/(4 * content (cbox a b))"
       by metis
     define d where "d x = c (m x) x" for x
     show "\<exists>\<gamma>. gauge \<gamma> \<and>
              (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and>
                   \<gamma> fine \<D> \<longrightarrow> abs ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R g x) - i) < e)"
     proof (rule exI, safe)
       show "gauge d"
         using c(1) unfolding gauge_def d_def by auto
     next
       fix \<D>
       assume ptag: "\<D> tagged_division_of (cbox a b)" and "d fine \<D>"
       note p'=tagged_division_ofD[OF ptag]
       obtain s where s: "\<And>x. x \<in> \<D> \<Longrightarrow> m (fst x) \<le> s"
         by (metis finite_imageI finite_nat_set_iff_bounded_le p'(1) rev_image_eqI)
       have *: "\<bar>a - d\<bar> < e" if "\<bar>a - b\<bar> \<le> e/4" "\<bar>b - c\<bar> < e/2" "\<bar>c - d\<bar> < e/4" for a b c d
         using that norm_triangle_lt[of "a - b" "b - c" "3* e/4"]
           norm_triangle_lt[of "a - b + (b - c)" "c - d" e]
         by (auto simp add: algebra_simps)
       show "\<bar>(\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R g x) - i\<bar> < e"
       proof (rule *)
         have "\<bar>(\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R g x) - (\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f (m x) x)\<bar> 
               \<le> (\<Sum>i\<in>\<D>. \<bar>(case i of (x, K) \<Rightarrow> content K *\<^sub>R g x) - (case i of (x, K) \<Rightarrow> content K *\<^sub>R f (m x) x)\<bar>)"
           by (metis (mono_tags) sum_subtractf sum_abs) 
         also have "... \<le> (\<Sum>(x, k)\<in>\<D>. content k * (e/(4 * content (cbox a b))))"
         proof (rule sum_mono, simp add: split_paired_all)
           fix x K
           assume xk: "(x,K) \<in> \<D>"
           with ptag have x: "x \<in> cbox a b"
             by blast
           then have "abs (content K * (g x - f (m x) x)) \<le> content K * (e/(4 * content (cbox a b)))"
             by (metis m[OF x] mult_nonneg_nonneg abs_of_nonneg less_eq_real_def measure_nonneg mult_left_mono order_refl)
           then show "\<bar>content K * g x - content K * f (m x) x\<bar> \<le> content K * e/(4 * content (cbox a b))"
             by (simp add: algebra_simps)
         qed
         also have "... = (e/(4 * content (cbox a b))) * (\<Sum>(x, k)\<in>\<D>. content k)"
           by (simp add: sum_distrib_left sum_divide_distrib split_def mult.commute)
         also have "... \<le> e/4"
           by (metis False additive_content_tagged_division [OF ptag] nonzero_mult_divide_mult_cancel_right order_refl times_divide_eq_left)
         finally show "\<bar>(\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R g x) - (\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f (m x) x)\<bar> \<le> e/4" .
 
       next
         have "norm ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f (m x) x) - (\<Sum>(x,K)\<in>\<D>. integral K (f (m x))))
               \<le> norm (\<Sum>j = 0..s. \<Sum>(x,K)\<in>{xk \<in> \<D>. m (fst xk) = j}. content K *\<^sub>R f (m x) x - integral K (f (m x)))"
           apply (subst sum.group)
           using s by (auto simp: sum_subtractf split_def p'(1))
         also have "\<dots> < e/2"
         proof -
           have "norm (\<Sum>j = 0..s. \<Sum>(x, k)\<in>{xk \<in> \<D>. m (fst xk) = j}. content k *\<^sub>R f (m x) x - integral k (f (m x)))
                 \<le> (\<Sum>i = 0..s. e/2 ^ (i + 2))"
           proof (rule sum_norm_le)
             fix t
             assume "t \<in> {0..s}"
             have "norm (\<Sum>(x,k)\<in>{xk \<in> \<D>. m (fst xk) = t}. content k *\<^sub>R f (m x) x - integral k (f (m x))) =
                   norm (\<Sum>(x,k)\<in>{xk \<in> \<D>. m (fst xk) = t}. content k *\<^sub>R f t x - integral k (f t))"
               by (force intro!: sum.cong arg_cong[where f=norm])
             also have "... \<le> e/2 ^ (t + 2)"
             proof (rule Henstock_lemma_part1 [OF intf])
               show "{xk \<in> \<D>. m (fst xk) = t} tagged_partial_division_of cbox a b"
               proof (rule tagged_partial_division_subset[of \<D>])
                 show "\<D> tagged_partial_division_of cbox a b"
                   using ptag tagged_division_of_def by blast
               qed auto
               show "c t fine {xk \<in> \<D>. m (fst xk) = t}"
                 using \<open>d fine \<D>\<close> by (auto simp: fine_def d_def)
             qed (use c e in auto)
             finally show "norm (\<Sum>(x,K)\<in>{xk \<in> \<D>. m (fst xk) = t}. content K *\<^sub>R f (m x) x -
                                 integral K (f (m x))) \<le> e/2 ^ (t + 2)" .
           qed
           also have "... = (e/2/2) * (\<Sum>i = 0..s. (1/2) ^ i)"
             by (simp add: sum_distrib_left field_simps)
           also have "\<dots> < e/2"
             by (simp add: sum_gp mult_strict_left_mono[OF _ e])
           finally show "norm (\<Sum>j = 0..s. \<Sum>(x, k)\<in>{xk \<in> \<D>.
             m (fst xk) = j}. content k *\<^sub>R f (m x) x - integral k (f (m x))) < e/2" .
         qed 
         finally show "\<bar>(\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f (m x) x) - (\<Sum>(x,K)\<in>\<D>. integral K (f (m x)))\<bar> < e/2"
           by simp
       next
         have comb: "integral (cbox a b) (f y) = (\<Sum>(x, k)\<in>\<D>. integral k (f y))" for y
           using integral_combine_tagged_division_topdown[OF intf ptag] by metis
         have f_le: "\<And>y m n. \<lbrakk>y \<in> cbox a b; n\<ge>m\<rbrakk> \<Longrightarrow> f m y \<le> f n y"
           using le by (auto intro: transitive_stepwise_le)        
         have "(\<Sum>(x, k)\<in>\<D>. integral k (f r)) \<le> (\<Sum>(x, K)\<in>\<D>. integral K (f (m x)))"
         proof (rule sum_mono, simp add: split_paired_all)
           fix x K
           assume xK: "(x, K) \<in> \<D>"
           show "integral K (f r) \<le> integral K (f (m x))"
           proof (rule integral_le)
             show "f r integrable_on K"
               by (metis integrable_on_subcbox intf p'(3) p'(4) xK)
             show "f (m x) integrable_on K"
               by (metis elementary_interval integrable_on_subdivision intf p'(3) p'(4) xK)
             show "f r y \<le> f (m x) y" if "y \<in> K" for y
               using that r_le_m[of x] p'(2-3)[OF xK] f_le by auto
           qed
         qed
         moreover have "(\<Sum>(x, K)\<in>\<D>. integral K (f (m x))) \<le> (\<Sum>(x, k)\<in>\<D>. integral k (f s))"
         proof (rule sum_mono, simp add: split_paired_all)
           fix x K
           assume xK: "(x, K) \<in> \<D>"
           show "integral K (f (m x)) \<le> integral K (f s)"
           proof (rule integral_le)
             show "f (m x) integrable_on K"
               by (metis elementary_interval integrable_on_subdivision intf p'(3) p'(4) xK)
             show "f s integrable_on K"
               by (metis integrable_on_subcbox intf p'(3) p'(4) xK)
             show "f (m x) y \<le> f s y" if "y \<in> K" for y
               using that s xK f_le p'(3) by fastforce
           qed
         qed
         moreover have "0 \<le> i - integral (cbox a b) (f r)" "i - integral (cbox a b) (f r) < e/4"
           using r by auto
         ultimately show "\<bar>(\<Sum>(x,K)\<in>\<D>. integral K (f (m x))) - i\<bar> < e/4"
           using comb i'[of s] by auto
       qed
     qed
   qed 
   with i integral_unique show ?thesis
     by blast
 qed
 
 lemma monotone_convergence_increasing:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real"
   assumes int_f: "\<And>k. (f k) integrable_on S"
     and "\<And>k x. x \<in> S \<Longrightarrow> (f k x) \<le> (f (Suc k) x)"
     and fg: "\<And>x. x \<in> S \<Longrightarrow> ((\<lambda>k. f k x) \<longlongrightarrow> g x) sequentially"
     and bou: "bounded (range (\<lambda>k. integral S (f k)))"
   shows "g integrable_on S \<and> ((\<lambda>k. integral S (f k)) \<longlongrightarrow> integral S g) sequentially"
 proof -
   have lem: "g integrable_on S \<and> ((\<lambda>k. integral S (f k)) \<longlongrightarrow> integral S g) sequentially"
     if f0: "\<And>k x. x \<in> S \<Longrightarrow> 0 \<le> f k x"
     and int_f: "\<And>k. (f k) integrable_on S"
     and le: "\<And>k x. x \<in> S \<Longrightarrow> f k x \<le> f (Suc k) x"
     and lim: "\<And>x. x \<in> S \<Longrightarrow> ((\<lambda>k. f k x) \<longlongrightarrow> g x) sequentially"
     and bou: "bounded (range(\<lambda>k. integral S (f k)))"
     for f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real" and g S
   proof -
     have fg: "(f k x) \<le> (g x)" if "x \<in> S" for x k
     proof -
       have "\<And>xa. k \<le> xa \<Longrightarrow> f k x \<le> f xa x"
         using le  by (force intro: transitive_stepwise_le that)
       then show ?thesis
         using tendsto_lowerbound [OF lim [OF that]] eventually_sequentiallyI by force
     qed
     obtain i where i: "(\<lambda>k. integral S (f k)) \<longlonglongrightarrow> i"
       using bounded_increasing_convergent [OF bou] le int_f integral_le by blast
     have i': "(integral S (f k)) \<le> i" for k
     proof -
       have "\<And>k. \<And>x. x \<in> S \<Longrightarrow> \<forall>n\<ge>k. f k x \<le> f n x"
         using le  by (force intro: transitive_stepwise_le)
       then show ?thesis
         using tendsto_lowerbound [OF i eventually_sequentiallyI trivial_limit_sequentially]
         by (meson int_f integral_le)
     qed
     let ?f = "(\<lambda>k x. if x \<in> S then f k x else 0)"
     let ?g = "(\<lambda>x. if x \<in> S then g x else 0)"
     have int: "?f k integrable_on cbox a b" for a b k
       by (simp add: int_f integrable_altD(1))
     have int': "\<And>k a b. f k integrable_on cbox a b \<inter> S"
       using int by (simp add: Int_commute integrable_restrict_Int) 
     have g: "?g integrable_on cbox a b \<and>
              (\<lambda>k. integral (cbox a b) (?f k)) \<longlonglongrightarrow> integral (cbox a b) ?g" for a b
     proof (rule monotone_convergence_interval)
       have "norm (integral (cbox a b) (?f k)) \<le> norm (integral S (f k))" for k
       proof -
         have "0 \<le> integral (cbox a b) (?f k)"
           by (metis (no_types) integral_nonneg Int_iff f0 inf_commute integral_restrict_Int int')
         moreover have "0 \<le> integral S (f k)"
           by (simp add: integral_nonneg f0 int_f)
         moreover have "integral (S \<inter> cbox a b) (f k) \<le> integral S (f k)"
           by (metis f0 inf_commute int' int_f integral_subset_le le_inf_iff order_refl)
         ultimately show ?thesis
           by (simp add: integral_restrict_Int)
       qed
       moreover obtain B where "\<And>x. x \<in> range (\<lambda>k. integral S (f k)) \<Longrightarrow> norm x \<le> B"
         using bou unfolding bounded_iff by blast
       ultimately show "bounded (range (\<lambda>k. integral (cbox a b) (?f k)))"
         unfolding bounded_iff by (blast intro: order_trans)
     qed (use int le lim in auto)
     moreover have "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow> norm (integral (cbox a b) ?g - i) < e"
       if "0 < e" for e
     proof -
       have "e/4>0"
         using that by auto
       with LIMSEQ_D [OF i] obtain N where N: "\<And>n. n \<ge> N \<Longrightarrow> norm (integral S (f n) - i) < e/4"
         by metis
       with int_f[of N, unfolded has_integral_integral has_integral_alt'[of "f N"]] 
       obtain B where "0 < B" and B: 
         "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> norm (integral (cbox a b) (?f N) - integral S (f N)) < e/4"
         by (meson \<open>0 < e/4\<close>)
       have "norm (integral (cbox a b) ?g - i) < e" if  ab: "ball 0 B \<subseteq> cbox a b" for a b
       proof -
         obtain M where M: "\<And>n. n \<ge> M \<Longrightarrow> abs (integral (cbox a b) (?f n) - integral (cbox a b) ?g) < e/2"
           using \<open>e > 0\<close> g by (fastforce simp add: dest!: LIMSEQ_D [where r = "e/2"])
         have *: "\<And>\<alpha> \<beta> g. \<lbrakk>\<bar>\<alpha> - i\<bar> < e/2; \<bar>\<beta> - g\<bar> < e/2; \<alpha> \<le> \<beta>; \<beta> \<le> i\<rbrakk> \<Longrightarrow> \<bar>g - i\<bar> < e"
           unfolding real_inner_1_right by arith
         show "norm (integral (cbox a b) ?g - i) < e"
           unfolding real_norm_def
         proof (rule *)
           show "\<bar>integral (cbox a b) (?f N) - i\<bar> < e/2"
           proof (rule abs_triangle_half_l)
             show "\<bar>integral (cbox a b) (?f N) - integral S (f N)\<bar> < e/2/2"
               using B[OF ab] by simp
             show "abs (i - integral S (f N)) < e/2/2"
               using N by (simp add: abs_minus_commute)
           qed
           show "\<bar>integral (cbox a b) (?f (M + N)) - integral (cbox a b) ?g\<bar> < e/2"
             by (metis le_add1 M[of "M + N"])
           show "integral (cbox a b) (?f N) \<le> integral (cbox a b) (?f (M + N))"
           proof (intro ballI integral_le[OF int int])
             fix x assume "x \<in> cbox a b"
             have "(f m x) \<le> (f n x)" if "x \<in> S" "n \<ge> m" for m n
             proof (rule transitive_stepwise_le [OF \<open>n \<ge> m\<close> order_refl])
               show "\<And>u y z. \<lbrakk>f u x \<le> f y x; f y x \<le> f z x\<rbrakk> \<Longrightarrow> f u x \<le> f z x"
                 using dual_order.trans by blast
             qed (simp add: le \<open>x \<in> S\<close>)
             then show "(?f N)x \<le> (?f (M+N))x"
               by auto
           qed
           have "integral (cbox a b \<inter> S) (f (M + N)) \<le> integral S (f (M + N))"
             by (metis Int_lower1 f0 inf_commute int' int_f integral_subset_le)
           then have "integral (cbox a b) (?f (M + N)) \<le> integral S (f (M + N))"
             by (metis (no_types) inf_commute integral_restrict_Int)
           also have "... \<le> i"
             using i'[of "M + N"] by auto
           finally show "integral (cbox a b) (?f (M + N)) \<le> i" .
         qed
       qed
       then show ?thesis
         using \<open>0 < B\<close> by blast
     qed
     ultimately have "(g has_integral i) S"
       unfolding has_integral_alt' by auto
     then show ?thesis
       using has_integral_integrable_integral i integral_unique by metis
   qed
 
   have sub: "\<And>k. integral S (\<lambda>x. f k x - f 0 x) = integral S (f k) - integral S (f 0)"
     by (simp add: integral_diff int_f)
   have *: "\<And>x m n. x \<in> S \<Longrightarrow> n\<ge>m \<Longrightarrow> f m x \<le> f n x"
     using assms(2) by (force intro: transitive_stepwise_le)
   have gf: "(\<lambda>x. g x - f 0 x) integrable_on S \<and> ((\<lambda>k. integral S (\<lambda>x. f (Suc k) x - f 0 x)) \<longlongrightarrow>
     integral S (\<lambda>x. g x - f 0 x)) sequentially"
   proof (rule lem)
     show "\<And>k. (\<lambda>x. f (Suc k) x - f 0 x) integrable_on S"
       by (simp add: integrable_diff int_f)
     show "(\<lambda>k. f (Suc k) x - f 0 x) \<longlonglongrightarrow> g x - f 0 x" if "x \<in> S" for x
     proof -
       have "(\<lambda>n. f (Suc n) x) \<longlonglongrightarrow> g x"
         using LIMSEQ_ignore_initial_segment[OF fg[OF \<open>x \<in> S\<close>], of 1] by simp
       then show ?thesis
         by (simp add: tendsto_diff)
     qed
     show "bounded (range (\<lambda>k. integral S (\<lambda>x. f (Suc k) x - f 0 x)))"
     proof -
       obtain B where B: "\<And>k. norm (integral S (f k)) \<le> B"
         using  bou by (auto simp: bounded_iff)
       then have "norm (integral S (\<lambda>x. f (Suc k) x - f 0 x))
               \<le> B + norm (integral S (f 0))" for k
         unfolding sub by (meson add_le_cancel_right norm_triangle_le_diff)
       then show ?thesis
         unfolding bounded_iff by blast
     qed
   qed (use * in auto)
   then have "(\<lambda>x. integral S (\<lambda>xa. f (Suc x) xa - f 0 xa) + integral S (f 0))
              \<longlonglongrightarrow> integral S (\<lambda>x. g x - f 0 x) + integral S (f 0)"
     by (auto simp add: tendsto_add)
   moreover have "(\<lambda>x. g x - f 0 x + f 0 x) integrable_on S"
     using gf integrable_add int_f [of 0] by metis
   ultimately show ?thesis
     by (simp add: integral_diff int_f LIMSEQ_imp_Suc sub)
 qed
 
 lemma has_integral_monotone_convergence_increasing:
   fixes f :: "nat \<Rightarrow> 'a::euclidean_space \<Rightarrow> real"
   assumes f: "\<And>k. (f k has_integral x k) s"
   assumes "\<And>k x. x \<in> s \<Longrightarrow> f k x \<le> f (Suc k) x"
   assumes "\<And>x. x \<in> s \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
   assumes "x \<longlonglongrightarrow> x'"
   shows "(g has_integral x') s"
 proof -
   have x_eq: "x = (\<lambda>i. integral s (f i))"
     by (simp add: integral_unique[OF f])
   then have x: "range(\<lambda>k. integral s (f k)) = range x"
     by auto
   have *: "g integrable_on s \<and> (\<lambda>k. integral s (f k)) \<longlonglongrightarrow> integral s g"
   proof (intro monotone_convergence_increasing allI ballI assms)
     show "bounded (range(\<lambda>k. integral s (f k)))"
       using x convergent_imp_bounded assms by metis
   qed (use f in auto)
   then have "integral s g = x'"
     by (intro LIMSEQ_unique[OF _ \<open>x \<longlonglongrightarrow> x'\<close>]) (simp add: x_eq)
   with * show ?thesis
     by (simp add: has_integral_integral)
 qed
 
 lemma monotone_convergence_decreasing:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real"
   assumes intf: "\<And>k. (f k) integrable_on S"
     and le: "\<And>k x. x \<in> S \<Longrightarrow> f (Suc k) x \<le> f k x"
     and fg: "\<And>x. x \<in> S \<Longrightarrow> ((\<lambda>k. f k x) \<longlongrightarrow> g x) sequentially"
     and bou: "bounded (range(\<lambda>k. integral S (f k)))"
   shows "g integrable_on S \<and> (\<lambda>k. integral S (f k)) \<longlonglongrightarrow> integral S g"
 proof -
   have *: "range(\<lambda>k. integral S (\<lambda>x. - f k x)) = (*\<^sub>R) (- 1) ` (range(\<lambda>k. integral S (f k)))"
     by force
   have "(\<lambda>x. - g x) integrable_on S \<and> (\<lambda>k. integral S (\<lambda>x. - f k x)) \<longlonglongrightarrow> integral S (\<lambda>x. - g x)"
   proof (rule monotone_convergence_increasing)
     show "\<And>k. (\<lambda>x. - f k x) integrable_on S"
       by (blast intro: integrable_neg intf)
     show "\<And>k x. x \<in> S \<Longrightarrow> - f k x \<le> - f (Suc k) x"
       by (simp add: le)
     show "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. - f k x) \<longlonglongrightarrow> - g x"
       by (simp add: fg tendsto_minus)
     show "bounded (range(\<lambda>k. integral S (\<lambda>x. - f k x)))"
       using "*" bou bounded_scaling by auto
   qed
   then show ?thesis
     by (force dest: integrable_neg tendsto_minus)
 qed
 
 lemma integral_norm_bound_integral:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes int_f: "f integrable_on S"
     and int_g: "g integrable_on S"
     and le_g: "\<And>x. x \<in> S \<Longrightarrow> norm (f x) \<le> g x"
   shows "norm (integral S f) \<le> integral S g"
 proof -
   have norm: "norm \<eta> \<le> y + e"
     if "norm \<zeta> \<le> x" and "\<bar>x - y\<bar> < e/2" and "norm (\<zeta> - \<eta>) < e/2"
     for e x y and \<zeta> \<eta> :: 'a
   proof -
     have "norm (\<eta> - \<zeta>) < e/2"
       by (metis norm_minus_commute that(3))
     moreover have "x \<le> y + e/2"
       using that(2) by linarith
     ultimately show ?thesis
       using that(1) le_less_trans[OF norm_triangle_sub[of \<eta> \<zeta>]] by (auto simp: less_imp_le)
   qed
   have lem: "norm (integral(cbox a b) f) \<le> integral (cbox a b) g"
     if f: "f integrable_on cbox a b"
     and g: "g integrable_on cbox a b"
     and nle: "\<And>x. x \<in> cbox a b \<Longrightarrow> norm (f x) \<le> g x"
     for f :: "'n \<Rightarrow> 'a" and g a b
   proof (rule field_le_epsilon)
     fix e :: real
     assume "e > 0"
     then have e: "e/2 > 0"
       by auto
     with integrable_integral[OF f,unfolded has_integral[of f]]
     obtain \<gamma> where \<gamma>: "gauge \<gamma>"
               "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> 
            \<Longrightarrow> norm ((\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R f x) - integral (cbox a b) f) < e/2"
       by meson 
     moreover
     from integrable_integral[OF g,unfolded has_integral[of g]] e
     obtain \<delta> where \<delta>: "gauge \<delta>"
               "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> \<delta> fine \<D> 
            \<Longrightarrow> norm ((\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R g x) - integral (cbox a b) g) < e/2"
       by meson
     ultimately have "gauge (\<lambda>x. \<gamma> x \<inter> \<delta> x)"
       using gauge_Int by blast
     with fine_division_exists obtain \<D> 
       where p: "\<D> tagged_division_of cbox a b" "(\<lambda>x. \<gamma> x \<inter> \<delta> x) fine \<D>" 
       by metis
     have "\<gamma> fine \<D>" "\<delta> fine \<D>"
       using fine_Int p(2) by blast+
     show "norm (integral (cbox a b) f) \<le> integral (cbox a b) g + e"
     proof (rule norm)
       have "norm (content K *\<^sub>R f x) \<le> content K *\<^sub>R g x" if  "(x, K) \<in> \<D>" for x K
       proof-
         have K: "x \<in> K" "K \<subseteq> cbox a b"
           using \<open>(x, K) \<in> \<D>\<close> p(1) by blast+
         obtain u v where  "K = cbox u v"
           using \<open>(x, K) \<in> \<D>\<close> p(1) by blast
         moreover have "content K * norm (f x) \<le> content K * g x"
           by (meson K(1) K(2) content_pos_le mult_left_mono nle subsetD)
         then show ?thesis
           by simp
       qed
       then show "norm (\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R f x) \<le> (\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R g x)"
         by (simp add: sum_norm_le split_def)
       show "norm ((\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R f x) - integral (cbox a b) f) < e/2"
         using \<open>\<gamma> fine \<D>\<close> \<gamma> p(1) by simp
       show "\<bar>(\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R g x) - integral (cbox a b) g\<bar> < e/2"
         using \<open>\<delta> fine \<D>\<close> \<delta> p(1) by simp
     qed
   qed
   show ?thesis
   proof (rule field_le_epsilon)
     fix e :: real
     assume "e > 0"
     then have e: "e/2 > 0"
       by auto
     let ?f = "(\<lambda>x. if x \<in> S then f x else 0)"
     let ?g = "(\<lambda>x. if x \<in> S then g x else 0)"
     have f: "?f integrable_on cbox a b" and g: "?g integrable_on cbox a b" for a b
       using int_f int_g integrable_altD by auto
     obtain Bf where "0 < Bf"
       and Bf: "\<And>a b. ball 0 Bf \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?f has_integral z) (cbox a b) \<and> norm (z - integral S f) < e/2"
       using integrable_integral [OF int_f,unfolded has_integral'[of f]] e that by blast
     obtain Bg where "0 < Bg"
       and Bg: "\<And>a b. ball 0 Bg \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?g has_integral z) (cbox a b) \<and> norm (z - integral S g) < e/2"
       using integrable_integral [OF int_g,unfolded has_integral'[of g]] e that by blast
     obtain a b::'n where ab: "ball 0 Bf \<union> ball 0 Bg \<subseteq> cbox a b"
       using ball_max_Un  by (metis bounded_ball bounded_subset_cbox_symmetric)
     have "ball 0 Bf \<subseteq> cbox a b"
       using ab by auto
     with Bf obtain z where int_fz: "(?f has_integral z) (cbox a b)" and z: "norm (z - integral S f) < e/2"
       by meson
     have "ball 0 Bg \<subseteq> cbox a b"
       using ab by auto
     with Bg obtain w where int_gw: "(?g has_integral w) (cbox a b)" and w: "norm (w - integral S g) < e/2"
       by meson
     show "norm (integral S f) \<le> integral S g + e"
     proof (rule norm)
       show "norm (integral (cbox a b) ?f) \<le> integral (cbox a b) ?g"
         by (simp add: le_g lem[OF f g, of a b])
       show "\<bar>integral (cbox a b) ?g - integral S g\<bar> < e/2"
         using int_gw integral_unique w by auto
       show "norm (integral (cbox a b) ?f - integral S f) < e/2"
         using int_fz integral_unique z by blast
     qed
   qed
 qed
 
 lemma continuous_on_imp_absolutely_integrable_on:
   fixes f::"real \<Rightarrow> 'a::banach"
   shows "continuous_on {a..b} f \<Longrightarrow>
     norm (integral {a..b} f) \<le> integral {a..b} (\<lambda>x. norm (f x))"
   by (intro integral_norm_bound_integral integrable_continuous_real continuous_on_norm) auto
 
 lemma integral_bound:
   fixes f::"real \<Rightarrow> 'a::banach"
   assumes "a \<le> b"
   assumes "continuous_on {a .. b} f"
   assumes "\<And>t. t \<in> {a .. b} \<Longrightarrow> norm (f t) \<le> B"
   shows "norm (integral {a .. b} f) \<le> B * (b - a)"
 proof -
   note continuous_on_imp_absolutely_integrable_on[OF assms(2)]
   also have "integral {a..b} (\<lambda>x. norm (f x)) \<le> integral {a..b} (\<lambda>_. B)"
     by (rule integral_le)
       (auto intro!: integrable_continuous_real continuous_intros assms)
   also have "\<dots> = B * (b - a)" using assms by simp
   finally show ?thesis .
 qed
 
 lemma integral_norm_bound_integral_component:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   fixes g :: "'n \<Rightarrow> 'b::euclidean_space"
   assumes f: "f integrable_on S" and g: "g integrable_on S"
     and fg: "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> (g x)\<bullet>k"
   shows "norm (integral S f) \<le> (integral S g)\<bullet>k"
 proof -
   have "norm (integral S f) \<le> integral S ((\<lambda>x. x \<bullet> k) \<circ> g)"
     using integral_norm_bound_integral[OF f integrable_linear[OF g]]
     by (simp add: bounded_linear_inner_left fg)
   then show ?thesis
     unfolding o_def integral_component_eq[OF g] .
 qed
 
 lemma has_integral_norm_bound_integral_component:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   fixes g :: "'n \<Rightarrow> 'b::euclidean_space"
   assumes f: "(f has_integral i) S"
     and g: "(g has_integral j) S"
     and "\<And>x. x \<in> S \<Longrightarrow> norm (f x) \<le> (g x)\<bullet>k"
   shows "norm i \<le> j\<bullet>k"
   using integral_norm_bound_integral_component[of f S g k] 
   unfolding integral_unique[OF f] integral_unique[OF g]
   using assms
   by auto
 
 
 lemma uniformly_convergent_improper_integral:
   fixes f :: "'b \<Rightarrow> real \<Rightarrow> 'a :: {banach}"
   assumes deriv: "\<And>x. x \<ge> a \<Longrightarrow> (G has_field_derivative g x) (at x within {a..})"
   assumes integrable: "\<And>a' b x. x \<in> A \<Longrightarrow> a' \<ge> a \<Longrightarrow> b \<ge> a' \<Longrightarrow> f x integrable_on {a'..b}"
   assumes G: "convergent G"
   assumes le: "\<And>y x. y \<in> A \<Longrightarrow> x \<ge> a \<Longrightarrow> norm (f y x) \<le> g x"
   shows   "uniformly_convergent_on A (\<lambda>b x. integral {a..b} (f x))"
 proof (intro Cauchy_uniformly_convergent uniformly_Cauchy_onI', goal_cases)
   case (1 \<epsilon>)
   from G have "Cauchy G"
     by (auto intro!: convergent_Cauchy)
   with 1 obtain M where M: "dist (G (real m)) (G (real n)) < \<epsilon>" if "m \<ge> M" "n \<ge> M" for m n
     by (force simp: Cauchy_def)
   define M' where "M' = max (nat \<lceil>a\<rceil>) M"
 
   show ?case
   proof (rule exI[of _ M'], safe, goal_cases)
     case (1 x m n)
     have M': "M' \<ge> a" "M' \<ge> M" unfolding M'_def by linarith+
     have int_g: "(g has_integral (G (real n) - G (real m))) {real m..real n}"
       using 1 M' by (intro fundamental_theorem_of_calculus) 
                     (auto simp: has_field_derivative_iff_has_vector_derivative [symmetric] 
                           intro!: DERIV_subset[OF deriv])
     have int_f: "f x integrable_on {a'..real n}" if "a' \<ge> a" for a'
       using that 1 by (cases "a' \<le> real n") (auto intro: integrable)
 
     have "dist (integral {a..real m} (f x)) (integral {a..real n} (f x)) =
             norm (integral {a..real n} (f x) - integral {a..real m} (f x))"
       by (simp add: dist_norm norm_minus_commute)
     also have "integral {a..real m} (f x) + integral {real m..real n} (f x) = 
                  integral {a..real n} (f x)"
       using M' and 1 by (intro integral_combine int_f) auto
     hence "integral {a..real n} (f x) - integral {a..real m} (f x) = 
              integral {real m..real n} (f x)"
       by (simp add: algebra_simps)
     also have "norm \<dots> \<le> integral {real m..real n} g"
       using le 1 M' int_f int_g by (intro integral_norm_bound_integral) auto 
     also from int_g have "integral {real m..real n} g = G (real n) - G (real m)"
       by (simp add: has_integral_iff)
     also have "\<dots> \<le> dist (G m) (G n)" 
       by (simp add: dist_norm)
     also from 1 and M' have "\<dots> < \<epsilon>"
       by (intro M) auto
     finally show ?case .
   qed
 qed
 
 lemma uniformly_convergent_improper_integral':
   fixes f :: "'b \<Rightarrow> real \<Rightarrow> 'a :: {banach, real_normed_algebra}"
   assumes deriv: "\<And>x. x \<ge> a \<Longrightarrow> (G has_field_derivative g x) (at x within {a..})"
   assumes integrable: "\<And>a' b x. x \<in> A \<Longrightarrow> a' \<ge> a \<Longrightarrow> b \<ge> a' \<Longrightarrow> f x integrable_on {a'..b}"
   assumes G: "convergent G"
   assumes le: "eventually (\<lambda>x. \<forall>y\<in>A. norm (f y x) \<le> g x) at_top"
   shows   "uniformly_convergent_on A (\<lambda>b x. integral {a..b} (f x))"
 proof -
   from le obtain a'' where le: "\<And>y x. y \<in> A \<Longrightarrow> x \<ge> a'' \<Longrightarrow> norm (f y x) \<le> g x"
     by (auto simp: eventually_at_top_linorder)
   define a' where "a' = max a a''"
 
   have "uniformly_convergent_on A (\<lambda>b x. integral {a'..real b} (f x))"
   proof (rule uniformly_convergent_improper_integral)
     fix t assume t: "t \<ge> a'"
     hence "(G has_field_derivative g t) (at t within {a..})"
       by (intro deriv) (auto simp: a'_def)
     moreover have "{a'..} \<subseteq> {a..}" unfolding a'_def by auto
     ultimately show "(G has_field_derivative g t) (at t within {a'..})"
       by (rule DERIV_subset)
   qed (insert le, auto simp: a'_def intro: integrable G)
   hence "uniformly_convergent_on A (\<lambda>b x. integral {a..a'} (f x) + integral {a'..real b} (f x))" 
     (is ?P) by (intro uniformly_convergent_add) auto
   also have "eventually (\<lambda>x. \<forall>y\<in>A. integral {a..a'} (f y) + integral {a'..x} (f y) =
                    integral {a..x} (f y)) sequentially"
     by (intro eventually_mono [OF eventually_ge_at_top[of "nat \<lceil>a'\<rceil>"]] ballI integral_combine)
        (auto simp: a'_def intro: integrable)
   hence "?P \<longleftrightarrow> ?thesis"
     by (intro uniformly_convergent_cong) simp_all
   finally show ?thesis .
 qed
 
 subsection \<open>differentiation under the integral sign\<close>
 
 lemma integral_continuous_on_param:
   fixes f::"'a::topological_space \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::banach"
   assumes cont_fx: "continuous_on (U \<times> cbox a b) (\<lambda>(x, t). f x t)"
   shows "continuous_on U (\<lambda>x. integral (cbox a b) (f x))"
 proof cases
   assume "content (cbox a b) \<noteq> 0"
   then have ne: "cbox a b \<noteq> {}" by auto
 
   note [continuous_intros] =
     continuous_on_compose2[OF cont_fx, where f="\<lambda>y. Pair x y" for x,
       unfolded split_beta fst_conv snd_conv]
 
   show ?thesis
     unfolding continuous_on_def
   proof (safe intro!: tendstoI)
     fix e'::real and x
     assume "e' > 0"
     define e where "e = e' / (content (cbox a b) + 1)"
     have "e > 0" using \<open>e' > 0\<close> by (auto simp: e_def intro!: divide_pos_pos add_nonneg_pos)
     assume "x \<in> U"
     from continuous_on_prod_compactE[OF cont_fx compact_cbox \<open>x \<in> U\<close> \<open>0 < e\<close>]
     obtain X0 where X0: "x \<in> X0" "open X0"
       and fx_bound: "\<And>y t. y \<in> X0 \<inter> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow> norm (f y t - f x t) \<le> e"
       unfolding split_beta fst_conv snd_conv dist_norm
       by metis
     have "\<forall>\<^sub>F y in at x within U. y \<in> X0 \<inter> U"
       using X0(1) X0(2) eventually_at_topological by auto
     then show "\<forall>\<^sub>F y in at x within U. dist (integral (cbox a b) (f y)) (integral (cbox a b) (f x)) < e'"
     proof eventually_elim
       case (elim y)
       have "dist (integral (cbox a b) (f y)) (integral (cbox a b) (f x)) =
         norm (integral (cbox a b) (\<lambda>t. f y t - f x t))"
         using elim \<open>x \<in> U\<close>
         unfolding dist_norm
         by (subst integral_diff)
            (auto intro!: integrable_continuous continuous_intros)
       also have "\<dots> \<le> e * content (cbox a b)"
         using elim \<open>x \<in> U\<close>
         by (intro integrable_bound)
            (auto intro!: fx_bound \<open>x \<in> U \<close> less_imp_le[OF \<open>0 < e\<close>]
               integrable_continuous continuous_intros)
       also have "\<dots> < e'"
         using \<open>0 < e'\<close> \<open>e > 0\<close>
         by (auto simp: e_def field_split_simps)
       finally show "dist (integral (cbox a b) (f y)) (integral (cbox a b) (f x)) < e'" .
     qed
   qed
 qed (auto intro!: continuous_on_const)
 
 lemma leibniz_rule:
   fixes f::"'a::banach \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::banach"
   assumes fx: "\<And>x t. x \<in> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow>
     ((\<lambda>x. f x t) has_derivative blinfun_apply (fx x t)) (at x within U)"
   assumes integrable_f2: "\<And>x. x \<in> U \<Longrightarrow> f x integrable_on cbox a b"
   assumes cont_fx: "continuous_on (U \<times> (cbox a b)) (\<lambda>(x, t). fx x t)"
   assumes [intro]: "x0 \<in> U"
   assumes "convex U"
   shows
     "((\<lambda>x. integral (cbox a b) (f x)) has_derivative integral (cbox a b) (fx x0)) (at x0 within U)"
     (is "(?F has_derivative ?dF) _")
 proof cases
   assume "content (cbox a b) \<noteq> 0"
   then have ne: "cbox a b \<noteq> {}" by auto
   note [continuous_intros] =
     continuous_on_compose2[OF cont_fx, where f="\<lambda>y. Pair x y" for x,
       unfolded split_beta fst_conv snd_conv]
   show ?thesis
   proof (intro has_derivativeI bounded_linear_scaleR_left tendstoI, fold norm_conv_dist)
     have cont_f1: "\<And>t. t \<in> cbox a b \<Longrightarrow> continuous_on U (\<lambda>x. f x t)"
       by (auto simp: continuous_on_eq_continuous_within intro!: has_derivative_continuous fx)
     note [continuous_intros] = continuous_on_compose2[OF cont_f1]
     fix e'::real
     assume "e' > 0"
     define e where "e = e' / (content (cbox a b) + 1)"
     have "e > 0" using \<open>e' > 0\<close> by (auto simp: e_def intro!: divide_pos_pos add_nonneg_pos)
     from continuous_on_prod_compactE[OF cont_fx compact_cbox \<open>x0 \<in> U\<close> \<open>e > 0\<close>]
     obtain X0 where X0: "x0 \<in> X0" "open X0"
       and fx_bound: "\<And>x t. x \<in> X0 \<inter> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow> norm (fx x t - fx x0 t) \<le> e"
       unfolding split_beta fst_conv snd_conv
       by (metis dist_norm)
 
     note eventually_closed_segment[OF \<open>open X0\<close> \<open>x0 \<in> X0\<close>, of U]
     moreover
     have "\<forall>\<^sub>F x in at x0 within U. x \<in> X0"
       using \<open>open X0\<close> \<open>x0 \<in> X0\<close> eventually_at_topological by blast
     moreover have "\<forall>\<^sub>F x in at x0 within U. x \<noteq> x0"
       by (auto simp: eventually_at_filter)
     moreover have "\<forall>\<^sub>F x in at x0 within U. x \<in> U"
       by (auto simp: eventually_at_filter)
     ultimately
     show "\<forall>\<^sub>F x in at x0 within U. norm ((?F x - ?F x0 - ?dF (x - x0)) /\<^sub>R norm (x - x0)) < e'"
     proof eventually_elim
       case (elim x)
       from elim have "0 < norm (x - x0)" by simp
       have "closed_segment x0 x \<subseteq> U"
         by (rule \<open>convex U\<close>[unfolded convex_contains_segment, rule_format, OF \<open>x0 \<in> U\<close> \<open>x \<in> U\<close>])
       from elim have [intro]: "x \<in> U" by auto
       have "?F x - ?F x0 - ?dF (x - x0) =
         integral (cbox a b) (\<lambda>y. f x y - f x0 y - fx x0 y (x - x0))"
         (is "_ = ?id")
         using \<open>x \<noteq> x0\<close>
         by (subst blinfun_apply_integral integral_diff,
             auto intro!: integrable_diff integrable_f2 continuous_intros
               intro: integrable_continuous)+
       also
       {
         fix t assume t: "t \<in> (cbox a b)"
         have seg: "\<And>t. t \<in> {0..1} \<Longrightarrow> x0 + t *\<^sub>R (x - x0) \<in> X0 \<inter> U"
           using \<open>closed_segment x0 x \<subseteq> U\<close>
             \<open>closed_segment x0 x \<subseteq> X0\<close>
           by (force simp: closed_segment_def algebra_simps)
         from t have deriv:
           "((\<lambda>x. f x t) has_derivative (fx y t)) (at y within X0 \<inter> U)"
           if "y \<in> X0 \<inter> U" for y
           unfolding has_vector_derivative_def[symmetric]
           using that \<open>x \<in> X0\<close>
           by (intro has_derivative_subset[OF fx]) auto
         have "\<And>x. x \<in> X0 \<inter> U \<Longrightarrow> onorm (blinfun_apply (fx x t) - (fx x0 t)) \<le> e"
           using fx_bound t
           by (auto simp add: norm_blinfun_def fun_diff_def blinfun.bilinear_simps[symmetric])
         from differentiable_bound_linearization[OF seg deriv this] X0
         have "norm (f x t - f x0 t - fx x0 t (x - x0)) \<le> e * norm (x - x0)"
           by (auto simp add: ac_simps)
       }
       then have "norm ?id \<le> integral (cbox a b) (\<lambda>_. e * norm (x - x0))"
         by (intro integral_norm_bound_integral)
           (auto intro!: continuous_intros integrable_diff integrable_f2
             intro: integrable_continuous)
       also have "\<dots> = content (cbox a b) * e * norm (x - x0)"
         by simp
       also have "\<dots> < e' * norm (x - x0)"
       proof (intro mult_strict_right_mono[OF _ \<open>0 < norm (x - x0)\<close>])
         show "content (cbox a b) * e < e'"
           using \<open>e' > 0\<close> by (simp add: divide_simps e_def not_less)
       qed
       finally have "norm (?F x - ?F x0 - ?dF (x - x0)) < e' * norm (x - x0)" .
       then show ?case
         by (auto simp: divide_simps)
     qed
   qed (rule blinfun.bounded_linear_right)
 qed (auto intro!: derivative_eq_intros simp: blinfun.bilinear_simps)
 
 lemma has_vector_derivative_eq_has_derivative_blinfun:
   "(f has_vector_derivative f') (at x within U) \<longleftrightarrow>
     (f has_derivative blinfun_scaleR_left f') (at x within U)"
   by (simp add: has_vector_derivative_def)
 
 lemma leibniz_rule_vector_derivative:
   fixes f::"real \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::banach"
   assumes fx: "\<And>x t. x \<in> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow>
       ((\<lambda>x. f x t) has_vector_derivative (fx x t)) (at x within U)"
   assumes integrable_f2: "\<And>x. x \<in> U \<Longrightarrow> (f x) integrable_on cbox a b"
   assumes cont_fx: "continuous_on (U \<times> cbox a b) (\<lambda>(x, t). fx x t)"
   assumes U: "x0 \<in> U" "convex U"
   shows "((\<lambda>x. integral (cbox a b) (f x)) has_vector_derivative integral (cbox a b) (fx x0))
       (at x0 within U)"
 proof -
   note [continuous_intros] =
     continuous_on_compose2[OF cont_fx, where f="\<lambda>y. Pair x y" for x,
       unfolded split_beta fst_conv snd_conv]
   show ?thesis
     unfolding has_vector_derivative_eq_has_derivative_blinfun
   proof (rule has_derivative_eq_rhs [OF leibniz_rule[OF _ integrable_f2 _ U]])
     show "continuous_on (U \<times> cbox a b) (\<lambda>(x, t). blinfun_scaleR_left (fx x t))"
       using cont_fx by (auto simp: split_beta intro!: continuous_intros)
     show "blinfun_apply (integral (cbox a b) (\<lambda>t. blinfun_scaleR_left (fx x0 t))) =
           blinfun_apply (blinfun_scaleR_left (integral (cbox a b) (fx x0)))"
     by (subst integral_linear[symmetric])
        (auto simp: has_vector_derivative_def o_def
          intro!: integrable_continuous U continuous_intros bounded_linear_intros)
     qed (use fx in \<open>auto simp: has_vector_derivative_def\<close>)
 qed
 
 lemma has_field_derivative_eq_has_derivative_blinfun:
   "(f has_field_derivative f') (at x within U) \<longleftrightarrow> (f has_derivative blinfun_mult_right f') (at x within U)"
   by (simp add: has_field_derivative_def)
 
 lemma leibniz_rule_field_derivative:
   fixes f::"'a::{real_normed_field, banach} \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'a"
   assumes fx: "\<And>x t. x \<in> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow> ((\<lambda>x. f x t) has_field_derivative fx x t) (at x within U)"
   assumes integrable_f2: "\<And>x. x \<in> U \<Longrightarrow> (f x) integrable_on cbox a b"
   assumes cont_fx: "continuous_on (U \<times> (cbox a b)) (\<lambda>(x, t). fx x t)"
   assumes U: "x0 \<in> U" "convex U"
   shows "((\<lambda>x. integral (cbox a b) (f x)) has_field_derivative integral (cbox a b) (fx x0)) (at x0 within U)"
 proof -
   note [continuous_intros] =
     continuous_on_compose2[OF cont_fx, where f="\<lambda>y. Pair x y" for x,
       unfolded split_beta fst_conv snd_conv]
   have *: "blinfun_mult_right (integral (cbox a b) (fx x0)) =
     integral (cbox a b) (\<lambda>t. blinfun_mult_right (fx x0 t))"
     by (subst integral_linear[symmetric])
       (auto simp: has_vector_derivative_def o_def
         intro!: integrable_continuous U continuous_intros bounded_linear_intros)
   show ?thesis
     unfolding has_field_derivative_eq_has_derivative_blinfun
   proof (rule has_derivative_eq_rhs [OF leibniz_rule[OF _ integrable_f2 _ U, where fx="\<lambda>x t. blinfun_mult_right (fx x t)"]])
     show "continuous_on (U \<times> cbox a b) (\<lambda>(x, t). blinfun_mult_right (fx x t))"
       using cont_fx by (auto simp: split_beta intro!: continuous_intros)
     show "blinfun_apply (integral (cbox a b) (\<lambda>t. blinfun_mult_right (fx x0 t))) =
           blinfun_apply (blinfun_mult_right (integral (cbox a b) (fx x0)))"
       by (subst integral_linear[symmetric])
         (auto simp: has_vector_derivative_def o_def
           intro!: integrable_continuous U continuous_intros bounded_linear_intros)
   qed (use fx in \<open>auto simp: has_field_derivative_def\<close>)
 qed
 
 lemma leibniz_rule_field_differentiable:
   fixes f::"'a::{real_normed_field, banach} \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'a"
   assumes "\<And>x t. x \<in> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow> ((\<lambda>x. f x t) has_field_derivative fx x t) (at x within U)"
   assumes "\<And>x. x \<in> U \<Longrightarrow> (f x) integrable_on cbox a b"
   assumes "continuous_on (U \<times> (cbox a b)) (\<lambda>(x, t). fx x t)"
   assumes "x0 \<in> U" "convex U"
   shows "(\<lambda>x. integral (cbox a b) (f x)) field_differentiable at x0 within U"
   using leibniz_rule_field_derivative[OF assms] by (auto simp: field_differentiable_def)
 
 
 subsection \<open>Exchange uniform limit and integral\<close>
 
 lemma uniform_limit_integral_cbox:
   fixes f::"'a \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::banach"
   assumes u: "uniform_limit (cbox a b) f g F"
   assumes c: "\<And>n. continuous_on (cbox a b) (f n)"
   assumes [simp]: "F \<noteq> bot"
   obtains I J where
     "\<And>n. (f n has_integral I n) (cbox a b)"
     "(g has_integral J) (cbox a b)"
     "(I \<longlongrightarrow> J) F"
 proof -
   have fi[simp]: "f n integrable_on (cbox a b)" for n
     by (auto intro!: integrable_continuous assms)
   then obtain I where I: "\<And>n. (f n has_integral I n) (cbox a b)"
     by atomize_elim (auto simp: integrable_on_def intro!: choice)
 
   moreover
   have gi[simp]: "g integrable_on (cbox a b)"
     by (auto intro!: integrable_continuous uniform_limit_theorem[OF _ u] eventuallyI c)
   then obtain J where J: "(g has_integral J) (cbox a b)"
     by blast
 
   moreover
   have "(I \<longlongrightarrow> J) F"
   proof cases
     assume "content (cbox a b) = 0"
     hence "I = (\<lambda>_. 0)" "J = 0"
       by (auto intro!: has_integral_unique I J)
     thus ?thesis by simp
   next
     assume content_nonzero: "content (cbox a b) \<noteq> 0"
     show ?thesis
     proof (rule tendstoI)
       fix e::real
       assume "e > 0"
       define e' where "e' = e/2"
       with \<open>e > 0\<close> have "e' > 0" by simp
       then have "\<forall>\<^sub>F n in F. \<forall>x\<in>cbox a b. norm (f n x - g x) < e' / content (cbox a b)"
         using u content_nonzero by (auto simp: uniform_limit_iff dist_norm zero_less_measure_iff)
       then show "\<forall>\<^sub>F n in F. dist (I n) J < e"
       proof eventually_elim
         case (elim n)
         have "I n = integral (cbox a b) (f n)"
             "J = integral (cbox a b) g"
           using I[of n] J by (simp_all add: integral_unique)
         then have "dist (I n) J = norm (integral (cbox a b) (\<lambda>x. f n x - g x))"
           by (simp add: integral_diff dist_norm)
         also have "\<dots> \<le> integral (cbox a b) (\<lambda>x. (e' / content (cbox a b)))"
           using elim
           by (intro integral_norm_bound_integral) (auto intro!: integrable_diff)
         also have "\<dots> < e"
           using \<open>0 < e\<close>
           by (simp add: e'_def)
         finally show ?case .
       qed
     qed
   qed
   ultimately show ?thesis ..
 qed
 
 lemma uniform_limit_integral:
   fixes f::"'a \<Rightarrow> 'b::ordered_euclidean_space \<Rightarrow> 'c::banach"
   assumes u: "uniform_limit {a..b} f g F"
   assumes c: "\<And>n. continuous_on {a..b} (f n)"
   assumes [simp]: "F \<noteq> bot"
   obtains I J where
     "\<And>n. (f n has_integral I n) {a..b}"
     "(g has_integral J) {a..b}"
     "(I \<longlongrightarrow> J) F"
   by (metis interval_cbox assms uniform_limit_integral_cbox)
 
 
 subsection \<open>Integration by parts\<close>
 
 lemma integration_by_parts_interior_strong:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes bilinear: "bounded_bilinear (prod)"
   assumes s: "finite s" and le: "a \<le> b"
   assumes cont [continuous_intros]: "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes deriv: "\<And>x. x\<in>{a<..<b} - s \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
                  "\<And>x. x\<in>{a<..<b} - s \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes int: "((\<lambda>x. prod (f x) (g' x)) has_integral
                   (prod (f b) (g b) - prod (f a) (g a) - y)) {a..b}"
   shows   "((\<lambda>x. prod (f' x) (g x)) has_integral y) {a..b}"
 proof -
   interpret bounded_bilinear prod by fact
   have "((\<lambda>x. prod (f x) (g' x) + prod (f' x) (g x)) has_integral
           (prod (f b) (g b) - prod (f a) (g a))) {a..b}"
     using deriv by (intro fundamental_theorem_of_calculus_interior_strong[OF s le])
                    (auto intro!: continuous_intros continuous_on has_vector_derivative)
   from has_integral_diff[OF this int] show ?thesis by (simp add: algebra_simps)
 qed
 
 lemma integration_by_parts_interior:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes "bounded_bilinear (prod)" "a \<le> b"
           "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes "\<And>x. x\<in>{a<..<b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
           "\<And>x. x\<in>{a<..<b} \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes "((\<lambda>x. prod (f x) (g' x)) has_integral (prod (f b) (g b) - prod (f a) (g a) - y)) {a..b}"
   shows   "((\<lambda>x. prod (f' x) (g x)) has_integral y) {a..b}"
   by (rule integration_by_parts_interior_strong[of _ "{}" _ _ f g f' g']) (insert assms, simp_all)
 
 lemma integration_by_parts:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes "bounded_bilinear (prod)" "a \<le> b"
           "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes "\<And>x. x\<in>{a..b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
           "\<And>x. x\<in>{a..b} \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes "((\<lambda>x. prod (f x) (g' x)) has_integral (prod (f b) (g b) - prod (f a) (g a) - y)) {a..b}"
   shows   "((\<lambda>x. prod (f' x) (g x)) has_integral y) {a..b}"
   by (rule integration_by_parts_interior[of _ _ _ f g f' g']) (insert assms, simp_all)
 
 lemma integrable_by_parts_interior_strong:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes bilinear: "bounded_bilinear (prod)"
   assumes s: "finite s" and le: "a \<le> b"
   assumes cont [continuous_intros]: "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes deriv: "\<And>x. x\<in>{a<..<b} - s \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
                  "\<And>x. x\<in>{a<..<b} - s \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes int: "(\<lambda>x. prod (f x) (g' x)) integrable_on {a..b}"
   shows   "(\<lambda>x. prod (f' x) (g x)) integrable_on {a..b}"
 proof -
   from int obtain I where "((\<lambda>x. prod (f x) (g' x)) has_integral I) {a..b}"
     unfolding integrable_on_def by blast
   hence "((\<lambda>x. prod (f x) (g' x)) has_integral (prod (f b) (g b) - prod (f a) (g a) -
            (prod (f b) (g b) - prod (f a) (g a) - I))) {a..b}" by simp
   from integration_by_parts_interior_strong[OF assms(1-7) this]
     show ?thesis unfolding integrable_on_def by blast
 qed
 
 lemma integrable_by_parts_interior:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes "bounded_bilinear (prod)" "a \<le> b"
           "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes "\<And>x. x\<in>{a<..<b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
           "\<And>x. x\<in>{a<..<b} \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes "(\<lambda>x. prod (f x) (g' x)) integrable_on {a..b}"
   shows   "(\<lambda>x. prod (f' x) (g x)) integrable_on {a..b}"
   by (rule integrable_by_parts_interior_strong[of _ "{}" _ _ f g f' g']) (insert assms, simp_all)
 
 lemma integrable_by_parts:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes "bounded_bilinear (prod)" "a \<le> b"
           "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes "\<And>x. x\<in>{a..b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
           "\<And>x. x\<in>{a..b} \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes "(\<lambda>x. prod (f x) (g' x)) integrable_on {a..b}"
   shows   "(\<lambda>x. prod (f' x) (g x)) integrable_on {a..b}"
   by (rule integrable_by_parts_interior_strong[of _ "{}" _ _ f g f' g']) (insert assms, simp_all)
 
 
 subsection \<open>Integration by substitution\<close>
 
 lemma has_integral_substitution_general:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space" and g :: "real \<Rightarrow> real"
   assumes s: "finite s" and le: "a \<le> b"
       and subset: "g ` {a..b} \<subseteq> {c..d}"
       and f [continuous_intros]: "continuous_on {c..d} f"
       and g [continuous_intros]: "continuous_on {a..b} g"
       and deriv [derivative_intros]:
               "\<And>x. x \<in> {a..b} - s \<Longrightarrow> (g has_field_derivative g' x) (at x within {a..b})"
     shows "((\<lambda>x. g' x *\<^sub>R f (g x)) has_integral (integral {g a..g b} f - integral {g b..g a} f)) {a..b}"
 proof -
   let ?F = "\<lambda>x. integral {c..g x} f"
   have cont_int: "continuous_on {a..b} ?F"
     by (rule continuous_on_compose2[OF _ g subset] indefinite_integral_continuous_1
           f integrable_continuous_real)+
   have deriv: "(((\<lambda>x. integral {c..x} f) \<circ> g) has_vector_derivative g' x *\<^sub>R f (g x))
                  (at x within {a..b})" if "x \<in> {a..b} - s" for x
   proof (rule has_vector_derivative_eq_rhs [OF vector_diff_chain_within refl])
     show "(g has_vector_derivative g' x) (at x within {a..b})"
       using deriv has_field_derivative_iff_has_vector_derivative that by blast
     show "((\<lambda>x. integral {c..x} f) has_vector_derivative f (g x)) 
           (at (g x) within g ` {a..b})"
       using that le subset
       by (blast intro: has_vector_derivative_within_subset integral_has_vector_derivative f)
   qed
   have deriv: "(?F has_vector_derivative g' x *\<^sub>R f (g x))
                   (at x)" if "x \<in> {a..b} - (s \<union> {a,b})" for x
     using deriv[of x] that by (simp add: at_within_Icc_at o_def)
   have "((\<lambda>x. g' x *\<^sub>R f (g x)) has_integral (?F b - ?F a)) {a..b}"
     using le cont_int s deriv cont_int
     by (intro fundamental_theorem_of_calculus_interior_strong[of "s \<union> {a,b}"]) simp_all
   also
   from subset have "g x \<in> {c..d}" if "x \<in> {a..b}" for x using that by blast
   from this[of a] this[of b] le have cd: "c \<le> g a" "g b \<le> d" "c \<le> g b" "g a \<le> d" by auto
   have "integral {c..g b} f - integral {c..g a} f = integral {g a..g b} f - integral {g b..g a} f"
   proof cases
     assume "g a \<le> g b"
     note le = le this
     from cd have "integral {c..g a} f + integral {g a..g b} f = integral {c..g b} f"
       by (intro integral_combine integrable_continuous_real continuous_on_subset[OF f] le) simp_all
     with le show ?thesis
       by (cases "g a = g b") (simp_all add: algebra_simps)
   next
     assume less: "\<not>g a \<le> g b"
     then have "g a \<ge> g b" by simp
     note le = le this
     from cd have "integral {c..g b} f + integral {g b..g a} f = integral {c..g a} f"
       by (intro integral_combine integrable_continuous_real continuous_on_subset[OF f] le) simp_all
     with less show ?thesis
       by (simp_all add: algebra_simps)
   qed
   finally show ?thesis .
 qed
 
 lemma has_integral_substitution_strong:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space" and g :: "real \<Rightarrow> real"
   assumes s: "finite s" and le: "a \<le> b" "g a \<le> g b"
     and subset: "g ` {a..b} \<subseteq> {c..d}"
     and f [continuous_intros]: "continuous_on {c..d} f"
     and g [continuous_intros]: "continuous_on {a..b} g"
     and deriv [derivative_intros]:
     "\<And>x. x \<in> {a..b} - s \<Longrightarrow> (g has_field_derivative g' x) (at x within {a..b})"
   shows "((\<lambda>x. g' x *\<^sub>R f (g x)) has_integral (integral {g a..g b} f)) {a..b}"
   using has_integral_substitution_general[OF s le(1) subset f g deriv] le(2)
   by (cases "g a = g b") auto
 
 lemma has_integral_substitution:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space" and g :: "real \<Rightarrow> real"
   assumes "a \<le> b" "g a \<le> g b" "g ` {a..b} \<subseteq> {c..d}"
       and "continuous_on {c..d} f"
       and "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_field_derivative g' x) (at x within {a..b})"
     shows "((\<lambda>x. g' x *\<^sub>R f (g x)) has_integral (integral {g a..g b} f)) {a..b}"
   by (intro has_integral_substitution_strong[of "{}" a b g c d] assms)
      (auto intro: DERIV_continuous_on assms)
 
 lemma integral_shift:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes cont: "continuous_on {a + c..b + c} f"
   shows "integral {a..b} (f \<circ> (\<lambda>x. x + c)) = integral {a + c..b + c} f"
 proof (cases "a \<le> b")
   case True
   have "((\<lambda>x. 1 *\<^sub>R f (x + c)) has_integral integral {a+c..b+c} f) {a..b}"
     using True cont
     by (intro has_integral_substitution[where c = "a + c" and d = "b + c"])
        (auto intro!: derivative_eq_intros)
   thus ?thesis by (simp add: has_integral_iff o_def)
 qed auto
 
 
 subsection \<open>Compute a double integral using iterated integrals and switching the order of integration\<close>
 
 lemma continuous_on_imp_integrable_on_Pair1:
   fixes f :: "_ \<Rightarrow> 'b::banach"
   assumes con: "continuous_on (cbox (a,c) (b,d)) f" and x: "x \<in> cbox a b"
   shows "(\<lambda>y. f (x, y)) integrable_on (cbox c d)"
 proof -
   have "f \<circ> (\<lambda>y. (x, y)) integrable_on (cbox c d)"
   proof (intro integrable_continuous continuous_on_compose [OF _ continuous_on_subset [OF con]])
     show "continuous_on (cbox c d) (Pair x)"
       by (simp add: continuous_on_Pair)
     show "Pair x ` cbox c d \<subseteq> cbox (a,c) (b,d)"
       using x by blast
   qed
   then show ?thesis
     by (simp add: o_def)
 qed
 
 lemma integral_integrable_2dim:
   fixes f :: "('a::euclidean_space * 'b::euclidean_space) \<Rightarrow> 'c::banach"
   assumes "continuous_on (cbox (a,c) (b,d)) f"
     shows "(\<lambda>x. integral (cbox c d) (\<lambda>y. f (x,y))) integrable_on cbox a b"
 proof (cases "content(cbox c d) = 0")
 case True
   then show ?thesis
     by (simp add: True integrable_const)
 next
   case False
   have uc: "uniformly_continuous_on (cbox (a,c) (b,d)) f"
     by (simp add: assms compact_cbox compact_uniformly_continuous)
   { fix x::'a and e::real
     assume x: "x \<in> cbox a b" and e: "0 < e"
     then have e2_gt: "0 < e/2 / content (cbox c d)" and e2_less: "e/2 / content (cbox c d) * content (cbox c d) < e"
       by (auto simp: False content_lt_nz e)
     then obtain dd
     where dd: "\<And>x x'. \<lbrakk>x\<in>cbox (a, c) (b, d); x'\<in>cbox (a, c) (b, d); norm (x' - x) < dd\<rbrakk>
                        \<Longrightarrow> norm (f x' - f x) \<le> e/(2 * content (cbox c d))"  "dd>0"
       using uc [unfolded uniformly_continuous_on_def, THEN spec, of "e/(2 * content (cbox c d))"]
       by (auto simp: dist_norm intro: less_imp_le)
     have "\<exists>delta>0. \<forall>x'\<in>cbox a b. norm (x' - x) < delta \<longrightarrow> norm (integral (cbox c d) (\<lambda>u. f (x', u) - f (x, u))) < e"
       using dd e2_gt assms x
       apply (rule_tac x=dd in exI)
       apply clarify
       apply (rule le_less_trans [OF integrable_bound e2_less])
       apply (auto intro: integrable_diff continuous_on_imp_integrable_on_Pair1)
       done
   } note * = this
   show ?thesis
   proof (rule integrable_continuous)
     show "continuous_on (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x, y)))"
       by (simp add: * continuous_on_iff dist_norm integral_diff [symmetric] continuous_on_imp_integrable_on_Pair1 [OF assms])
   qed
 qed
 
 lemma integral_split:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::{real_normed_vector,complete_space}"
   assumes f: "f integrable_on (cbox a b)"
       and k: "k \<in> Basis"
   shows "integral (cbox a b) f =
            integral (cbox a b \<inter> {x. x\<bullet>k \<le> c}) f +
            integral (cbox a b \<inter> {x. x\<bullet>k \<ge> c}) f"
   using k f
   by (auto simp: has_integral_integral intro: integral_unique [OF has_integral_split])
 
 lemma integral_swap_operativeI:
   fixes f :: "('a::euclidean_space * 'b::euclidean_space) \<Rightarrow> 'c::banach"
   assumes f: "continuous_on s f" and e: "0 < e"
     shows "operative conj True
            (\<lambda>k. \<forall>a b c d.
                 cbox (a,c) (b,d) \<subseteq> k \<and> cbox (a,c) (b,d) \<subseteq> s
                 \<longrightarrow> norm(integral (cbox (a,c) (b,d)) f -
                          integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f((x,y)))))
                     \<le> e * content (cbox (a,c) (b,d)))"
 proof (standard, auto)
   fix a::'a and c::'b and b::'a and d::'b and u::'a and v::'a and w::'b and z::'b
   assume *: "box (a, c) (b, d) = {}"
      and cb1: "cbox (u, w) (v, z) \<subseteq> cbox (a, c) (b, d)"
      and cb2: "cbox (u, w) (v, z) \<subseteq> s"
   then have c0: "content (cbox (a, c) (b, d)) = 0"
     using * unfolding content_eq_0_interior by simp
   have c0': "content (cbox (u, w) (v, z)) = 0"
     by (fact content_0_subset [OF c0 cb1])
   show "norm (integral (cbox (u,w) (v,z)) f - integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))))
           \<le> e * content (cbox (u,w) (v,z))"
     using content_cbox_pair_eq0_D [OF c0']
     by (force simp add: c0')
 next
   fix a::'a and c::'b and b::'a and d::'b
   and M::real and i::'a and j::'b
   and u::'a and v::'a and w::'b and z::'b
   assume ij: "(i,j) \<in> Basis"
      and n1: "\<forall>a' b' c' d'.
                 cbox (a',c') (b',d') \<subseteq> cbox (a,c) (b,d) \<and>
                 cbox (a',c') (b',d') \<subseteq> {x. x \<bullet> (i,j) \<le> M} \<and> cbox (a',c') (b',d') \<subseteq> s \<longrightarrow>
                 norm (integral (cbox (a',c') (b',d')) f - integral (cbox a' b') (\<lambda>x. integral (cbox c' d') (\<lambda>y. f (x,y))))
                 \<le> e * content (cbox (a',c') (b',d'))"
      and n2: "\<forall>a' b' c' d'.
                 cbox (a',c') (b',d') \<subseteq> cbox (a,c) (b,d) \<and>
                 cbox (a',c') (b',d') \<subseteq> {x. M \<le> x \<bullet> (i,j)} \<and> cbox (a',c') (b',d') \<subseteq> s \<longrightarrow>
                 norm (integral (cbox (a',c') (b',d')) f - integral (cbox a' b') (\<lambda>x. integral (cbox c' d') (\<lambda>y. f (x,y))))
                 \<le> e * content (cbox (a',c') (b',d'))"
      and subs: "cbox (u,w) (v,z) \<subseteq> cbox (a,c) (b,d)"  "cbox (u,w) (v,z) \<subseteq> s"
   have fcont: "continuous_on (cbox (u, w) (v, z)) f"
     using assms(1) continuous_on_subset  subs(2) by blast
   then have fint: "f integrable_on cbox (u, w) (v, z)"
     by (metis integrable_continuous)
   consider "i \<in> Basis" "j=0" | "j \<in> Basis" "i=0"  using ij
     by (auto simp: Euclidean_Space.Basis_prod_def)
   then show "norm (integral (cbox (u,w) (v,z)) f - integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x,y))))
              \<le> e * content (cbox (u,w) (v,z))" (is ?normle)
   proof cases
     case 1
     then have e: "e * content (cbox (u, w) (v, z)) =
                   e * (content (cbox u v \<inter> {x. x \<bullet> i \<le> M}) * content (cbox w z)) +
                   e * (content (cbox u v \<inter> {x. M \<le> x \<bullet> i}) * content (cbox w z))"
       by (simp add: content_split [where c=M] content_Pair algebra_simps)
     have *: "integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))) =
                 integral (cbox u v \<inter> {x. x \<bullet> i \<le> M}) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))) +
                 integral (cbox u v \<inter> {x. M \<le> x \<bullet> i}) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y)))"
       using 1 f subs integral_integrable_2dim continuous_on_subset
       by (blast intro: integral_split)
     show ?normle
       apply (rule norm_diff2 [OF integral_split [where c=M, OF fint ij] * e])
       using 1 subs
       apply (simp_all add: cbox_Pair_eq setcomp_dot1 [of "\<lambda>u. M\<le>u"] setcomp_dot1 [of "\<lambda>u. u\<le>M"] Sigma_Int_Paircomp1)
       apply (simp_all add: interval_split ij flip: cbox_Pair_eq content_Pair)
       apply (force simp flip: interval_split intro!: n1 [rule_format])
       apply (force simp flip: interval_split intro!: n2 [rule_format])
       done
   next
     case 2
     then have e: "e * content (cbox (u, w) (v, z)) =
                   e * (content (cbox u v) * content (cbox w z \<inter> {x. x \<bullet> j \<le> M})) +
                   e * (content (cbox u v) * content (cbox w z \<inter> {x. M \<le> x \<bullet> j}))"
       by (simp add: content_split [where c=M] content_Pair algebra_simps)
     have "(\<lambda>x. integral (cbox w z \<inter> {x. x \<bullet> j \<le> M}) (\<lambda>y. f (x, y))) integrable_on cbox u v"
          "(\<lambda>x. integral (cbox w z \<inter> {x. M \<le> x \<bullet> j}) (\<lambda>y. f (x, y))) integrable_on cbox u v"
       using 2 subs
       apply (simp_all add: interval_split)
       apply (rule integral_integrable_2dim [OF continuous_on_subset [OF f]]; auto simp: cbox_Pair_eq interval_split [symmetric])+
       done
     with 2 have *: "integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))) =
                    integral (cbox u v) (\<lambda>x. integral (cbox w z \<inter> {x. x \<bullet> j \<le> M}) (\<lambda>y. f (x, y))) +
                    integral (cbox u v) (\<lambda>x. integral (cbox w z \<inter> {x. M \<le> x \<bullet> j}) (\<lambda>y. f (x, y)))"
       by (simp add: integral_add [symmetric] integral_split [symmetric]
                     continuous_on_imp_integrable_on_Pair1 [OF fcont] cong: integral_cong)
     show ?normle
       apply (rule norm_diff2 [OF integral_split [where c=M, OF fint ij] * e])
       using 2 subs
       apply (simp_all add: cbox_Pair_eq setcomp_dot2 [of "\<lambda>u. M\<le>u"] setcomp_dot2 [of "\<lambda>u. u\<le>M"] Sigma_Int_Paircomp2)
       apply (simp_all add: interval_split ij flip: cbox_Pair_eq content_Pair)
       apply (force simp flip: interval_split intro!: n1 [rule_format])
       apply (force simp flip: interval_split intro!: n2 [rule_format])
       done
   qed
 qed
 
 lemma integral_Pair_const:
     "integral (cbox (a,c) (b,d)) (\<lambda>x. k) =
      integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. k))"
   by (simp add: content_Pair)
 
 lemma integral_prod_continuous:
   fixes f :: "('a::euclidean_space * 'b::euclidean_space) \<Rightarrow> 'c::banach"
   assumes "continuous_on (cbox (a, c) (b, d)) f" (is "continuous_on ?CBOX f")
     shows "integral (cbox (a, c) (b, d)) f = integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x, y)))"
 proof (cases "content ?CBOX = 0")
   case True
   then show ?thesis
     by (auto simp: content_Pair)
 next
   case False
   then have cbp: "content ?CBOX > 0"
     using content_lt_nz by blast
   have "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x,y)))) = 0"
   proof (rule dense_eq0_I, simp)
     fix e :: real 
     assume "0 < e"
     with \<open>content ?CBOX > 0\<close> have "0 < e/content ?CBOX"
       by simp
     have f_int_acbd: "f integrable_on ?CBOX"
       by (rule integrable_continuous [OF assms])
     { fix p
       assume p: "p division_of ?CBOX"
       then have "finite p"
         by blast
       define e' where "e' = e/content ?CBOX"
       with \<open>0 < e\<close> \<open>0 < e/content ?CBOX\<close>
       have "0 < e'"
         by simp
       interpret operative conj True
            "\<lambda>k. \<forall>a' b' c' d'.
                 cbox (a', c') (b', d') \<subseteq> k \<and> cbox (a', c') (b', d') \<subseteq> ?CBOX
                 \<longrightarrow> norm (integral (cbox (a', c') (b', d')) f -
                          integral (cbox a' b') (\<lambda>x. integral (cbox c' d') (\<lambda>y. f ((x, y)))))
                     \<le> e' * content (cbox (a', c') (b', d'))"
         using assms \<open>0 < e'\<close> by (rule integral_swap_operativeI)
       have "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x, y))))
           \<le> e' * content ?CBOX"
         if "\<And>t u v w z. t \<in> p \<Longrightarrow> cbox (u, w) (v, z) \<subseteq> t \<Longrightarrow> cbox (u, w) (v, z) \<subseteq> ?CBOX
           \<Longrightarrow> norm (integral (cbox (u, w) (v, z)) f -
               integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))))
               \<le> e' * content (cbox (u, w) (v, z))"
         using that division [of p "(a, c)" "(b, d)"] p \<open>finite p\<close> by (auto simp add: comm_monoid_set_F_and)
       with False have "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x, y))))
           \<le> e"
         if "\<And>t u v w z. t \<in> p \<Longrightarrow> cbox (u, w) (v, z) \<subseteq> t \<Longrightarrow> cbox (u, w) (v, z) \<subseteq> ?CBOX
           \<Longrightarrow> norm (integral (cbox (u, w) (v, z)) f -
               integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))))
               \<le> e * content (cbox (u, w) (v, z)) / content ?CBOX"
         using that by (simp add: e'_def)
     } note op_acbd = this
     { fix k::real and \<D> and u::'a and v w and z::'b and t1 t2 l
       assume k: "0 < k"
          and nf: "\<And>x y u v.
                   \<lbrakk>x \<in> cbox a b; y \<in> cbox c d; u \<in> cbox a b; v\<in>cbox c d; norm (u-x, v-y) < k\<rbrakk>
                   \<Longrightarrow> norm (f(u,v) - f(x,y)) < e/(2 * (content ?CBOX))"
          and p_acbd: "\<D> tagged_division_of cbox (a,c) (b,d)"
          and fine: "(\<lambda>x. ball x k) fine \<D>"  "((t1,t2), l) \<in> \<D>"
          and uwvz_sub: "cbox (u,w) (v,z) \<subseteq> l" "cbox (u,w) (v,z) \<subseteq> cbox (a,c) (b,d)"
       have t: "t1 \<in> cbox a b" "t2 \<in> cbox c d"
         by (meson fine p_acbd cbox_Pair_iff tag_in_interval)+
       have ls: "l \<subseteq> ball (t1,t2) k"
         using fine by (simp add: fine_def Ball_def)
       { fix x1 x2
         assume xuvwz: "x1 \<in> cbox u v" "x2 \<in> cbox w z"
         then have x: "x1 \<in> cbox a b" "x2 \<in> cbox c d"
           using uwvz_sub by auto
         have "norm (x1 - t1, x2 - t2) = norm (t1 - x1, t2 - x2)"
           by (simp add: norm_Pair norm_minus_commute)
         also have "norm (t1 - x1, t2 - x2) < k"
           using xuvwz ls uwvz_sub unfolding ball_def
           by (force simp add: cbox_Pair_eq dist_norm )
         finally have "norm (f (x1,x2) - f (t1,t2)) \<le> e/content ?CBOX/2"
           using nf [OF t x]  by simp
       } note nf' = this
       have f_int_uwvz: "f integrable_on cbox (u,w) (v,z)"
         using f_int_acbd uwvz_sub integrable_on_subcbox by blast
       have f_int_uv: "\<And>x. x \<in> cbox u v \<Longrightarrow> (\<lambda>y. f (x,y)) integrable_on cbox w z"
         using assms continuous_on_subset uwvz_sub
         by (blast intro: continuous_on_imp_integrable_on_Pair1)
       have 1: "norm (integral (cbox (u,w) (v,z)) f - integral (cbox (u,w) (v,z)) (\<lambda>x. f (t1,t2)))
              \<le> e * content (cbox (u,w) (v,z)) / content ?CBOX/2"
         using cbp \<open>0 < e/content ?CBOX\<close> nf'
         apply (simp only: integral_diff [symmetric] f_int_uwvz integrable_const)
         apply (auto simp: integrable_diff f_int_uwvz integrable_const intro: order_trans [OF integrable_bound [of "e/content ?CBOX/2"]])
         done
       have int_integrable: "(\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))) integrable_on cbox u v"
         using assms integral_integrable_2dim continuous_on_subset uwvz_sub(2) by blast
       have normint_wz:
          "\<And>x. x \<in> cbox u v \<Longrightarrow>
                norm (integral (cbox w z) (\<lambda>y. f (x, y)) - integral (cbox w z) (\<lambda>y. f (t1, t2)))
                \<le> e * content (cbox w z) / content (cbox (a, c) (b, d))/2"
         using cbp \<open>0 < e/content ?CBOX\<close> nf'
         apply (simp only: integral_diff [symmetric] f_int_uv integrable_const)
         apply (auto simp: integrable_diff f_int_uv integrable_const intro: order_trans [OF integrable_bound [of "e/content ?CBOX/2"]])
         done
       have "norm (integral (cbox u v)
                (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x,y)) - integral (cbox w z) (\<lambda>y. f (t1,t2))))
             \<le> e * content (cbox w z) / content ?CBOX/2 * content (cbox u v)"
         using cbp \<open>0 < e/content ?CBOX\<close>
         apply (intro integrable_bound [OF _ _ normint_wz])
         apply (auto simp: field_split_simps integrable_diff int_integrable integrable_const)
         done
       also have "... \<le> e * content (cbox (u,w) (v,z)) / content ?CBOX/2"
         by (simp add: content_Pair field_split_simps)
       finally have 2: "norm (integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x,y))) -
                       integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (t1,t2))))
                 \<le> e * content (cbox (u,w) (v,z)) / content ?CBOX/2"
         by (simp only: integral_diff [symmetric] int_integrable integrable_const)
       have norm_xx: "\<lbrakk>x' = y'; norm(x - x') \<le> e/2; norm(y - y') \<le> e/2\<rbrakk> \<Longrightarrow> norm(x - y) \<le> e" for x::'c and y x' y' e
         using norm_triangle_mono [of "x-y'" "e/2" "y'-y" "e/2"] field_sum_of_halves
         by (simp add: norm_minus_commute)
       have "norm (integral (cbox (u,w) (v,z)) f - integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x,y))))
             \<le> e * content (cbox (u,w) (v,z)) / content ?CBOX"
         by (rule norm_xx [OF integral_Pair_const 1 2])
     } note * = this
     have "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x,y)))) \<le> e" 
       if "\<forall>x\<in>?CBOX. \<forall>x'\<in>?CBOX. norm (x' - x) < k \<longrightarrow> norm (f x' - f x) < e /(2 * content (?CBOX))" "0 < k" for k
     proof -
       obtain p where ptag: "p tagged_division_of cbox (a, c) (b, d)" 
                  and fine: "(\<lambda>x. ball x k) fine p"
         using fine_division_exists \<open>0 < k\<close> by blast
       show ?thesis
         using that fine ptag \<open>0 < k\<close> 
         by (auto simp: * intro: op_acbd [OF division_of_tagged_division [OF ptag]])
     qed
     then show "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x,y)))) \<le> e"
       using compact_uniformly_continuous [OF assms compact_cbox]
       apply (simp add: uniformly_continuous_on_def dist_norm)
       apply (drule_tac x="e/2 / content?CBOX" in spec)
       using cbp \<open>0 < e\<close> by (auto simp: zero_less_mult_iff)
   qed
   then show ?thesis
     by simp
 qed
 
 lemma integral_swap_2dim:
   fixes f :: "['a::euclidean_space, 'b::euclidean_space] \<Rightarrow> 'c::banach"
   assumes "continuous_on (cbox (a,c) (b,d)) (\<lambda>(x,y). f x y)"
     shows "integral (cbox (a, c) (b, d)) (\<lambda>(x, y). f x y) = integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)"
 proof -
   have "((\<lambda>(x, y). f x y) has_integral integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)) (prod.swap ` (cbox (c, a) (d, b)))"
   proof (rule has_integral_twiddle [of 1 prod.swap prod.swap "\<lambda>(x,y). f y x" "integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)", simplified])
     show "\<And>u v. content (prod.swap ` cbox u v) = content (cbox u v)"
       by (metis content_Pair mult.commute old.prod.exhaust swap_cbox_Pair)
     show "((\<lambda>(x, y). f y x) has_integral integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)) (cbox (c, a) (d, b))"
       by (simp add: assms integrable_continuous integrable_integral swap_continuous)
   qed (use isCont_swap in \<open>fastforce+\<close>)
  then show ?thesis
    by force
 qed
 
 theorem integral_swap_continuous:
   fixes f :: "['a::euclidean_space, 'b::euclidean_space] \<Rightarrow> 'c::banach"
   assumes "continuous_on (cbox (a,c) (b,d)) (\<lambda>(x,y). f x y)"
     shows "integral (cbox a b) (\<lambda>x. integral (cbox c d) (f x)) =
            integral (cbox c d) (\<lambda>y. integral (cbox a b) (\<lambda>x. f x y))"
 proof -
   have "integral (cbox a b) (\<lambda>x. integral (cbox c d) (f x)) = integral (cbox (a, c) (b, d)) (\<lambda>(x, y). f x y)"
     using integral_prod_continuous [OF assms] by auto
   also have "... = integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)"
     by (rule integral_swap_2dim [OF assms])
   also have "... = integral (cbox c d) (\<lambda>y. integral (cbox a b) (\<lambda>x. f x y))"
     using integral_prod_continuous [OF swap_continuous] assms
     by auto
   finally show ?thesis .
 qed
 
 
 subsection \<open>Definite integrals for exponential and power function\<close>
 
 lemma has_integral_exp_minus_to_infinity:
   assumes a: "a > 0"
   shows   "((\<lambda>x::real. exp (-a*x)) has_integral exp (-a*c)/a) {c..}"
 proof -
   define f where "f = (\<lambda>k x. if x \<in> {c..real k} then exp (-a*x) else 0)"
   {
     fix k :: nat assume k: "of_nat k \<ge> c"
     from k a
       have "((\<lambda>x. exp (-a*x)) has_integral (-exp (-a*real k)/a - (-exp (-a*c)/a))) {c..real k}"
       by (intro fundamental_theorem_of_calculus)
          (auto intro!: derivative_eq_intros
                simp: has_field_derivative_iff_has_vector_derivative [symmetric])
     hence "(f k has_integral (exp (-a*c)/a - exp (-a*real k)/a)) {c..}" unfolding f_def
       by (subst has_integral_restrict) simp_all
   } note has_integral_f = this
 
   have [simp]: "f k = (\<lambda>_. 0)" if "of_nat k < c" for k using that by (auto simp: fun_eq_iff f_def)
   have integral_f: "integral {c..} (f k) =
                       (if real k \<ge> c then exp (-a*c)/a - exp (-a*real k)/a else 0)"
     for k using integral_unique[OF has_integral_f[of k]] by simp
 
   have A: "(\<lambda>x. exp (-a*x)) integrable_on {c..} \<and>
              (\<lambda>k. integral {c..} (f k)) \<longlonglongrightarrow> integral {c..} (\<lambda>x. exp (-a*x))"
   proof (intro monotone_convergence_increasing allI ballI)
     fix k ::nat
     have "(\<lambda>x. exp (-a*x)) integrable_on {c..of_real k}" (is ?P)
       unfolding f_def by (auto intro!: continuous_intros integrable_continuous_real)
     hence  "(f k) integrable_on {c..of_real k}"
       by (rule integrable_eq) (simp add: f_def)
     then show "f k integrable_on {c..}"
       by (rule integrable_on_superset) (auto simp: f_def)
   next
     fix x assume x: "x \<in> {c..}"
     have "sequentially \<le> principal {nat \<lceil>x\<rceil>..}" unfolding at_top_def by (simp add: Inf_lower)
     also have "{nat \<lceil>x\<rceil>..} \<subseteq> {k. x \<le> real k}" by auto
     also have "inf (principal \<dots>) (principal {k. \<not>x \<le> real k}) =
                  principal ({k. x \<le> real k} \<inter> {k. \<not>x \<le> real k})" by simp
     also have "{k. x \<le> real k} \<inter> {k. \<not>x \<le> real k} = {}" by blast
     finally have "inf sequentially (principal {k. \<not>x \<le> real k}) = bot"
       by (simp add: inf.coboundedI1 bot_unique)
     with x show "(\<lambda>k. f k x) \<longlonglongrightarrow> exp (-a*x)" unfolding f_def
       by (intro filterlim_If) auto
   next
     have "\<bar>integral {c..} (f k)\<bar> \<le> exp (-a*c)/a" for k
     proof (cases "c > of_nat k")
       case False
       hence "abs (integral {c..} (f k)) = abs (exp (- (a * c)) / a - exp (- (a * real k)) / a)"
         by (simp add: integral_f)
       also have "abs (exp (- (a * c)) / a - exp (- (a * real k)) / a) =
                    exp (- (a * c)) / a - exp (- (a * real k)) / a"
         using False a by (intro abs_of_nonneg) (simp_all add: field_simps)
       also have "\<dots> \<le> exp (- a * c) / a" using a by simp
       finally show ?thesis .
     qed (insert a, simp_all add: integral_f)
     thus "bounded (range(\<lambda>k. integral {c..} (f k)))"
       by (intro boundedI[of _ "exp (-a*c)/a"]) auto
   qed (auto simp: f_def)
   have "(\<lambda>k. exp (-a*c)/a - exp (-a * of_nat k)/a) \<longlonglongrightarrow> exp (-a*c)/a - 0/a"
     by (intro tendsto_intros filterlim_compose[OF exp_at_bot]
         filterlim_tendsto_neg_mult_at_bot[OF tendsto_const] filterlim_real_sequentially)+
       (insert a, simp_all)
   moreover
   from eventually_gt_at_top[of "nat \<lceil>c\<rceil>"] have "eventually (\<lambda>k. of_nat k > c) sequentially"
     by eventually_elim linarith
   hence "eventually (\<lambda>k. exp (-a*c)/a - exp (-a * of_nat k)/a = integral {c..} (f k)) sequentially"
     by eventually_elim (simp add: integral_f) 
   ultimately have "(\<lambda>k. integral {c..} (f k)) \<longlonglongrightarrow> exp (-a*c)/a - 0/a"
     by (rule Lim_transform_eventually)
   from LIMSEQ_unique[OF conjunct2[OF A] this]
   have "integral {c..} (\<lambda>x. exp (-a*x)) = exp (-a*c)/a" by simp
   with conjunct1[OF A] show ?thesis
     by (simp add: has_integral_integral)
 qed
 
 lemma integrable_on_exp_minus_to_infinity: "a > 0 \<Longrightarrow> (\<lambda>x. exp (-a*x) :: real) integrable_on {c..}"
   using has_integral_exp_minus_to_infinity[of a c] unfolding integrable_on_def by blast
 
 lemma has_integral_powr_from_0:
   assumes a: "a > (-1::real)" and c: "c \<ge> 0"
   shows   "((\<lambda>x. x powr a) has_integral (c powr (a+1) / (a+1))) {0..c}"
 proof (cases "c = 0")
   case False
   define f where "f = (\<lambda>k x. if x \<in> {inverse (of_nat (Suc k))..c} then x powr a else 0)"
   define F where "F = (\<lambda>k. if inverse (of_nat (Suc k)) \<le> c then
                              c powr (a+1)/(a+1) - inverse (real (Suc k)) powr (a+1)/(a+1) else 0)"
   {
     fix k :: nat
     have "(f k has_integral F k) {0..c}"
     proof (cases "inverse (of_nat (Suc k)) \<le> c")
       case True
       {
         fix x assume x: "x \<ge> inverse (1 + real k)"
         have "0 < inverse (1 + real k)" by simp
         also note x
         finally have "x > 0" .
       } note x = this
       hence "((\<lambda>x. x powr a) has_integral c powr (a + 1) / (a + 1) -
                inverse (real (Suc k)) powr (a + 1) / (a + 1)) {inverse (real (Suc k))..c}"
         using True a by (intro fundamental_theorem_of_calculus)
            (auto intro!: derivative_eq_intros continuous_on_powr' continuous_on_const
               simp: has_field_derivative_iff_has_vector_derivative [symmetric])
       with True show ?thesis unfolding f_def F_def by (subst has_integral_restrict) simp_all
     next
       case False
       thus ?thesis unfolding f_def F_def by (subst has_integral_restrict) auto
     qed
   } note has_integral_f = this
   have integral_f: "integral {0..c} (f k) = F k" for k
     using has_integral_f[of k] by (rule integral_unique)
 
   have A: "(\<lambda>x. x powr a) integrable_on {0..c} \<and>
            (\<lambda>k. integral {0..c} (f k)) \<longlonglongrightarrow> integral {0..c} (\<lambda>x. x powr a)"
   proof (intro monotone_convergence_increasing ballI allI)
     fix k from has_integral_f[of k] show "f k integrable_on {0..c}"
       by (auto simp: integrable_on_def)
   next
     fix k :: nat and x :: real
     {
       assume x: "inverse (real (Suc k)) \<le> x"
       have "inverse (real (Suc (Suc k))) \<le> inverse (real (Suc k))" by (simp add: field_simps)
       also note x
       finally have "inverse (real (Suc (Suc k))) \<le> x" .
     }
     thus "f k x \<le> f (Suc k) x" by (auto simp: f_def simp del: of_nat_Suc)
   next
     fix x assume x: "x \<in> {0..c}"
     show "(\<lambda>k. f k x) \<longlonglongrightarrow> x powr a"
     proof (cases "x = 0")
       case False
       with x have "x > 0" by simp
       from order_tendstoD(2)[OF LIMSEQ_inverse_real_of_nat this]
         have "eventually (\<lambda>k. x powr a = f k x) sequentially"
         by eventually_elim (insert x, simp add: f_def)
       moreover have "(\<lambda>_. x powr a) \<longlonglongrightarrow> x powr a" by simp
       ultimately show ?thesis by (blast intro: Lim_transform_eventually)
     qed (simp_all add: f_def)
   next
     {
       fix k
       from a have "F k \<le> c powr (a + 1) / (a + 1)"
         by (auto simp add: F_def divide_simps)
       also from a have "F k \<ge> 0"
         by (auto simp: F_def divide_simps simp del: of_nat_Suc intro!: powr_mono2)
       hence "F k = abs (F k)" by simp
       finally have "abs (F k) \<le>  c powr (a + 1) / (a + 1)" .
     }
     thus "bounded (range(\<lambda>k. integral {0..c} (f k)))"
       by (intro boundedI[of _ "c powr (a+1) / (a+1)"]) (auto simp: integral_f)
   qed
 
   from False c have "c > 0" by simp
   from order_tendstoD(2)[OF LIMSEQ_inverse_real_of_nat this]
     have "eventually (\<lambda>k. c powr (a + 1) / (a + 1) - inverse (real (Suc k)) powr (a+1) / (a+1) =
             integral {0..c} (f k)) sequentially"
     by eventually_elim (simp add: integral_f F_def)
   moreover have "(\<lambda>k. c powr (a + 1) / (a + 1) - inverse (real (Suc k)) powr (a + 1) / (a + 1))
                    \<longlonglongrightarrow> c powr (a + 1) / (a + 1) - 0 powr (a + 1) / (a + 1)"
     using a by (intro tendsto_intros LIMSEQ_inverse_real_of_nat) auto
   hence "(\<lambda>k. c powr (a + 1) / (a + 1) - inverse (real (Suc k)) powr (a + 1) / (a + 1))
           \<longlonglongrightarrow> c powr (a + 1) / (a + 1)" by simp
   ultimately have "(\<lambda>k. integral {0..c} (f k)) \<longlonglongrightarrow> c powr (a+1) / (a+1)"
     by (blast intro: Lim_transform_eventually)
   with A have "integral {0..c} (\<lambda>x. x powr a) = c powr (a+1) / (a+1)"
     by (blast intro: LIMSEQ_unique)
   with A show ?thesis by (simp add: has_integral_integral)
 qed (simp_all add: has_integral_refl)
 
 lemma integrable_on_powr_from_0:
   assumes a: "a > (-1::real)" and c: "c \<ge> 0"
   shows   "(\<lambda>x. x powr a) integrable_on {0..c}"
   using has_integral_powr_from_0[OF assms] unfolding integrable_on_def by blast
 
 lemma has_integral_powr_to_inf:
   fixes a e :: real
   assumes "e < -1" "a > 0"
   shows   "((\<lambda>x. x powr e) has_integral -(a powr (e + 1)) / (e + 1)) {a..}"
 proof -
   define f :: "nat \<Rightarrow> real \<Rightarrow> real" where "f = (\<lambda>n x. if x \<in> {a..n} then x powr e else 0)"
   define F where "F = (\<lambda>x. x powr (e + 1) / (e + 1))"
 
   have has_integral_f: "(f n has_integral (F n - F a)) {a..}"
     if n: "n \<ge> a" for n :: nat
   proof -
     from n assms have "((\<lambda>x. x powr e) has_integral (F n - F a)) {a..n}"
       by (intro fundamental_theorem_of_calculus) (auto intro!: derivative_eq_intros
             simp: has_field_derivative_iff_has_vector_derivative [symmetric] F_def)
     hence "(f n has_integral (F n - F a)) {a..n}"
       by (rule has_integral_eq [rotated]) (simp add: f_def)
     thus "(f n has_integral (F n - F a)) {a..}"
       by (rule has_integral_on_superset) (auto simp: f_def)
   qed
   have integral_f: "integral {a..} (f n) = (if n \<ge> a then F n - F a else 0)" for n :: nat
   proof (cases "n \<ge> a")
     case True
     with has_integral_f[OF this] show ?thesis by (simp add: integral_unique)
   next
     case False
     have "(f n has_integral 0) {a}" by (rule has_integral_refl)
     hence "(f n has_integral 0) {a..}"
       by (rule has_integral_on_superset) (insert False, simp_all add: f_def)
     with False show ?thesis by (simp add: integral_unique)
   qed
 
   have *: "(\<lambda>x. x powr e) integrable_on {a..} \<and>
            (\<lambda>n. integral {a..} (f n)) \<longlonglongrightarrow> integral {a..} (\<lambda>x. x powr e)"
   proof (intro monotone_convergence_increasing allI ballI)
     fix n :: nat
     from assms have "(\<lambda>x. x powr e) integrable_on {a..n}"
       by (auto intro!: integrable_continuous_real continuous_intros)
     hence "f n integrable_on {a..n}"
       by (rule integrable_eq) (auto simp: f_def)
     thus "f n integrable_on {a..}"
       by (rule integrable_on_superset) (auto simp: f_def)
   next
     fix n :: nat and x :: real
     show "f n x \<le> f (Suc n) x" by (auto simp: f_def)
   next
     fix x :: real assume x: "x \<in> {a..}"
     from filterlim_real_sequentially
       have "eventually (\<lambda>n. real n \<ge> x) at_top"
       by (simp add: filterlim_at_top)
     with x have "eventually (\<lambda>n. f n x = x powr e) at_top"
       by (auto elim!: eventually_mono simp: f_def)
     thus "(\<lambda>n. f n x) \<longlonglongrightarrow> x powr e" by (simp add: tendsto_eventually)
   next
     have "norm (integral {a..} (f n)) \<le> -F a" for n :: nat
     proof (cases "n \<ge> a")
       case True
       with assms have "a powr (e + 1) \<ge> n powr (e + 1)"
         by (intro powr_mono2') simp_all
       with assms show ?thesis by (auto simp: divide_simps F_def integral_f)
     qed (insert assms, simp add: integral_f F_def field_split_simps)
     thus "bounded (range(\<lambda>k. integral {a..} (f k)))"
       unfolding bounded_iff by (intro exI[of _ "-F a"]) auto
   qed
 
   from filterlim_real_sequentially
     have "eventually (\<lambda>n. real n \<ge> a) at_top"
     by (simp add: filterlim_at_top)
   hence "eventually (\<lambda>n. F n - F a = integral {a..} (f n)) at_top"
     by eventually_elim (simp add: integral_f)
   moreover have "(\<lambda>n. F n - F a) \<longlonglongrightarrow> 0 / (e + 1) - F a" unfolding F_def
     by (insert assms, (rule tendsto_intros filterlim_compose[OF tendsto_neg_powr]
           filterlim_ident filterlim_real_sequentially | simp)+)
   hence "(\<lambda>n. F n - F a) \<longlonglongrightarrow> -F a" by simp
   ultimately have "(\<lambda>n. integral {a..} (f n)) \<longlonglongrightarrow> -F a" by (blast intro: Lim_transform_eventually)
   from conjunct2[OF *] and this
     have "integral {a..} (\<lambda>x. x powr e) = -F a" by (rule LIMSEQ_unique)
   with conjunct1[OF *] show ?thesis
     by (simp add: has_integral_integral F_def)
 qed
 
 lemma has_integral_inverse_power_to_inf:
   fixes a :: real and n :: nat
   assumes "n > 1" "a > 0"
   shows   "((\<lambda>x. 1 / x ^ n) has_integral 1 / (real (n - 1) * a ^ (n - 1))) {a..}"
 proof -
   from assms have "real_of_int (-int n) < -1" by simp
   note has_integral_powr_to_inf[OF this \<open>a > 0\<close>]
   also have "- (a powr (real_of_int (- int n) + 1)) / (real_of_int (- int n) + 1) =
                  1 / (real (n - 1) * a powr (real (n - 1)))" using assms
     by (simp add: field_split_simps powr_add [symmetric] of_nat_diff)
   also from assms have "a powr (real (n - 1)) = a ^ (n - 1)"
     by (intro powr_realpow)
   finally show ?thesis
     by (rule has_integral_eq [rotated])
        (insert assms, simp_all add: powr_minus powr_realpow field_split_simps)
 qed
 
 subsubsection \<open>Adaption to ordered Euclidean spaces and the Cartesian Euclidean space\<close>
 
 lemma integral_component_eq_cart[simp]:
   fixes f :: "'n::euclidean_space \<Rightarrow> real^'m"
   assumes "f integrable_on s"
   shows "integral s (\<lambda>x. f x $ k) = integral s f $ k"
   using integral_linear[OF assms(1) bounded_linear_vec_nth,unfolded o_def] .
 
 lemma content_closed_interval:
   fixes a :: "'a::ordered_euclidean_space"
   assumes "a \<le> b"
   shows "content {a..b} = (\<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i)"
   using content_cbox[of a b] assms by (simp add: cbox_interval eucl_le[where 'a='a])
 
 lemma integrable_const_ivl[intro]:
   fixes a::"'a::ordered_euclidean_space"
   shows "(\<lambda>x. c) integrable_on {a..b}"
   unfolding cbox_interval[symmetric] by (rule integrable_const)
 
 lemma integrable_on_subinterval:
   fixes f :: "'n::ordered_euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on S" "{a..b} \<subseteq> S"
   shows "f integrable_on {a..b}"
   using integrable_on_subcbox[of f S a b] assms by (simp add: cbox_interval)
 
 end
diff --git a/src/HOL/Analysis/Measure_Space.thy b/src/HOL/Analysis/Measure_Space.thy
--- a/src/HOL/Analysis/Measure_Space.thy
+++ b/src/HOL/Analysis/Measure_Space.thy
@@ -1,3885 +1,3884 @@
 (*  Title:      HOL/Analysis/Measure_Space.thy
     Author:     Lawrence C Paulson
     Author:     Johannes Hölzl, TU München
     Author:     Armin Heller, TU München
 *)
 
 section \<open>Measure Spaces\<close>
 
 theory Measure_Space
 imports
   Measurable "HOL-Library.Extended_Nonnegative_Real"
 begin
 
 subsection\<^marker>\<open>tag unimportant\<close> "Relate extended reals and the indicator function"
 
 lemma suminf_cmult_indicator:
   fixes f :: "nat \<Rightarrow> ennreal"
   assumes "disjoint_family A" "x \<in> A i"
   shows "(\<Sum>n. f n * indicator (A n) x) = f i"
 proof -
   have **: "\<And>n. f n * indicator (A n) x = (if n = i then f n else 0 :: ennreal)"
     using \<open>x \<in> A i\<close> assms unfolding disjoint_family_on_def indicator_def by auto
   then have "\<And>n. (\<Sum>j<n. f j * indicator (A j) x) = (if i < n then f i else 0 :: ennreal)"
     by (auto simp: sum.If_cases)
   moreover have "(SUP n. if i < n then f i else 0) = (f i :: ennreal)"
   proof (rule SUP_eqI)
     fix y :: ennreal assume "\<And>n. n \<in> UNIV \<Longrightarrow> (if i < n then f i else 0) \<le> y"
     from this[of "Suc i"] show "f i \<le> y" by auto
   qed (insert assms, simp)
   ultimately show ?thesis using assms
     by (subst suminf_eq_SUP) (auto simp: indicator_def)
 qed
 
 lemma suminf_indicator:
   assumes "disjoint_family A"
   shows "(\<Sum>n. indicator (A n) x :: ennreal) = indicator (\<Union>i. A i) x"
 proof cases
   assume *: "x \<in> (\<Union>i. A i)"
   then obtain i where "x \<in> A i" by auto
   from suminf_cmult_indicator[OF assms(1), OF \<open>x \<in> A i\<close>, of "\<lambda>k. 1"]
   show ?thesis using * by simp
 qed simp
 
 lemma sum_indicator_disjoint_family:
   fixes f :: "'d \<Rightarrow> 'e::semiring_1"
   assumes d: "disjoint_family_on A P" and "x \<in> A j" and "finite P" and "j \<in> P"
   shows "(\<Sum>i\<in>P. f i * indicator (A i) x) = f j"
 proof -
   have "P \<inter> {i. x \<in> A i} = {j}"
     using d \<open>x \<in> A j\<close> \<open>j \<in> P\<close> unfolding disjoint_family_on_def
     by auto
-  thus ?thesis
-    unfolding indicator_def
-    by (simp add: if_distrib sum.If_cases[OF \<open>finite P\<close>])
+  with \<open>finite P\<close> show ?thesis
+    by (simp add: indicator_def)
 qed
 
 text \<open>
   The type for emeasure spaces is already defined in \<^theory>\<open>HOL-Analysis.Sigma_Algebra\<close>, as it
   is also used to represent sigma algebras (with an arbitrary emeasure).
 \<close>
 
 subsection\<^marker>\<open>tag unimportant\<close> "Extend binary sets"
 
 lemma LIMSEQ_binaryset:
   assumes f: "f {} = 0"
   shows  "(\<lambda>n. \<Sum>i<n. f (binaryset A B i)) \<longlonglongrightarrow> f A + f B"
 proof -
   have "(\<lambda>n. \<Sum>i < Suc (Suc n). f (binaryset A B i)) = (\<lambda>n. f A + f B)"
     proof
       fix n
       show "(\<Sum>i < Suc (Suc n). f (binaryset A B i)) = f A + f B"
         by (induct n)  (auto simp add: binaryset_def f)
     qed
   moreover
   have "... \<longlonglongrightarrow> f A + f B" by (rule tendsto_const)
   ultimately
   have "(\<lambda>n. \<Sum>i< Suc (Suc n). f (binaryset A B i)) \<longlonglongrightarrow> f A + f B"
     by metis
   hence "(\<lambda>n. \<Sum>i< n+2. f (binaryset A B i)) \<longlonglongrightarrow> f A + f B"
     by simp
   thus ?thesis by (rule LIMSEQ_offset [where k=2])
 qed
 
 lemma binaryset_sums:
   assumes f: "f {} = 0"
   shows  "(\<lambda>n. f (binaryset A B n)) sums (f A + f B)"
     by (simp add: sums_def LIMSEQ_binaryset [where f=f, OF f] atLeast0LessThan)
 
 lemma suminf_binaryset_eq:
   fixes f :: "'a set \<Rightarrow> 'b::{comm_monoid_add, t2_space}"
   shows "f {} = 0 \<Longrightarrow> (\<Sum>n. f (binaryset A B n)) = f A + f B"
   by (metis binaryset_sums sums_unique)
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Properties of a premeasure \<^term>\<open>\<mu>\<close>\<close>
 
 text \<open>
   The definitions for \<^const>\<open>positive\<close> and \<^const>\<open>countably_additive\<close> should be here, by they are
   necessary to define \<^typ>\<open>'a measure\<close> in \<^theory>\<open>HOL-Analysis.Sigma_Algebra\<close>.
 \<close>
 
 definition subadditive where
   "subadditive M f \<longleftrightarrow> (\<forall>x\<in>M. \<forall>y\<in>M. x \<inter> y = {} \<longrightarrow> f (x \<union> y) \<le> f x + f y)"
 
 lemma subadditiveD: "subadditive M f \<Longrightarrow> x \<inter> y = {} \<Longrightarrow> x \<in> M \<Longrightarrow> y \<in> M \<Longrightarrow> f (x \<union> y) \<le> f x + f y"
   by (auto simp add: subadditive_def)
 
 definition countably_subadditive where
   "countably_subadditive M f \<longleftrightarrow>
     (\<forall>A. range A \<subseteq> M \<longrightarrow> disjoint_family A \<longrightarrow> (\<Union>i. A i) \<in> M \<longrightarrow> (f (\<Union>i. A i) \<le> (\<Sum>i. f (A i))))"
 
 lemma (in ring_of_sets) countably_subadditive_subadditive:
   fixes f :: "'a set \<Rightarrow> ennreal"
   assumes f: "positive M f" and cs: "countably_subadditive M f"
   shows  "subadditive M f"
 proof (auto simp add: subadditive_def)
   fix x y
   assume x: "x \<in> M" and y: "y \<in> M" and "x \<inter> y = {}"
   hence "disjoint_family (binaryset x y)"
     by (auto simp add: disjoint_family_on_def binaryset_def)
   hence "range (binaryset x y) \<subseteq> M \<longrightarrow>
          (\<Union>i. binaryset x y i) \<in> M \<longrightarrow>
          f (\<Union>i. binaryset x y i) \<le> (\<Sum> n. f (binaryset x y n))"
     using cs by (auto simp add: countably_subadditive_def)
   hence "{x,y,{}} \<subseteq> M \<longrightarrow> x \<union> y \<in> M \<longrightarrow>
          f (x \<union> y) \<le> (\<Sum> n. f (binaryset x y n))"
     by (simp add: range_binaryset_eq UN_binaryset_eq)
   thus "f (x \<union> y) \<le>  f x + f y" using f x y
     by (auto simp add: Un o_def suminf_binaryset_eq positive_def)
 qed
 
 definition additive where
   "additive M \<mu> \<longleftrightarrow> (\<forall>x\<in>M. \<forall>y\<in>M. x \<inter> y = {} \<longrightarrow> \<mu> (x \<union> y) = \<mu> x + \<mu> y)"
 
 definition increasing where
   "increasing M \<mu> \<longleftrightarrow> (\<forall>x\<in>M. \<forall>y\<in>M. x \<subseteq> y \<longrightarrow> \<mu> x \<le> \<mu> y)"
 
 lemma positiveD1: "positive M f \<Longrightarrow> f {} = 0" by (auto simp: positive_def)
 
 lemma positiveD_empty:
   "positive M f \<Longrightarrow> f {} = 0"
   by (auto simp add: positive_def)
 
 lemma additiveD:
   "additive M f \<Longrightarrow> x \<inter> y = {} \<Longrightarrow> x \<in> M \<Longrightarrow> y \<in> M \<Longrightarrow> f (x \<union> y) = f x + f y"
   by (auto simp add: additive_def)
 
 lemma increasingD:
   "increasing M f \<Longrightarrow> x \<subseteq> y \<Longrightarrow> x\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> f x \<le> f y"
   by (auto simp add: increasing_def)
 
 lemma countably_additiveI[case_names countably]:
   "(\<And>A. range A \<subseteq> M \<Longrightarrow> disjoint_family A \<Longrightarrow> (\<Union>i. A i) \<in> M \<Longrightarrow> (\<Sum>i. f (A i)) = f (\<Union>i. A i))
   \<Longrightarrow> countably_additive M f"
   by (simp add: countably_additive_def)
 
 lemma (in ring_of_sets) disjointed_additive:
   assumes f: "positive M f" "additive M f" and A: "range A \<subseteq> M" "incseq A"
   shows "(\<Sum>i\<le>n. f (disjointed A i)) = f (A n)"
 proof (induct n)
   case (Suc n)
   then have "(\<Sum>i\<le>Suc n. f (disjointed A i)) = f (A n) + f (disjointed A (Suc n))"
     by simp
   also have "\<dots> = f (A n \<union> disjointed A (Suc n))"
     using A by (subst f(2)[THEN additiveD]) (auto simp: disjointed_mono)
   also have "A n \<union> disjointed A (Suc n) = A (Suc n)"
     using \<open>incseq A\<close> by (auto dest: incseq_SucD simp: disjointed_mono)
   finally show ?case .
 qed simp
 
 lemma (in ring_of_sets) additive_sum:
   fixes A:: "'i \<Rightarrow> 'a set"
   assumes f: "positive M f" and ad: "additive M f" and "finite S"
       and A: "A`S \<subseteq> M"
       and disj: "disjoint_family_on A S"
   shows  "(\<Sum>i\<in>S. f (A i)) = f (\<Union>i\<in>S. A i)"
   using \<open>finite S\<close> disj A
 proof induct
   case empty show ?case using f by (simp add: positive_def)
 next
   case (insert s S)
   then have "A s \<inter> (\<Union>i\<in>S. A i) = {}"
     by (auto simp add: disjoint_family_on_def neq_iff)
   moreover
   have "A s \<in> M" using insert by blast
   moreover have "(\<Union>i\<in>S. A i) \<in> M"
     using insert \<open>finite S\<close> by auto
   ultimately have "f (A s \<union> (\<Union>i\<in>S. A i)) = f (A s) + f(\<Union>i\<in>S. A i)"
     using ad UNION_in_sets A by (auto simp add: additive_def)
   with insert show ?case using ad disjoint_family_on_mono[of S "insert s S" A]
     by (auto simp add: additive_def subset_insertI)
 qed
 
 lemma (in ring_of_sets) additive_increasing:
   fixes f :: "'a set \<Rightarrow> ennreal"
   assumes posf: "positive M f" and addf: "additive M f"
   shows "increasing M f"
 proof (auto simp add: increasing_def)
   fix x y
   assume xy: "x \<in> M" "y \<in> M" "x \<subseteq> y"
   then have "y - x \<in> M" by auto
   then have "f x + 0 \<le> f x + f (y-x)" by (intro add_left_mono zero_le)
   also have "... = f (x \<union> (y-x))" using addf
     by (auto simp add: additive_def) (metis Diff_disjoint Un_Diff_cancel Diff xy(1,2))
   also have "... = f y"
     by (metis Un_Diff_cancel Un_absorb1 xy(3))
   finally show "f x \<le> f y" by simp
 qed
 
 lemma (in ring_of_sets) subadditive:
   fixes f :: "'a set \<Rightarrow> ennreal"
   assumes f: "positive M f" "additive M f" and A: "A`S \<subseteq> M" and S: "finite S"
   shows "f (\<Union>i\<in>S. A i) \<le> (\<Sum>i\<in>S. f (A i))"
 using S A
 proof (induct S)
   case empty thus ?case using f by (auto simp: positive_def)
 next
   case (insert x F)
   hence in_M: "A x \<in> M" "(\<Union>i\<in>F. A i) \<in> M" "(\<Union>i\<in>F. A i) - A x \<in> M" using A by force+
   have subs: "(\<Union>i\<in>F. A i) - A x \<subseteq> (\<Union>i\<in>F. A i)" by auto
   have "(\<Union>i\<in>(insert x F). A i) = A x \<union> ((\<Union>i\<in>F. A i) - A x)" by auto
   hence "f (\<Union>i\<in>(insert x F). A i) = f (A x \<union> ((\<Union>i\<in>F. A i) - A x))"
     by simp
   also have "\<dots> = f (A x) + f ((\<Union>i\<in>F. A i) - A x)"
     using f(2) by (rule additiveD) (insert in_M, auto)
   also have "\<dots> \<le> f (A x) + f (\<Union>i\<in>F. A i)"
     using additive_increasing[OF f] in_M subs by (auto simp: increasing_def intro: add_left_mono)
   also have "\<dots> \<le> f (A x) + (\<Sum>i\<in>F. f (A i))" using insert by (auto intro: add_left_mono)
   finally show "f (\<Union>i\<in>(insert x F). A i) \<le> (\<Sum>i\<in>(insert x F). f (A i))" using insert by simp
 qed
 
 lemma (in ring_of_sets) countably_additive_additive:
   fixes f :: "'a set \<Rightarrow> ennreal"
   assumes posf: "positive M f" and ca: "countably_additive M f"
   shows "additive M f"
 proof (auto simp add: additive_def)
   fix x y
   assume x: "x \<in> M" and y: "y \<in> M" and "x \<inter> y = {}"
   hence "disjoint_family (binaryset x y)"
     by (auto simp add: disjoint_family_on_def binaryset_def)
   hence "range (binaryset x y) \<subseteq> M \<longrightarrow>
          (\<Union>i. binaryset x y i) \<in> M \<longrightarrow>
          f (\<Union>i. binaryset x y i) = (\<Sum> n. f (binaryset x y n))"
     using ca
     by (simp add: countably_additive_def)
   hence "{x,y,{}} \<subseteq> M \<longrightarrow> x \<union> y \<in> M \<longrightarrow>
          f (x \<union> y) = (\<Sum>n. f (binaryset x y n))"
     by (simp add: range_binaryset_eq UN_binaryset_eq)
   thus "f (x \<union> y) = f x + f y" using posf x y
     by (auto simp add: Un suminf_binaryset_eq positive_def)
 qed
 
 lemma (in algebra) increasing_additive_bound:
   fixes A:: "nat \<Rightarrow> 'a set" and  f :: "'a set \<Rightarrow> ennreal"
   assumes f: "positive M f" and ad: "additive M f"
       and inc: "increasing M f"
       and A: "range A \<subseteq> M"
       and disj: "disjoint_family A"
   shows  "(\<Sum>i. f (A i)) \<le> f \<Omega>"
 proof (safe intro!: suminf_le_const)
   fix N
   note disj_N = disjoint_family_on_mono[OF _ disj, of "{..<N}"]
   have "(\<Sum>i<N. f (A i)) = f (\<Union>i\<in>{..<N}. A i)"
     using A by (intro additive_sum [OF f ad _ _]) (auto simp: disj_N)
   also have "... \<le> f \<Omega>" using space_closed A
     by (intro increasingD[OF inc] finite_UN) auto
   finally show "(\<Sum>i<N. f (A i)) \<le> f \<Omega>" by simp
 qed (insert f A, auto simp: positive_def)
 
 lemma (in ring_of_sets) countably_additiveI_finite:
   fixes \<mu> :: "'a set \<Rightarrow> ennreal"
   assumes "finite \<Omega>" "positive M \<mu>" "additive M \<mu>"
   shows "countably_additive M \<mu>"
 proof (rule countably_additiveI)
   fix F :: "nat \<Rightarrow> 'a set" assume F: "range F \<subseteq> M" "(\<Union>i. F i) \<in> M" and disj: "disjoint_family F"
 
   have "\<forall>i\<in>{i. F i \<noteq> {}}. \<exists>x. x \<in> F i" by auto
   from bchoice[OF this] obtain f where f: "\<And>i. F i \<noteq> {} \<Longrightarrow> f i \<in> F i" by auto
 
   have inj_f: "inj_on f {i. F i \<noteq> {}}"
   proof (rule inj_onI, simp)
     fix i j a b assume *: "f i = f j" "F i \<noteq> {}" "F j \<noteq> {}"
     then have "f i \<in> F i" "f j \<in> F j" using f by force+
     with disj * show "i = j" by (auto simp: disjoint_family_on_def)
   qed
   have "finite (\<Union>i. F i)"
     by (metis F(2) assms(1) infinite_super sets_into_space)
 
   have F_subset: "{i. \<mu> (F i) \<noteq> 0} \<subseteq> {i. F i \<noteq> {}}"
     by (auto simp: positiveD_empty[OF \<open>positive M \<mu>\<close>])
   moreover have fin_not_empty: "finite {i. F i \<noteq> {}}"
   proof (rule finite_imageD)
     from f have "f`{i. F i \<noteq> {}} \<subseteq> (\<Union>i. F i)" by auto
     then show "finite (f`{i. F i \<noteq> {}})"
       by (rule finite_subset) fact
   qed fact
   ultimately have fin_not_0: "finite {i. \<mu> (F i) \<noteq> 0}"
     by (rule finite_subset)
 
   have disj_not_empty: "disjoint_family_on F {i. F i \<noteq> {}}"
     using disj by (auto simp: disjoint_family_on_def)
 
   from fin_not_0 have "(\<Sum>i. \<mu> (F i)) = (\<Sum>i | \<mu> (F i) \<noteq> 0. \<mu> (F i))"
     by (rule suminf_finite) auto
   also have "\<dots> = (\<Sum>i | F i \<noteq> {}. \<mu> (F i))"
     using fin_not_empty F_subset by (rule sum.mono_neutral_left) auto
   also have "\<dots> = \<mu> (\<Union>i\<in>{i. F i \<noteq> {}}. F i)"
     using \<open>positive M \<mu>\<close> \<open>additive M \<mu>\<close> fin_not_empty disj_not_empty F by (intro additive_sum) auto
   also have "\<dots> = \<mu> (\<Union>i. F i)"
     by (rule arg_cong[where f=\<mu>]) auto
   finally show "(\<Sum>i. \<mu> (F i)) = \<mu> (\<Union>i. F i)" .
 qed
 
 lemma (in ring_of_sets) countably_additive_iff_continuous_from_below:
   fixes f :: "'a set \<Rightarrow> ennreal"
   assumes f: "positive M f" "additive M f"
   shows "countably_additive M f \<longleftrightarrow>
     (\<forall>A. range A \<subseteq> M \<longrightarrow> incseq A \<longrightarrow> (\<Union>i. A i) \<in> M \<longrightarrow> (\<lambda>i. f (A i)) \<longlonglongrightarrow> f (\<Union>i. A i))"
   unfolding countably_additive_def
 proof safe
   assume count_sum: "\<forall>A. range A \<subseteq> M \<longrightarrow> disjoint_family A \<longrightarrow> \<Union>(A ` UNIV) \<in> M \<longrightarrow> (\<Sum>i. f (A i)) = f (\<Union>(A ` UNIV))"
   fix A :: "nat \<Rightarrow> 'a set" assume A: "range A \<subseteq> M" "incseq A" "(\<Union>i. A i) \<in> M"
   then have dA: "range (disjointed A) \<subseteq> M" by (auto simp: range_disjointed_sets)
   with count_sum[THEN spec, of "disjointed A"] A(3)
   have f_UN: "(\<Sum>i. f (disjointed A i)) = f (\<Union>i. A i)"
     by (auto simp: UN_disjointed_eq disjoint_family_disjointed)
   moreover have "(\<lambda>n. (\<Sum>i<n. f (disjointed A i))) \<longlonglongrightarrow> (\<Sum>i. f (disjointed A i))"
     using f(1)[unfolded positive_def] dA
     by (auto intro!: summable_LIMSEQ)
   from LIMSEQ_Suc[OF this]
   have "(\<lambda>n. (\<Sum>i\<le>n. f (disjointed A i))) \<longlonglongrightarrow> (\<Sum>i. f (disjointed A i))"
     unfolding lessThan_Suc_atMost .
   moreover have "\<And>n. (\<Sum>i\<le>n. f (disjointed A i)) = f (A n)"
     using disjointed_additive[OF f A(1,2)] .
   ultimately show "(\<lambda>i. f (A i)) \<longlonglongrightarrow> f (\<Union>i. A i)" by simp
 next
   assume cont: "\<forall>A. range A \<subseteq> M \<longrightarrow> incseq A \<longrightarrow> (\<Union>i. A i) \<in> M \<longrightarrow> (\<lambda>i. f (A i)) \<longlonglongrightarrow> f (\<Union>i. A i)"
   fix A :: "nat \<Rightarrow> 'a set" assume A: "range A \<subseteq> M" "disjoint_family A" "(\<Union>i. A i) \<in> M"
   have *: "(\<Union>n. (\<Union>i<n. A i)) = (\<Union>i. A i)" by auto
   have "(\<lambda>n. f (\<Union>i<n. A i)) \<longlonglongrightarrow> f (\<Union>i. A i)"
   proof (unfold *[symmetric], intro cont[rule_format])
     show "range (\<lambda>i. \<Union>i<i. A i) \<subseteq> M" "(\<Union>i. \<Union>i<i. A i) \<in> M"
       using A * by auto
   qed (force intro!: incseq_SucI)
   moreover have "\<And>n. f (\<Union>i<n. A i) = (\<Sum>i<n. f (A i))"
     using A
     by (intro additive_sum[OF f, of _ A, symmetric])
        (auto intro: disjoint_family_on_mono[where B=UNIV])
   ultimately
   have "(\<lambda>i. f (A i)) sums f (\<Union>i. A i)"
     unfolding sums_def by simp
   from sums_unique[OF this]
   show "(\<Sum>i. f (A i)) = f (\<Union>i. A i)" by simp
 qed
 
 lemma (in ring_of_sets) continuous_from_above_iff_empty_continuous:
   fixes f :: "'a set \<Rightarrow> ennreal"
   assumes f: "positive M f" "additive M f"
   shows "(\<forall>A. range A \<subseteq> M \<longrightarrow> decseq A \<longrightarrow> (\<Inter>i. A i) \<in> M \<longrightarrow> (\<forall>i. f (A i) \<noteq> \<infinity>) \<longrightarrow> (\<lambda>i. f (A i)) \<longlonglongrightarrow> f (\<Inter>i. A i))
      \<longleftrightarrow> (\<forall>A. range A \<subseteq> M \<longrightarrow> decseq A \<longrightarrow> (\<Inter>i. A i) = {} \<longrightarrow> (\<forall>i. f (A i) \<noteq> \<infinity>) \<longrightarrow> (\<lambda>i. f (A i)) \<longlonglongrightarrow> 0)"
 proof safe
   assume cont: "(\<forall>A. range A \<subseteq> M \<longrightarrow> decseq A \<longrightarrow> (\<Inter>i. A i) \<in> M \<longrightarrow> (\<forall>i. f (A i) \<noteq> \<infinity>) \<longrightarrow> (\<lambda>i. f (A i)) \<longlonglongrightarrow> f (\<Inter>i. A i))"
   fix A :: "nat \<Rightarrow> 'a set" assume A: "range A \<subseteq> M" "decseq A" "(\<Inter>i. A i) = {}" "\<forall>i. f (A i) \<noteq> \<infinity>"
   with cont[THEN spec, of A] show "(\<lambda>i. f (A i)) \<longlonglongrightarrow> 0"
     using \<open>positive M f\<close>[unfolded positive_def] by auto
 next
   assume cont: "\<forall>A. range A \<subseteq> M \<longrightarrow> decseq A \<longrightarrow> (\<Inter>i. A i) = {} \<longrightarrow> (\<forall>i. f (A i) \<noteq> \<infinity>) \<longrightarrow> (\<lambda>i. f (A i)) \<longlonglongrightarrow> 0"
   fix A :: "nat \<Rightarrow> 'a set" assume A: "range A \<subseteq> M" "decseq A" "(\<Inter>i. A i) \<in> M" "\<forall>i. f (A i) \<noteq> \<infinity>"
 
   have f_mono: "\<And>a b. a \<in> M \<Longrightarrow> b \<in> M \<Longrightarrow> a \<subseteq> b \<Longrightarrow> f a \<le> f b"
     using additive_increasing[OF f] unfolding increasing_def by simp
 
   have decseq_fA: "decseq (\<lambda>i. f (A i))"
     using A by (auto simp: decseq_def intro!: f_mono)
   have decseq: "decseq (\<lambda>i. A i - (\<Inter>i. A i))"
     using A by (auto simp: decseq_def)
   then have decseq_f: "decseq (\<lambda>i. f (A i - (\<Inter>i. A i)))"
     using A unfolding decseq_def by (auto intro!: f_mono Diff)
   have "f (\<Inter>x. A x) \<le> f (A 0)"
     using A by (auto intro!: f_mono)
   then have f_Int_fin: "f (\<Inter>x. A x) \<noteq> \<infinity>"
     using A by (auto simp: top_unique)
   { fix i
     have "f (A i - (\<Inter>i. A i)) \<le> f (A i)" using A by (auto intro!: f_mono)
     then have "f (A i - (\<Inter>i. A i)) \<noteq> \<infinity>"
       using A by (auto simp: top_unique) }
   note f_fin = this
   have "(\<lambda>i. f (A i - (\<Inter>i. A i))) \<longlonglongrightarrow> 0"
   proof (intro cont[rule_format, OF _ decseq _ f_fin])
     show "range (\<lambda>i. A i - (\<Inter>i. A i)) \<subseteq> M" "(\<Inter>i. A i - (\<Inter>i. A i)) = {}"
       using A by auto
   qed
   from INF_Lim[OF decseq_f this]
   have "(INF n. f (A n - (\<Inter>i. A i))) = 0" .
   moreover have "(INF n. f (\<Inter>i. A i)) = f (\<Inter>i. A i)"
     by auto
   ultimately have "(INF n. f (A n - (\<Inter>i. A i)) + f (\<Inter>i. A i)) = 0 + f (\<Inter>i. A i)"
     using A(4) f_fin f_Int_fin
     by (subst INF_ennreal_add_const) (auto simp: decseq_f)
   moreover {
     fix n
     have "f (A n - (\<Inter>i. A i)) + f (\<Inter>i. A i) = f ((A n - (\<Inter>i. A i)) \<union> (\<Inter>i. A i))"
       using A by (subst f(2)[THEN additiveD]) auto
     also have "(A n - (\<Inter>i. A i)) \<union> (\<Inter>i. A i) = A n"
       by auto
     finally have "f (A n - (\<Inter>i. A i)) + f (\<Inter>i. A i) = f (A n)" . }
   ultimately have "(INF n. f (A n)) = f (\<Inter>i. A i)"
     by simp
   with LIMSEQ_INF[OF decseq_fA]
   show "(\<lambda>i. f (A i)) \<longlonglongrightarrow> f (\<Inter>i. A i)" by simp
 qed
 
 lemma (in ring_of_sets) empty_continuous_imp_continuous_from_below:
   fixes f :: "'a set \<Rightarrow> ennreal"
   assumes f: "positive M f" "additive M f" "\<forall>A\<in>M. f A \<noteq> \<infinity>"
   assumes cont: "\<forall>A. range A \<subseteq> M \<longrightarrow> decseq A \<longrightarrow> (\<Inter>i. A i) = {} \<longrightarrow> (\<lambda>i. f (A i)) \<longlonglongrightarrow> 0"
   assumes A: "range A \<subseteq> M" "incseq A" "(\<Union>i. A i) \<in> M"
   shows "(\<lambda>i. f (A i)) \<longlonglongrightarrow> f (\<Union>i. A i)"
 proof -
   from A have "(\<lambda>i. f ((\<Union>i. A i) - A i)) \<longlonglongrightarrow> 0"
     by (intro cont[rule_format]) (auto simp: decseq_def incseq_def)
   moreover
   { fix i
     have "f ((\<Union>i. A i) - A i \<union> A i) = f ((\<Union>i. A i) - A i) + f (A i)"
       using A by (intro f(2)[THEN additiveD]) auto
     also have "((\<Union>i. A i) - A i) \<union> A i = (\<Union>i. A i)"
       by auto
     finally have "f ((\<Union>i. A i) - A i) = f (\<Union>i. A i) - f (A i)"
       using f(3)[rule_format, of "A i"] A by (auto simp: ennreal_add_diff_cancel subset_eq) }
   moreover have "\<forall>\<^sub>F i in sequentially. f (A i) \<le> f (\<Union>i. A i)"
     using increasingD[OF additive_increasing[OF f(1, 2)], of "A _" "\<Union>i. A i"] A
     by (auto intro!: always_eventually simp: subset_eq)
   ultimately show "(\<lambda>i. f (A i)) \<longlonglongrightarrow> f (\<Union>i. A i)"
     by (auto intro: ennreal_tendsto_const_minus)
 qed
 
 lemma (in ring_of_sets) empty_continuous_imp_countably_additive:
   fixes f :: "'a set \<Rightarrow> ennreal"
   assumes f: "positive M f" "additive M f" and fin: "\<forall>A\<in>M. f A \<noteq> \<infinity>"
   assumes cont: "\<And>A. range A \<subseteq> M \<Longrightarrow> decseq A \<Longrightarrow> (\<Inter>i. A i) = {} \<Longrightarrow> (\<lambda>i. f (A i)) \<longlonglongrightarrow> 0"
   shows "countably_additive M f"
   using countably_additive_iff_continuous_from_below[OF f]
   using empty_continuous_imp_continuous_from_below[OF f fin] cont
   by blast
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Properties of \<^const>\<open>emeasure\<close>\<close>
 
 lemma emeasure_positive: "positive (sets M) (emeasure M)"
   by (cases M) (auto simp: sets_def emeasure_def Abs_measure_inverse measure_space_def)
 
 lemma emeasure_empty[simp, intro]: "emeasure M {} = 0"
   using emeasure_positive[of M] by (simp add: positive_def)
 
 lemma emeasure_single_in_space: "emeasure M {x} \<noteq> 0 \<Longrightarrow> x \<in> space M"
   using emeasure_notin_sets[of "{x}" M] by (auto dest: sets.sets_into_space zero_less_iff_neq_zero[THEN iffD2])
 
 lemma emeasure_countably_additive: "countably_additive (sets M) (emeasure M)"
   by (cases M) (auto simp: sets_def emeasure_def Abs_measure_inverse measure_space_def)
 
 lemma suminf_emeasure:
   "range A \<subseteq> sets M \<Longrightarrow> disjoint_family A \<Longrightarrow> (\<Sum>i. emeasure M (A i)) = emeasure M (\<Union>i. A i)"
   using sets.countable_UN[of A UNIV M] emeasure_countably_additive[of M]
   by (simp add: countably_additive_def)
 
 lemma sums_emeasure:
   "disjoint_family F \<Longrightarrow> (\<And>i. F i \<in> sets M) \<Longrightarrow> (\<lambda>i. emeasure M (F i)) sums emeasure M (\<Union>i. F i)"
   unfolding sums_iff by (intro conjI suminf_emeasure) auto
 
 lemma emeasure_additive: "additive (sets M) (emeasure M)"
   by (metis sets.countably_additive_additive emeasure_positive emeasure_countably_additive)
 
 lemma plus_emeasure:
   "a \<in> sets M \<Longrightarrow> b \<in> sets M \<Longrightarrow> a \<inter> b = {} \<Longrightarrow> emeasure M a + emeasure M b = emeasure M (a \<union> b)"
   using additiveD[OF emeasure_additive] ..
 
 lemma emeasure_Un:
   "A \<in> sets M \<Longrightarrow> B \<in> sets M \<Longrightarrow> emeasure M (A \<union> B) = emeasure M A + emeasure M (B - A)"
   using plus_emeasure[of A M "B - A"] by auto
 
 lemma emeasure_Un_Int:
   assumes "A \<in> sets M" "B \<in> sets M"
   shows "emeasure M A + emeasure M B = emeasure M (A \<union> B) + emeasure M (A \<inter> B)"
 proof -
   have "A = (A-B) \<union> (A \<inter> B)" by auto
   then have "emeasure M A = emeasure M (A-B) + emeasure M (A \<inter> B)"
     by (metis Diff_Diff_Int Diff_disjoint assms plus_emeasure sets.Diff)
   moreover have "A \<union> B = (A-B) \<union> B" by auto
   then have "emeasure M (A \<union> B) = emeasure M (A-B) + emeasure M B"
     by (metis Diff_disjoint Int_commute assms plus_emeasure sets.Diff)
   ultimately show ?thesis by (metis add.assoc add.commute)
 qed
 
 lemma sum_emeasure:
   "F`I \<subseteq> sets M \<Longrightarrow> disjoint_family_on F I \<Longrightarrow> finite I \<Longrightarrow>
     (\<Sum>i\<in>I. emeasure M (F i)) = emeasure M (\<Union>i\<in>I. F i)"
   by (metis sets.additive_sum emeasure_positive emeasure_additive)
 
 lemma emeasure_mono:
   "a \<subseteq> b \<Longrightarrow> b \<in> sets M \<Longrightarrow> emeasure M a \<le> emeasure M b"
   by (metis zero_le sets.additive_increasing emeasure_additive emeasure_notin_sets emeasure_positive increasingD)
 
 lemma emeasure_space:
   "emeasure M A \<le> emeasure M (space M)"
   by (metis emeasure_mono emeasure_notin_sets sets.sets_into_space sets.top zero_le)
 
 lemma emeasure_Diff:
   assumes finite: "emeasure M B \<noteq> \<infinity>"
   and [measurable]: "A \<in> sets M" "B \<in> sets M" and "B \<subseteq> A"
   shows "emeasure M (A - B) = emeasure M A - emeasure M B"
 proof -
   have "(A - B) \<union> B = A" using \<open>B \<subseteq> A\<close> by auto
   then have "emeasure M A = emeasure M ((A - B) \<union> B)" by simp
   also have "\<dots> = emeasure M (A - B) + emeasure M B"
     by (subst plus_emeasure[symmetric]) auto
   finally show "emeasure M (A - B) = emeasure M A - emeasure M B"
     using finite by simp
 qed
 
 lemma emeasure_compl:
   "s \<in> sets M \<Longrightarrow> emeasure M s \<noteq> \<infinity> \<Longrightarrow> emeasure M (space M - s) = emeasure M (space M) - emeasure M s"
   by (rule emeasure_Diff) (auto dest: sets.sets_into_space)
 
 lemma Lim_emeasure_incseq:
   "range A \<subseteq> sets M \<Longrightarrow> incseq A \<Longrightarrow> (\<lambda>i. (emeasure M (A i))) \<longlonglongrightarrow> emeasure M (\<Union>i. A i)"
   using emeasure_countably_additive
   by (auto simp add: sets.countably_additive_iff_continuous_from_below emeasure_positive
     emeasure_additive)
 
 lemma incseq_emeasure:
   assumes "range B \<subseteq> sets M" "incseq B"
   shows "incseq (\<lambda>i. emeasure M (B i))"
   using assms by (auto simp: incseq_def intro!: emeasure_mono)
 
 lemma SUP_emeasure_incseq:
   assumes A: "range A \<subseteq> sets M" "incseq A"
   shows "(SUP n. emeasure M (A n)) = emeasure M (\<Union>i. A i)"
   using LIMSEQ_SUP[OF incseq_emeasure, OF A] Lim_emeasure_incseq[OF A]
   by (simp add: LIMSEQ_unique)
 
 lemma decseq_emeasure:
   assumes "range B \<subseteq> sets M" "decseq B"
   shows "decseq (\<lambda>i. emeasure M (B i))"
   using assms by (auto simp: decseq_def intro!: emeasure_mono)
 
 lemma INF_emeasure_decseq:
   assumes A: "range A \<subseteq> sets M" and "decseq A"
   and finite: "\<And>i. emeasure M (A i) \<noteq> \<infinity>"
   shows "(INF n. emeasure M (A n)) = emeasure M (\<Inter>i. A i)"
 proof -
   have le_MI: "emeasure M (\<Inter>i. A i) \<le> emeasure M (A 0)"
     using A by (auto intro!: emeasure_mono)
   hence *: "emeasure M (\<Inter>i. A i) \<noteq> \<infinity>" using finite[of 0] by (auto simp: top_unique)
 
   have "emeasure M (A 0) - (INF n. emeasure M (A n)) = (SUP n. emeasure M (A 0) - emeasure M (A n))"
     by (simp add: ennreal_INF_const_minus)
   also have "\<dots> = (SUP n. emeasure M (A 0 - A n))"
     using A finite \<open>decseq A\<close>[unfolded decseq_def] by (subst emeasure_Diff) auto
   also have "\<dots> = emeasure M (\<Union>i. A 0 - A i)"
   proof (rule SUP_emeasure_incseq)
     show "range (\<lambda>n. A 0 - A n) \<subseteq> sets M"
       using A by auto
     show "incseq (\<lambda>n. A 0 - A n)"
       using \<open>decseq A\<close> by (auto simp add: incseq_def decseq_def)
   qed
   also have "\<dots> = emeasure M (A 0) - emeasure M (\<Inter>i. A i)"
     using A finite * by (simp, subst emeasure_Diff) auto
   finally show ?thesis
     by (rule ennreal_minus_cancel[rotated 3])
        (insert finite A, auto intro: INF_lower emeasure_mono)
 qed
 
 lemma INF_emeasure_decseq':
   assumes A: "\<And>i. A i \<in> sets M" and "decseq A"
   and finite: "\<exists>i. emeasure M (A i) \<noteq> \<infinity>"
   shows "(INF n. emeasure M (A n)) = emeasure M (\<Inter>i. A i)"
 proof -
   from finite obtain i where i: "emeasure M (A i) < \<infinity>"
     by (auto simp: less_top)
   have fin: "i \<le> j \<Longrightarrow> emeasure M (A j) < \<infinity>" for j
     by (rule le_less_trans[OF emeasure_mono i]) (auto intro!: decseqD[OF \<open>decseq A\<close>] A)
 
   have "(INF n. emeasure M (A n)) = (INF n. emeasure M (A (n + i)))"
   proof (rule INF_eq)
     show "\<exists>j\<in>UNIV. emeasure M (A (j + i)) \<le> emeasure M (A i')" for i'
       by (intro bexI[of _ i'] emeasure_mono decseqD[OF \<open>decseq A\<close>] A) auto
   qed auto
   also have "\<dots> = emeasure M (INF n. (A (n + i)))"
     using A \<open>decseq A\<close> fin by (intro INF_emeasure_decseq) (auto simp: decseq_def less_top)
   also have "(INF n. (A (n + i))) = (INF n. A n)"
     by (meson INF_eq UNIV_I assms(2) decseqD le_add1)
   finally show ?thesis .
 qed
 
 lemma emeasure_INT_decseq_subset:
   fixes F :: "nat \<Rightarrow> 'a set"
   assumes I: "I \<noteq> {}" and F: "\<And>i j. i \<in> I \<Longrightarrow> j \<in> I \<Longrightarrow> i \<le> j \<Longrightarrow> F j \<subseteq> F i"
   assumes F_sets[measurable]: "\<And>i. i \<in> I \<Longrightarrow> F i \<in> sets M"
     and fin: "\<And>i. i \<in> I \<Longrightarrow> emeasure M (F i) \<noteq> \<infinity>"
   shows "emeasure M (\<Inter>i\<in>I. F i) = (INF i\<in>I. emeasure M (F i))"
 proof cases
   assume "finite I"
   have "(\<Inter>i\<in>I. F i) = F (Max I)"
     using I \<open>finite I\<close> by (intro antisym INF_lower INF_greatest F) auto
   moreover have "(INF i\<in>I. emeasure M (F i)) = emeasure M (F (Max I))"
     using I \<open>finite I\<close> by (intro antisym INF_lower INF_greatest F emeasure_mono) auto
   ultimately show ?thesis
     by simp
 next
   assume "infinite I"
   define L where "L n = (LEAST i. i \<in> I \<and> i \<ge> n)" for n
   have L: "L n \<in> I \<and> n \<le> L n" for n
     unfolding L_def
   proof (rule LeastI_ex)
     show "\<exists>x. x \<in> I \<and> n \<le> x"
       using \<open>infinite I\<close> finite_subset[of I "{..< n}"]
       by (rule_tac ccontr) (auto simp: not_le)
   qed
   have L_eq[simp]: "i \<in> I \<Longrightarrow> L i = i" for i
     unfolding L_def by (intro Least_equality) auto
   have L_mono: "i \<le> j \<Longrightarrow> L i \<le> L j" for i j
     using L[of j] unfolding L_def by (intro Least_le) (auto simp: L_def)
 
   have "emeasure M (\<Inter>i. F (L i)) = (INF i. emeasure M (F (L i)))"
   proof (intro INF_emeasure_decseq[symmetric])
     show "decseq (\<lambda>i. F (L i))"
       using L by (intro antimonoI F L_mono) auto
   qed (insert L fin, auto)
   also have "\<dots> = (INF i\<in>I. emeasure M (F i))"
   proof (intro antisym INF_greatest)
     show "i \<in> I \<Longrightarrow> (INF i. emeasure M (F (L i))) \<le> emeasure M (F i)" for i
       by (intro INF_lower2[of i]) auto
   qed (insert L, auto intro: INF_lower)
   also have "(\<Inter>i. F (L i)) = (\<Inter>i\<in>I. F i)"
   proof (intro antisym INF_greatest)
     show "i \<in> I \<Longrightarrow> (\<Inter>i. F (L i)) \<subseteq> F i" for i
       by (intro INF_lower2[of i]) auto
   qed (insert L, auto)
   finally show ?thesis .
 qed
 
 lemma Lim_emeasure_decseq:
   assumes A: "range A \<subseteq> sets M" "decseq A" and fin: "\<And>i. emeasure M (A i) \<noteq> \<infinity>"
   shows "(\<lambda>i. emeasure M (A i)) \<longlonglongrightarrow> emeasure M (\<Inter>i. A i)"
   using LIMSEQ_INF[OF decseq_emeasure, OF A]
   using INF_emeasure_decseq[OF A fin] by simp
 
 lemma emeasure_lfp'[consumes 1, case_names cont measurable]:
   assumes "P M"
   assumes cont: "sup_continuous F"
   assumes *: "\<And>M A. P M \<Longrightarrow> (\<And>N. P N \<Longrightarrow> Measurable.pred N A) \<Longrightarrow> Measurable.pred M (F A)"
   shows "emeasure M {x\<in>space M. lfp F x} = (SUP i. emeasure M {x\<in>space M. (F ^^ i) (\<lambda>x. False) x})"
 proof -
   have "emeasure M {x\<in>space M. lfp F x} = emeasure M (\<Union>i. {x\<in>space M. (F ^^ i) (\<lambda>x. False) x})"
     using sup_continuous_lfp[OF cont] by (auto simp add: bot_fun_def intro!: arg_cong2[where f=emeasure])
   moreover { fix i from \<open>P M\<close> have "{x\<in>space M. (F ^^ i) (\<lambda>x. False) x} \<in> sets M"
     by (induct i arbitrary: M) (auto simp add: pred_def[symmetric] intro: *) }
   moreover have "incseq (\<lambda>i. {x\<in>space M. (F ^^ i) (\<lambda>x. False) x})"
   proof (rule incseq_SucI)
     fix i
     have "(F ^^ i) (\<lambda>x. False) \<le> (F ^^ (Suc i)) (\<lambda>x. False)"
     proof (induct i)
       case 0 show ?case by (simp add: le_fun_def)
     next
       case Suc thus ?case using monoD[OF sup_continuous_mono[OF cont] Suc] by auto
     qed
     then show "{x \<in> space M. (F ^^ i) (\<lambda>x. False) x} \<subseteq> {x \<in> space M. (F ^^ Suc i) (\<lambda>x. False) x}"
       by auto
   qed
   ultimately show ?thesis
     by (subst SUP_emeasure_incseq) auto
 qed
 
 lemma emeasure_lfp:
   assumes [simp]: "\<And>s. sets (M s) = sets N"
   assumes cont: "sup_continuous F" "sup_continuous f"
   assumes meas: "\<And>P. Measurable.pred N P \<Longrightarrow> Measurable.pred N (F P)"
   assumes iter: "\<And>P s. Measurable.pred N P \<Longrightarrow> P \<le> lfp F \<Longrightarrow> emeasure (M s) {x\<in>space N. F P x} = f (\<lambda>s. emeasure (M s) {x\<in>space N. P x}) s"
   shows "emeasure (M s) {x\<in>space N. lfp F x} = lfp f s"
 proof (subst lfp_transfer_bounded[where \<alpha>="\<lambda>F s. emeasure (M s) {x\<in>space N. F x}" and g=f and f=F and P="Measurable.pred N", symmetric])
   fix C assume "incseq C" "\<And>i. Measurable.pred N (C i)"
   then show "(\<lambda>s. emeasure (M s) {x \<in> space N. (SUP i. C i) x}) = (SUP i. (\<lambda>s. emeasure (M s) {x \<in> space N. C i x}))"
     unfolding SUP_apply[abs_def]
     by (subst SUP_emeasure_incseq) (auto simp: mono_def fun_eq_iff intro!: arg_cong2[where f=emeasure])
 qed (auto simp add: iter le_fun_def SUP_apply[abs_def] intro!: meas cont)
 
 lemma emeasure_subadditive_finite:
   "finite I \<Longrightarrow> A ` I \<subseteq> sets M \<Longrightarrow> emeasure M (\<Union>i\<in>I. A i) \<le> (\<Sum>i\<in>I. emeasure M (A i))"
   by (rule sets.subadditive[OF emeasure_positive emeasure_additive]) auto
 
 lemma emeasure_subadditive:
   "A \<in> sets M \<Longrightarrow> B \<in> sets M \<Longrightarrow> emeasure M (A \<union> B) \<le> emeasure M A + emeasure M B"
   using emeasure_subadditive_finite[of "{True, False}" "\<lambda>True \<Rightarrow> A | False \<Rightarrow> B" M] by simp
 
 lemma emeasure_subadditive_countably:
   assumes "range f \<subseteq> sets M"
   shows "emeasure M (\<Union>i. f i) \<le> (\<Sum>i. emeasure M (f i))"
 proof -
   have "emeasure M (\<Union>i. f i) = emeasure M (\<Union>i. disjointed f i)"
     unfolding UN_disjointed_eq ..
   also have "\<dots> = (\<Sum>i. emeasure M (disjointed f i))"
     using sets.range_disjointed_sets[OF assms] suminf_emeasure[of "disjointed f"]
     by (simp add:  disjoint_family_disjointed comp_def)
   also have "\<dots> \<le> (\<Sum>i. emeasure M (f i))"
     using sets.range_disjointed_sets[OF assms] assms
     by (auto intro!: suminf_le emeasure_mono disjointed_subset)
   finally show ?thesis .
 qed
 
 lemma emeasure_insert:
   assumes sets: "{x} \<in> sets M" "A \<in> sets M" and "x \<notin> A"
   shows "emeasure M (insert x A) = emeasure M {x} + emeasure M A"
 proof -
   have "{x} \<inter> A = {}" using \<open>x \<notin> A\<close> by auto
   from plus_emeasure[OF sets this] show ?thesis by simp
 qed
 
 lemma emeasure_insert_ne:
   "A \<noteq> {} \<Longrightarrow> {x} \<in> sets M \<Longrightarrow> A \<in> sets M \<Longrightarrow> x \<notin> A \<Longrightarrow> emeasure M (insert x A) = emeasure M {x} + emeasure M A"
   by (rule emeasure_insert)
 
 lemma emeasure_eq_sum_singleton:
   assumes "finite S" "\<And>x. x \<in> S \<Longrightarrow> {x} \<in> sets M"
   shows "emeasure M S = (\<Sum>x\<in>S. emeasure M {x})"
   using sum_emeasure[of "\<lambda>x. {x}" S M] assms
   by (auto simp: disjoint_family_on_def subset_eq)
 
 lemma sum_emeasure_cover:
   assumes "finite S" and "A \<in> sets M" and br_in_M: "B ` S \<subseteq> sets M"
   assumes A: "A \<subseteq> (\<Union>i\<in>S. B i)"
   assumes disj: "disjoint_family_on B S"
   shows "emeasure M A = (\<Sum>i\<in>S. emeasure M (A \<inter> (B i)))"
 proof -
   have "(\<Sum>i\<in>S. emeasure M (A \<inter> (B i))) = emeasure M (\<Union>i\<in>S. A \<inter> (B i))"
   proof (rule sum_emeasure)
     show "disjoint_family_on (\<lambda>i. A \<inter> B i) S"
       using \<open>disjoint_family_on B S\<close>
       unfolding disjoint_family_on_def by auto
   qed (insert assms, auto)
   also have "(\<Union>i\<in>S. A \<inter> (B i)) = A"
     using A by auto
   finally show ?thesis by simp
 qed
 
 lemma emeasure_eq_0:
   "N \<in> sets M \<Longrightarrow> emeasure M N = 0 \<Longrightarrow> K \<subseteq> N \<Longrightarrow> emeasure M K = 0"
   by (metis emeasure_mono order_eq_iff zero_le)
 
 lemma emeasure_UN_eq_0:
   assumes "\<And>i::nat. emeasure M (N i) = 0" and "range N \<subseteq> sets M"
   shows "emeasure M (\<Union>i. N i) = 0"
 proof -
   have "emeasure M (\<Union>i. N i) \<le> 0"
     using emeasure_subadditive_countably[OF assms(2)] assms(1) by simp
   then show ?thesis
     by (auto intro: antisym zero_le)
 qed
 
 lemma measure_eqI_finite:
   assumes [simp]: "sets M = Pow A" "sets N = Pow A" and "finite A"
   assumes eq: "\<And>a. a \<in> A \<Longrightarrow> emeasure M {a} = emeasure N {a}"
   shows "M = N"
 proof (rule measure_eqI)
   fix X assume "X \<in> sets M"
   then have X: "X \<subseteq> A" by auto
   then have "emeasure M X = (\<Sum>a\<in>X. emeasure M {a})"
     using \<open>finite A\<close> by (subst emeasure_eq_sum_singleton) (auto dest: finite_subset)
   also have "\<dots> = (\<Sum>a\<in>X. emeasure N {a})"
     using X eq by (auto intro!: sum.cong)
   also have "\<dots> = emeasure N X"
     using X \<open>finite A\<close> by (subst emeasure_eq_sum_singleton) (auto dest: finite_subset)
   finally show "emeasure M X = emeasure N X" .
 qed simp
 
 lemma measure_eqI_generator_eq:
   fixes M N :: "'a measure" and E :: "'a set set" and A :: "nat \<Rightarrow> 'a set"
   assumes "Int_stable E" "E \<subseteq> Pow \<Omega>"
   and eq: "\<And>X. X \<in> E \<Longrightarrow> emeasure M X = emeasure N X"
   and M: "sets M = sigma_sets \<Omega> E"
   and N: "sets N = sigma_sets \<Omega> E"
   and A: "range A \<subseteq> E" "(\<Union>i. A i) = \<Omega>" "\<And>i. emeasure M (A i) \<noteq> \<infinity>"
   shows "M = N"
 proof -
   let ?\<mu>  = "emeasure M" and ?\<nu> = "emeasure N"
   interpret S: sigma_algebra \<Omega> "sigma_sets \<Omega> E" by (rule sigma_algebra_sigma_sets) fact
   have "space M = \<Omega>"
     using sets.top[of M] sets.space_closed[of M] S.top S.space_closed \<open>sets M = sigma_sets \<Omega> E\<close>
     by blast
 
   { fix F D assume "F \<in> E" and "?\<mu> F \<noteq> \<infinity>"
     then have [intro]: "F \<in> sigma_sets \<Omega> E" by auto
     have "?\<nu> F \<noteq> \<infinity>" using \<open>?\<mu> F \<noteq> \<infinity>\<close> \<open>F \<in> E\<close> eq by simp
     assume "D \<in> sets M"
     with \<open>Int_stable E\<close> \<open>E \<subseteq> Pow \<Omega>\<close> have "emeasure M (F \<inter> D) = emeasure N (F \<inter> D)"
       unfolding M
     proof (induct rule: sigma_sets_induct_disjoint)
       case (basic A)
       then have "F \<inter> A \<in> E" using \<open>Int_stable E\<close> \<open>F \<in> E\<close> by (auto simp: Int_stable_def)
       then show ?case using eq by auto
     next
       case empty then show ?case by simp
     next
       case (compl A)
       then have **: "F \<inter> (\<Omega> - A) = F - (F \<inter> A)"
         and [intro]: "F \<inter> A \<in> sigma_sets \<Omega> E"
         using \<open>F \<in> E\<close> S.sets_into_space by (auto simp: M)
       have "?\<nu> (F \<inter> A) \<le> ?\<nu> F" by (auto intro!: emeasure_mono simp: M N)
       then have "?\<nu> (F \<inter> A) \<noteq> \<infinity>" using \<open>?\<nu> F \<noteq> \<infinity>\<close> by (auto simp: top_unique)
       have "?\<mu> (F \<inter> A) \<le> ?\<mu> F" by (auto intro!: emeasure_mono simp: M N)
       then have "?\<mu> (F \<inter> A) \<noteq> \<infinity>" using \<open>?\<mu> F \<noteq> \<infinity>\<close> by (auto simp: top_unique)
       then have "?\<mu> (F \<inter> (\<Omega> - A)) = ?\<mu> F - ?\<mu> (F \<inter> A)" unfolding **
         using \<open>F \<inter> A \<in> sigma_sets \<Omega> E\<close> by (auto intro!: emeasure_Diff simp: M N)
       also have "\<dots> = ?\<nu> F - ?\<nu> (F \<inter> A)" using eq \<open>F \<in> E\<close> compl by simp
       also have "\<dots> = ?\<nu> (F \<inter> (\<Omega> - A))" unfolding **
         using \<open>F \<inter> A \<in> sigma_sets \<Omega> E\<close> \<open>?\<nu> (F \<inter> A) \<noteq> \<infinity>\<close>
         by (auto intro!: emeasure_Diff[symmetric] simp: M N)
       finally show ?case
         using \<open>space M = \<Omega>\<close> by auto
     next
       case (union A)
       then have "?\<mu> (\<Union>x. F \<inter> A x) = ?\<nu> (\<Union>x. F \<inter> A x)"
         by (subst (1 2) suminf_emeasure[symmetric]) (auto simp: disjoint_family_on_def subset_eq M N)
       with A show ?case
         by auto
     qed }
   note * = this
   show "M = N"
   proof (rule measure_eqI)
     show "sets M = sets N"
       using M N by simp
     have [simp, intro]: "\<And>i. A i \<in> sets M"
       using A(1) by (auto simp: subset_eq M)
     fix F assume "F \<in> sets M"
     let ?D = "disjointed (\<lambda>i. F \<inter> A i)"
     from \<open>space M = \<Omega>\<close> have F_eq: "F = (\<Union>i. ?D i)"
       using \<open>F \<in> sets M\<close>[THEN sets.sets_into_space] A(2)[symmetric] by (auto simp: UN_disjointed_eq)
     have [simp, intro]: "\<And>i. ?D i \<in> sets M"
       using sets.range_disjointed_sets[of "\<lambda>i. F \<inter> A i" M] \<open>F \<in> sets M\<close>
       by (auto simp: subset_eq)
     have "disjoint_family ?D"
       by (auto simp: disjoint_family_disjointed)
     moreover
     have "(\<Sum>i. emeasure M (?D i)) = (\<Sum>i. emeasure N (?D i))"
     proof (intro arg_cong[where f=suminf] ext)
       fix i
       have "A i \<inter> ?D i = ?D i"
         by (auto simp: disjointed_def)
       then show "emeasure M (?D i) = emeasure N (?D i)"
         using *[of "A i" "?D i", OF _ A(3)] A(1) by auto
     qed
     ultimately show "emeasure M F = emeasure N F"
       by (simp add: image_subset_iff \<open>sets M = sets N\<close>[symmetric] F_eq[symmetric] suminf_emeasure)
   qed
 qed
 
 lemma space_empty: "space M = {} \<Longrightarrow> M = count_space {}"
   by (rule measure_eqI) (simp_all add: space_empty_iff)
 
 lemma measure_eqI_generator_eq_countable:
   fixes M N :: "'a measure" and E :: "'a set set" and A :: "'a set set"
   assumes E: "Int_stable E" "E \<subseteq> Pow \<Omega>" "\<And>X. X \<in> E \<Longrightarrow> emeasure M X = emeasure N X"
     and sets: "sets M = sigma_sets \<Omega> E" "sets N = sigma_sets \<Omega> E"
   and A: "A \<subseteq> E" "(\<Union>A) = \<Omega>" "countable A" "\<And>a. a \<in> A \<Longrightarrow> emeasure M a \<noteq> \<infinity>"
   shows "M = N"
 proof cases
   assume "\<Omega> = {}"
   have *: "sigma_sets \<Omega> E = sets (sigma \<Omega> E)"
     using E(2) by simp
   have "space M = \<Omega>" "space N = \<Omega>"
     using sets E(2) unfolding * by (auto dest: sets_eq_imp_space_eq simp del: sets_measure_of)
   then show "M = N"
     unfolding \<open>\<Omega> = {}\<close> by (auto dest: space_empty)
 next
   assume "\<Omega> \<noteq> {}" with \<open>\<Union>A = \<Omega>\<close> have "A \<noteq> {}" by auto
   from this \<open>countable A\<close> have rng: "range (from_nat_into A) = A"
     by (rule range_from_nat_into)
   show "M = N"
   proof (rule measure_eqI_generator_eq[OF E sets])
     show "range (from_nat_into A) \<subseteq> E"
       unfolding rng using \<open>A \<subseteq> E\<close> .
     show "(\<Union>i. from_nat_into A i) = \<Omega>"
       unfolding rng using \<open>\<Union>A = \<Omega>\<close> .
     show "emeasure M (from_nat_into A i) \<noteq> \<infinity>" for i
       using rng by (intro A) auto
   qed
 qed
 
 lemma measure_of_of_measure: "measure_of (space M) (sets M) (emeasure M) = M"
 proof (intro measure_eqI emeasure_measure_of_sigma)
   show "sigma_algebra (space M) (sets M)" ..
   show "positive (sets M) (emeasure M)"
     by (simp add: positive_def)
   show "countably_additive (sets M) (emeasure M)"
     by (simp add: emeasure_countably_additive)
 qed simp_all
 
 subsection \<open>\<open>\<mu>\<close>-null sets\<close>
 
 definition\<^marker>\<open>tag important\<close> null_sets :: "'a measure \<Rightarrow> 'a set set" where
   "null_sets M = {N\<in>sets M. emeasure M N = 0}"
 
 lemma null_setsD1[dest]: "A \<in> null_sets M \<Longrightarrow> emeasure M A = 0"
   by (simp add: null_sets_def)
 
 lemma null_setsD2[dest]: "A \<in> null_sets M \<Longrightarrow> A \<in> sets M"
   unfolding null_sets_def by simp
 
 lemma null_setsI[intro]: "emeasure M A = 0 \<Longrightarrow> A \<in> sets M \<Longrightarrow> A \<in> null_sets M"
   unfolding null_sets_def by simp
 
 interpretation null_sets: ring_of_sets "space M" "null_sets M" for M
 proof (rule ring_of_setsI)
   show "null_sets M \<subseteq> Pow (space M)"
     using sets.sets_into_space by auto
   show "{} \<in> null_sets M"
     by auto
   fix A B assume null_sets: "A \<in> null_sets M" "B \<in> null_sets M"
   then have sets: "A \<in> sets M" "B \<in> sets M"
     by auto
   then have *: "emeasure M (A \<union> B) \<le> emeasure M A + emeasure M B"
     "emeasure M (A - B) \<le> emeasure M A"
     by (auto intro!: emeasure_subadditive emeasure_mono)
   then have "emeasure M B = 0" "emeasure M A = 0"
     using null_sets by auto
   with sets * show "A - B \<in> null_sets M" "A \<union> B \<in> null_sets M"
     by (auto intro!: antisym zero_le)
 qed
 
 lemma UN_from_nat_into:
   assumes I: "countable I" "I \<noteq> {}"
   shows "(\<Union>i\<in>I. N i) = (\<Union>i. N (from_nat_into I i))"
 proof -
   have "(\<Union>i\<in>I. N i) = \<Union>(N ` range (from_nat_into I))"
     using I by simp
   also have "\<dots> = (\<Union>i. (N \<circ> from_nat_into I) i)"
     by simp
   finally show ?thesis by simp
 qed
 
 lemma null_sets_UN':
   assumes "countable I"
   assumes "\<And>i. i \<in> I \<Longrightarrow> N i \<in> null_sets M"
   shows "(\<Union>i\<in>I. N i) \<in> null_sets M"
 proof cases
   assume "I = {}" then show ?thesis by simp
 next
   assume "I \<noteq> {}"
   show ?thesis
   proof (intro conjI CollectI null_setsI)
     show "(\<Union>i\<in>I. N i) \<in> sets M"
       using assms by (intro sets.countable_UN') auto
     have "emeasure M (\<Union>i\<in>I. N i) \<le> (\<Sum>n. emeasure M (N (from_nat_into I n)))"
       unfolding UN_from_nat_into[OF \<open>countable I\<close> \<open>I \<noteq> {}\<close>]
       using assms \<open>I \<noteq> {}\<close> by (intro emeasure_subadditive_countably) (auto intro: from_nat_into)
     also have "(\<lambda>n. emeasure M (N (from_nat_into I n))) = (\<lambda>_. 0)"
       using assms \<open>I \<noteq> {}\<close> by (auto intro: from_nat_into)
     finally show "emeasure M (\<Union>i\<in>I. N i) = 0"
       by (intro antisym zero_le) simp
   qed
 qed
 
 lemma null_sets_UN[intro]:
   "(\<And>i::'i::countable. N i \<in> null_sets M) \<Longrightarrow> (\<Union>i. N i) \<in> null_sets M"
   by (rule null_sets_UN') auto
 
 lemma null_set_Int1:
   assumes "B \<in> null_sets M" "A \<in> sets M" shows "A \<inter> B \<in> null_sets M"
 proof (intro CollectI conjI null_setsI)
   show "emeasure M (A \<inter> B) = 0" using assms
     by (intro emeasure_eq_0[of B _ "A \<inter> B"]) auto
 qed (insert assms, auto)
 
 lemma null_set_Int2:
   assumes "B \<in> null_sets M" "A \<in> sets M" shows "B \<inter> A \<in> null_sets M"
   using assms by (subst Int_commute) (rule null_set_Int1)
 
 lemma emeasure_Diff_null_set:
   assumes "B \<in> null_sets M" "A \<in> sets M"
   shows "emeasure M (A - B) = emeasure M A"
 proof -
   have *: "A - B = (A - (A \<inter> B))" by auto
   have "A \<inter> B \<in> null_sets M" using assms by (rule null_set_Int1)
   then show ?thesis
     unfolding * using assms
     by (subst emeasure_Diff) auto
 qed
 
 lemma null_set_Diff:
   assumes "B \<in> null_sets M" "A \<in> sets M" shows "B - A \<in> null_sets M"
 proof (intro CollectI conjI null_setsI)
   show "emeasure M (B - A) = 0" using assms by (intro emeasure_eq_0[of B _ "B - A"]) auto
 qed (insert assms, auto)
 
 lemma emeasure_Un_null_set:
   assumes "A \<in> sets M" "B \<in> null_sets M"
   shows "emeasure M (A \<union> B) = emeasure M A"
 proof -
   have *: "A \<union> B = A \<union> (B - A)" by auto
   have "B - A \<in> null_sets M" using assms(2,1) by (rule null_set_Diff)
   then show ?thesis
     unfolding * using assms
     by (subst plus_emeasure[symmetric]) auto
 qed
 
 lemma emeasure_Un':
   assumes "A \<in> sets M" "B \<in> sets M" "A \<inter> B \<in> null_sets M"
   shows   "emeasure M (A \<union> B) = emeasure M A + emeasure M B"
 proof -
   have "A \<union> B = A \<union> (B - A \<inter> B)" by blast
   also have "emeasure M \<dots> = emeasure M A + emeasure M (B - A \<inter> B)"
     using assms by (subst plus_emeasure) auto
   also have "emeasure M (B - A \<inter> B) = emeasure M B"
     using assms by (intro emeasure_Diff_null_set) auto
   finally show ?thesis .
 qed
 
 subsection \<open>The almost everywhere filter (i.e.\ quantifier)\<close>
 
 definition\<^marker>\<open>tag important\<close> ae_filter :: "'a measure \<Rightarrow> 'a filter" where
   "ae_filter M = (INF N\<in>null_sets M. principal (space M - N))"
 
 abbreviation almost_everywhere :: "'a measure \<Rightarrow> ('a \<Rightarrow> bool) \<Rightarrow> bool" where
   "almost_everywhere M P \<equiv> eventually P (ae_filter M)"
 
 syntax
   "_almost_everywhere" :: "pttrn \<Rightarrow> 'a \<Rightarrow> bool \<Rightarrow> bool" ("AE _ in _. _" [0,0,10] 10)
 
 translations
   "AE x in M. P" \<rightleftharpoons> "CONST almost_everywhere M (\<lambda>x. P)"
 
 abbreviation
   "set_almost_everywhere A M P \<equiv> AE x in M. x \<in> A \<longrightarrow> P x"
 
 syntax
   "_set_almost_everywhere" :: "pttrn \<Rightarrow> 'a set \<Rightarrow> 'a \<Rightarrow> bool \<Rightarrow> bool"
   ("AE _\<in>_ in _./ _" [0,0,0,10] 10)
 
 translations
   "AE x\<in>A in M. P" \<rightleftharpoons> "CONST set_almost_everywhere A M (\<lambda>x. P)"
 
 lemma eventually_ae_filter: "eventually P (ae_filter M) \<longleftrightarrow> (\<exists>N\<in>null_sets M. {x \<in> space M. \<not> P x} \<subseteq> N)"
   unfolding ae_filter_def by (subst eventually_INF_base) (auto simp: eventually_principal subset_eq)
 
 lemma AE_I':
   "N \<in> null_sets M \<Longrightarrow> {x\<in>space M. \<not> P x} \<subseteq> N \<Longrightarrow> (AE x in M. P x)"
   unfolding eventually_ae_filter by auto
 
 lemma AE_iff_null:
   assumes "{x\<in>space M. \<not> P x} \<in> sets M" (is "?P \<in> sets M")
   shows "(AE x in M. P x) \<longleftrightarrow> {x\<in>space M. \<not> P x} \<in> null_sets M"
 proof
   assume "AE x in M. P x" then obtain N where N: "N \<in> sets M" "?P \<subseteq> N" "emeasure M N = 0"
     unfolding eventually_ae_filter by auto
   have "emeasure M ?P \<le> emeasure M N"
     using assms N(1,2) by (auto intro: emeasure_mono)
   then have "emeasure M ?P = 0"
     unfolding \<open>emeasure M N = 0\<close> by auto
   then show "?P \<in> null_sets M" using assms by auto
 next
   assume "?P \<in> null_sets M" with assms show "AE x in M. P x" by (auto intro: AE_I')
 qed
 
 lemma AE_iff_null_sets:
   "N \<in> sets M \<Longrightarrow> N \<in> null_sets M \<longleftrightarrow> (AE x in M. x \<notin> N)"
   using Int_absorb1[OF sets.sets_into_space, of N M]
   by (subst AE_iff_null) (auto simp: Int_def[symmetric])
 
 lemma AE_not_in:
   "N \<in> null_sets M \<Longrightarrow> AE x in M. x \<notin> N"
   by (metis AE_iff_null_sets null_setsD2)
 
 lemma AE_iff_measurable:
   "N \<in> sets M \<Longrightarrow> {x\<in>space M. \<not> P x} = N \<Longrightarrow> (AE x in M. P x) \<longleftrightarrow> emeasure M N = 0"
   using AE_iff_null[of _ P] by auto
 
 lemma AE_E[consumes 1]:
   assumes "AE x in M. P x"
   obtains N where "{x \<in> space M. \<not> P x} \<subseteq> N" "emeasure M N = 0" "N \<in> sets M"
   using assms unfolding eventually_ae_filter by auto
 
 lemma AE_E2:
   assumes "AE x in M. P x" "{x\<in>space M. P x} \<in> sets M"
   shows "emeasure M {x\<in>space M. \<not> P x} = 0" (is "emeasure M ?P = 0")
 proof -
   have "{x\<in>space M. \<not> P x} = space M - {x\<in>space M. P x}" by auto
   with AE_iff_null[of M P] assms show ?thesis by auto
 qed
 
 lemma AE_E3:
   assumes "AE x in M. P x"
   obtains N where "\<And>x. x \<in> space M - N \<Longrightarrow> P x" "N \<in> null_sets M"
 using assms unfolding eventually_ae_filter by auto
 
 lemma AE_I:
   assumes "{x \<in> space M. \<not> P x} \<subseteq> N" "emeasure M N = 0" "N \<in> sets M"
   shows "AE x in M. P x"
   using assms unfolding eventually_ae_filter by auto
 
 lemma AE_mp[elim!]:
   assumes AE_P: "AE x in M. P x" and AE_imp: "AE x in M. P x \<longrightarrow> Q x"
   shows "AE x in M. Q x"
 proof -
   from AE_P obtain A where P: "{x\<in>space M. \<not> P x} \<subseteq> A"
     and A: "A \<in> sets M" "emeasure M A = 0"
     by (auto elim!: AE_E)
 
   from AE_imp obtain B where imp: "{x\<in>space M. P x \<and> \<not> Q x} \<subseteq> B"
     and B: "B \<in> sets M" "emeasure M B = 0"
     by (auto elim!: AE_E)
 
   show ?thesis
   proof (intro AE_I)
     have "emeasure M (A \<union> B) \<le> 0"
       using emeasure_subadditive[of A M B] A B by auto
     then show "A \<union> B \<in> sets M" "emeasure M (A \<union> B) = 0"
       using A B by auto
     show "{x\<in>space M. \<not> Q x} \<subseteq> A \<union> B"
       using P imp by auto
   qed
 qed
 
 text \<open>The next lemma is convenient to combine with a lemma whose conclusion is of the
 form \<open>AE x in M. P x = Q x\<close>: for such a lemma, there is no \<open>[symmetric]\<close> variant,
 but using \<open>AE_symmetric[OF...]\<close> will replace it.\<close>
 
 (* depricated replace by laws about eventually *)
 lemma
   shows AE_iffI: "AE x in M. P x \<Longrightarrow> AE x in M. P x \<longleftrightarrow> Q x \<Longrightarrow> AE x in M. Q x"
     and AE_disjI1: "AE x in M. P x \<Longrightarrow> AE x in M. P x \<or> Q x"
     and AE_disjI2: "AE x in M. Q x \<Longrightarrow> AE x in M. P x \<or> Q x"
     and AE_conjI: "AE x in M. P x \<Longrightarrow> AE x in M. Q x \<Longrightarrow> AE x in M. P x \<and> Q x"
     and AE_conj_iff[simp]: "(AE x in M. P x \<and> Q x) \<longleftrightarrow> (AE x in M. P x) \<and> (AE x in M. Q x)"
   by auto
 
 lemma AE_symmetric:
   assumes "AE x in M. P x = Q x"
   shows "AE x in M. Q x = P x"
   using assms by auto
 
 lemma AE_impI:
   "(P \<Longrightarrow> AE x in M. Q x) \<Longrightarrow> AE x in M. P \<longrightarrow> Q x"
   by fastforce
 
 lemma AE_measure:
   assumes AE: "AE x in M. P x" and sets: "{x\<in>space M. P x} \<in> sets M" (is "?P \<in> sets M")
   shows "emeasure M {x\<in>space M. P x} = emeasure M (space M)"
 proof -
   from AE_E[OF AE] guess N . note N = this
   with sets have "emeasure M (space M) \<le> emeasure M (?P \<union> N)"
     by (intro emeasure_mono) auto
   also have "\<dots> \<le> emeasure M ?P + emeasure M N"
     using sets N by (intro emeasure_subadditive) auto
   also have "\<dots> = emeasure M ?P" using N by simp
   finally show "emeasure M ?P = emeasure M (space M)"
     using emeasure_space[of M "?P"] by auto
 qed
 
 lemma AE_space: "AE x in M. x \<in> space M"
   by (rule AE_I[where N="{}"]) auto
 
 lemma AE_I2[simp, intro]:
   "(\<And>x. x \<in> space M \<Longrightarrow> P x) \<Longrightarrow> AE x in M. P x"
   using AE_space by force
 
 lemma AE_Ball_mp:
   "\<forall>x\<in>space M. P x \<Longrightarrow> AE x in M. P x \<longrightarrow> Q x \<Longrightarrow> AE x in M. Q x"
   by auto
 
 lemma AE_cong[cong]:
   "(\<And>x. x \<in> space M \<Longrightarrow> P x \<longleftrightarrow> Q x) \<Longrightarrow> (AE x in M. P x) \<longleftrightarrow> (AE x in M. Q x)"
   by auto
 
 lemma AE_cong_simp: "M = N \<Longrightarrow> (\<And>x. x \<in> space N =simp=> P x = Q x) \<Longrightarrow> (AE x in M. P x) \<longleftrightarrow> (AE x in N. Q x)"
   by (auto simp: simp_implies_def)
 
 lemma AE_all_countable:
   "(AE x in M. \<forall>i. P i x) \<longleftrightarrow> (\<forall>i::'i::countable. AE x in M. P i x)"
 proof
   assume "\<forall>i. AE x in M. P i x"
   from this[unfolded eventually_ae_filter Bex_def, THEN choice]
   obtain N where N: "\<And>i. N i \<in> null_sets M" "\<And>i. {x\<in>space M. \<not> P i x} \<subseteq> N i" by auto
   have "{x\<in>space M. \<not> (\<forall>i. P i x)} \<subseteq> (\<Union>i. {x\<in>space M. \<not> P i x})" by auto
   also have "\<dots> \<subseteq> (\<Union>i. N i)" using N by auto
   finally have "{x\<in>space M. \<not> (\<forall>i. P i x)} \<subseteq> (\<Union>i. N i)" .
   moreover from N have "(\<Union>i. N i) \<in> null_sets M"
     by (intro null_sets_UN) auto
   ultimately show "AE x in M. \<forall>i. P i x"
     unfolding eventually_ae_filter by auto
 qed auto
 
 lemma AE_ball_countable:
   assumes [intro]: "countable X"
   shows "(AE x in M. \<forall>y\<in>X. P x y) \<longleftrightarrow> (\<forall>y\<in>X. AE x in M. P x y)"
 proof
   assume "\<forall>y\<in>X. AE x in M. P x y"
   from this[unfolded eventually_ae_filter Bex_def, THEN bchoice]
   obtain N where N: "\<And>y. y \<in> X \<Longrightarrow> N y \<in> null_sets M" "\<And>y. y \<in> X \<Longrightarrow> {x\<in>space M. \<not> P x y} \<subseteq> N y"
     by auto
   have "{x\<in>space M. \<not> (\<forall>y\<in>X. P x y)} \<subseteq> (\<Union>y\<in>X. {x\<in>space M. \<not> P x y})"
     by auto
   also have "\<dots> \<subseteq> (\<Union>y\<in>X. N y)"
     using N by auto
   finally have "{x\<in>space M. \<not> (\<forall>y\<in>X. P x y)} \<subseteq> (\<Union>y\<in>X. N y)" .
   moreover from N have "(\<Union>y\<in>X. N y) \<in> null_sets M"
     by (intro null_sets_UN') auto
   ultimately show "AE x in M. \<forall>y\<in>X. P x y"
     unfolding eventually_ae_filter by auto
 qed auto
 
 lemma AE_ball_countable':
   "(\<And>N. N \<in> I \<Longrightarrow> AE x in M. P N x) \<Longrightarrow> countable I \<Longrightarrow> AE x in M. \<forall>N \<in> I. P N x"
   unfolding AE_ball_countable by simp
 
 lemma AE_pairwise: "countable F \<Longrightarrow> pairwise (\<lambda>A B. AE x in M. R x A B) F \<longleftrightarrow> (AE x in M. pairwise (R x) F)"
   unfolding pairwise_alt by (simp add: AE_ball_countable)
 
 lemma AE_discrete_difference:
   assumes X: "countable X"
   assumes null: "\<And>x. x \<in> X \<Longrightarrow> emeasure M {x} = 0"
   assumes sets: "\<And>x. x \<in> X \<Longrightarrow> {x} \<in> sets M"
   shows "AE x in M. x \<notin> X"
 proof -
   have "(\<Union>x\<in>X. {x}) \<in> null_sets M"
     using assms by (intro null_sets_UN') auto
   from AE_not_in[OF this] show "AE x in M. x \<notin> X"
     by auto
 qed
 
 lemma AE_finite_all:
   assumes f: "finite S" shows "(AE x in M. \<forall>i\<in>S. P i x) \<longleftrightarrow> (\<forall>i\<in>S. AE x in M. P i x)"
   using f by induct auto
 
 lemma AE_finite_allI:
   assumes "finite S"
   shows "(\<And>s. s \<in> S \<Longrightarrow> AE x in M. Q s x) \<Longrightarrow> AE x in M. \<forall>s\<in>S. Q s x"
   using AE_finite_all[OF \<open>finite S\<close>] by auto
 
 lemma emeasure_mono_AE:
   assumes imp: "AE x in M. x \<in> A \<longrightarrow> x \<in> B"
     and B: "B \<in> sets M"
   shows "emeasure M A \<le> emeasure M B"
 proof cases
   assume A: "A \<in> sets M"
   from imp obtain N where N: "{x\<in>space M. \<not> (x \<in> A \<longrightarrow> x \<in> B)} \<subseteq> N" "N \<in> null_sets M"
     by (auto simp: eventually_ae_filter)
   have "emeasure M A = emeasure M (A - N)"
     using N A by (subst emeasure_Diff_null_set) auto
   also have "emeasure M (A - N) \<le> emeasure M (B - N)"
     using N A B sets.sets_into_space by (auto intro!: emeasure_mono)
   also have "emeasure M (B - N) = emeasure M B"
     using N B by (subst emeasure_Diff_null_set) auto
   finally show ?thesis .
 qed (simp add: emeasure_notin_sets)
 
 lemma emeasure_eq_AE:
   assumes iff: "AE x in M. x \<in> A \<longleftrightarrow> x \<in> B"
   assumes A: "A \<in> sets M" and B: "B \<in> sets M"
   shows "emeasure M A = emeasure M B"
   using assms by (safe intro!: antisym emeasure_mono_AE) auto
 
 lemma emeasure_Collect_eq_AE:
   "AE x in M. P x \<longleftrightarrow> Q x \<Longrightarrow> Measurable.pred M Q \<Longrightarrow> Measurable.pred M P \<Longrightarrow>
    emeasure M {x\<in>space M. P x} = emeasure M {x\<in>space M. Q x}"
    by (intro emeasure_eq_AE) auto
 
 lemma emeasure_eq_0_AE: "AE x in M. \<not> P x \<Longrightarrow> emeasure M {x\<in>space M. P x} = 0"
   using AE_iff_measurable[OF _ refl, of M "\<lambda>x. \<not> P x"]
   by (cases "{x\<in>space M. P x} \<in> sets M") (simp_all add: emeasure_notin_sets)
 
 lemma emeasure_0_AE:
   assumes "emeasure M (space M) = 0"
   shows "AE x in M. P x"
 using eventually_ae_filter assms by blast
 
 lemma emeasure_add_AE:
   assumes [measurable]: "A \<in> sets M" "B \<in> sets M" "C \<in> sets M"
   assumes 1: "AE x in M. x \<in> C \<longleftrightarrow> x \<in> A \<or> x \<in> B"
   assumes 2: "AE x in M. \<not> (x \<in> A \<and> x \<in> B)"
   shows "emeasure M C = emeasure M A + emeasure M B"
 proof -
   have "emeasure M C = emeasure M (A \<union> B)"
     by (rule emeasure_eq_AE) (insert 1, auto)
   also have "\<dots> = emeasure M A + emeasure M (B - A)"
     by (subst plus_emeasure) auto
   also have "emeasure M (B - A) = emeasure M B"
     by (rule emeasure_eq_AE) (insert 2, auto)
   finally show ?thesis .
 qed
 
 subsection \<open>\<open>\<sigma>\<close>-finite Measures\<close>
 
 locale\<^marker>\<open>tag important\<close> sigma_finite_measure =
   fixes M :: "'a measure"
   assumes sigma_finite_countable:
     "\<exists>A::'a set set. countable A \<and> A \<subseteq> sets M \<and> (\<Union>A) = space M \<and> (\<forall>a\<in>A. emeasure M a \<noteq> \<infinity>)"
 
 lemma (in sigma_finite_measure) sigma_finite:
   obtains A :: "nat \<Rightarrow> 'a set"
   where "range A \<subseteq> sets M" "(\<Union>i. A i) = space M" "\<And>i. emeasure M (A i) \<noteq> \<infinity>"
 proof -
   obtain A :: "'a set set" where
     [simp]: "countable A" and
     A: "A \<subseteq> sets M" "(\<Union>A) = space M" "\<And>a. a \<in> A \<Longrightarrow> emeasure M a \<noteq> \<infinity>"
     using sigma_finite_countable by metis
   show thesis
   proof cases
     assume "A = {}" with \<open>(\<Union>A) = space M\<close> show thesis
       by (intro that[of "\<lambda>_. {}"]) auto
   next
     assume "A \<noteq> {}"
     show thesis
     proof
       show "range (from_nat_into A) \<subseteq> sets M"
         using \<open>A \<noteq> {}\<close> A by auto
       have "(\<Union>i. from_nat_into A i) = \<Union>A"
         using range_from_nat_into[OF \<open>A \<noteq> {}\<close> \<open>countable A\<close>] by auto
       with A show "(\<Union>i. from_nat_into A i) = space M"
         by auto
     qed (intro A from_nat_into \<open>A \<noteq> {}\<close>)
   qed
 qed
 
 lemma (in sigma_finite_measure) sigma_finite_disjoint:
   obtains A :: "nat \<Rightarrow> 'a set"
   where "range A \<subseteq> sets M" "(\<Union>i. A i) = space M" "\<And>i. emeasure M (A i) \<noteq> \<infinity>" "disjoint_family A"
 proof -
   obtain A :: "nat \<Rightarrow> 'a set" where
     range: "range A \<subseteq> sets M" and
     space: "(\<Union>i. A i) = space M" and
     measure: "\<And>i. emeasure M (A i) \<noteq> \<infinity>"
     using sigma_finite by blast
   show thesis
   proof (rule that[of "disjointed A"])
     show "range (disjointed A) \<subseteq> sets M"
       by (rule sets.range_disjointed_sets[OF range])
     show "(\<Union>i. disjointed A i) = space M"
       and "disjoint_family (disjointed A)"
       using disjoint_family_disjointed UN_disjointed_eq[of A] space range
       by auto
     show "emeasure M (disjointed A i) \<noteq> \<infinity>" for i
     proof -
       have "emeasure M (disjointed A i) \<le> emeasure M (A i)"
         using range disjointed_subset[of A i] by (auto intro!: emeasure_mono)
       then show ?thesis using measure[of i] by (auto simp: top_unique)
     qed
   qed
 qed
 
 lemma (in sigma_finite_measure) sigma_finite_incseq:
   obtains A :: "nat \<Rightarrow> 'a set"
   where "range A \<subseteq> sets M" "(\<Union>i. A i) = space M" "\<And>i. emeasure M (A i) \<noteq> \<infinity>" "incseq A"
 proof -
   obtain F :: "nat \<Rightarrow> 'a set" where
     F: "range F \<subseteq> sets M" "(\<Union>i. F i) = space M" "\<And>i. emeasure M (F i) \<noteq> \<infinity>"
     using sigma_finite by blast
   show thesis
   proof (rule that[of "\<lambda>n. \<Union>i\<le>n. F i"])
     show "range (\<lambda>n. \<Union>i\<le>n. F i) \<subseteq> sets M"
       using F by (force simp: incseq_def)
     show "(\<Union>n. \<Union>i\<le>n. F i) = space M"
     proof -
       from F have "\<And>x. x \<in> space M \<Longrightarrow> \<exists>i. x \<in> F i" by auto
       with F show ?thesis by fastforce
     qed
     show "emeasure M (\<Union>i\<le>n. F i) \<noteq> \<infinity>" for n
     proof -
       have "emeasure M (\<Union>i\<le>n. F i) \<le> (\<Sum>i\<le>n. emeasure M (F i))"
         using F by (auto intro!: emeasure_subadditive_finite)
       also have "\<dots> < \<infinity>"
         using F by (auto simp: sum_Pinfty less_top)
       finally show ?thesis by simp
     qed
     show "incseq (\<lambda>n. \<Union>i\<le>n. F i)"
       by (force simp: incseq_def)
   qed
 qed
 
 lemma (in sigma_finite_measure) approx_PInf_emeasure_with_finite:
   fixes C::real
   assumes W_meas: "W \<in> sets M"
       and W_inf: "emeasure M W = \<infinity>"
   obtains Z where "Z \<in> sets M" "Z \<subseteq> W" "emeasure M Z < \<infinity>" "emeasure M Z > C"
 proof -
   obtain A :: "nat \<Rightarrow> 'a set"
     where A: "range A \<subseteq> sets M" "(\<Union>i. A i) = space M" "\<And>i. emeasure M (A i) \<noteq> \<infinity>" "incseq A"
     using sigma_finite_incseq by blast
   define B where "B = (\<lambda>i. W \<inter> A i)"
   have B_meas: "\<And>i. B i \<in> sets M" using W_meas \<open>range A \<subseteq> sets M\<close> B_def by blast
   have b: "\<And>i. B i \<subseteq> W" using B_def by blast
 
   { fix i
     have "emeasure M (B i) \<le> emeasure M (A i)"
       using A by (intro emeasure_mono) (auto simp: B_def)
     also have "emeasure M (A i) < \<infinity>"
       using \<open>\<And>i. emeasure M (A i) \<noteq> \<infinity>\<close> by (simp add: less_top)
     finally have "emeasure M (B i) < \<infinity>" . }
   note c = this
 
   have "W = (\<Union>i. B i)" using B_def \<open>(\<Union>i. A i) = space M\<close> W_meas by auto
   moreover have "incseq B" using B_def \<open>incseq A\<close> by (simp add: incseq_def subset_eq)
   ultimately have "(\<lambda>i. emeasure M (B i)) \<longlonglongrightarrow> emeasure M W" using W_meas B_meas
     by (simp add: B_meas Lim_emeasure_incseq image_subset_iff)
   then have "(\<lambda>i. emeasure M (B i)) \<longlonglongrightarrow> \<infinity>" using W_inf by simp
   from order_tendstoD(1)[OF this, of C]
   obtain i where d: "emeasure M (B i) > C"
     by (auto simp: eventually_sequentially)
   have "B i \<in> sets M" "B i \<subseteq> W" "emeasure M (B i) < \<infinity>" "emeasure M (B i) > C"
     using B_meas b c d by auto
   then show ?thesis using that by blast
 qed
 
 subsection \<open>Measure space induced by distribution of \<^const>\<open>measurable\<close>-functions\<close>
 
 definition\<^marker>\<open>tag important\<close> distr :: "'a measure \<Rightarrow> 'b measure \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> 'b measure" where
 "distr M N f =
   measure_of (space N) (sets N) (\<lambda>A. emeasure M (f -` A \<inter> space M))"
 
 lemma
   shows sets_distr[simp, measurable_cong]: "sets (distr M N f) = sets N"
     and space_distr[simp]: "space (distr M N f) = space N"
   by (auto simp: distr_def)
 
 lemma
   shows measurable_distr_eq1[simp]: "measurable (distr Mf Nf f) Mf' = measurable Nf Mf'"
     and measurable_distr_eq2[simp]: "measurable Mg' (distr Mg Ng g) = measurable Mg' Ng"
   by (auto simp: measurable_def)
 
 lemma distr_cong:
   "M = K \<Longrightarrow> sets N = sets L \<Longrightarrow> (\<And>x. x \<in> space M \<Longrightarrow> f x = g x) \<Longrightarrow> distr M N f = distr K L g"
   using sets_eq_imp_space_eq[of N L] by (simp add: distr_def Int_def cong: rev_conj_cong)
 
 lemma emeasure_distr:
   fixes f :: "'a \<Rightarrow> 'b"
   assumes f: "f \<in> measurable M N" and A: "A \<in> sets N"
   shows "emeasure (distr M N f) A = emeasure M (f -` A \<inter> space M)" (is "_ = ?\<mu> A")
   unfolding distr_def
 proof (rule emeasure_measure_of_sigma)
   show "positive (sets N) ?\<mu>"
     by (auto simp: positive_def)
 
   show "countably_additive (sets N) ?\<mu>"
   proof (intro countably_additiveI)
     fix A :: "nat \<Rightarrow> 'b set" assume "range A \<subseteq> sets N" "disjoint_family A"
     then have A: "\<And>i. A i \<in> sets N" "(\<Union>i. A i) \<in> sets N" by auto
     then have *: "range (\<lambda>i. f -` (A i) \<inter> space M) \<subseteq> sets M"
       using f by (auto simp: measurable_def)
     moreover have "(\<Union>i. f -`  A i \<inter> space M) \<in> sets M"
       using * by blast
     moreover have **: "disjoint_family (\<lambda>i. f -` A i \<inter> space M)"
       using \<open>disjoint_family A\<close> by (auto simp: disjoint_family_on_def)
     ultimately show "(\<Sum>i. ?\<mu> (A i)) = ?\<mu> (\<Union>i. A i)"
       using suminf_emeasure[OF _ **] A f
       by (auto simp: comp_def vimage_UN)
   qed
   show "sigma_algebra (space N) (sets N)" ..
 qed fact
 
 lemma emeasure_Collect_distr:
   assumes X[measurable]: "X \<in> measurable M N" "Measurable.pred N P"
   shows "emeasure (distr M N X) {x\<in>space N. P x} = emeasure M {x\<in>space M. P (X x)}"
   by (subst emeasure_distr)
      (auto intro!: arg_cong2[where f=emeasure] X(1)[THEN measurable_space])
 
 lemma emeasure_lfp2[consumes 1, case_names cont f measurable]:
   assumes "P M"
   assumes cont: "sup_continuous F"
   assumes f: "\<And>M. P M \<Longrightarrow> f \<in> measurable M' M"
   assumes *: "\<And>M A. P M \<Longrightarrow> (\<And>N. P N \<Longrightarrow> Measurable.pred N A) \<Longrightarrow> Measurable.pred M (F A)"
   shows "emeasure M' {x\<in>space M'. lfp F (f x)} = (SUP i. emeasure M' {x\<in>space M'. (F ^^ i) (\<lambda>x. False) (f x)})"
 proof (subst (1 2) emeasure_Collect_distr[symmetric, where X=f])
   show "f \<in> measurable M' M"  "f \<in> measurable M' M"
     using f[OF \<open>P M\<close>] by auto
   { fix i show "Measurable.pred M ((F ^^ i) (\<lambda>x. False))"
     using \<open>P M\<close> by (induction i arbitrary: M) (auto intro!: *) }
   show "Measurable.pred M (lfp F)"
     using \<open>P M\<close> cont * by (rule measurable_lfp_coinduct[of P])
 
   have "emeasure (distr M' M f) {x \<in> space (distr M' M f). lfp F x} =
     (SUP i. emeasure (distr M' M f) {x \<in> space (distr M' M f). (F ^^ i) (\<lambda>x. False) x})"
     using \<open>P M\<close>
   proof (coinduction arbitrary: M rule: emeasure_lfp')
     case (measurable A N) then have "\<And>N. P N \<Longrightarrow> Measurable.pred (distr M' N f) A"
       by metis
     then have "\<And>N. P N \<Longrightarrow> Measurable.pred N A"
       by simp
     with \<open>P N\<close>[THEN *] show ?case
       by auto
   qed fact
   then show "emeasure (distr M' M f) {x \<in> space M. lfp F x} =
     (SUP i. emeasure (distr M' M f) {x \<in> space M. (F ^^ i) (\<lambda>x. False) x})"
    by simp
 qed
 
 lemma distr_id[simp]: "distr N N (\<lambda>x. x) = N"
   by (rule measure_eqI) (auto simp: emeasure_distr)
 
 lemma distr_id2: "sets M = sets N \<Longrightarrow> distr N M (\<lambda>x. x) = N"
   by (rule measure_eqI) (auto simp: emeasure_distr)
 
 lemma measure_distr:
   "f \<in> measurable M N \<Longrightarrow> S \<in> sets N \<Longrightarrow> measure (distr M N f) S = measure M (f -` S \<inter> space M)"
   by (simp add: emeasure_distr measure_def)
 
 lemma distr_cong_AE:
   assumes 1: "M = K" "sets N = sets L" and
     2: "(AE x in M. f x = g x)" and "f \<in> measurable M N" and "g \<in> measurable K L"
   shows "distr M N f = distr K L g"
 proof (rule measure_eqI)
   fix A assume "A \<in> sets (distr M N f)"
   with assms show "emeasure (distr M N f) A = emeasure (distr K L g) A"
     by (auto simp add: emeasure_distr intro!: emeasure_eq_AE measurable_sets)
 qed (insert 1, simp)
 
 lemma AE_distrD:
   assumes f: "f \<in> measurable M M'"
     and AE: "AE x in distr M M' f. P x"
   shows "AE x in M. P (f x)"
 proof -
   from AE[THEN AE_E] guess N .
   with f show ?thesis
     unfolding eventually_ae_filter
     by (intro bexI[of _ "f -` N \<inter> space M"])
        (auto simp: emeasure_distr measurable_def)
 qed
 
 lemma AE_distr_iff:
   assumes f[measurable]: "f \<in> measurable M N" and P[measurable]: "{x \<in> space N. P x} \<in> sets N"
   shows "(AE x in distr M N f. P x) \<longleftrightarrow> (AE x in M. P (f x))"
 proof (subst (1 2) AE_iff_measurable[OF _ refl])
   have "f -` {x\<in>space N. \<not> P x} \<inter> space M = {x \<in> space M. \<not> P (f x)}"
     using f[THEN measurable_space] by auto
   then show "(emeasure (distr M N f) {x \<in> space (distr M N f). \<not> P x} = 0) =
     (emeasure M {x \<in> space M. \<not> P (f x)} = 0)"
     by (simp add: emeasure_distr)
 qed auto
 
 lemma null_sets_distr_iff:
   "f \<in> measurable M N \<Longrightarrow> A \<in> null_sets (distr M N f) \<longleftrightarrow> f -` A \<inter> space M \<in> null_sets M \<and> A \<in> sets N"
   by (auto simp add: null_sets_def emeasure_distr)
 
 proposition distr_distr:
   "g \<in> measurable N L \<Longrightarrow> f \<in> measurable M N \<Longrightarrow> distr (distr M N f) L g = distr M L (g \<circ> f)"
   by (auto simp add: emeasure_distr measurable_space
            intro!: arg_cong[where f="emeasure M"] measure_eqI)
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Real measure values\<close>
 
 lemma ring_of_finite_sets: "ring_of_sets (space M) {A\<in>sets M. emeasure M A \<noteq> top}"
 proof (rule ring_of_setsI)
   show "a \<in> {A \<in> sets M. emeasure M A \<noteq> top} \<Longrightarrow> b \<in> {A \<in> sets M. emeasure M A \<noteq> top} \<Longrightarrow>
     a \<union> b \<in> {A \<in> sets M. emeasure M A \<noteq> top}" for a b
     using emeasure_subadditive[of a M b] by (auto simp: top_unique)
 
   show "a \<in> {A \<in> sets M. emeasure M A \<noteq> top} \<Longrightarrow> b \<in> {A \<in> sets M. emeasure M A \<noteq> top} \<Longrightarrow>
     a - b \<in> {A \<in> sets M. emeasure M A \<noteq> top}" for a b
     using emeasure_mono[of "a - b" a M] by (auto simp: top_unique)
 qed (auto dest: sets.sets_into_space)
 
 lemma measure_nonneg[simp]: "0 \<le> measure M A"
   unfolding measure_def by auto
 
 lemma measure_nonneg' [simp]: "\<not> measure M A < 0"
   using measure_nonneg not_le by blast
 
 lemma zero_less_measure_iff: "0 < measure M A \<longleftrightarrow> measure M A \<noteq> 0"
   using measure_nonneg[of M A] by (auto simp add: le_less)
 
 lemma measure_le_0_iff: "measure M X \<le> 0 \<longleftrightarrow> measure M X = 0"
   using measure_nonneg[of M X] by linarith
 
 lemma measure_empty[simp]: "measure M {} = 0"
   unfolding measure_def by (simp add: zero_ennreal.rep_eq)
 
 lemma emeasure_eq_ennreal_measure:
   "emeasure M A \<noteq> top \<Longrightarrow> emeasure M A = ennreal (measure M A)"
   by (cases "emeasure M A" rule: ennreal_cases) (auto simp: measure_def)
 
 lemma measure_zero_top: "emeasure M A = top \<Longrightarrow> measure M A = 0"
   by (simp add: measure_def)
 
 lemma measure_eq_emeasure_eq_ennreal: "0 \<le> x \<Longrightarrow> emeasure M A = ennreal x \<Longrightarrow> measure M A = x"
   using emeasure_eq_ennreal_measure[of M A]
   by (cases "A \<in> M") (auto simp: measure_notin_sets emeasure_notin_sets)
 
 lemma enn2real_plus:"a < top \<Longrightarrow> b < top \<Longrightarrow> enn2real (a + b) = enn2real a + enn2real b"
   by (simp add: enn2real_def plus_ennreal.rep_eq real_of_ereal_add less_top
            del: real_of_ereal_enn2ereal)
 
 lemma enn2real_sum:"(\<And>i. i \<in> I \<Longrightarrow> f i < top) \<Longrightarrow> enn2real (sum f I) = sum (enn2real \<circ> f) I"
   by (induction I rule: infinite_finite_induct) (auto simp: enn2real_plus)
 
 lemma measure_eq_AE:
   assumes iff: "AE x in M. x \<in> A \<longleftrightarrow> x \<in> B"
   assumes A: "A \<in> sets M" and B: "B \<in> sets M"
   shows "measure M A = measure M B"
   using assms emeasure_eq_AE[OF assms] by (simp add: measure_def)
 
 lemma measure_Union:
   "emeasure M A \<noteq> \<infinity> \<Longrightarrow> emeasure M B \<noteq> \<infinity> \<Longrightarrow> A \<in> sets M \<Longrightarrow> B \<in> sets M \<Longrightarrow> A \<inter> B = {} \<Longrightarrow>
     measure M (A \<union> B) = measure M A + measure M B"
   by (simp add: measure_def plus_emeasure[symmetric] enn2real_plus less_top)
 
 lemma disjoint_family_on_insert:
   "i \<notin> I \<Longrightarrow> disjoint_family_on A (insert i I) \<longleftrightarrow> A i \<inter> (\<Union>i\<in>I. A i) = {} \<and> disjoint_family_on A I"
   by (fastforce simp: disjoint_family_on_def)
 
 lemma measure_finite_Union:
   "finite S \<Longrightarrow> A`S \<subseteq> sets M \<Longrightarrow> disjoint_family_on A S \<Longrightarrow> (\<And>i. i \<in> S \<Longrightarrow> emeasure M (A i) \<noteq> \<infinity>) \<Longrightarrow>
     measure M (\<Union>i\<in>S. A i) = (\<Sum>i\<in>S. measure M (A i))"
   by (induction S rule: finite_induct)
      (auto simp: disjoint_family_on_insert measure_Union sum_emeasure[symmetric] sets.countable_UN'[OF countable_finite])
 
 lemma measure_Diff:
   assumes finite: "emeasure M A \<noteq> \<infinity>"
   and measurable: "A \<in> sets M" "B \<in> sets M" "B \<subseteq> A"
   shows "measure M (A - B) = measure M A - measure M B"
 proof -
   have "emeasure M (A - B) \<le> emeasure M A" "emeasure M B \<le> emeasure M A"
     using measurable by (auto intro!: emeasure_mono)
   hence "measure M ((A - B) \<union> B) = measure M (A - B) + measure M B"
     using measurable finite by (rule_tac measure_Union) (auto simp: top_unique)
   thus ?thesis using \<open>B \<subseteq> A\<close> by (auto simp: Un_absorb2)
 qed
 
 lemma measure_UNION:
   assumes measurable: "range A \<subseteq> sets M" "disjoint_family A"
   assumes finite: "emeasure M (\<Union>i. A i) \<noteq> \<infinity>"
   shows "(\<lambda>i. measure M (A i)) sums (measure M (\<Union>i. A i))"
 proof -
   have "(\<lambda>i. emeasure M (A i)) sums (emeasure M (\<Union>i. A i))"
     unfolding suminf_emeasure[OF measurable, symmetric] by (simp add: summable_sums)
   moreover
   { fix i
     have "emeasure M (A i) \<le> emeasure M (\<Union>i. A i)"
       using measurable by (auto intro!: emeasure_mono)
     then have "emeasure M (A i) = ennreal ((measure M (A i)))"
       using finite by (intro emeasure_eq_ennreal_measure) (auto simp: top_unique) }
   ultimately show ?thesis using finite
     by (subst (asm) (2) emeasure_eq_ennreal_measure) simp_all
 qed
 
 lemma measure_subadditive:
   assumes measurable: "A \<in> sets M" "B \<in> sets M"
   and fin: "emeasure M A \<noteq> \<infinity>" "emeasure M B \<noteq> \<infinity>"
   shows "measure M (A \<union> B) \<le> measure M A + measure M B"
 proof -
   have "emeasure M (A \<union> B) \<noteq> \<infinity>"
     using emeasure_subadditive[OF measurable] fin by (auto simp: top_unique)
   then show "(measure M (A \<union> B)) \<le> (measure M A) + (measure M B)"
     using emeasure_subadditive[OF measurable] fin
     apply simp
     apply (subst (asm) (2 3 4) emeasure_eq_ennreal_measure)
     apply (auto simp flip: ennreal_plus)
     done
 qed
 
 lemma measure_subadditive_finite:
   assumes A: "finite I" "A`I \<subseteq> sets M" and fin: "\<And>i. i \<in> I \<Longrightarrow> emeasure M (A i) \<noteq> \<infinity>"
   shows "measure M (\<Union>i\<in>I. A i) \<le> (\<Sum>i\<in>I. measure M (A i))"
 proof -
   { have "emeasure M (\<Union>i\<in>I. A i) \<le> (\<Sum>i\<in>I. emeasure M (A i))"
       using emeasure_subadditive_finite[OF A] .
     also have "\<dots> < \<infinity>"
       using fin by (simp add: less_top A)
     finally have "emeasure M (\<Union>i\<in>I. A i) \<noteq> top" by simp }
   note * = this
   show ?thesis
     using emeasure_subadditive_finite[OF A] fin
     unfolding emeasure_eq_ennreal_measure[OF *]
     by (simp_all add: sum_nonneg emeasure_eq_ennreal_measure)
 qed
 
 lemma measure_subadditive_countably:
   assumes A: "range A \<subseteq> sets M" and fin: "(\<Sum>i. emeasure M (A i)) \<noteq> \<infinity>"
   shows "measure M (\<Union>i. A i) \<le> (\<Sum>i. measure M (A i))"
 proof -
   from fin have **: "\<And>i. emeasure M (A i) \<noteq> top"
     using ennreal_suminf_lessD[of "\<lambda>i. emeasure M (A i)"] by (simp add: less_top)
   { have "emeasure M (\<Union>i. A i) \<le> (\<Sum>i. emeasure M (A i))"
       using emeasure_subadditive_countably[OF A] .
     also have "\<dots> < \<infinity>"
       using fin by (simp add: less_top)
     finally have "emeasure M (\<Union>i. A i) \<noteq> top" by simp }
   then have "ennreal (measure M (\<Union>i. A i)) = emeasure M (\<Union>i. A i)"
     by (rule emeasure_eq_ennreal_measure[symmetric])
   also have "\<dots> \<le> (\<Sum>i. emeasure M (A i))"
     using emeasure_subadditive_countably[OF A] .
   also have "\<dots> = ennreal (\<Sum>i. measure M (A i))"
     using fin unfolding emeasure_eq_ennreal_measure[OF **]
     by (subst suminf_ennreal) (auto simp: **)
   finally show ?thesis
     apply (rule ennreal_le_iff[THEN iffD1, rotated])
     apply (intro suminf_nonneg allI measure_nonneg summable_suminf_not_top)
     using fin
     apply (simp add: emeasure_eq_ennreal_measure[OF **])
     done
 qed
 
 lemma measure_Un_null_set: "A \<in> sets M \<Longrightarrow> B \<in> null_sets M \<Longrightarrow> measure M (A \<union> B) = measure M A"
   by (simp add: measure_def emeasure_Un_null_set)
 
 lemma measure_Diff_null_set: "A \<in> sets M \<Longrightarrow> B \<in> null_sets M \<Longrightarrow> measure M (A - B) = measure M A"
   by (simp add: measure_def emeasure_Diff_null_set)
 
 lemma measure_eq_sum_singleton:
   "finite S \<Longrightarrow> (\<And>x. x \<in> S \<Longrightarrow> {x} \<in> sets M) \<Longrightarrow> (\<And>x. x \<in> S \<Longrightarrow> emeasure M {x} \<noteq> \<infinity>) \<Longrightarrow>
     measure M S = (\<Sum>x\<in>S. measure M {x})"
   using emeasure_eq_sum_singleton[of S M]
   by (intro measure_eq_emeasure_eq_ennreal) (auto simp: sum_nonneg emeasure_eq_ennreal_measure)
 
 lemma Lim_measure_incseq:
   assumes A: "range A \<subseteq> sets M" "incseq A" and fin: "emeasure M (\<Union>i. A i) \<noteq> \<infinity>"
   shows "(\<lambda>i. measure M (A i)) \<longlonglongrightarrow> measure M (\<Union>i. A i)"
 proof (rule tendsto_ennrealD)
   have "ennreal (measure M (\<Union>i. A i)) = emeasure M (\<Union>i. A i)"
     using fin by (auto simp: emeasure_eq_ennreal_measure)
   moreover have "ennreal (measure M (A i)) = emeasure M (A i)" for i
     using assms emeasure_mono[of "A _" "\<Union>i. A i" M]
     by (intro emeasure_eq_ennreal_measure[symmetric]) (auto simp: less_top UN_upper intro: le_less_trans)
   ultimately show "(\<lambda>x. ennreal (measure M (A x))) \<longlonglongrightarrow> ennreal (measure M (\<Union>i. A i))"
     using A by (auto intro!: Lim_emeasure_incseq)
 qed auto
 
 lemma Lim_measure_decseq:
   assumes A: "range A \<subseteq> sets M" "decseq A" and fin: "\<And>i. emeasure M (A i) \<noteq> \<infinity>"
   shows "(\<lambda>n. measure M (A n)) \<longlonglongrightarrow> measure M (\<Inter>i. A i)"
 proof (rule tendsto_ennrealD)
   have "ennreal (measure M (\<Inter>i. A i)) = emeasure M (\<Inter>i. A i)"
     using fin[of 0] A emeasure_mono[of "\<Inter>i. A i" "A 0" M]
     by (auto intro!: emeasure_eq_ennreal_measure[symmetric] simp: INT_lower less_top intro: le_less_trans)
   moreover have "ennreal (measure M (A i)) = emeasure M (A i)" for i
     using A fin[of i] by (intro emeasure_eq_ennreal_measure[symmetric]) auto
   ultimately show "(\<lambda>x. ennreal (measure M (A x))) \<longlonglongrightarrow> ennreal (measure M (\<Inter>i. A i))"
     using fin A by (auto intro!: Lim_emeasure_decseq)
 qed auto
 
 subsection \<open>Set of measurable sets with finite measure\<close>
 
 definition\<^marker>\<open>tag important\<close> fmeasurable :: "'a measure \<Rightarrow> 'a set set" where
 "fmeasurable M = {A\<in>sets M. emeasure M A < \<infinity>}"
 
 lemma fmeasurableD[dest, measurable_dest]: "A \<in> fmeasurable M \<Longrightarrow> A \<in> sets M"
   by (auto simp: fmeasurable_def)
 
 lemma fmeasurableD2: "A \<in> fmeasurable M \<Longrightarrow> emeasure M A \<noteq> top"
   by (auto simp: fmeasurable_def)
 
 lemma fmeasurableI: "A \<in> sets M \<Longrightarrow> emeasure M A < \<infinity> \<Longrightarrow> A \<in> fmeasurable M"
   by (auto simp: fmeasurable_def)
 
 lemma fmeasurableI_null_sets: "A \<in> null_sets M \<Longrightarrow> A \<in> fmeasurable M"
   by (auto simp: fmeasurable_def)
 
 lemma fmeasurableI2: "A \<in> fmeasurable M \<Longrightarrow> B \<subseteq> A \<Longrightarrow> B \<in> sets M \<Longrightarrow> B \<in> fmeasurable M"
   using emeasure_mono[of B A M] by (auto simp: fmeasurable_def)
 
 lemma measure_mono_fmeasurable:
   "A \<subseteq> B \<Longrightarrow> A \<in> sets M \<Longrightarrow> B \<in> fmeasurable M \<Longrightarrow> measure M A \<le> measure M B"
   by (auto simp: measure_def fmeasurable_def intro!: emeasure_mono enn2real_mono)
 
 lemma emeasure_eq_measure2: "A \<in> fmeasurable M \<Longrightarrow> emeasure M A = measure M A"
   by (simp add: emeasure_eq_ennreal_measure fmeasurable_def less_top)
 
 interpretation fmeasurable: ring_of_sets "space M" "fmeasurable M"
 proof (rule ring_of_setsI)
   show "fmeasurable M \<subseteq> Pow (space M)" "{} \<in> fmeasurable M"
     by (auto simp: fmeasurable_def dest: sets.sets_into_space)
   fix a b assume *: "a \<in> fmeasurable M" "b \<in> fmeasurable M"
   then have "emeasure M (a \<union> b) \<le> emeasure M a + emeasure M b"
     by (intro emeasure_subadditive) auto
   also have "\<dots> < top"
     using * by (auto simp: fmeasurable_def)
   finally show  "a \<union> b \<in> fmeasurable M"
     using * by (auto intro: fmeasurableI)
   show "a - b \<in> fmeasurable M"
     using emeasure_mono[of "a - b" a M] * by (auto simp: fmeasurable_def)
 qed
 
 subsection\<^marker>\<open>tag unimportant\<close>\<open>Measurable sets formed by unions and intersections\<close>
 
 lemma fmeasurable_Diff: "A \<in> fmeasurable M \<Longrightarrow> B \<in> sets M \<Longrightarrow> A - B \<in> fmeasurable M"
   using fmeasurableI2[of A M "A - B"] by auto
 
 lemma fmeasurable_Int_fmeasurable:
    "\<lbrakk>S \<in> fmeasurable M; T \<in> sets M\<rbrakk> \<Longrightarrow> (S \<inter> T) \<in> fmeasurable M"
   by (meson fmeasurableD fmeasurableI2 inf_le1 sets.Int)
 
 lemma fmeasurable_UN:
   assumes "countable I" "\<And>i. i \<in> I \<Longrightarrow> F i \<subseteq> A" "\<And>i. i \<in> I \<Longrightarrow> F i \<in> sets M" "A \<in> fmeasurable M"
   shows "(\<Union>i\<in>I. F i) \<in> fmeasurable M"
 proof (rule fmeasurableI2)
   show "A \<in> fmeasurable M" "(\<Union>i\<in>I. F i) \<subseteq> A" using assms by auto
   show "(\<Union>i\<in>I. F i) \<in> sets M"
     using assms by (intro sets.countable_UN') auto
 qed
 
 lemma fmeasurable_INT:
   assumes "countable I" "i \<in> I" "\<And>i. i \<in> I \<Longrightarrow> F i \<in> sets M" "F i \<in> fmeasurable M"
   shows "(\<Inter>i\<in>I. F i) \<in> fmeasurable M"
 proof (rule fmeasurableI2)
   show "F i \<in> fmeasurable M" "(\<Inter>i\<in>I. F i) \<subseteq> F i"
     using assms by auto
   show "(\<Inter>i\<in>I. F i) \<in> sets M"
     using assms by (intro sets.countable_INT') auto
 qed
 
 lemma measurable_measure_Diff:
   assumes "A \<in> fmeasurable M" "B \<in> sets M" "B \<subseteq> A"
   shows "measure M (A - B) = measure M A - measure M B"
   by (simp add: assms fmeasurableD fmeasurableD2 measure_Diff)
 
 lemma measurable_Un_null_set:
   assumes "B \<in> null_sets M"
   shows "(A \<union> B \<in> fmeasurable M \<and> A \<in> sets M) \<longleftrightarrow> A \<in> fmeasurable M"
   using assms  by (fastforce simp add: fmeasurable.Un fmeasurableI_null_sets intro: fmeasurableI2)
 
 lemma measurable_Diff_null_set:
   assumes "B \<in> null_sets M"
   shows "(A - B) \<in> fmeasurable M \<and> A \<in> sets M \<longleftrightarrow> A \<in> fmeasurable M"
   using assms
   by (metis Un_Diff_cancel2 fmeasurable.Diff fmeasurableD fmeasurableI_null_sets measurable_Un_null_set)
 
 lemma fmeasurable_Diff_D:
     assumes m: "T - S \<in> fmeasurable M" "S \<in> fmeasurable M" and sub: "S \<subseteq> T"
     shows "T \<in> fmeasurable M"
 proof -
   have "T = S \<union> (T - S)"
     using assms by blast
   then show ?thesis
     by (metis m fmeasurable.Un)
 qed
 
 lemma measure_Un2:
   "A \<in> fmeasurable M \<Longrightarrow> B \<in> fmeasurable M \<Longrightarrow> measure M (A \<union> B) = measure M A + measure M (B - A)"
   using measure_Union[of M A "B - A"] by (auto simp: fmeasurableD2 fmeasurable.Diff)
 
 lemma measure_Un3:
   assumes "A \<in> fmeasurable M" "B \<in> fmeasurable M"
   shows "measure M (A \<union> B) = measure M A + measure M B - measure M (A \<inter> B)"
 proof -
   have "measure M (A \<union> B) = measure M A + measure M (B - A)"
     using assms by (rule measure_Un2)
   also have "B - A = B - (A \<inter> B)"
     by auto
   also have "measure M (B - (A \<inter> B)) = measure M B - measure M (A \<inter> B)"
     using assms by (intro measure_Diff) (auto simp: fmeasurable_def)
   finally show ?thesis
     by simp
 qed
 
 lemma measure_Un_AE:
   "AE x in M. x \<notin> A \<or> x \<notin> B \<Longrightarrow> A \<in> fmeasurable M \<Longrightarrow> B \<in> fmeasurable M \<Longrightarrow>
   measure M (A \<union> B) = measure M A + measure M B"
   by (subst measure_Un2) (auto intro!: measure_eq_AE)
 
 lemma measure_UNION_AE:
   assumes I: "finite I"
   shows "(\<And>i. i \<in> I \<Longrightarrow> F i \<in> fmeasurable M) \<Longrightarrow> pairwise (\<lambda>i j. AE x in M. x \<notin> F i \<or> x \<notin> F j) I \<Longrightarrow>
     measure M (\<Union>i\<in>I. F i) = (\<Sum>i\<in>I. measure M (F i))"
   unfolding AE_pairwise[OF countable_finite, OF I]
   using I
 proof (induction I rule: finite_induct)
   case (insert x I)
   have "measure M (F x \<union> \<Union>(F ` I)) = measure M (F x) + measure M (\<Union>(F ` I))"
     by (rule measure_Un_AE) (use insert in \<open>auto simp: pairwise_insert\<close>)
     with insert show ?case
       by (simp add: pairwise_insert )
 qed simp
 
 lemma measure_UNION':
   "finite I \<Longrightarrow> (\<And>i. i \<in> I \<Longrightarrow> F i \<in> fmeasurable M) \<Longrightarrow> pairwise (\<lambda>i j. disjnt (F i) (F j)) I \<Longrightarrow>
     measure M (\<Union>i\<in>I. F i) = (\<Sum>i\<in>I. measure M (F i))"
   by (intro measure_UNION_AE) (auto simp: disjnt_def elim!: pairwise_mono intro!: always_eventually)
 
 lemma measure_Union_AE:
   "finite F \<Longrightarrow> (\<And>S. S \<in> F \<Longrightarrow> S \<in> fmeasurable M) \<Longrightarrow> pairwise (\<lambda>S T. AE x in M. x \<notin> S \<or> x \<notin> T) F \<Longrightarrow>
     measure M (\<Union>F) = (\<Sum>S\<in>F. measure M S)"
   using measure_UNION_AE[of F "\<lambda>x. x" M] by simp
 
 lemma measure_Union':
   "finite F \<Longrightarrow> (\<And>S. S \<in> F \<Longrightarrow> S \<in> fmeasurable M) \<Longrightarrow> pairwise disjnt F \<Longrightarrow> measure M (\<Union>F) = (\<Sum>S\<in>F. measure M S)"
   using measure_UNION'[of F "\<lambda>x. x" M] by simp
 
 lemma measure_Un_le:
   assumes "A \<in> sets M" "B \<in> sets M" shows "measure M (A \<union> B) \<le> measure M A + measure M B"
 proof cases
   assume "A \<in> fmeasurable M \<and> B \<in> fmeasurable M"
   with measure_subadditive[of A M B] assms show ?thesis
     by (auto simp: fmeasurableD2)
 next
   assume "\<not> (A \<in> fmeasurable M \<and> B \<in> fmeasurable M)"
   then have "A \<union> B \<notin> fmeasurable M"
     using fmeasurableI2[of "A \<union> B" M A] fmeasurableI2[of "A \<union> B" M B] assms by auto
   with assms show ?thesis
     by (auto simp: fmeasurable_def measure_def less_top[symmetric])
 qed
 
 lemma measure_UNION_le:
   "finite I \<Longrightarrow> (\<And>i. i \<in> I \<Longrightarrow> F i \<in> sets M) \<Longrightarrow> measure M (\<Union>i\<in>I. F i) \<le> (\<Sum>i\<in>I. measure M (F i))"
 proof (induction I rule: finite_induct)
   case (insert i I)
   then have "measure M (\<Union>i\<in>insert i I. F i) = measure M (F i \<union> \<Union> (F ` I))"
     by simp
   also from insert have "measure M (F i \<union> \<Union> (F ` I)) \<le> measure M (F i) + measure M (\<Union> (F ` I))"
     by (intro measure_Un_le sets.finite_Union) auto
   also have "measure M (\<Union>i\<in>I. F i) \<le> (\<Sum>i\<in>I. measure M (F i))"
     using insert by auto
   finally show ?case
     using insert by simp
 qed simp
 
 lemma measure_Union_le:
   "finite F \<Longrightarrow> (\<And>S. S \<in> F \<Longrightarrow> S \<in> sets M) \<Longrightarrow> measure M (\<Union>F) \<le> (\<Sum>S\<in>F. measure M S)"
   using measure_UNION_le[of F "\<lambda>x. x" M] by simp
 
 text\<open>Version for indexed union over a countable set\<close>
 lemma
   assumes "countable I" and I: "\<And>i. i \<in> I \<Longrightarrow> A i \<in> fmeasurable M"
     and bound: "\<And>I'. I' \<subseteq> I \<Longrightarrow> finite I' \<Longrightarrow> measure M (\<Union>i\<in>I'. A i) \<le> B"
   shows fmeasurable_UN_bound: "(\<Union>i\<in>I. A i) \<in> fmeasurable M" (is ?fm)
     and measure_UN_bound: "measure M (\<Union>i\<in>I. A i) \<le> B" (is ?m)
 proof -
   have "B \<ge> 0"
     using bound by force
   have "?fm \<and> ?m"
   proof cases
     assume "I = {}"
     with \<open>B \<ge> 0\<close> show ?thesis
       by simp
   next
     assume "I \<noteq> {}"
     have "(\<Union>i\<in>I. A i) = (\<Union>i. (\<Union>n\<le>i. A (from_nat_into I n)))"
       by (subst range_from_nat_into[symmetric, OF \<open>I \<noteq> {}\<close> \<open>countable I\<close>]) auto
     then have "emeasure M (\<Union>i\<in>I. A i) = emeasure M (\<Union>i. (\<Union>n\<le>i. A (from_nat_into I n)))" by simp
     also have "\<dots> = (SUP i. emeasure M (\<Union>n\<le>i. A (from_nat_into I n)))"
       using I \<open>I \<noteq> {}\<close>[THEN from_nat_into] by (intro SUP_emeasure_incseq[symmetric]) (fastforce simp: incseq_Suc_iff)+
     also have "\<dots> \<le> B"
     proof (intro SUP_least)
       fix i :: nat
       have "emeasure M (\<Union>n\<le>i. A (from_nat_into I n)) = measure M (\<Union>n\<le>i. A (from_nat_into I n))"
         using I \<open>I \<noteq> {}\<close>[THEN from_nat_into] by (intro emeasure_eq_measure2 fmeasurable.finite_UN) auto
       also have "\<dots> = measure M (\<Union>n\<in>from_nat_into I ` {..i}. A n)"
         by simp
       also have "\<dots> \<le> B"
         by (intro ennreal_leI bound) (auto intro:  from_nat_into[OF \<open>I \<noteq> {}\<close>])
       finally show "emeasure M (\<Union>n\<le>i. A (from_nat_into I n)) \<le> ennreal B" .
     qed
     finally have *: "emeasure M (\<Union>i\<in>I. A i) \<le> B" .
     then have ?fm
       using I \<open>countable I\<close> by (intro fmeasurableI conjI) (auto simp: less_top[symmetric] top_unique)
     with * \<open>0\<le>B\<close> show ?thesis
       by (simp add: emeasure_eq_measure2)
   qed
   then show ?fm ?m by auto
 qed
 
 text\<open>Version for big union of a countable set\<close>
 lemma
   assumes "countable \<D>"
     and meas: "\<And>D. D \<in> \<D> \<Longrightarrow> D \<in> fmeasurable M"
     and bound:  "\<And>\<E>. \<lbrakk>\<E> \<subseteq> \<D>; finite \<E>\<rbrakk> \<Longrightarrow> measure M (\<Union>\<E>) \<le> B"
  shows fmeasurable_Union_bound: "\<Union>\<D> \<in> fmeasurable M"  (is ?fm)
     and measure_Union_bound: "measure M (\<Union>\<D>) \<le> B"     (is ?m)
 proof -
   have "B \<ge> 0"
     using bound by force
   have "?fm \<and> ?m"
   proof (cases "\<D> = {}")
     case True
     with \<open>B \<ge> 0\<close> show ?thesis
       by auto
   next
     case False
     then obtain D :: "nat \<Rightarrow> 'a set" where D: "\<D> = range D"
       using \<open>countable \<D>\<close> uncountable_def by force
       have 1: "\<And>i. D i \<in> fmeasurable M"
         by (simp add: D meas)
       have 2: "\<And>I'. finite I' \<Longrightarrow> measure M (\<Union>x\<in>I'. D x) \<le> B"
         by (simp add: D bound image_subset_iff)
       show ?thesis
         unfolding D
         by (intro conjI fmeasurable_UN_bound [OF _ 1 2] measure_UN_bound [OF _ 1 2]) auto
     qed
     then show ?fm ?m by auto
 qed
 
 text\<open>Version for indexed union over the type of naturals\<close>
 lemma
   fixes S :: "nat \<Rightarrow> 'a set"
   assumes S: "\<And>i. S i \<in> fmeasurable M" and B: "\<And>n. measure M (\<Union>i\<le>n. S i) \<le> B"
   shows fmeasurable_countable_Union: "(\<Union>i. S i) \<in> fmeasurable M"
     and measure_countable_Union_le: "measure M (\<Union>i. S i) \<le> B"
 proof -
   have mB: "measure M (\<Union>i\<in>I. S i) \<le> B" if "finite I" for I
   proof -
     have "(\<Union>i\<in>I. S i) \<subseteq> (\<Union>i\<le>Max I. S i)"
       using Max_ge that by force
     then have "measure M (\<Union>i\<in>I. S i) \<le> measure M (\<Union>i \<le> Max I. S i)"
       by (rule measure_mono_fmeasurable) (use S in \<open>blast+\<close>)
     then show ?thesis
       using B order_trans by blast
   qed
   show "(\<Union>i. S i) \<in> fmeasurable M"
     by (auto intro: fmeasurable_UN_bound [OF _ S mB])
   show "measure M (\<Union>n. S n) \<le> B"
     by (auto intro: measure_UN_bound [OF _ S mB])
 qed
 
 lemma measure_diff_le_measure_setdiff:
   assumes "S \<in> fmeasurable M" "T \<in> fmeasurable M"
   shows "measure M S - measure M T \<le> measure M (S - T)"
 proof -
   have "measure M S \<le> measure M ((S - T) \<union> T)"
     by (simp add: assms fmeasurable.Un fmeasurableD measure_mono_fmeasurable)
   also have "\<dots> \<le> measure M (S - T) + measure M T"
     using assms by (blast intro: measure_Un_le)
   finally show ?thesis
     by (simp add: algebra_simps)
 qed
 
 lemma suminf_exist_split2:
   fixes f :: "nat \<Rightarrow> 'a::real_normed_vector"
   assumes "summable f"
   shows "(\<lambda>n. (\<Sum>k. f(k+n))) \<longlonglongrightarrow> 0"
 by (subst lim_sequentially, auto simp add: dist_norm suminf_exist_split[OF _ assms])
 
 lemma emeasure_union_summable:
   assumes [measurable]: "\<And>n. A n \<in> sets M"
     and "\<And>n. emeasure M (A n) < \<infinity>" "summable (\<lambda>n. measure M (A n))"
   shows "emeasure M (\<Union>n. A n) < \<infinity>" "emeasure M (\<Union>n. A n) \<le> (\<Sum>n. measure M (A n))"
 proof -
   define B where "B = (\<lambda>N. (\<Union>n\<in>{..<N}. A n))"
   have [measurable]: "B N \<in> sets M" for N unfolding B_def by auto
   have "(\<lambda>N. emeasure M (B N)) \<longlonglongrightarrow> emeasure M (\<Union>N. B N)"
     apply (rule Lim_emeasure_incseq) unfolding B_def by (auto simp add: SUP_subset_mono incseq_def)
   moreover have "emeasure M (B N) \<le> ennreal (\<Sum>n. measure M (A n))" for N
   proof -
     have *: "(\<Sum>n\<in>{..<N}. measure M (A n)) \<le> (\<Sum>n. measure M (A n))"
       using assms(3) measure_nonneg sum_le_suminf by blast
 
     have "emeasure M (B N) \<le> (\<Sum>n\<in>{..<N}. emeasure M (A n))"
       unfolding B_def by (rule emeasure_subadditive_finite, auto)
     also have "... = (\<Sum>n\<in>{..<N}. ennreal(measure M (A n)))"
       using assms(2) by (simp add: emeasure_eq_ennreal_measure less_top)
     also have "... = ennreal (\<Sum>n\<in>{..<N}. measure M (A n))"
       by auto
     also have "... \<le> ennreal (\<Sum>n. measure M (A n))"
       using * by (auto simp: ennreal_leI)
     finally show ?thesis by simp
   qed
   ultimately have "emeasure M (\<Union>N. B N) \<le> ennreal (\<Sum>n. measure M (A n))"
     by (simp add: Lim_bounded)
   then show "emeasure M (\<Union>n. A n) \<le> (\<Sum>n. measure M (A n))"
     unfolding B_def by (metis UN_UN_flatten UN_lessThan_UNIV)
   then show "emeasure M (\<Union>n. A n) < \<infinity>"
     by (auto simp: less_top[symmetric] top_unique)
 qed
 
 lemma borel_cantelli_limsup1:
   assumes [measurable]: "\<And>n. A n \<in> sets M"
     and "\<And>n. emeasure M (A n) < \<infinity>" "summable (\<lambda>n. measure M (A n))"
   shows "limsup A \<in> null_sets M"
 proof -
   have "emeasure M (limsup A) \<le> 0"
   proof (rule LIMSEQ_le_const)
     have "(\<lambda>n. (\<Sum>k. measure M (A (k+n)))) \<longlonglongrightarrow> 0" by (rule suminf_exist_split2[OF assms(3)])
     then show "(\<lambda>n. ennreal (\<Sum>k. measure M (A (k+n)))) \<longlonglongrightarrow> 0"
       unfolding ennreal_0[symmetric] by (intro tendsto_ennrealI)
     have "emeasure M (limsup A) \<le> (\<Sum>k. measure M (A (k+n)))" for n
     proof -
       have I: "(\<Union>k\<in>{n..}. A k) = (\<Union>k. A (k+n))" by (auto, metis le_add_diff_inverse2, fastforce)
       have "emeasure M (limsup A) \<le> emeasure M (\<Union>k\<in>{n..}. A k)"
         by (rule emeasure_mono, auto simp add: limsup_INF_SUP)
       also have "... = emeasure M (\<Union>k. A (k+n))"
         using I by auto
       also have "... \<le> (\<Sum>k. measure M (A (k+n)))"
         apply (rule emeasure_union_summable)
         using assms summable_ignore_initial_segment[OF assms(3), of n] by auto
       finally show ?thesis by simp
     qed
     then show "\<exists>N. \<forall>n\<ge>N. emeasure M (limsup A) \<le> (\<Sum>k. measure M (A (k+n)))"
       by auto
   qed
   then show ?thesis using assms(1) measurable_limsup by auto
 qed
 
 lemma borel_cantelli_AE1:
   assumes [measurable]: "\<And>n. A n \<in> sets M"
     and "\<And>n. emeasure M (A n) < \<infinity>" "summable (\<lambda>n. measure M (A n))"
   shows "AE x in M. eventually (\<lambda>n. x \<in> space M - A n) sequentially"
 proof -
   have "AE x in M. x \<notin> limsup A"
     using borel_cantelli_limsup1[OF assms] unfolding eventually_ae_filter by auto
   moreover
   {
     fix x assume "x \<notin> limsup A"
     then obtain N where "x \<notin> (\<Union>n\<in>{N..}. A n)" unfolding limsup_INF_SUP by blast
     then have "eventually (\<lambda>n. x \<notin> A n) sequentially" using eventually_sequentially by auto
   }
   ultimately show ?thesis by auto
 qed
 
 subsection \<open>Measure spaces with \<^term>\<open>emeasure M (space M) < \<infinity>\<close>\<close>
 
 locale\<^marker>\<open>tag important\<close> finite_measure = sigma_finite_measure M for M +
   assumes finite_emeasure_space: "emeasure M (space M) \<noteq> top"
 
 lemma finite_measureI[Pure.intro!]:
   "emeasure M (space M) \<noteq> \<infinity> \<Longrightarrow> finite_measure M"
   proof qed (auto intro!: exI[of _ "{space M}"])
 
 lemma (in finite_measure) emeasure_finite[simp, intro]: "emeasure M A \<noteq> top"
   using finite_emeasure_space emeasure_space[of M A] by (auto simp: top_unique)
 
 lemma (in finite_measure) fmeasurable_eq_sets: "fmeasurable M = sets M"
   by (auto simp: fmeasurable_def less_top[symmetric])
 
 lemma (in finite_measure) emeasure_eq_measure: "emeasure M A = ennreal (measure M A)"
   by (intro emeasure_eq_ennreal_measure) simp
 
 lemma (in finite_measure) emeasure_real: "\<exists>r. 0 \<le> r \<and> emeasure M A = ennreal r"
   using emeasure_finite[of A] by (cases "emeasure M A" rule: ennreal_cases) auto
 
 lemma (in finite_measure) bounded_measure: "measure M A \<le> measure M (space M)"
   using emeasure_space[of M A] emeasure_real[of A] emeasure_real[of "space M"] by (auto simp: measure_def)
 
 lemma (in finite_measure) finite_measure_Diff:
   assumes sets: "A \<in> sets M" "B \<in> sets M" and "B \<subseteq> A"
   shows "measure M (A - B) = measure M A - measure M B"
   using measure_Diff[OF _ assms] by simp
 
 lemma (in finite_measure) finite_measure_Union:
   assumes sets: "A \<in> sets M" "B \<in> sets M" and "A \<inter> B = {}"
   shows "measure M (A \<union> B) = measure M A + measure M B"
   using measure_Union[OF _ _ assms] by simp
 
 lemma (in finite_measure) finite_measure_finite_Union:
   assumes measurable: "finite S" "A`S \<subseteq> sets M" "disjoint_family_on A S"
   shows "measure M (\<Union>i\<in>S. A i) = (\<Sum>i\<in>S. measure M (A i))"
   using measure_finite_Union[OF assms] by simp
 
 lemma (in finite_measure) finite_measure_UNION:
   assumes A: "range A \<subseteq> sets M" "disjoint_family A"
   shows "(\<lambda>i. measure M (A i)) sums (measure M (\<Union>i. A i))"
   using measure_UNION[OF A] by simp
 
 lemma (in finite_measure) finite_measure_mono:
   assumes "A \<subseteq> B" "B \<in> sets M" shows "measure M A \<le> measure M B"
   using emeasure_mono[OF assms] emeasure_real[of A] emeasure_real[of B] by (auto simp: measure_def)
 
 lemma (in finite_measure) finite_measure_subadditive:
   assumes m: "A \<in> sets M" "B \<in> sets M"
   shows "measure M (A \<union> B) \<le> measure M A + measure M B"
   using measure_subadditive[OF m] by simp
 
 lemma (in finite_measure) finite_measure_subadditive_finite:
   assumes "finite I" "A`I \<subseteq> sets M" shows "measure M (\<Union>i\<in>I. A i) \<le> (\<Sum>i\<in>I. measure M (A i))"
   using measure_subadditive_finite[OF assms] by simp
 
 lemma (in finite_measure) finite_measure_subadditive_countably:
   "range A \<subseteq> sets M \<Longrightarrow> summable (\<lambda>i. measure M (A i)) \<Longrightarrow> measure M (\<Union>i. A i) \<le> (\<Sum>i. measure M (A i))"
   by (rule measure_subadditive_countably)
      (simp_all add: ennreal_suminf_neq_top emeasure_eq_measure)
 
 lemma (in finite_measure) finite_measure_eq_sum_singleton:
   assumes "finite S" and *: "\<And>x. x \<in> S \<Longrightarrow> {x} \<in> sets M"
   shows "measure M S = (\<Sum>x\<in>S. measure M {x})"
   using measure_eq_sum_singleton[OF assms] by simp
 
 lemma (in finite_measure) finite_Lim_measure_incseq:
   assumes A: "range A \<subseteq> sets M" "incseq A"
   shows "(\<lambda>i. measure M (A i)) \<longlonglongrightarrow> measure M (\<Union>i. A i)"
   using Lim_measure_incseq[OF A] by simp
 
 lemma (in finite_measure) finite_Lim_measure_decseq:
   assumes A: "range A \<subseteq> sets M" "decseq A"
   shows "(\<lambda>n. measure M (A n)) \<longlonglongrightarrow> measure M (\<Inter>i. A i)"
   using Lim_measure_decseq[OF A] by simp
 
 lemma (in finite_measure) finite_measure_compl:
   assumes S: "S \<in> sets M"
   shows "measure M (space M - S) = measure M (space M) - measure M S"
   using measure_Diff[OF _ sets.top S sets.sets_into_space] S by simp
 
 lemma (in finite_measure) finite_measure_mono_AE:
   assumes imp: "AE x in M. x \<in> A \<longrightarrow> x \<in> B" and B: "B \<in> sets M"
   shows "measure M A \<le> measure M B"
   using assms emeasure_mono_AE[OF imp B]
   by (simp add: emeasure_eq_measure)
 
 lemma (in finite_measure) finite_measure_eq_AE:
   assumes iff: "AE x in M. x \<in> A \<longleftrightarrow> x \<in> B"
   assumes A: "A \<in> sets M" and B: "B \<in> sets M"
   shows "measure M A = measure M B"
   using assms emeasure_eq_AE[OF assms] by (simp add: emeasure_eq_measure)
 
 lemma (in finite_measure) measure_increasing: "increasing M (measure M)"
   by (auto intro!: finite_measure_mono simp: increasing_def)
 
 lemma (in finite_measure) measure_zero_union:
   assumes "s \<in> sets M" "t \<in> sets M" "measure M t = 0"
   shows "measure M (s \<union> t) = measure M s"
 using assms
 proof -
   have "measure M (s \<union> t) \<le> measure M s"
     using finite_measure_subadditive[of s t] assms by auto
   moreover have "measure M (s \<union> t) \<ge> measure M s"
     using assms by (blast intro: finite_measure_mono)
   ultimately show ?thesis by simp
 qed
 
 lemma (in finite_measure) measure_eq_compl:
   assumes "s \<in> sets M" "t \<in> sets M"
   assumes "measure M (space M - s) = measure M (space M - t)"
   shows "measure M s = measure M t"
   using assms finite_measure_compl by auto
 
 lemma (in finite_measure) measure_eq_bigunion_image:
   assumes "range f \<subseteq> sets M" "range g \<subseteq> sets M"
   assumes "disjoint_family f" "disjoint_family g"
   assumes "\<And> n :: nat. measure M (f n) = measure M (g n)"
   shows "measure M (\<Union>i. f i) = measure M (\<Union>i. g i)"
 using assms
 proof -
   have a: "(\<lambda> i. measure M (f i)) sums (measure M (\<Union>i. f i))"
     by (rule finite_measure_UNION[OF assms(1,3)])
   have b: "(\<lambda> i. measure M (g i)) sums (measure M (\<Union>i. g i))"
     by (rule finite_measure_UNION[OF assms(2,4)])
   show ?thesis using sums_unique[OF b] sums_unique[OF a] assms by simp
 qed
 
 lemma (in finite_measure) measure_countably_zero:
   assumes "range c \<subseteq> sets M"
   assumes "\<And> i. measure M (c i) = 0"
   shows "measure M (\<Union>i :: nat. c i) = 0"
 proof (rule antisym)
   show "measure M (\<Union>i :: nat. c i) \<le> 0"
     using finite_measure_subadditive_countably[OF assms(1)] by (simp add: assms(2))
 qed simp
 
 lemma (in finite_measure) measure_space_inter:
   assumes events:"s \<in> sets M" "t \<in> sets M"
   assumes "measure M t = measure M (space M)"
   shows "measure M (s \<inter> t) = measure M s"
 proof -
   have "measure M ((space M - s) \<union> (space M - t)) = measure M (space M - s)"
     using events assms finite_measure_compl[of "t"] by (auto intro!: measure_zero_union)
   also have "(space M - s) \<union> (space M - t) = space M - (s \<inter> t)"
     by blast
   finally show "measure M (s \<inter> t) = measure M s"
     using events by (auto intro!: measure_eq_compl[of "s \<inter> t" s])
 qed
 
 lemma (in finite_measure) measure_equiprobable_finite_unions:
   assumes s: "finite s" "\<And>x. x \<in> s \<Longrightarrow> {x} \<in> sets M"
   assumes "\<And> x y. \<lbrakk>x \<in> s; y \<in> s\<rbrakk> \<Longrightarrow> measure M {x} = measure M {y}"
   shows "measure M s = real (card s) * measure M {SOME x. x \<in> s}"
 proof cases
   assume "s \<noteq> {}"
   then have "\<exists> x. x \<in> s" by blast
   from someI_ex[OF this] assms
   have prob_some: "\<And> x. x \<in> s \<Longrightarrow> measure M {x} = measure M {SOME y. y \<in> s}" by blast
   have "measure M s = (\<Sum> x \<in> s. measure M {x})"
     using finite_measure_eq_sum_singleton[OF s] by simp
   also have "\<dots> = (\<Sum> x \<in> s. measure M {SOME y. y \<in> s})" using prob_some by auto
   also have "\<dots> = real (card s) * measure M {(SOME x. x \<in> s)}"
     using sum_constant assms by simp
   finally show ?thesis by simp
 qed simp
 
 lemma (in finite_measure) measure_real_sum_image_fn:
   assumes "e \<in> sets M"
   assumes "\<And> x. x \<in> s \<Longrightarrow> e \<inter> f x \<in> sets M"
   assumes "finite s"
   assumes disjoint: "\<And> x y. \<lbrakk>x \<in> s ; y \<in> s ; x \<noteq> y\<rbrakk> \<Longrightarrow> f x \<inter> f y = {}"
   assumes upper: "space M \<subseteq> (\<Union>i \<in> s. f i)"
   shows "measure M e = (\<Sum> x \<in> s. measure M (e \<inter> f x))"
 proof -
   have "e \<subseteq> (\<Union>i\<in>s. f i)"
     using \<open>e \<in> sets M\<close> sets.sets_into_space upper by blast
   then have e: "e = (\<Union>i \<in> s. e \<inter> f i)"
     by auto
   hence "measure M e = measure M (\<Union>i \<in> s. e \<inter> f i)" by simp
   also have "\<dots> = (\<Sum> x \<in> s. measure M (e \<inter> f x))"
   proof (rule finite_measure_finite_Union)
     show "finite s" by fact
     show "(\<lambda>i. e \<inter> f i)`s \<subseteq> sets M" using assms(2) by auto
     show "disjoint_family_on (\<lambda>i. e \<inter> f i) s"
       using disjoint by (auto simp: disjoint_family_on_def)
   qed
   finally show ?thesis .
 qed
 
 lemma (in finite_measure) measure_exclude:
   assumes "A \<in> sets M" "B \<in> sets M"
   assumes "measure M A = measure M (space M)" "A \<inter> B = {}"
   shows "measure M B = 0"
   using measure_space_inter[of B A] assms by (auto simp: ac_simps)
 lemma (in finite_measure) finite_measure_distr:
   assumes f: "f \<in> measurable M M'"
   shows "finite_measure (distr M M' f)"
 proof (rule finite_measureI)
   have "f -` space M' \<inter> space M = space M" using f by (auto dest: measurable_space)
   with f show "emeasure (distr M M' f) (space (distr M M' f)) \<noteq> \<infinity>" by (auto simp: emeasure_distr)
 qed
 
 lemma emeasure_gfp[consumes 1, case_names cont measurable]:
   assumes sets[simp]: "\<And>s. sets (M s) = sets N"
   assumes "\<And>s. finite_measure (M s)"
   assumes cont: "inf_continuous F" "inf_continuous f"
   assumes meas: "\<And>P. Measurable.pred N P \<Longrightarrow> Measurable.pred N (F P)"
   assumes iter: "\<And>P s. Measurable.pred N P \<Longrightarrow> emeasure (M s) {x\<in>space N. F P x} = f (\<lambda>s. emeasure (M s) {x\<in>space N. P x}) s"
   assumes bound: "\<And>P. f P \<le> f (\<lambda>s. emeasure (M s) (space (M s)))"
   shows "emeasure (M s) {x\<in>space N. gfp F x} = gfp f s"
 proof (subst gfp_transfer_bounded[where \<alpha>="\<lambda>F s. emeasure (M s) {x\<in>space N. F x}" and g=f and f=F and
     P="Measurable.pred N", symmetric])
   interpret finite_measure "M s" for s by fact
   fix C assume "decseq C" "\<And>i. Measurable.pred N (C i)"
   then show "(\<lambda>s. emeasure (M s) {x \<in> space N. (INF i. C i) x}) = (INF i. (\<lambda>s. emeasure (M s) {x \<in> space N. C i x}))"
     unfolding INF_apply[abs_def]
     by (subst INF_emeasure_decseq) (auto simp: antimono_def fun_eq_iff intro!: arg_cong2[where f=emeasure])
 next
   show "f x \<le> (\<lambda>s. emeasure (M s) {x \<in> space N. F top x})" for x
     using bound[of x] sets_eq_imp_space_eq[OF sets] by (simp add: iter)
 qed (auto simp add: iter le_fun_def INF_apply[abs_def] intro!: meas cont)
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Counting space\<close>
 
 lemma strict_monoI_Suc:
   assumes ord [simp]: "(\<And>n. f n < f (Suc n))" shows "strict_mono f"
   unfolding strict_mono_def
 proof safe
   fix n m :: nat assume "n < m" then show "f n < f m"
     by (induct m) (auto simp: less_Suc_eq intro: less_trans ord)
 qed
 
 lemma emeasure_count_space:
   assumes "X \<subseteq> A" shows "emeasure (count_space A) X = (if finite X then of_nat (card X) else \<infinity>)"
     (is "_ = ?M X")
   unfolding count_space_def
 proof (rule emeasure_measure_of_sigma)
   show "X \<in> Pow A" using \<open>X \<subseteq> A\<close> by auto
   show "sigma_algebra A (Pow A)" by (rule sigma_algebra_Pow)
   show positive: "positive (Pow A) ?M"
     by (auto simp: positive_def)
   have additive: "additive (Pow A) ?M"
     by (auto simp: card_Un_disjoint additive_def)
 
   interpret ring_of_sets A "Pow A"
     by (rule ring_of_setsI) auto
   show "countably_additive (Pow A) ?M"
     unfolding countably_additive_iff_continuous_from_below[OF positive additive]
   proof safe
     fix F :: "nat \<Rightarrow> 'a set" assume "incseq F"
     show "(\<lambda>i. ?M (F i)) \<longlonglongrightarrow> ?M (\<Union>i. F i)"
     proof cases
       assume "\<exists>i. \<forall>j\<ge>i. F i = F j"
       then guess i .. note i = this
       { fix j from i \<open>incseq F\<close> have "F j \<subseteq> F i"
           by (cases "i \<le> j") (auto simp: incseq_def) }
       then have eq: "(\<Union>i. F i) = F i"
         by auto
       with i show ?thesis
         by (auto intro!: Lim_transform_eventually[OF tendsto_const] eventually_sequentiallyI[where c=i])
     next
       assume "\<not> (\<exists>i. \<forall>j\<ge>i. F i = F j)"
       then obtain f where f: "\<And>i. i \<le> f i" "\<And>i. F i \<noteq> F (f i)" by metis
       then have "\<And>i. F i \<subseteq> F (f i)" using \<open>incseq F\<close> by (auto simp: incseq_def)
       with f have *: "\<And>i. F i \<subset> F (f i)" by auto
 
       have "incseq (\<lambda>i. ?M (F i))"
         using \<open>incseq F\<close> unfolding incseq_def by (auto simp: card_mono dest: finite_subset)
       then have "(\<lambda>i. ?M (F i)) \<longlonglongrightarrow> (SUP n. ?M (F n))"
         by (rule LIMSEQ_SUP)
 
       moreover have "(SUP n. ?M (F n)) = top"
       proof (rule ennreal_SUP_eq_top)
         fix n :: nat show "\<exists>k::nat\<in>UNIV. of_nat n \<le> ?M (F k)"
         proof (induct n)
           case (Suc n)
           then guess k .. note k = this
           moreover have "finite (F k) \<Longrightarrow> finite (F (f k)) \<Longrightarrow> card (F k) < card (F (f k))"
             using \<open>F k \<subset> F (f k)\<close> by (simp add: psubset_card_mono)
           moreover have "finite (F (f k)) \<Longrightarrow> finite (F k)"
             using \<open>k \<le> f k\<close> \<open>incseq F\<close> by (auto simp: incseq_def dest: finite_subset)
           ultimately show ?case
             by (auto intro!: exI[of _ "f k"] simp del: of_nat_Suc)
         qed auto
       qed
 
       moreover
       have "inj (\<lambda>n. F ((f ^^ n) 0))"
         by (intro strict_mono_imp_inj_on strict_monoI_Suc) (simp add: *)
       then have 1: "infinite (range (\<lambda>i. F ((f ^^ i) 0)))"
         by (rule range_inj_infinite)
       have "infinite (Pow (\<Union>i. F i))"
         by (rule infinite_super[OF _ 1]) auto
       then have "infinite (\<Union>i. F i)"
         by auto
       ultimately show ?thesis by (simp only:) simp
          
     qed
   qed
 qed
 
 lemma distr_bij_count_space:
   assumes f: "bij_betw f A B"
   shows "distr (count_space A) (count_space B) f = count_space B"
 proof (rule measure_eqI)
   have f': "f \<in> measurable (count_space A) (count_space B)"
     using f unfolding Pi_def bij_betw_def by auto
   fix X assume "X \<in> sets (distr (count_space A) (count_space B) f)"
   then have X: "X \<in> sets (count_space B)" by auto
   moreover from X have "f -` X \<inter> A = the_inv_into A f ` X"
     using f by (auto simp: bij_betw_def subset_image_iff image_iff the_inv_into_f_f intro: the_inv_into_f_f[symmetric])
   moreover have "inj_on (the_inv_into A f) B"
     using X f by (auto simp: bij_betw_def inj_on_the_inv_into)
   with X have "inj_on (the_inv_into A f) X"
     by (auto intro: subset_inj_on)
   ultimately show "emeasure (distr (count_space A) (count_space B) f) X = emeasure (count_space B) X"
     using f unfolding emeasure_distr[OF f' X]
     by (subst (1 2) emeasure_count_space) (auto simp: card_image dest: finite_imageD)
 qed simp
 
 lemma emeasure_count_space_finite[simp]:
   "X \<subseteq> A \<Longrightarrow> finite X \<Longrightarrow> emeasure (count_space A) X = of_nat (card X)"
   using emeasure_count_space[of X A] by simp
 
 lemma emeasure_count_space_infinite[simp]:
   "X \<subseteq> A \<Longrightarrow> infinite X \<Longrightarrow> emeasure (count_space A) X = \<infinity>"
   using emeasure_count_space[of X A] by simp
 
 lemma measure_count_space: "measure (count_space A) X = (if X \<subseteq> A then of_nat (card X) else 0)"
   by (cases "finite X") (auto simp: measure_notin_sets ennreal_of_nat_eq_real_of_nat
                                     measure_zero_top measure_eq_emeasure_eq_ennreal)
 
 lemma emeasure_count_space_eq_0:
   "emeasure (count_space A) X = 0 \<longleftrightarrow> (X \<subseteq> A \<longrightarrow> X = {})"
 proof cases
   assume X: "X \<subseteq> A"
   then show ?thesis
   proof (intro iffI impI)
     assume "emeasure (count_space A) X = 0"
     with X show "X = {}"
       by (subst (asm) emeasure_count_space) (auto split: if_split_asm)
   qed simp
 qed (simp add: emeasure_notin_sets)
 
 lemma null_sets_count_space: "null_sets (count_space A) = { {} }"
   unfolding null_sets_def by (auto simp add: emeasure_count_space_eq_0)
 
 lemma AE_count_space: "(AE x in count_space A. P x) \<longleftrightarrow> (\<forall>x\<in>A. P x)"
   unfolding eventually_ae_filter by (auto simp add: null_sets_count_space)
 
 lemma sigma_finite_measure_count_space_countable:
   assumes A: "countable A"
   shows "sigma_finite_measure (count_space A)"
   proof qed (insert A, auto intro!: exI[of _ "(\<lambda>a. {a}) ` A"])
 
 lemma sigma_finite_measure_count_space:
   fixes A :: "'a::countable set" shows "sigma_finite_measure (count_space A)"
   by (rule sigma_finite_measure_count_space_countable) auto
 
 lemma finite_measure_count_space:
   assumes [simp]: "finite A"
   shows "finite_measure (count_space A)"
   by rule simp
 
 lemma sigma_finite_measure_count_space_finite:
   assumes A: "finite A" shows "sigma_finite_measure (count_space A)"
 proof -
   interpret finite_measure "count_space A" using A by (rule finite_measure_count_space)
   show "sigma_finite_measure (count_space A)" ..
 qed
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Measure restricted to space\<close>
 
 lemma emeasure_restrict_space:
   assumes "\<Omega> \<inter> space M \<in> sets M" "A \<subseteq> \<Omega>"
   shows "emeasure (restrict_space M \<Omega>) A = emeasure M A"
 proof (cases "A \<in> sets M")
   case True
   show ?thesis
   proof (rule emeasure_measure_of[OF restrict_space_def])
     show "(\<inter>) \<Omega> ` sets M \<subseteq> Pow (\<Omega> \<inter> space M)" "A \<in> sets (restrict_space M \<Omega>)"
       using \<open>A \<subseteq> \<Omega>\<close> \<open>A \<in> sets M\<close> sets.space_closed by (auto simp: sets_restrict_space)
     show "positive (sets (restrict_space M \<Omega>)) (emeasure M)"
       by (auto simp: positive_def)
     show "countably_additive (sets (restrict_space M \<Omega>)) (emeasure M)"
     proof (rule countably_additiveI)
       fix A :: "nat \<Rightarrow> _" assume "range A \<subseteq> sets (restrict_space M \<Omega>)" "disjoint_family A"
       with assms have "\<And>i. A i \<in> sets M" "\<And>i. A i \<subseteq> space M" "disjoint_family A"
         by (fastforce simp: sets_restrict_space_iff[OF assms(1)] image_subset_iff
                       dest: sets.sets_into_space)+
       then show "(\<Sum>i. emeasure M (A i)) = emeasure M (\<Union>i. A i)"
         by (subst suminf_emeasure) (auto simp: disjoint_family_subset)
     qed
   qed
 next
   case False
   with assms have "A \<notin> sets (restrict_space M \<Omega>)"
     by (simp add: sets_restrict_space_iff)
   with False show ?thesis
     by (simp add: emeasure_notin_sets)
 qed
 
 lemma measure_restrict_space:
   assumes "\<Omega> \<inter> space M \<in> sets M" "A \<subseteq> \<Omega>"
   shows "measure (restrict_space M \<Omega>) A = measure M A"
   using emeasure_restrict_space[OF assms] by (simp add: measure_def)
 
 lemma AE_restrict_space_iff:
   assumes "\<Omega> \<inter> space M \<in> sets M"
   shows "(AE x in restrict_space M \<Omega>. P x) \<longleftrightarrow> (AE x in M. x \<in> \<Omega> \<longrightarrow> P x)"
 proof -
   have ex_cong: "\<And>P Q f. (\<And>x. P x \<Longrightarrow> Q x) \<Longrightarrow> (\<And>x. Q x \<Longrightarrow> P (f x)) \<Longrightarrow> (\<exists>x. P x) \<longleftrightarrow> (\<exists>x. Q x)"
     by auto
   { fix X assume X: "X \<in> sets M" "emeasure M X = 0"
     then have "emeasure M (\<Omega> \<inter> space M \<inter> X) \<le> emeasure M X"
       by (intro emeasure_mono) auto
     then have "emeasure M (\<Omega> \<inter> space M \<inter> X) = 0"
       using X by (auto intro!: antisym) }
   with assms show ?thesis
     unfolding eventually_ae_filter
     by (auto simp add: space_restrict_space null_sets_def sets_restrict_space_iff
                        emeasure_restrict_space cong: conj_cong
              intro!: ex_cong[where f="\<lambda>X. (\<Omega> \<inter> space M) \<inter> X"])
 qed
 
 lemma restrict_restrict_space:
   assumes "A \<inter> space M \<in> sets M" "B \<inter> space M \<in> sets M"
   shows "restrict_space (restrict_space M A) B = restrict_space M (A \<inter> B)" (is "?l = ?r")
 proof (rule measure_eqI[symmetric])
   show "sets ?r = sets ?l"
     unfolding sets_restrict_space image_comp by (intro image_cong) auto
 next
   fix X assume "X \<in> sets (restrict_space M (A \<inter> B))"
   then obtain Y where "Y \<in> sets M" "X = Y \<inter> A \<inter> B"
     by (auto simp: sets_restrict_space)
   with assms sets.Int[OF assms] show "emeasure ?r X = emeasure ?l X"
     by (subst (1 2) emeasure_restrict_space)
        (auto simp: space_restrict_space sets_restrict_space_iff emeasure_restrict_space ac_simps)
 qed
 
 lemma restrict_count_space: "restrict_space (count_space B) A = count_space (A \<inter> B)"
 proof (rule measure_eqI)
   show "sets (restrict_space (count_space B) A) = sets (count_space (A \<inter> B))"
     by (subst sets_restrict_space) auto
   moreover fix X assume "X \<in> sets (restrict_space (count_space B) A)"
   ultimately have "X \<subseteq> A \<inter> B" by auto
   then show "emeasure (restrict_space (count_space B) A) X = emeasure (count_space (A \<inter> B)) X"
     by (cases "finite X") (auto simp add: emeasure_restrict_space)
 qed
 
 lemma sigma_finite_measure_restrict_space:
   assumes "sigma_finite_measure M"
   and A: "A \<in> sets M"
   shows "sigma_finite_measure (restrict_space M A)"
 proof -
   interpret sigma_finite_measure M by fact
   from sigma_finite_countable obtain C
     where C: "countable C" "C \<subseteq> sets M" "(\<Union>C) = space M" "\<forall>a\<in>C. emeasure M a \<noteq> \<infinity>"
     by blast
   let ?C = "(\<inter>) A ` C"
   from C have "countable ?C" "?C \<subseteq> sets (restrict_space M A)" "(\<Union>?C) = space (restrict_space M A)"
     by(auto simp add: sets_restrict_space space_restrict_space)
   moreover {
     fix a
     assume "a \<in> ?C"
     then obtain a' where "a = A \<inter> a'" "a' \<in> C" ..
     then have "emeasure (restrict_space M A) a \<le> emeasure M a'"
       using A C by(auto simp add: emeasure_restrict_space intro: emeasure_mono)
     also have "\<dots> < \<infinity>" using C(4)[rule_format, of a'] \<open>a' \<in> C\<close> by (simp add: less_top)
     finally have "emeasure (restrict_space M A) a \<noteq> \<infinity>" by simp }
   ultimately show ?thesis
     by unfold_locales (rule exI conjI|assumption|blast)+
 qed
 
 lemma finite_measure_restrict_space:
   assumes "finite_measure M"
   and A: "A \<in> sets M"
   shows "finite_measure (restrict_space M A)"
 proof -
   interpret finite_measure M by fact
   show ?thesis
     by(rule finite_measureI)(simp add: emeasure_restrict_space A space_restrict_space)
 qed
 
 lemma restrict_distr:
   assumes [measurable]: "f \<in> measurable M N"
   assumes [simp]: "\<Omega> \<inter> space N \<in> sets N" and restrict: "f \<in> space M \<rightarrow> \<Omega>"
   shows "restrict_space (distr M N f) \<Omega> = distr M (restrict_space N \<Omega>) f"
   (is "?l = ?r")
 proof (rule measure_eqI)
   fix A assume "A \<in> sets (restrict_space (distr M N f) \<Omega>)"
   with restrict show "emeasure ?l A = emeasure ?r A"
     by (subst emeasure_distr)
        (auto simp: sets_restrict_space_iff emeasure_restrict_space emeasure_distr
              intro!: measurable_restrict_space2)
 qed (simp add: sets_restrict_space)
 
 lemma measure_eqI_restrict_generator:
   assumes E: "Int_stable E" "E \<subseteq> Pow \<Omega>" "\<And>X. X \<in> E \<Longrightarrow> emeasure M X = emeasure N X"
   assumes sets_eq: "sets M = sets N" and \<Omega>: "\<Omega> \<in> sets M"
   assumes "sets (restrict_space M \<Omega>) = sigma_sets \<Omega> E"
   assumes "sets (restrict_space N \<Omega>) = sigma_sets \<Omega> E"
   assumes ae: "AE x in M. x \<in> \<Omega>" "AE x in N. x \<in> \<Omega>"
   assumes A: "countable A" "A \<noteq> {}" "A \<subseteq> E" "\<Union>A = \<Omega>" "\<And>a. a \<in> A \<Longrightarrow> emeasure M a \<noteq> \<infinity>"
   shows "M = N"
 proof (rule measure_eqI)
   fix X assume X: "X \<in> sets M"
   then have "emeasure M X = emeasure (restrict_space M \<Omega>) (X \<inter> \<Omega>)"
     using ae \<Omega> by (auto simp add: emeasure_restrict_space intro!: emeasure_eq_AE)
   also have "restrict_space M \<Omega> = restrict_space N \<Omega>"
   proof (rule measure_eqI_generator_eq)
     fix X assume "X \<in> E"
     then show "emeasure (restrict_space M \<Omega>) X = emeasure (restrict_space N \<Omega>) X"
       using E \<Omega> by (subst (1 2) emeasure_restrict_space) (auto simp: sets_eq sets_eq[THEN sets_eq_imp_space_eq])
   next
     show "range (from_nat_into A) \<subseteq> E" "(\<Union>i. from_nat_into A i) = \<Omega>"
       using A by (auto cong del: SUP_cong_simp)
   next
     fix i
     have "emeasure (restrict_space M \<Omega>) (from_nat_into A i) = emeasure M (from_nat_into A i)"
       using A \<Omega> by (subst emeasure_restrict_space)
                    (auto simp: sets_eq sets_eq[THEN sets_eq_imp_space_eq] intro: from_nat_into)
     with A show "emeasure (restrict_space M \<Omega>) (from_nat_into A i) \<noteq> \<infinity>"
       by (auto intro: from_nat_into)
   qed fact+
   also have "emeasure (restrict_space N \<Omega>) (X \<inter> \<Omega>) = emeasure N X"
     using X ae \<Omega> by (auto simp add: emeasure_restrict_space sets_eq intro!: emeasure_eq_AE)
   finally show "emeasure M X = emeasure N X" .
 qed fact
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Null measure\<close>
 
 definition null_measure :: "'a measure \<Rightarrow> 'a measure" where
 "null_measure M = sigma (space M) (sets M)"
 
 lemma space_null_measure[simp]: "space (null_measure M) = space M"
   by (simp add: null_measure_def)
 
 lemma sets_null_measure[simp, measurable_cong]: "sets (null_measure M) = sets M"
   by (simp add: null_measure_def)
 
 lemma emeasure_null_measure[simp]: "emeasure (null_measure M) X = 0"
   by (cases "X \<in> sets M", rule emeasure_measure_of)
      (auto simp: positive_def countably_additive_def emeasure_notin_sets null_measure_def
            dest: sets.sets_into_space)
 
 lemma measure_null_measure[simp]: "measure (null_measure M) X = 0"
   by (intro measure_eq_emeasure_eq_ennreal) auto
 
 lemma null_measure_idem [simp]: "null_measure (null_measure M) = null_measure M"
   by(rule measure_eqI) simp_all
 
 subsection \<open>Scaling a measure\<close>
 
 definition\<^marker>\<open>tag important\<close> scale_measure :: "ennreal \<Rightarrow> 'a measure \<Rightarrow> 'a measure" where
 "scale_measure r M = measure_of (space M) (sets M) (\<lambda>A. r * emeasure M A)"
 
 lemma space_scale_measure: "space (scale_measure r M) = space M"
   by (simp add: scale_measure_def)
 
 lemma sets_scale_measure [simp, measurable_cong]: "sets (scale_measure r M) = sets M"
   by (simp add: scale_measure_def)
 
 lemma emeasure_scale_measure [simp]:
   "emeasure (scale_measure r M) A = r * emeasure M A"
   (is "_ = ?\<mu> A")
 proof(cases "A \<in> sets M")
   case True
   show ?thesis unfolding scale_measure_def
   proof(rule emeasure_measure_of_sigma)
     show "sigma_algebra (space M) (sets M)" ..
     show "positive (sets M) ?\<mu>" by (simp add: positive_def)
     show "countably_additive (sets M) ?\<mu>"
     proof (rule countably_additiveI)
       fix A :: "nat \<Rightarrow> _"  assume *: "range A \<subseteq> sets M" "disjoint_family A"
       have "(\<Sum>i. ?\<mu> (A i)) = r * (\<Sum>i. emeasure M (A i))"
         by simp
       also have "\<dots> = ?\<mu> (\<Union>i. A i)" using * by(simp add: suminf_emeasure)
       finally show "(\<Sum>i. ?\<mu> (A i)) = ?\<mu> (\<Union>i. A i)" .
     qed
   qed(fact True)
 qed(simp add: emeasure_notin_sets)
 
 lemma scale_measure_1 [simp]: "scale_measure 1 M = M"
   by(rule measure_eqI) simp_all
 
 lemma scale_measure_0[simp]: "scale_measure 0 M = null_measure M"
   by(rule measure_eqI) simp_all
 
 lemma measure_scale_measure [simp]: "0 \<le> r \<Longrightarrow> measure (scale_measure r M) A = r * measure M A"
   using emeasure_scale_measure[of r M A]
     emeasure_eq_ennreal_measure[of M A]
     measure_eq_emeasure_eq_ennreal[of _ "scale_measure r M" A]
   by (cases "emeasure (scale_measure r M) A = top")
      (auto simp del: emeasure_scale_measure
            simp: ennreal_top_eq_mult_iff ennreal_mult_eq_top_iff measure_zero_top ennreal_mult[symmetric])
 
 lemma scale_scale_measure [simp]:
   "scale_measure r (scale_measure r' M) = scale_measure (r * r') M"
   by (rule measure_eqI) (simp_all add: max_def mult.assoc)
 
 lemma scale_null_measure [simp]: "scale_measure r (null_measure M) = null_measure M"
   by (rule measure_eqI) simp_all
 
 
 subsection \<open>Complete lattice structure on measures\<close>
 
 lemma (in finite_measure) finite_measure_Diff':
   "A \<in> sets M \<Longrightarrow> B \<in> sets M \<Longrightarrow> measure M (A - B) = measure M A - measure M (A \<inter> B)"
   using finite_measure_Diff[of A "A \<inter> B"] by (auto simp: Diff_Int)
 
 lemma (in finite_measure) finite_measure_Union':
   "A \<in> sets M \<Longrightarrow> B \<in> sets M \<Longrightarrow> measure M (A \<union> B) = measure M A + measure M (B - A)"
   using finite_measure_Union[of A "B - A"] by auto
 
 lemma finite_unsigned_Hahn_decomposition:
   assumes "finite_measure M" "finite_measure N" and [simp]: "sets N = sets M"
   shows "\<exists>Y\<in>sets M. (\<forall>X\<in>sets M. X \<subseteq> Y \<longrightarrow> N X \<le> M X) \<and> (\<forall>X\<in>sets M. X \<inter> Y = {} \<longrightarrow> M X \<le> N X)"
 proof -
   interpret M: finite_measure M by fact
   interpret N: finite_measure N by fact
 
   define d where "d X = measure M X - measure N X" for X
 
   have [intro]: "bdd_above (d`sets M)"
     using sets.sets_into_space[of _ M]
     by (intro bdd_aboveI[where M="measure M (space M)"])
        (auto simp: d_def field_simps subset_eq intro!: add_increasing M.finite_measure_mono)
 
   define \<gamma> where "\<gamma> = (SUP X\<in>sets M. d X)"
   have le_\<gamma>[intro]: "X \<in> sets M \<Longrightarrow> d X \<le> \<gamma>" for X
     by (auto simp: \<gamma>_def intro!: cSUP_upper)
 
   have "\<exists>f. \<forall>n. f n \<in> sets M \<and> d (f n) > \<gamma> - 1 / 2^n"
   proof (intro choice_iff[THEN iffD1] allI)
     fix n
     have "\<exists>X\<in>sets M. \<gamma> - 1 / 2^n < d X"
       unfolding \<gamma>_def by (intro less_cSUP_iff[THEN iffD1]) auto
     then show "\<exists>y. y \<in> sets M \<and> \<gamma> - 1 / 2 ^ n < d y"
       by auto
   qed
   then obtain E where [measurable]: "E n \<in> sets M" and E: "d (E n) > \<gamma> - 1 / 2^n" for n
     by auto
 
   define F where "F m n = (if m \<le> n then \<Inter>i\<in>{m..n}. E i else space M)" for m n
 
   have [measurable]: "m \<le> n \<Longrightarrow> F m n \<in> sets M" for m n
     by (auto simp: F_def)
 
   have 1: "\<gamma> - 2 / 2 ^ m + 1 / 2 ^ n \<le> d (F m n)" if "m \<le> n" for m n
     using that
   proof (induct rule: dec_induct)
     case base with E[of m] show ?case
       by (simp add: F_def field_simps)
   next
     case (step i)
     have F_Suc: "F m (Suc i) = F m i \<inter> E (Suc i)"
       using \<open>m \<le> i\<close> by (auto simp: F_def le_Suc_eq)
 
     have "\<gamma> + (\<gamma> - 2 / 2^m + 1 / 2 ^ Suc i) \<le> (\<gamma> - 1 / 2^Suc i) + (\<gamma> - 2 / 2^m + 1 / 2^i)"
       by (simp add: field_simps)
     also have "\<dots> \<le> d (E (Suc i)) + d (F m i)"
       using E[of "Suc i"] by (intro add_mono step) auto
     also have "\<dots> = d (E (Suc i)) + d (F m i - E (Suc i)) + d (F m (Suc i))"
       using \<open>m \<le> i\<close> by (simp add: d_def field_simps F_Suc M.finite_measure_Diff' N.finite_measure_Diff')
     also have "\<dots> = d (E (Suc i) \<union> F m i) + d (F m (Suc i))"
       using \<open>m \<le> i\<close> by (simp add: d_def field_simps M.finite_measure_Union' N.finite_measure_Union')
     also have "\<dots> \<le> \<gamma> + d (F m (Suc i))"
       using \<open>m \<le> i\<close> by auto
     finally show ?case
       by auto
   qed
 
   define F' where "F' m = (\<Inter>i\<in>{m..}. E i)" for m
   have F'_eq: "F' m = (\<Inter>i. F m (i + m))" for m
     by (fastforce simp: le_iff_add[of m] F'_def F_def)
 
   have [measurable]: "F' m \<in> sets M" for m
     by (auto simp: F'_def)
 
   have \<gamma>_le: "\<gamma> - 0 \<le> d (\<Union>m. F' m)"
   proof (rule LIMSEQ_le)
     show "(\<lambda>n. \<gamma> - 2 / 2 ^ n) \<longlonglongrightarrow> \<gamma> - 0"
       by (intro tendsto_intros LIMSEQ_divide_realpow_zero) auto
     have "incseq F'"
       by (auto simp: incseq_def F'_def)
     then show "(\<lambda>m. d (F' m)) \<longlonglongrightarrow> d (\<Union>m. F' m)"
       unfolding d_def
       by (intro tendsto_diff M.finite_Lim_measure_incseq N.finite_Lim_measure_incseq) auto
 
     have "\<gamma> - 2 / 2 ^ m + 0 \<le> d (F' m)" for m
     proof (rule LIMSEQ_le)
       have *: "decseq (\<lambda>n. F m (n + m))"
         by (auto simp: decseq_def F_def)
       show "(\<lambda>n. d (F m n)) \<longlonglongrightarrow> d (F' m)"
         unfolding d_def F'_eq
         by (rule LIMSEQ_offset[where k=m])
            (auto intro!: tendsto_diff M.finite_Lim_measure_decseq N.finite_Lim_measure_decseq *)
       show "(\<lambda>n. \<gamma> - 2 / 2 ^ m + 1 / 2 ^ n) \<longlonglongrightarrow> \<gamma> - 2 / 2 ^ m + 0"
         by (intro tendsto_add LIMSEQ_divide_realpow_zero tendsto_const) auto
       show "\<exists>N. \<forall>n\<ge>N. \<gamma> - 2 / 2 ^ m + 1 / 2 ^ n \<le> d (F m n)"
         using 1[of m] by (intro exI[of _ m]) auto
     qed
     then show "\<exists>N. \<forall>n\<ge>N. \<gamma> - 2 / 2 ^ n \<le> d (F' n)"
       by auto
   qed
 
   show ?thesis
   proof (safe intro!: bexI[of _ "\<Union>m. F' m"])
     fix X assume [measurable]: "X \<in> sets M" and X: "X \<subseteq> (\<Union>m. F' m)"
     have "d (\<Union>m. F' m) - d X = d ((\<Union>m. F' m) - X)"
       using X by (auto simp: d_def M.finite_measure_Diff N.finite_measure_Diff)
     also have "\<dots> \<le> \<gamma>"
       by auto
     finally have "0 \<le> d X"
       using \<gamma>_le by auto
     then show "emeasure N X \<le> emeasure M X"
       by (auto simp: d_def M.emeasure_eq_measure N.emeasure_eq_measure)
   next
     fix X assume [measurable]: "X \<in> sets M" and X: "X \<inter> (\<Union>m. F' m) = {}"
     then have "d (\<Union>m. F' m) + d X = d (X \<union> (\<Union>m. F' m))"
       by (auto simp: d_def M.finite_measure_Union N.finite_measure_Union)
     also have "\<dots> \<le> \<gamma>"
       by auto
     finally have "d X \<le> 0"
       using \<gamma>_le by auto
     then show "emeasure M X \<le> emeasure N X"
       by (auto simp: d_def M.emeasure_eq_measure N.emeasure_eq_measure)
   qed auto
 qed
 
 proposition unsigned_Hahn_decomposition:
   assumes [simp]: "sets N = sets M" and [measurable]: "A \<in> sets M"
     and [simp]: "emeasure M A \<noteq> top" "emeasure N A \<noteq> top"
   shows "\<exists>Y\<in>sets M. Y \<subseteq> A \<and> (\<forall>X\<in>sets M. X \<subseteq> Y \<longrightarrow> N X \<le> M X) \<and> (\<forall>X\<in>sets M. X \<subseteq> A \<longrightarrow> X \<inter> Y = {} \<longrightarrow> M X \<le> N X)"
 proof -
   have "\<exists>Y\<in>sets (restrict_space M A).
     (\<forall>X\<in>sets (restrict_space M A). X \<subseteq> Y \<longrightarrow> (restrict_space N A) X \<le> (restrict_space M A) X) \<and>
     (\<forall>X\<in>sets (restrict_space M A). X \<inter> Y = {} \<longrightarrow> (restrict_space M A) X \<le> (restrict_space N A) X)"
   proof (rule finite_unsigned_Hahn_decomposition)
     show "finite_measure (restrict_space M A)" "finite_measure (restrict_space N A)"
       by (auto simp: space_restrict_space emeasure_restrict_space less_top intro!: finite_measureI)
   qed (simp add: sets_restrict_space)
   then guess Y ..
   then show ?thesis
     apply (intro bexI[of _ Y] conjI ballI conjI)
     apply (simp_all add: sets_restrict_space emeasure_restrict_space)
     apply safe
     subgoal for X Z
       by (erule ballE[of _ _ X]) (auto simp add: Int_absorb1)
     subgoal for X Z
       by (erule ballE[of _ _ X])  (auto simp add: Int_absorb1 ac_simps)
     apply auto
     done
 qed
 
 text\<^marker>\<open>tag important\<close> \<open>
   Define a lexicographical order on \<^type>\<open>measure\<close>, in the order space, sets and measure. The parts
   of the lexicographical order are point-wise ordered.
 \<close>
 
 instantiation measure :: (type) order_bot
 begin
 
 inductive less_eq_measure :: "'a measure \<Rightarrow> 'a measure \<Rightarrow> bool" where
   "space M \<subset> space N \<Longrightarrow> less_eq_measure M N"
 | "space M = space N \<Longrightarrow> sets M \<subset> sets N \<Longrightarrow> less_eq_measure M N"
 | "space M = space N \<Longrightarrow> sets M = sets N \<Longrightarrow> emeasure M \<le> emeasure N \<Longrightarrow> less_eq_measure M N"
 
 lemma le_measure_iff:
   "M \<le> N \<longleftrightarrow> (if space M = space N then
     if sets M = sets N then emeasure M \<le> emeasure N else sets M \<subseteq> sets N else space M \<subseteq> space N)"
   by (auto elim: less_eq_measure.cases intro: less_eq_measure.intros)
 
 definition\<^marker>\<open>tag important\<close> less_measure :: "'a measure \<Rightarrow> 'a measure \<Rightarrow> bool" where
   "less_measure M N \<longleftrightarrow> (M \<le> N \<and> \<not> N \<le> M)"
 
 definition\<^marker>\<open>tag important\<close> bot_measure :: "'a measure" where
   "bot_measure = sigma {} {}"
 
 lemma
   shows space_bot[simp]: "space bot = {}"
     and sets_bot[simp]: "sets bot = {{}}"
     and emeasure_bot[simp]: "emeasure bot X = 0"
   by (auto simp: bot_measure_def sigma_sets_empty_eq emeasure_sigma)
 
 instance
 proof standard
   show "bot \<le> a" for a :: "'a measure"
     by (simp add: le_measure_iff bot_measure_def sigma_sets_empty_eq emeasure_sigma le_fun_def)
 qed (auto simp: le_measure_iff less_measure_def split: if_split_asm intro: measure_eqI)
 
 end
 
 proposition le_measure: "sets M = sets N \<Longrightarrow> M \<le> N \<longleftrightarrow> (\<forall>A\<in>sets M. emeasure M A \<le> emeasure N A)"
   apply -
   apply (auto simp: le_measure_iff le_fun_def dest: sets_eq_imp_space_eq)
   subgoal for X
     by (cases "X \<in> sets M") (auto simp: emeasure_notin_sets)
   done
 
 definition\<^marker>\<open>tag important\<close> sup_measure' :: "'a measure \<Rightarrow> 'a measure \<Rightarrow> 'a measure" where
 "sup_measure' A B =
   measure_of (space A) (sets A)
     (\<lambda>X. SUP Y\<in>sets A. emeasure A (X \<inter> Y) + emeasure B (X \<inter> - Y))"
 
 lemma assumes [simp]: "sets B = sets A"
   shows space_sup_measure'[simp]: "space (sup_measure' A B) = space A"
     and sets_sup_measure'[simp]: "sets (sup_measure' A B) = sets A"
   using sets_eq_imp_space_eq[OF assms] by (simp_all add: sup_measure'_def)
 
 lemma emeasure_sup_measure':
   assumes sets_eq[simp]: "sets B = sets A" and [simp, intro]: "X \<in> sets A"
   shows "emeasure (sup_measure' A B) X = (SUP Y\<in>sets A. emeasure A (X \<inter> Y) + emeasure B (X \<inter> - Y))"
     (is "_ = ?S X")
 proof -
   note sets_eq_imp_space_eq[OF sets_eq, simp]
   show ?thesis
     using sup_measure'_def
   proof (rule emeasure_measure_of)
     let ?d = "\<lambda>X Y. emeasure A (X \<inter> Y) + emeasure B (X \<inter> - Y)"
     show "countably_additive (sets (sup_measure' A B)) (\<lambda>X. SUP Y \<in> sets A. emeasure A (X \<inter> Y) + emeasure B (X \<inter> - Y))"
     proof (rule countably_additiveI, goal_cases)
       case (1 X)
       then have [measurable]: "\<And>i. X i \<in> sets A" and "disjoint_family X"
         by auto
       have disjoint: "disjoint_family (\<lambda>i. X i \<inter> Y)" "disjoint_family (\<lambda>i. X i - Y)" for Y
         by (auto intro: disjoint_family_on_bisimulation [OF \<open>disjoint_family X\<close>, simplified])
       have "(\<Sum>i. ?S (X i)) = (SUP Y\<in>sets A. \<Sum>i. ?d (X i) Y)"
       proof (rule ennreal_suminf_SUP_eq_directed)
         fix J :: "nat set" and a b assume "finite J" and [measurable]: "a \<in> sets A" "b \<in> sets A"
         have "\<exists>c\<in>sets A. c \<subseteq> X i \<and> (\<forall>a\<in>sets A. ?d (X i) a \<le> ?d (X i) c)" for i
         proof cases
           assume "emeasure A (X i) = top \<or> emeasure B (X i) = top"
           then show ?thesis
           proof
             assume "emeasure A (X i) = top" then show ?thesis
               by (intro bexI[of _ "X i"]) auto
           next
             assume "emeasure B (X i) = top" then show ?thesis
               by (intro bexI[of _ "{}"]) auto
           qed
         next
           assume finite: "\<not> (emeasure A (X i) = top \<or> emeasure B (X i) = top)"
           then have "\<exists>Y\<in>sets A. Y \<subseteq> X i \<and> (\<forall>C\<in>sets A. C \<subseteq> Y \<longrightarrow> B C \<le> A C) \<and> (\<forall>C\<in>sets A. C \<subseteq> X i \<longrightarrow> C \<inter> Y = {} \<longrightarrow> A C \<le> B C)"
             using unsigned_Hahn_decomposition[of B A "X i"] by simp
           then obtain Y where [measurable]: "Y \<in> sets A" and [simp]: "Y \<subseteq> X i"
             and B_le_A: "\<And>C. C \<in> sets A \<Longrightarrow> C \<subseteq> Y \<Longrightarrow> B C \<le> A C"
             and A_le_B: "\<And>C. C \<in> sets A \<Longrightarrow> C \<subseteq> X i \<Longrightarrow> C \<inter> Y = {} \<Longrightarrow> A C \<le> B C"
             by auto
 
           show ?thesis
           proof (intro bexI[of _ Y] ballI conjI)
             fix a assume [measurable]: "a \<in> sets A"
             have *: "(X i \<inter> a \<inter> Y \<union> (X i \<inter> a - Y)) = X i \<inter> a" "(X i - a) \<inter> Y \<union> (X i - a - Y) = X i \<inter> - a"
               for a Y by auto
             then have "?d (X i) a =
               (A (X i \<inter> a \<inter> Y) + A (X i \<inter> a \<inter> - Y)) + (B (X i \<inter> - a \<inter> Y) + B (X i \<inter> - a \<inter> - Y))"
               by (subst (1 2) plus_emeasure) (auto simp: Diff_eq[symmetric])
             also have "\<dots> \<le> (A (X i \<inter> a \<inter> Y) + B (X i \<inter> a \<inter> - Y)) + (A (X i \<inter> - a \<inter> Y) + B (X i \<inter> - a \<inter> - Y))"
               by (intro add_mono order_refl B_le_A A_le_B) (auto simp: Diff_eq[symmetric])
             also have "\<dots> \<le> (A (X i \<inter> Y \<inter> a) + A (X i \<inter> Y \<inter> - a)) + (B (X i \<inter> - Y \<inter> a) + B (X i \<inter> - Y \<inter> - a))"
               by (simp add: ac_simps)
             also have "\<dots> \<le> A (X i \<inter> Y) + B (X i \<inter> - Y)"
               by (subst (1 2) plus_emeasure) (auto simp: Diff_eq[symmetric] *)
             finally show "?d (X i) a \<le> ?d (X i) Y" .
           qed auto
         qed
         then obtain C where [measurable]: "C i \<in> sets A" and "C i \<subseteq> X i"
           and C: "\<And>a. a \<in> sets A \<Longrightarrow> ?d (X i) a \<le> ?d (X i) (C i)" for i
           by metis
         have *: "X i \<inter> (\<Union>i. C i) = X i \<inter> C i" for i
         proof safe
           fix x j assume "x \<in> X i" "x \<in> C j"
           moreover have "i = j \<or> X i \<inter> X j = {}"
             using \<open>disjoint_family X\<close> by (auto simp: disjoint_family_on_def)
           ultimately show "x \<in> C i"
             using \<open>C i \<subseteq> X i\<close> \<open>C j \<subseteq> X j\<close> by auto
         qed auto
         have **: "X i \<inter> - (\<Union>i. C i) = X i \<inter> - C i" for i
         proof safe
           fix x j assume "x \<in> X i" "x \<notin> C i" "x \<in> C j"
           moreover have "i = j \<or> X i \<inter> X j = {}"
             using \<open>disjoint_family X\<close> by (auto simp: disjoint_family_on_def)
           ultimately show False
             using \<open>C i \<subseteq> X i\<close> \<open>C j \<subseteq> X j\<close> by auto
         qed auto
         show "\<exists>c\<in>sets A. \<forall>i\<in>J. ?d (X i) a \<le> ?d (X i) c \<and> ?d (X i) b \<le> ?d (X i) c"
           apply (intro bexI[of _ "\<Union>i. C i"])
           unfolding * **
           apply (intro C ballI conjI)
           apply auto
           done
       qed
       also have "\<dots> = ?S (\<Union>i. X i)"
         apply (simp only: UN_extend_simps(4))
         apply (rule arg_cong [of _ _ Sup])
         apply (rule image_cong)
          apply (fact refl)
         using disjoint
         apply (auto simp add: suminf_add [symmetric] Diff_eq [symmetric] image_subset_iff suminf_emeasure simp del: UN_simps)
         done
       finally show "(\<Sum>i. ?S (X i)) = ?S (\<Union>i. X i)" .
     qed
   qed (auto dest: sets.sets_into_space simp: positive_def intro!: SUP_const)
 qed
 
 lemma le_emeasure_sup_measure'1:
   assumes "sets B = sets A" "X \<in> sets A" shows "emeasure A X \<le> emeasure (sup_measure' A B) X"
   by (subst emeasure_sup_measure'[OF assms]) (auto intro!: SUP_upper2[of "X"] assms)
 
 lemma le_emeasure_sup_measure'2:
   assumes "sets B = sets A" "X \<in> sets A" shows "emeasure B X \<le> emeasure (sup_measure' A B) X"
   by (subst emeasure_sup_measure'[OF assms]) (auto intro!: SUP_upper2[of "{}"] assms)
 
 lemma emeasure_sup_measure'_le2:
   assumes [simp]: "sets B = sets C" "sets A = sets C" and [measurable]: "X \<in> sets C"
   assumes A: "\<And>Y. Y \<subseteq> X \<Longrightarrow> Y \<in> sets A \<Longrightarrow> emeasure A Y \<le> emeasure C Y"
   assumes B: "\<And>Y. Y \<subseteq> X \<Longrightarrow> Y \<in> sets A \<Longrightarrow> emeasure B Y \<le> emeasure C Y"
   shows "emeasure (sup_measure' A B) X \<le> emeasure C X"
 proof (subst emeasure_sup_measure')
   show "(SUP Y\<in>sets A. emeasure A (X \<inter> Y) + emeasure B (X \<inter> - Y)) \<le> emeasure C X"
     unfolding \<open>sets A = sets C\<close>
   proof (intro SUP_least)
     fix Y assume [measurable]: "Y \<in> sets C"
     have [simp]: "X \<inter> Y \<union> (X - Y) = X"
       by auto
     have "emeasure A (X \<inter> Y) + emeasure B (X \<inter> - Y) \<le> emeasure C (X \<inter> Y) + emeasure C (X \<inter> - Y)"
       by (intro add_mono A B) (auto simp: Diff_eq[symmetric])
     also have "\<dots> = emeasure C X"
       by (subst plus_emeasure) (auto simp: Diff_eq[symmetric])
     finally show "emeasure A (X \<inter> Y) + emeasure B (X \<inter> - Y) \<le> emeasure C X" .
   qed
 qed simp_all
 
 definition\<^marker>\<open>tag important\<close> sup_lexord :: "'a \<Rightarrow> 'a \<Rightarrow> ('a \<Rightarrow> 'b::order) \<Rightarrow> 'a \<Rightarrow> 'a \<Rightarrow> 'a" where
 "sup_lexord A B k s c =
   (if k A = k B then c else
    if \<not> k A \<le> k B \<and> \<not> k B \<le> k A then s else
    if k B \<le> k A then A else B)"
 
 lemma sup_lexord:
   "(k A < k B \<Longrightarrow> P B) \<Longrightarrow> (k B < k A \<Longrightarrow> P A) \<Longrightarrow> (k A = k B \<Longrightarrow> P c) \<Longrightarrow>
     (\<not> k B \<le> k A \<Longrightarrow> \<not> k A \<le> k B \<Longrightarrow> P s) \<Longrightarrow> P (sup_lexord A B k s c)"
   by (auto simp: sup_lexord_def)
 
 lemmas le_sup_lexord = sup_lexord[where P="\<lambda>a. c \<le> a" for c]
 
 lemma sup_lexord1: "k A = k B \<Longrightarrow> sup_lexord A B k s c = c"
   by (simp add: sup_lexord_def)
 
 lemma sup_lexord_commute: "sup_lexord A B k s c = sup_lexord B A k s c"
   by (auto simp: sup_lexord_def)
 
 lemma sigma_sets_le_sets_iff: "(sigma_sets (space x) \<A> \<subseteq> sets x) = (\<A> \<subseteq> sets x)"
   using sets.sigma_sets_subset[of \<A> x] by auto
 
 lemma sigma_le_iff: "\<A> \<subseteq> Pow \<Omega> \<Longrightarrow> sigma \<Omega> \<A> \<le> x \<longleftrightarrow> (\<Omega> \<subseteq> space x \<and> (space x = \<Omega> \<longrightarrow> \<A> \<subseteq> sets x))"
   by (cases "\<Omega> = space x")
      (simp_all add: eq_commute[of _ "sets x"] le_measure_iff emeasure_sigma le_fun_def
                     sigma_sets_superset_generator sigma_sets_le_sets_iff)
 
 instantiation measure :: (type) semilattice_sup
 begin
 
 definition\<^marker>\<open>tag important\<close> sup_measure :: "'a measure \<Rightarrow> 'a measure \<Rightarrow> 'a measure" where
   "sup_measure A B =
     sup_lexord A B space (sigma (space A \<union> space B) {})
       (sup_lexord A B sets (sigma (space A) (sets A \<union> sets B)) (sup_measure' A B))"
 
 instance
 proof
   fix x y z :: "'a measure"
   show "x \<le> sup x y"
     unfolding sup_measure_def
   proof (intro le_sup_lexord)
     assume "space x = space y"
     then have *: "sets x \<union> sets y \<subseteq> Pow (space x)"
       using sets.space_closed by auto
     assume "\<not> sets y \<subseteq> sets x" "\<not> sets x \<subseteq> sets y"
     then have "sets x \<subset> sets x \<union> sets y"
       by auto
     also have "\<dots> \<le> sigma (space x) (sets x \<union> sets y)"
       by (subst sets_measure_of[OF *]) (rule sigma_sets_superset_generator)
     finally show "x \<le> sigma (space x) (sets x \<union> sets y)"
       by (simp add: space_measure_of[OF *] less_eq_measure.intros(2))
   next
     assume "\<not> space y \<subseteq> space x" "\<not> space x \<subseteq> space y"
     then show "x \<le> sigma (space x \<union> space y) {}"
       by (intro less_eq_measure.intros) auto
   next
     assume "sets x = sets y" then show "x \<le> sup_measure' x y"
       by (simp add: le_measure le_emeasure_sup_measure'1)
   qed (auto intro: less_eq_measure.intros)
   show "y \<le> sup x y"
     unfolding sup_measure_def
   proof (intro le_sup_lexord)
     assume **: "space x = space y"
     then have *: "sets x \<union> sets y \<subseteq> Pow (space y)"
       using sets.space_closed by auto
     assume "\<not> sets y \<subseteq> sets x" "\<not> sets x \<subseteq> sets y"
     then have "sets y \<subset> sets x \<union> sets y"
       by auto
     also have "\<dots> \<le> sigma (space y) (sets x \<union> sets y)"
       by (subst sets_measure_of[OF *]) (rule sigma_sets_superset_generator)
     finally show "y \<le> sigma (space x) (sets x \<union> sets y)"
       by (simp add: ** space_measure_of[OF *] less_eq_measure.intros(2))
   next
     assume "\<not> space y \<subseteq> space x" "\<not> space x \<subseteq> space y"
     then show "y \<le> sigma (space x \<union> space y) {}"
       by (intro less_eq_measure.intros) auto
   next
     assume "sets x = sets y" then show "y \<le> sup_measure' x y"
       by (simp add: le_measure le_emeasure_sup_measure'2)
   qed (auto intro: less_eq_measure.intros)
   show "x \<le> y \<Longrightarrow> z \<le> y \<Longrightarrow> sup x z \<le> y"
     unfolding sup_measure_def
   proof (intro sup_lexord[where P="\<lambda>x. x \<le> y"])
     assume "x \<le> y" "z \<le> y" and [simp]: "space x = space z" "sets x = sets z"
     from \<open>x \<le> y\<close> show "sup_measure' x z \<le> y"
     proof cases
       case 1 then show ?thesis
         by (intro less_eq_measure.intros(1)) simp
     next
       case 2 then show ?thesis
         by (intro less_eq_measure.intros(2)) simp_all
     next
       case 3 with \<open>z \<le> y\<close> \<open>x \<le> y\<close> show ?thesis
         by (auto simp add: le_measure intro!: emeasure_sup_measure'_le2)
     qed
   next
     assume **: "x \<le> y" "z \<le> y" "space x = space z" "\<not> sets z \<subseteq> sets x" "\<not> sets x \<subseteq> sets z"
     then have *: "sets x \<union> sets z \<subseteq> Pow (space x)"
       using sets.space_closed by auto
     show "sigma (space x) (sets x \<union> sets z) \<le> y"
       unfolding sigma_le_iff[OF *] using ** by (auto simp: le_measure_iff split: if_split_asm)
   next
     assume "x \<le> y" "z \<le> y" "\<not> space z \<subseteq> space x" "\<not> space x \<subseteq> space z"
     then have "space x \<subseteq> space y" "space z \<subseteq> space y"
       by (auto simp: le_measure_iff split: if_split_asm)
     then show "sigma (space x \<union> space z) {} \<le> y"
       by (simp add: sigma_le_iff)
   qed
 qed
 
 end
 
 lemma space_empty_eq_bot: "space a = {} \<longleftrightarrow> a = bot"
   using space_empty[of a] by (auto intro!: measure_eqI)
 
 lemma sets_eq_iff_bounded: "A \<le> B \<Longrightarrow> B \<le> C \<Longrightarrow> sets A = sets C \<Longrightarrow> sets B = sets A"
   by (auto dest: sets_eq_imp_space_eq simp add: le_measure_iff split: if_split_asm)
 
 lemma sets_sup: "sets A = sets M \<Longrightarrow> sets B = sets M \<Longrightarrow> sets (sup A B) = sets M"
   by (auto simp add: sup_measure_def sup_lexord_def dest: sets_eq_imp_space_eq)
 
 lemma le_measureD1: "A \<le> B \<Longrightarrow> space A \<le> space B"
   by (auto simp: le_measure_iff split: if_split_asm)
 
 lemma le_measureD2: "A \<le> B \<Longrightarrow> space A = space B \<Longrightarrow> sets A \<le> sets B"
   by (auto simp: le_measure_iff split: if_split_asm)
 
 lemma le_measureD3: "A \<le> B \<Longrightarrow> sets A = sets B \<Longrightarrow> emeasure A X \<le> emeasure B X"
   by (auto simp: le_measure_iff le_fun_def dest: sets_eq_imp_space_eq split: if_split_asm)
 
 lemma UN_space_closed: "\<Union>(sets ` S) \<subseteq> Pow (\<Union>(space ` S))"
   using sets.space_closed by auto
 
 definition\<^marker>\<open>tag important\<close>
   Sup_lexord :: "('a \<Rightarrow> 'b::complete_lattice) \<Rightarrow> ('a set \<Rightarrow> 'a) \<Rightarrow> ('a set \<Rightarrow> 'a) \<Rightarrow> 'a set \<Rightarrow> 'a"
 where
   "Sup_lexord k c s A =
   (let U = (SUP a\<in>A. k a)
    in if \<exists>a\<in>A. k a = U then c {a\<in>A. k a = U} else s A)"
 
 lemma Sup_lexord:
   "(\<And>a S. a \<in> A \<Longrightarrow> k a = (SUP a\<in>A. k a) \<Longrightarrow> S = {a'\<in>A. k a' = k a} \<Longrightarrow> P (c S)) \<Longrightarrow> ((\<And>a. a \<in> A \<Longrightarrow> k a \<noteq> (SUP a\<in>A. k a)) \<Longrightarrow> P (s A)) \<Longrightarrow>
     P (Sup_lexord k c s A)"
   by (auto simp: Sup_lexord_def Let_def)
 
 lemma Sup_lexord1:
   assumes A: "A \<noteq> {}" "(\<And>a. a \<in> A \<Longrightarrow> k a = (\<Union>a\<in>A. k a))" "P (c A)"
   shows "P (Sup_lexord k c s A)"
   unfolding Sup_lexord_def Let_def
 proof (clarsimp, safe)
   show "\<forall>a\<in>A. k a \<noteq> (\<Union>x\<in>A. k x) \<Longrightarrow> P (s A)"
     by (metis assms(1,2) ex_in_conv)
 next
   fix a assume "a \<in> A" "k a = (\<Union>x\<in>A. k x)"
   then have "{a \<in> A. k a = (\<Union>x\<in>A. k x)} = {a \<in> A. k a = k a}"
     by (metis A(2)[symmetric])
   then show "P (c {a \<in> A. k a = (\<Union>x\<in>A. k x)})"
     by (simp add: A(3))
 qed
 
 instantiation measure :: (type) complete_lattice
 begin
 
 interpretation sup_measure: comm_monoid_set sup "bot :: 'a measure"
   by standard (auto intro!: antisym)
 
 lemma sup_measure_F_mono':
   "finite J \<Longrightarrow> finite I \<Longrightarrow> sup_measure.F id I \<le> sup_measure.F id (I \<union> J)"
 proof (induction J rule: finite_induct)
   case empty then show ?case
     by simp
 next
   case (insert i J)
   show ?case
   proof cases
     assume "i \<in> I" with insert show ?thesis
       by (auto simp: insert_absorb)
   next
     assume "i \<notin> I"
     have "sup_measure.F id I \<le> sup_measure.F id (I \<union> J)"
       by (intro insert)
     also have "\<dots> \<le> sup_measure.F id (insert i (I \<union> J))"
       using insert \<open>i \<notin> I\<close> by (subst sup_measure.insert) auto
     finally show ?thesis
       by auto
   qed
 qed
 
 lemma sup_measure_F_mono: "finite I \<Longrightarrow> J \<subseteq> I \<Longrightarrow> sup_measure.F id J \<le> sup_measure.F id I"
   using sup_measure_F_mono'[of I J] by (auto simp: finite_subset Un_absorb1)
 
 lemma sets_sup_measure_F:
   "finite I \<Longrightarrow> I \<noteq> {} \<Longrightarrow> (\<And>i. i \<in> I \<Longrightarrow> sets i = sets M) \<Longrightarrow> sets (sup_measure.F id I) = sets M"
   by (induction I rule: finite_ne_induct) (simp_all add: sets_sup)
 
 definition\<^marker>\<open>tag important\<close> Sup_measure' :: "'a measure set \<Rightarrow> 'a measure" where
 "Sup_measure' M =
   measure_of (\<Union>a\<in>M. space a) (\<Union>a\<in>M. sets a)
     (\<lambda>X. (SUP P\<in>{P. finite P \<and> P \<subseteq> M }. sup_measure.F id P X))"
 
 lemma space_Sup_measure'2: "space (Sup_measure' M) = (\<Union>m\<in>M. space m)"
   unfolding Sup_measure'_def by (intro space_measure_of[OF UN_space_closed])
 
 lemma sets_Sup_measure'2: "sets (Sup_measure' M) = sigma_sets (\<Union>m\<in>M. space m) (\<Union>m\<in>M. sets m)"
   unfolding Sup_measure'_def by (intro sets_measure_of[OF UN_space_closed])
 
 lemma sets_Sup_measure':
   assumes sets_eq[simp]: "\<And>m. m \<in> M \<Longrightarrow> sets m = sets A" and "M \<noteq> {}"
   shows "sets (Sup_measure' M) = sets A"
   using sets_eq[THEN sets_eq_imp_space_eq, simp] \<open>M \<noteq> {}\<close> by (simp add: Sup_measure'_def)
 
 lemma space_Sup_measure':
   assumes sets_eq[simp]: "\<And>m. m \<in> M \<Longrightarrow> sets m = sets A" and "M \<noteq> {}"
   shows "space (Sup_measure' M) = space A"
   using sets_eq[THEN sets_eq_imp_space_eq, simp] \<open>M \<noteq> {}\<close>
   by (simp add: Sup_measure'_def )
 
 lemma emeasure_Sup_measure':
   assumes sets_eq[simp]: "\<And>m. m \<in> M \<Longrightarrow> sets m = sets A" and "X \<in> sets A" "M \<noteq> {}"
   shows "emeasure (Sup_measure' M) X = (SUP P\<in>{P. finite P \<and> P \<subseteq> M}. sup_measure.F id P X)"
     (is "_ = ?S X")
   using Sup_measure'_def
 proof (rule emeasure_measure_of)
   note sets_eq[THEN sets_eq_imp_space_eq, simp]
   have *: "sets (Sup_measure' M) = sets A" "space (Sup_measure' M) = space A"
     using \<open>M \<noteq> {}\<close> by (simp_all add: Sup_measure'_def)
   let ?\<mu> = "sup_measure.F id"
   show "countably_additive (sets (Sup_measure' M)) ?S"
   proof (rule countably_additiveI, goal_cases)
     case (1 F)
     then have **: "range F \<subseteq> sets A"
       by (auto simp: *)
     show "(\<Sum>i. ?S (F i)) = ?S (\<Union>i. F i)"
     proof (subst ennreal_suminf_SUP_eq_directed)
       fix i j and N :: "nat set" assume ij: "i \<in> {P. finite P \<and> P \<subseteq> M}" "j \<in> {P. finite P \<and> P \<subseteq> M}"
       have "(i \<noteq> {} \<longrightarrow> sets (?\<mu> i) = sets A) \<and> (j \<noteq> {} \<longrightarrow> sets (?\<mu> j) = sets A) \<and>
         (i \<noteq> {} \<or> j \<noteq> {} \<longrightarrow> sets (?\<mu> (i \<union> j)) = sets A)"
         using ij by (intro impI sets_sup_measure_F conjI) auto
       then have "?\<mu> j (F n) \<le> ?\<mu> (i \<union> j) (F n) \<and> ?\<mu> i (F n) \<le> ?\<mu> (i \<union> j) (F n)" for n
         using ij
         by (cases "i = {}"; cases "j = {}")
            (auto intro!: le_measureD3 sup_measure_F_mono simp: sets_sup_measure_F
                  simp del: id_apply)
       with ij show "\<exists>k\<in>{P. finite P \<and> P \<subseteq> M}. \<forall>n\<in>N. ?\<mu> i (F n) \<le> ?\<mu> k (F n) \<and> ?\<mu> j (F n) \<le> ?\<mu> k (F n)"
         by (safe intro!: bexI[of _ "i \<union> j"]) auto
     next
       show "(SUP P \<in> {P. finite P \<and> P \<subseteq> M}. \<Sum>n. ?\<mu> P (F n)) = (SUP P \<in> {P. finite P \<and> P \<subseteq> M}. ?\<mu> P (\<Union>(F ` UNIV)))"
       proof (intro arg_cong [of _ _ Sup] image_cong refl)
         fix i assume i: "i \<in> {P. finite P \<and> P \<subseteq> M}"
         show "(\<Sum>n. ?\<mu> i (F n)) = ?\<mu> i (\<Union>(F ` UNIV))"
         proof cases
           assume "i \<noteq> {}" with i ** show ?thesis
             apply (intro suminf_emeasure \<open>disjoint_family F\<close>)
             apply (subst sets_sup_measure_F[OF _ _ sets_eq])
             apply auto
             done
         qed simp
       qed
     qed
   qed
   show "positive (sets (Sup_measure' M)) ?S"
     by (auto simp: positive_def bot_ennreal[symmetric])
   show "X \<in> sets (Sup_measure' M)"
     using assms * by auto
 qed (rule UN_space_closed)
 
 definition\<^marker>\<open>tag important\<close> Sup_measure :: "'a measure set \<Rightarrow> 'a measure" where
 "Sup_measure =
   Sup_lexord space
     (Sup_lexord sets Sup_measure'
       (\<lambda>U. sigma (\<Union>u\<in>U. space u) (\<Union>u\<in>U. sets u)))
     (\<lambda>U. sigma (\<Union>u\<in>U. space u) {})"
 
 definition\<^marker>\<open>tag important\<close> Inf_measure :: "'a measure set \<Rightarrow> 'a measure" where
   "Inf_measure A = Sup {x. \<forall>a\<in>A. x \<le> a}"
 
 definition\<^marker>\<open>tag important\<close> inf_measure :: "'a measure \<Rightarrow> 'a measure \<Rightarrow> 'a measure" where
   "inf_measure a b = Inf {a, b}"
 
 definition\<^marker>\<open>tag important\<close> top_measure :: "'a measure" where
   "top_measure = Inf {}"
 
 instance
 proof
   note UN_space_closed [simp]
   show upper: "x \<le> Sup A" if x: "x \<in> A" for x :: "'a measure" and A
     unfolding Sup_measure_def
   proof (intro Sup_lexord[where P="\<lambda>y. x \<le> y"])
     assume "\<And>a. a \<in> A \<Longrightarrow> space a \<noteq> (\<Union>a\<in>A. space a)"
     from this[OF \<open>x \<in> A\<close>] \<open>x \<in> A\<close> show "x \<le> sigma (\<Union>a\<in>A. space a) {}"
       by (intro less_eq_measure.intros) auto
   next
     fix a S assume "a \<in> A" and a: "space a = (\<Union>a\<in>A. space a)" and S: "S = {a' \<in> A. space a' = space a}"
       and neq: "\<And>aa. aa \<in> S \<Longrightarrow> sets aa \<noteq> (\<Union>a\<in>S. sets a)"
     have sp_a: "space a = (\<Union>(space ` S))"
       using \<open>a\<in>A\<close> by (auto simp: S)
     show "x \<le> sigma (\<Union>(space ` S)) (\<Union>(sets ` S))"
     proof cases
       assume [simp]: "space x = space a"
       have "sets x \<subset> (\<Union>a\<in>S. sets a)"
         using \<open>x\<in>A\<close> neq[of x] by (auto simp: S)
       also have "\<dots> \<subseteq> sigma_sets (\<Union>x\<in>S. space x) (\<Union>x\<in>S. sets x)"
         by (rule sigma_sets_superset_generator)
       finally show ?thesis
         by (intro less_eq_measure.intros(2)) (simp_all add: sp_a)
     next
       assume "space x \<noteq> space a"
       moreover have "space x \<le> space a"
         unfolding a using \<open>x\<in>A\<close> by auto
       ultimately show ?thesis
         by (intro less_eq_measure.intros) (simp add: less_le sp_a)
     qed
   next
     fix a b S S' assume "a \<in> A" and a: "space a = (\<Union>a\<in>A. space a)" and S: "S = {a' \<in> A. space a' = space a}"
       and "b \<in> S" and b: "sets b = (\<Union>a\<in>S. sets a)" and S': "S' = {a' \<in> S. sets a' = sets b}"
     then have "S' \<noteq> {}" "space b = space a"
       by auto
     have sets_eq: "\<And>x. x \<in> S' \<Longrightarrow> sets x = sets b"
       by (auto simp: S')
     note sets_eq[THEN sets_eq_imp_space_eq, simp]
     have *: "sets (Sup_measure' S') = sets b" "space (Sup_measure' S') = space b"
       using \<open>S' \<noteq> {}\<close> by (simp_all add: Sup_measure'_def sets_eq)
     show "x \<le> Sup_measure' S'"
     proof cases
       assume "x \<in> S"
       with \<open>b \<in> S\<close> have "space x = space b"
         by (simp add: S)
       show ?thesis
       proof cases
         assume "x \<in> S'"
         show "x \<le> Sup_measure' S'"
         proof (intro le_measure[THEN iffD2] ballI)
           show "sets x = sets (Sup_measure' S')"
             using \<open>x\<in>S'\<close> * by (simp add: S')
           fix X assume "X \<in> sets x"
           show "emeasure x X \<le> emeasure (Sup_measure' S') X"
           proof (subst emeasure_Sup_measure'[OF _ \<open>X \<in> sets x\<close>])
             show "emeasure x X \<le> (SUP P \<in> {P. finite P \<and> P \<subseteq> S'}. emeasure (sup_measure.F id P) X)"
               using \<open>x\<in>S'\<close> by (intro SUP_upper2[where i="{x}"]) auto
           qed (insert \<open>x\<in>S'\<close> S', auto)
         qed
       next
         assume "x \<notin> S'"
         then have "sets x \<noteq> sets b"
           using \<open>x\<in>S\<close> by (auto simp: S')
         moreover have "sets x \<le> sets b"
           using \<open>x\<in>S\<close> unfolding b by auto
         ultimately show ?thesis
           using * \<open>x \<in> S\<close>
           by (intro less_eq_measure.intros(2))
              (simp_all add: * \<open>space x = space b\<close> less_le)
       qed
     next
       assume "x \<notin> S"
       with \<open>x\<in>A\<close> \<open>x \<notin> S\<close> \<open>space b = space a\<close> show ?thesis
         by (intro less_eq_measure.intros)
            (simp_all add: * less_le a SUP_upper S)
     qed
   qed
   show least: "Sup A \<le> x" if x: "\<And>z. z \<in> A \<Longrightarrow> z \<le> x" for x :: "'a measure" and A
     unfolding Sup_measure_def
   proof (intro Sup_lexord[where P="\<lambda>y. y \<le> x"])
     assume "\<And>a. a \<in> A \<Longrightarrow> space a \<noteq> (\<Union>a\<in>A. space a)"
     show "sigma (\<Union>(space ` A)) {} \<le> x"
       using x[THEN le_measureD1] by (subst sigma_le_iff) auto
   next
     fix a S assume "a \<in> A" "space a = (\<Union>a\<in>A. space a)" and S: "S = {a' \<in> A. space a' = space a}"
       "\<And>a. a \<in> S \<Longrightarrow> sets a \<noteq> (\<Union>a\<in>S. sets a)"
     have "\<Union>(space ` S) \<subseteq> space x"
       using S le_measureD1[OF x] by auto
     moreover
     have "\<Union>(space ` S) = space a"
       using \<open>a\<in>A\<close> S by auto
     then have "space x = \<Union>(space ` S) \<Longrightarrow> \<Union>(sets ` S) \<subseteq> sets x"
       using \<open>a \<in> A\<close> le_measureD2[OF x] by (auto simp: S)
     ultimately show "sigma (\<Union>(space ` S)) (\<Union>(sets ` S)) \<le> x"
       by (subst sigma_le_iff) simp_all
   next
     fix a b S S' assume "a \<in> A" and a: "space a = (\<Union>a\<in>A. space a)" and S: "S = {a' \<in> A. space a' = space a}"
       and "b \<in> S" and b: "sets b = (\<Union>a\<in>S. sets a)" and S': "S' = {a' \<in> S. sets a' = sets b}"
     then have "S' \<noteq> {}" "space b = space a"
       by auto
     have sets_eq: "\<And>x. x \<in> S' \<Longrightarrow> sets x = sets b"
       by (auto simp: S')
     note sets_eq[THEN sets_eq_imp_space_eq, simp]
     have *: "sets (Sup_measure' S') = sets b" "space (Sup_measure' S') = space b"
       using \<open>S' \<noteq> {}\<close> by (simp_all add: Sup_measure'_def sets_eq)
     show "Sup_measure' S' \<le> x"
     proof cases
       assume "space x = space a"
       show ?thesis
       proof cases
         assume **: "sets x = sets b"
         show ?thesis
         proof (intro le_measure[THEN iffD2] ballI)
           show ***: "sets (Sup_measure' S') = sets x"
             by (simp add: * **)
           fix X assume "X \<in> sets (Sup_measure' S')"
           show "emeasure (Sup_measure' S') X \<le> emeasure x X"
             unfolding ***
           proof (subst emeasure_Sup_measure'[OF _ \<open>X \<in> sets (Sup_measure' S')\<close>])
             show "(SUP P \<in> {P. finite P \<and> P \<subseteq> S'}. emeasure (sup_measure.F id P) X) \<le> emeasure x X"
             proof (safe intro!: SUP_least)
               fix P assume P: "finite P" "P \<subseteq> S'"
               show "emeasure (sup_measure.F id P) X \<le> emeasure x X"
               proof cases
                 assume "P = {}" then show ?thesis
                   by auto
               next
                 assume "P \<noteq> {}"
                 from P have "finite P" "P \<subseteq> A"
                   unfolding S' S by (simp_all add: subset_eq)
                 then have "sup_measure.F id P \<le> x"
                   by (induction P) (auto simp: x)
                 moreover have "sets (sup_measure.F id P) = sets x"
                   using \<open>finite P\<close> \<open>P \<noteq> {}\<close> \<open>P \<subseteq> S'\<close> \<open>sets x = sets b\<close>
                   by (intro sets_sup_measure_F) (auto simp: S')
                 ultimately show "emeasure (sup_measure.F id P) X \<le> emeasure x X"
                   by (rule le_measureD3)
               qed
             qed
             show "m \<in> S' \<Longrightarrow> sets m = sets (Sup_measure' S')" for m
               unfolding * by (simp add: S')
           qed fact
         qed
       next
         assume "sets x \<noteq> sets b"
         moreover have "sets b \<le> sets x"
           unfolding b S using x[THEN le_measureD2] \<open>space x = space a\<close> by auto
         ultimately show "Sup_measure' S' \<le> x"
           using \<open>space x = space a\<close> \<open>b \<in> S\<close>
           by (intro less_eq_measure.intros(2)) (simp_all add: * S)
       qed
     next
       assume "space x \<noteq> space a"
       then have "space a < space x"
         using le_measureD1[OF x[OF \<open>a\<in>A\<close>]] by auto
       then show "Sup_measure' S' \<le> x"
         by (intro less_eq_measure.intros) (simp add: * \<open>space b = space a\<close>)
     qed
   qed
   show "Sup {} = (bot::'a measure)" "Inf {} = (top::'a measure)"
     by (auto intro!: antisym least simp: top_measure_def)
   show lower: "x \<in> A \<Longrightarrow> Inf A \<le> x" for x :: "'a measure" and A
     unfolding Inf_measure_def by (intro least) auto
   show greatest: "(\<And>z. z \<in> A \<Longrightarrow> x \<le> z) \<Longrightarrow> x \<le> Inf A" for x :: "'a measure" and A
     unfolding Inf_measure_def by (intro upper) auto
   show "inf x y \<le> x" "inf x y \<le> y" "x \<le> y \<Longrightarrow> x \<le> z \<Longrightarrow> x \<le> inf y z" for x y z :: "'a measure"
     by (auto simp: inf_measure_def intro!: lower greatest)
 qed
 
 end
 
 lemma sets_SUP:
   assumes "\<And>x. x \<in> I \<Longrightarrow> sets (M x) = sets N"
   shows "I \<noteq> {} \<Longrightarrow> sets (SUP i\<in>I. M i) = sets N"
   unfolding Sup_measure_def
   using assms assms[THEN sets_eq_imp_space_eq]
     sets_Sup_measure'[where A=N and M="M`I"]
   by (intro Sup_lexord1[where P="\<lambda>x. sets x = sets N"]) auto
 
 lemma emeasure_SUP:
   assumes sets: "\<And>i. i \<in> I \<Longrightarrow> sets (M i) = sets N" "X \<in> sets N" "I \<noteq> {}"
   shows "emeasure (SUP i\<in>I. M i) X = (SUP J\<in>{J. J \<noteq> {} \<and> finite J \<and> J \<subseteq> I}. emeasure (SUP i\<in>J. M i) X)"
 proof -
   interpret sup_measure: comm_monoid_set sup "bot :: 'b measure"
     by standard (auto intro!: antisym)
   have eq: "finite J \<Longrightarrow> sup_measure.F id J = (SUP i\<in>J. i)" for J :: "'b measure set"
     by (induction J rule: finite_induct) auto
   have 1: "J \<noteq> {} \<Longrightarrow> J \<subseteq> I \<Longrightarrow> sets (SUP x\<in>J. M x) = sets N" for J
     by (intro sets_SUP sets) (auto )
   from \<open>I \<noteq> {}\<close> obtain i where "i\<in>I" by auto
   have "Sup_measure' (M`I) X = (SUP P\<in>{P. finite P \<and> P \<subseteq> M`I}. sup_measure.F id P X)"
     using sets by (intro emeasure_Sup_measure') auto
   also have "Sup_measure' (M`I) = (SUP i\<in>I. M i)"
     unfolding Sup_measure_def using \<open>I \<noteq> {}\<close> sets sets(1)[THEN sets_eq_imp_space_eq]
     by (intro Sup_lexord1[where P="\<lambda>x. _ = x"]) auto
   also have "(SUP P\<in>{P. finite P \<and> P \<subseteq> M`I}. sup_measure.F id P X) =
     (SUP J\<in>{J. J \<noteq> {} \<and> finite J \<and> J \<subseteq> I}. (SUP i\<in>J. M i) X)"
   proof (intro SUP_eq)
     fix J assume "J \<in> {P. finite P \<and> P \<subseteq> M`I}"
     then obtain J' where J': "J' \<subseteq> I" "finite J'" and J: "J = M`J'" and "finite J"
       using finite_subset_image[of J M I] by auto
     show "\<exists>j\<in>{J. J \<noteq> {} \<and> finite J \<and> J \<subseteq> I}. sup_measure.F id J X \<le> (SUP i\<in>j. M i) X"
     proof cases
       assume "J' = {}" with \<open>i \<in> I\<close> show ?thesis
         by (auto simp add: J)
     next
       assume "J' \<noteq> {}" with J J' show ?thesis
         by (intro bexI[of _ "J'"]) (auto simp add: eq simp del: id_apply)
     qed
   next
     fix J assume J: "J \<in> {P. P \<noteq> {} \<and> finite P \<and> P \<subseteq> I}"
     show "\<exists>J'\<in>{J. finite J \<and> J \<subseteq> M`I}. (SUP i\<in>J. M i) X \<le> sup_measure.F id J' X"
       using J by (intro bexI[of _ "M`J"]) (auto simp add: eq simp del: id_apply)
   qed
   finally show ?thesis .
 qed
 
 lemma emeasure_SUP_chain:
   assumes sets: "\<And>i. i \<in> A \<Longrightarrow> sets (M i) = sets N" "X \<in> sets N"
   assumes ch: "Complete_Partial_Order.chain (\<le>) (M ` A)" and "A \<noteq> {}"
   shows "emeasure (SUP i\<in>A. M i) X = (SUP i\<in>A. emeasure (M i) X)"
 proof (subst emeasure_SUP[OF sets \<open>A \<noteq> {}\<close>])
   show "(SUP J\<in>{J. J \<noteq> {} \<and> finite J \<and> J \<subseteq> A}. emeasure (Sup (M ` J)) X) = (SUP i\<in>A. emeasure (M i) X)"
   proof (rule SUP_eq)
     fix J assume "J \<in> {J. J \<noteq> {} \<and> finite J \<and> J \<subseteq> A}"
     then have J: "Complete_Partial_Order.chain (\<le>) (M ` J)" "finite J" "J \<noteq> {}" and "J \<subseteq> A"
       using ch[THEN chain_subset, of "M`J"] by auto
     with in_chain_finite[OF J(1)] obtain j where "j \<in> J" "(SUP j\<in>J. M j) = M j"
       by auto
     with \<open>J \<subseteq> A\<close> show "\<exists>j\<in>A. emeasure (Sup (M ` J)) X \<le> emeasure (M j) X"
       by auto
   next
     fix j assume "j\<in>A" then show "\<exists>i\<in>{J. J \<noteq> {} \<and> finite J \<and> J \<subseteq> A}. emeasure (M j) X \<le> emeasure (Sup (M ` i)) X"
       by (intro bexI[of _ "{j}"]) auto
   qed
 qed
 
 subsubsection\<^marker>\<open>tag unimportant\<close> \<open>Supremum of a set of \<open>\<sigma>\<close>-algebras\<close>
 
 lemma space_Sup_eq_UN: "space (Sup M) = (\<Union>x\<in>M. space x)"
   unfolding Sup_measure_def
   apply (intro Sup_lexord[where P="\<lambda>x. space x = _"])
   apply (subst space_Sup_measure'2)
   apply auto []
   apply (subst space_measure_of[OF UN_space_closed])
   apply auto
   done
 
 lemma sets_Sup_eq:
   assumes *: "\<And>m. m \<in> M \<Longrightarrow> space m = X" and "M \<noteq> {}"
   shows "sets (Sup M) = sigma_sets X (\<Union>x\<in>M. sets x)"
   unfolding Sup_measure_def
   apply (rule Sup_lexord1)
   apply fact
   apply (simp add: assms)
   apply (rule Sup_lexord)
   subgoal premises that for a S
     unfolding that(3) that(2)[symmetric]
     using that(1)
     apply (subst sets_Sup_measure'2)
     apply (intro arg_cong2[where f=sigma_sets])
     apply (auto simp: *)
     done
   apply (subst sets_measure_of[OF UN_space_closed])
   apply (simp add:  assms)
   done
 
 lemma in_sets_Sup: "(\<And>m. m \<in> M \<Longrightarrow> space m = X) \<Longrightarrow> m \<in> M \<Longrightarrow> A \<in> sets m \<Longrightarrow> A \<in> sets (Sup M)"
   by (subst sets_Sup_eq[where X=X]) auto
 
 lemma Sup_lexord_rel:
   assumes "\<And>i. i \<in> I \<Longrightarrow> k (A i) = k (B i)"
     "R (c (A ` {a \<in> I. k (B a) = (SUP x\<in>I. k (B x))})) (c (B ` {a \<in> I. k (B a) = (SUP x\<in>I. k (B x))}))"
     "R (s (A`I)) (s (B`I))"
   shows "R (Sup_lexord k c s (A`I)) (Sup_lexord k c s (B`I))"
 proof -
   have "A ` {a \<in> I. k (B a) = (SUP x\<in>I. k (B x))} =  {a \<in> A ` I. k a = (SUP x\<in>I. k (B x))}"
     using assms(1) by auto
   moreover have "B ` {a \<in> I. k (B a) = (SUP x\<in>I. k (B x))} =  {a \<in> B ` I. k a = (SUP x\<in>I. k (B x))}"
     by auto
   ultimately show ?thesis
     using assms by (auto simp: Sup_lexord_def Let_def image_comp)
 qed
 
 lemma sets_SUP_cong:
   assumes eq: "\<And>i. i \<in> I \<Longrightarrow> sets (M i) = sets (N i)" shows "sets (SUP i\<in>I. M i) = sets (SUP i\<in>I. N i)"
   unfolding Sup_measure_def
   using eq eq[THEN sets_eq_imp_space_eq]
   apply (intro Sup_lexord_rel[where R="\<lambda>x y. sets x = sets y"])
   apply simp
   apply simp
   apply (simp add: sets_Sup_measure'2)
   apply (intro arg_cong2[where f="\<lambda>x y. sets (sigma x y)"])
   apply auto
   done
 
 lemma sets_Sup_in_sets:
   assumes "M \<noteq> {}"
   assumes "\<And>m. m \<in> M \<Longrightarrow> space m = space N"
   assumes "\<And>m. m \<in> M \<Longrightarrow> sets m \<subseteq> sets N"
   shows "sets (Sup M) \<subseteq> sets N"
 proof -
   have *: "\<Union>(space ` M) = space N"
     using assms by auto
   show ?thesis
     unfolding * using assms by (subst sets_Sup_eq[of M "space N"]) (auto intro!: sets.sigma_sets_subset)
 qed
 
 lemma measurable_Sup1:
   assumes m: "m \<in> M" and f: "f \<in> measurable m N"
     and const_space: "\<And>m n. m \<in> M \<Longrightarrow> n \<in> M \<Longrightarrow> space m = space n"
   shows "f \<in> measurable (Sup M) N"
 proof -
   have "space (Sup M) = space m"
     using m by (auto simp add: space_Sup_eq_UN dest: const_space)
   then show ?thesis
     using m f unfolding measurable_def by (auto intro: in_sets_Sup[OF const_space])
 qed
 
 lemma measurable_Sup2:
   assumes M: "M \<noteq> {}"
   assumes f: "\<And>m. m \<in> M \<Longrightarrow> f \<in> measurable N m"
     and const_space: "\<And>m n. m \<in> M \<Longrightarrow> n \<in> M \<Longrightarrow> space m = space n"
   shows "f \<in> measurable N (Sup M)"
 proof -
   from M obtain m where "m \<in> M" by auto
   have space_eq: "\<And>n. n \<in> M \<Longrightarrow> space n = space m"
     by (intro const_space \<open>m \<in> M\<close>)
   have "f \<in> measurable N (sigma (\<Union>m\<in>M. space m) (\<Union>m\<in>M. sets m))"
   proof (rule measurable_measure_of)
     show "f \<in> space N \<rightarrow> \<Union>(space ` M)"
       using measurable_space[OF f] M by auto
   qed (auto intro: measurable_sets f dest: sets.sets_into_space)
   also have "measurable N (sigma (\<Union>m\<in>M. space m) (\<Union>m\<in>M. sets m)) = measurable N (Sup M)"
     apply (intro measurable_cong_sets refl)
     apply (subst sets_Sup_eq[OF space_eq M])
     apply simp
     apply (subst sets_measure_of[OF UN_space_closed])
     apply (simp add: space_eq M)
     done
   finally show ?thesis .
 qed
 
 lemma measurable_SUP2:
   "I \<noteq> {} \<Longrightarrow> (\<And>i. i \<in> I \<Longrightarrow> f \<in> measurable N (M i)) \<Longrightarrow>
     (\<And>i j. i \<in> I \<Longrightarrow> j \<in> I \<Longrightarrow> space (M i) = space (M j)) \<Longrightarrow> f \<in> measurable N (SUP i\<in>I. M i)"
   by (auto intro!: measurable_Sup2)
 
 lemma sets_Sup_sigma:
   assumes [simp]: "M \<noteq> {}" and M: "\<And>m. m \<in> M \<Longrightarrow> m \<subseteq> Pow \<Omega>"
   shows "sets (SUP m\<in>M. sigma \<Omega> m) = sets (sigma \<Omega> (\<Union>M))"
 proof -
   { fix a m assume "a \<in> sigma_sets \<Omega> m" "m \<in> M"
     then have "a \<in> sigma_sets \<Omega> (\<Union>M)"
      by induction (auto intro: sigma_sets.intros(2-)) }
   then show "sets (SUP m\<in>M. sigma \<Omega> m) = sets (sigma \<Omega> (\<Union>M))"
     apply (subst sets_Sup_eq[where X="\<Omega>"])
     apply (auto simp add: M) []
     apply auto []
     apply (simp add: space_measure_of_conv M Union_least)
     apply (rule sigma_sets_eqI)
     apply auto
     done
 qed
 
 lemma Sup_sigma:
   assumes [simp]: "M \<noteq> {}" and M: "\<And>m. m \<in> M \<Longrightarrow> m \<subseteq> Pow \<Omega>"
   shows "(SUP m\<in>M. sigma \<Omega> m) = (sigma \<Omega> (\<Union>M))"
 proof (intro antisym SUP_least)
   have *: "\<Union>M \<subseteq> Pow \<Omega>"
     using M by auto
   show "sigma \<Omega> (\<Union>M) \<le> (SUP m\<in>M. sigma \<Omega> m)"
   proof (intro less_eq_measure.intros(3))
     show "space (sigma \<Omega> (\<Union>M)) = space (SUP m\<in>M. sigma \<Omega> m)"
       "sets (sigma \<Omega> (\<Union>M)) = sets (SUP m\<in>M. sigma \<Omega> m)"
       using sets_Sup_sigma[OF assms] sets_Sup_sigma[OF assms, THEN sets_eq_imp_space_eq]
       by auto
   qed (simp add: emeasure_sigma le_fun_def)
   fix m assume "m \<in> M" then show "sigma \<Omega> m \<le> sigma \<Omega> (\<Union>M)"
     by (subst sigma_le_iff) (auto simp add: M *)
 qed
 
 lemma SUP_sigma_sigma:
   "M \<noteq> {} \<Longrightarrow> (\<And>m. m \<in> M \<Longrightarrow> f m \<subseteq> Pow \<Omega>) \<Longrightarrow> (SUP m\<in>M. sigma \<Omega> (f m)) = sigma \<Omega> (\<Union>m\<in>M. f m)"
   using Sup_sigma[of "f`M" \<Omega>] by (auto simp: image_comp)
 
 lemma sets_vimage_Sup_eq:
   assumes *: "M \<noteq> {}" "f \<in> X \<rightarrow> Y" "\<And>m. m \<in> M \<Longrightarrow> space m = Y"
   shows "sets (vimage_algebra X f (Sup M)) = sets (SUP m \<in> M. vimage_algebra X f m)"
   (is "?IS = ?SI")
 proof
   show "?IS \<subseteq> ?SI"
     apply (intro sets_image_in_sets measurable_Sup2)
     apply (simp add: space_Sup_eq_UN *)
     apply (simp add: *)
     apply (intro measurable_Sup1)
     apply (rule imageI)
     apply assumption
     apply (rule measurable_vimage_algebra1)
     apply (auto simp: *)
     done
   show "?SI \<subseteq> ?IS"
     apply (intro sets_Sup_in_sets)
     apply (auto simp: *) []
     apply (auto simp: *) []
     apply (elim imageE)
     apply simp
     apply (rule sets_image_in_sets)
     apply simp
     apply (simp add: measurable_def)
     apply (simp add: * space_Sup_eq_UN sets_vimage_algebra2)
     apply (auto intro: in_sets_Sup[OF *(3)])
     done
 qed
 
 lemma restrict_space_eq_vimage_algebra':
   "sets (restrict_space M \<Omega>) = sets (vimage_algebra (\<Omega> \<inter> space M) (\<lambda>x. x) M)"
 proof -
   have *: "{A \<inter> (\<Omega> \<inter> space M) |A. A \<in> sets M} = {A \<inter> \<Omega> |A. A \<in> sets M}"
     using sets.sets_into_space[of _ M] by blast
 
   show ?thesis
     unfolding restrict_space_def
     by (subst sets_measure_of)
        (auto simp add: image_subset_iff sets_vimage_algebra * dest: sets.sets_into_space intro!: arg_cong2[where f=sigma_sets])
 qed
 
 lemma sigma_le_sets:
   assumes [simp]: "A \<subseteq> Pow X" shows "sets (sigma X A) \<subseteq> sets N \<longleftrightarrow> X \<in> sets N \<and> A \<subseteq> sets N"
 proof
   have "X \<in> sigma_sets X A" "A \<subseteq> sigma_sets X A"
     by (auto intro: sigma_sets_top)
   moreover assume "sets (sigma X A) \<subseteq> sets N"
   ultimately show "X \<in> sets N \<and> A \<subseteq> sets N"
     by auto
 next
   assume *: "X \<in> sets N \<and> A \<subseteq> sets N"
   { fix Y assume "Y \<in> sigma_sets X A" from this * have "Y \<in> sets N"
       by induction auto }
   then show "sets (sigma X A) \<subseteq> sets N"
     by auto
 qed
 
 lemma measurable_iff_sets:
   "f \<in> measurable M N \<longleftrightarrow> (f \<in> space M \<rightarrow> space N \<and> sets (vimage_algebra (space M) f N) \<subseteq> sets M)"
 proof -
   have *: "{f -` A \<inter> space M |A. A \<in> sets N} \<subseteq> Pow (space M)"
     by auto
   show ?thesis
     unfolding measurable_def
     by (auto simp add: vimage_algebra_def sigma_le_sets[OF *])
 qed
 
 lemma sets_vimage_algebra_space: "X \<in> sets (vimage_algebra X f M)"
   using sets.top[of "vimage_algebra X f M"] by simp
 
 lemma measurable_mono:
   assumes N: "sets N' \<le> sets N" "space N = space N'"
   assumes M: "sets M \<le> sets M'" "space M = space M'"
   shows "measurable M N \<subseteq> measurable M' N'"
   unfolding measurable_def
 proof safe
   fix f A assume "f \<in> space M \<rightarrow> space N" "A \<in> sets N'"
   moreover assume "\<forall>y\<in>sets N. f -` y \<inter> space M \<in> sets M" note this[THEN bspec, of A]
   ultimately show "f -` A \<inter> space M' \<in> sets M'"
     using assms by auto
 qed (insert N M, auto)
 
 lemma measurable_Sup_measurable:
   assumes f: "f \<in> space N \<rightarrow> A"
   shows "f \<in> measurable N (Sup {M. space M = A \<and> f \<in> measurable N M})"
 proof (rule measurable_Sup2)
   show "{M. space M = A \<and> f \<in> measurable N M} \<noteq> {}"
     using f unfolding ex_in_conv[symmetric]
     by (intro exI[of _ "sigma A {}"]) (auto intro!: measurable_measure_of)
 qed auto
 
 lemma (in sigma_algebra) sigma_sets_subset':
   assumes a: "a \<subseteq> M" "\<Omega>' \<in> M"
   shows "sigma_sets \<Omega>' a \<subseteq> M"
 proof
   show "x \<in> M" if x: "x \<in> sigma_sets \<Omega>' a" for x
     using x by (induct rule: sigma_sets.induct) (insert a, auto)
 qed
 
 lemma in_sets_SUP: "i \<in> I \<Longrightarrow> (\<And>i. i \<in> I \<Longrightarrow> space (M i) = Y) \<Longrightarrow> X \<in> sets (M i) \<Longrightarrow> X \<in> sets (SUP i\<in>I. M i)"
   by (intro in_sets_Sup[where X=Y]) auto
 
 lemma measurable_SUP1:
   "i \<in> I \<Longrightarrow> f \<in> measurable (M i) N \<Longrightarrow> (\<And>m n. m \<in> I \<Longrightarrow> n \<in> I \<Longrightarrow> space (M m) = space (M n)) \<Longrightarrow>
     f \<in> measurable (SUP i\<in>I. M i) N"
   by (auto intro: measurable_Sup1)
 
 lemma sets_image_in_sets':
   assumes X: "X \<in> sets N"
   assumes f: "\<And>A. A \<in> sets M \<Longrightarrow> f -` A \<inter> X \<in> sets N"
   shows "sets (vimage_algebra X f M) \<subseteq> sets N"
   unfolding sets_vimage_algebra
   by (rule sets.sigma_sets_subset') (auto intro!: measurable_sets X f)
 
 lemma mono_vimage_algebra:
   "sets M \<le> sets N \<Longrightarrow> sets (vimage_algebra X f M) \<subseteq> sets (vimage_algebra X f N)"
   using sets.top[of "sigma X {f -` A \<inter> X |A. A \<in> sets N}"]
   unfolding vimage_algebra_def
   apply (subst (asm) space_measure_of)
   apply auto []
   apply (subst sigma_le_sets)
   apply auto
   done
 
 lemma mono_restrict_space: "sets M \<le> sets N \<Longrightarrow> sets (restrict_space M X) \<subseteq> sets (restrict_space N X)"
   unfolding sets_restrict_space by (rule image_mono)
 
 lemma sets_eq_bot: "sets M = {{}} \<longleftrightarrow> M = bot"
   apply safe
   apply (intro measure_eqI)
   apply auto
   done
 
 lemma sets_eq_bot2: "{{}} = sets M \<longleftrightarrow> M = bot"
   using sets_eq_bot[of M] by blast
 
 
 lemma (in finite_measure) countable_support:
   "countable {x. measure M {x} \<noteq> 0}"
 proof cases
   assume "measure M (space M) = 0"
   with bounded_measure measure_le_0_iff have "{x. measure M {x} \<noteq> 0} = {}"
     by auto
   then show ?thesis
     by simp
 next
   let ?M = "measure M (space M)" and ?m = "\<lambda>x. measure M {x}"
   assume "?M \<noteq> 0"
   then have *: "{x. ?m x \<noteq> 0} = (\<Union>n. {x. ?M / Suc n < ?m x})"
     using reals_Archimedean[of "?m x / ?M" for x]
     by (auto simp: field_simps not_le[symmetric] divide_le_0_iff measure_le_0_iff)
   have **: "\<And>n. finite {x. ?M / Suc n < ?m x}"
   proof (rule ccontr)
     fix n assume "infinite {x. ?M / Suc n < ?m x}" (is "infinite ?X")
     then obtain X where "finite X" "card X = Suc (Suc n)" "X \<subseteq> ?X"
       by (metis infinite_arbitrarily_large)
     from this(3) have *: "\<And>x. x \<in> X \<Longrightarrow> ?M / Suc n \<le> ?m x"
       by auto
     { fix x assume "x \<in> X"
       from \<open>?M \<noteq> 0\<close> *[OF this] have "?m x \<noteq> 0" by (auto simp: field_simps measure_le_0_iff)
       then have "{x} \<in> sets M" by (auto dest: measure_notin_sets) }
     note singleton_sets = this
     have "?M < (\<Sum>x\<in>X. ?M / Suc n)"
       using \<open>?M \<noteq> 0\<close>
       by (simp add: \<open>card X = Suc (Suc n)\<close> field_simps less_le)
     also have "\<dots> \<le> (\<Sum>x\<in>X. ?m x)"
       by (rule sum_mono) fact
     also have "\<dots> = measure M (\<Union>x\<in>X. {x})"
       using singleton_sets \<open>finite X\<close>
       by (intro finite_measure_finite_Union[symmetric]) (auto simp: disjoint_family_on_def)
     finally have "?M < measure M (\<Union>x\<in>X. {x})" .
     moreover have "measure M (\<Union>x\<in>X. {x}) \<le> ?M"
       using singleton_sets[THEN sets.sets_into_space] by (intro finite_measure_mono) auto
     ultimately show False by simp
   qed
   show ?thesis
     unfolding * by (intro countable_UN countableI_type countable_finite[OF **])
 qed
 
 end
diff --git a/src/HOL/Analysis/Nonnegative_Lebesgue_Integration.thy b/src/HOL/Analysis/Nonnegative_Lebesgue_Integration.thy
--- a/src/HOL/Analysis/Nonnegative_Lebesgue_Integration.thy
+++ b/src/HOL/Analysis/Nonnegative_Lebesgue_Integration.thy
@@ -1,2633 +1,2633 @@
 (*  Title:      HOL/Analysis/Nonnegative_Lebesgue_Integration.thy
     Author:     Johannes Hölzl, TU München
     Author:     Armin Heller, TU München
 *)
 
 section \<open>Lebesgue Integration for Nonnegative Functions\<close>
 
 theory Nonnegative_Lebesgue_Integration
   imports Measure_Space Borel_Space
 begin
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Approximating functions\<close>
 
 lemma AE_upper_bound_inf_ennreal:
   fixes F G::"'a \<Rightarrow> ennreal"
   assumes "\<And>e. (e::real) > 0 \<Longrightarrow> AE x in M. F x \<le> G x + e"
   shows "AE x in M. F x \<le> G x"
 proof -
   have "AE x in M. \<forall>n::nat. F x \<le> G x + ennreal (1 / Suc n)"
     using assms by (auto simp: AE_all_countable)
   then show ?thesis
   proof (eventually_elim)
     fix x assume x: "\<forall>n::nat. F x \<le> G x + ennreal (1 / Suc n)"
     show "F x \<le> G x"
     proof (rule ennreal_le_epsilon)
       fix e :: real assume "0 < e"
       then obtain n where n: "1 / Suc n < e"
         by (blast elim: nat_approx_posE)
       have "F x \<le> G x + 1 / Suc n"
         using x by simp
       also have "\<dots> \<le> G x + e"
         using n by (intro add_mono ennreal_leI) auto
       finally show "F x \<le> G x + ennreal e" .
     qed
   qed
 qed
 
 lemma AE_upper_bound_inf:
   fixes F G::"'a \<Rightarrow> real"
   assumes "\<And>e. e > 0 \<Longrightarrow> AE x in M. F x \<le> G x + e"
   shows "AE x in M. F x \<le> G x"
 proof -
   have "AE x in M. F x \<le> G x + 1/real (n+1)" for n::nat
     by (rule assms, auto)
   then have "AE x in M. \<forall>n::nat \<in> UNIV. F x \<le> G x + 1/real (n+1)"
     by (rule AE_ball_countable', auto)
   moreover
   {
     fix x assume i: "\<forall>n::nat \<in> UNIV. F x \<le> G x + 1/real (n+1)"
     have "(\<lambda>n. G x + 1/real (n+1)) \<longlonglongrightarrow> G x + 0"
       by (rule tendsto_add, simp, rule LIMSEQ_ignore_initial_segment[OF lim_1_over_n, of 1])
     then have "F x \<le> G x" using i LIMSEQ_le_const by fastforce
   }
   ultimately show ?thesis by auto
 qed
 
 lemma not_AE_zero_ennreal_E:
   fixes f::"'a \<Rightarrow> ennreal"
   assumes "\<not> (AE x in M. f x = 0)" and [measurable]: "f \<in> borel_measurable M"
   shows "\<exists>A\<in>sets M. \<exists>e::real>0. emeasure M A > 0 \<and> (\<forall>x \<in> A. f x \<ge> e)"
 proof -
   { assume "\<not> (\<exists>e::real>0. {x \<in> space M. f x \<ge> e} \<notin> null_sets M)"
     then have "0 < e \<Longrightarrow> AE x in M. f x \<le> e" for e :: real
       by (auto simp: not_le less_imp_le dest!: AE_not_in)
     then have "AE x in M. f x \<le> 0"
       by (intro AE_upper_bound_inf_ennreal[where G="\<lambda>_. 0"]) simp
     then have False
       using assms by auto }
   then obtain e::real where e: "e > 0" "{x \<in> space M. f x \<ge> e} \<notin> null_sets M" by auto
   define A where "A = {x \<in> space M. f x \<ge> e}"
   have 1 [measurable]: "A \<in> sets M" unfolding A_def by auto
   have 2: "emeasure M A > 0"
     using e(2) A_def \<open>A \<in> sets M\<close> by auto
   have 3: "\<And>x. x \<in> A \<Longrightarrow> f x \<ge> e" unfolding A_def by auto
   show ?thesis using e(1) 1 2 3 by blast
 qed
 
 lemma not_AE_zero_E:
   fixes f::"'a \<Rightarrow> real"
   assumes "AE x in M. f x \<ge> 0"
           "\<not>(AE x in M. f x = 0)"
       and [measurable]: "f \<in> borel_measurable M"
   shows "\<exists>A e. A \<in> sets M \<and> e>0 \<and> emeasure M A > 0 \<and> (\<forall>x \<in> A. f x \<ge> e)"
 proof -
   have "\<exists>e. e > 0 \<and> {x \<in> space M. f x \<ge> e} \<notin> null_sets M"
   proof (rule ccontr)
     assume *: "\<not>(\<exists>e. e > 0 \<and> {x \<in> space M. f x \<ge> e} \<notin> null_sets M)"
     {
       fix e::real assume "e > 0"
       then have "{x \<in> space M. f x \<ge> e} \<in> null_sets M" using * by blast
       then have "AE x in M. x \<notin> {x \<in> space M. f x \<ge> e}" using AE_not_in by blast
       then have "AE x in M. f x \<le> e" by auto
     }
     then have "AE x in M. f x \<le> 0" by (rule AE_upper_bound_inf, auto)
     then have "AE x in M. f x = 0" using assms(1) by auto
     then show False using assms(2) by auto
   qed
   then obtain e where e: "e>0" "{x \<in> space M. f x \<ge> e} \<notin> null_sets M" by auto
   define A where "A = {x \<in> space M. f x \<ge> e}"
   have 1 [measurable]: "A \<in> sets M" unfolding A_def by auto
   have 2: "emeasure M A > 0"
     using e(2) A_def \<open>A \<in> sets M\<close> by auto
   have 3: "\<And>x. x \<in> A \<Longrightarrow> f x \<ge> e" unfolding A_def by auto
   show ?thesis
     using e(1) 1 2 3 by blast
 qed
 
 subsection "Simple function"
 
 text \<open>
 
 Our simple functions are not restricted to nonnegative real numbers. Instead
 they are just functions with a finite range and are measurable when singleton
 sets are measurable.
 
 \<close>
 
 definition\<^marker>\<open>tag important\<close> "simple_function M g \<longleftrightarrow>
     finite (g ` space M) \<and>
     (\<forall>x \<in> g ` space M. g -` {x} \<inter> space M \<in> sets M)"
 
 lemma simple_functionD:
   assumes "simple_function M g"
   shows "finite (g ` space M)" and "g -` X \<inter> space M \<in> sets M"
 proof -
   show "finite (g ` space M)"
     using assms unfolding simple_function_def by auto
   have "g -` X \<inter> space M = g -` (X \<inter> g`space M) \<inter> space M" by auto
   also have "\<dots> = (\<Union>x\<in>X \<inter> g`space M. g-`{x} \<inter> space M)" by auto
   finally show "g -` X \<inter> space M \<in> sets M" using assms
     by (auto simp del: UN_simps simp: simple_function_def)
 qed
 
 lemma measurable_simple_function[measurable_dest]:
   "simple_function M f \<Longrightarrow> f \<in> measurable M (count_space UNIV)"
   unfolding simple_function_def measurable_def
 proof safe
   fix A assume "finite (f ` space M)" "\<forall>x\<in>f ` space M. f -` {x} \<inter> space M \<in> sets M"
   then have "(\<Union>x\<in>f ` space M. if x \<in> A then f -` {x} \<inter> space M else {}) \<in> sets M"
     by (intro sets.finite_UN) auto
   also have "(\<Union>x\<in>f ` space M. if x \<in> A then f -` {x} \<inter> space M else {}) = f -` A \<inter> space M"
     by (auto split: if_split_asm)
   finally show "f -` A \<inter> space M \<in> sets M" .
 qed simp
 
 lemma borel_measurable_simple_function:
   "simple_function M f \<Longrightarrow> f \<in> borel_measurable M"
   by (auto dest!: measurable_simple_function simp: measurable_def)
 
 lemma simple_function_measurable2[intro]:
   assumes "simple_function M f" "simple_function M g"
   shows "f -` A \<inter> g -` B \<inter> space M \<in> sets M"
 proof -
   have "f -` A \<inter> g -` B \<inter> space M = (f -` A \<inter> space M) \<inter> (g -` B \<inter> space M)"
     by auto
   then show ?thesis using assms[THEN simple_functionD(2)] by auto
 qed
 
 lemma simple_function_indicator_representation:
   fixes f ::"'a \<Rightarrow> ennreal"
   assumes f: "simple_function M f" and x: "x \<in> space M"
   shows "f x = (\<Sum>y \<in> f ` space M. y * indicator (f -` {y} \<inter> space M) x)"
   (is "?l = ?r")
 proof -
   have "?r = (\<Sum>y \<in> f ` space M.
     (if y = f x then y * indicator (f -` {y} \<inter> space M) x else 0))"
     by (auto intro!: sum.cong)
   also have "... =  f x *  indicator (f -` {f x} \<inter> space M) x"
     using assms by (auto dest: simple_functionD)
   also have "... = f x" using x by (auto simp: indicator_def)
   finally show ?thesis by auto
 qed
 
 lemma simple_function_notspace:
   "simple_function M (\<lambda>x. h x * indicator (- space M) x::ennreal)" (is "simple_function M ?h")
 proof -
   have "?h ` space M \<subseteq> {0}" unfolding indicator_def by auto
   hence [simp, intro]: "finite (?h ` space M)" by (auto intro: finite_subset)
   have "?h -` {0} \<inter> space M = space M" by auto
   thus ?thesis unfolding simple_function_def by (auto simp add: image_constant_conv)
 qed
 
 lemma simple_function_cong:
   assumes "\<And>t. t \<in> space M \<Longrightarrow> f t = g t"
   shows "simple_function M f \<longleftrightarrow> simple_function M g"
 proof -
   have "\<And>x. f -` {x} \<inter> space M = g -` {x} \<inter> space M"
     using assms by auto
   with assms show ?thesis
     by (simp add: simple_function_def cong: image_cong)
 qed
 
 lemma simple_function_cong_algebra:
   assumes "sets N = sets M" "space N = space M"
   shows "simple_function M f \<longleftrightarrow> simple_function N f"
   unfolding simple_function_def assms ..
 
 lemma simple_function_borel_measurable:
   fixes f :: "'a \<Rightarrow> 'x::{t2_space}"
   assumes "f \<in> borel_measurable M" and "finite (f ` space M)"
   shows "simple_function M f"
   using assms unfolding simple_function_def
   by (auto intro: borel_measurable_vimage)
 
 lemma simple_function_iff_borel_measurable:
   fixes f :: "'a \<Rightarrow> 'x::{t2_space}"
   shows "simple_function M f \<longleftrightarrow> finite (f ` space M) \<and> f \<in> borel_measurable M"
   by (metis borel_measurable_simple_function simple_functionD(1) simple_function_borel_measurable)
 
 lemma simple_function_eq_measurable:
   "simple_function M f \<longleftrightarrow> finite (f`space M) \<and> f \<in> measurable M (count_space UNIV)"
   using measurable_simple_function[of M f] by (fastforce simp: simple_function_def)
 
 lemma simple_function_const[intro, simp]:
   "simple_function M (\<lambda>x. c)"
   by (auto intro: finite_subset simp: simple_function_def)
 lemma simple_function_compose[intro, simp]:
   assumes "simple_function M f"
   shows "simple_function M (g \<circ> f)"
   unfolding simple_function_def
 proof safe
   show "finite ((g \<circ> f) ` space M)"
     using assms unfolding simple_function_def image_comp [symmetric] by auto
 next
   fix x assume "x \<in> space M"
   let ?G = "g -` {g (f x)} \<inter> (f`space M)"
   have *: "(g \<circ> f) -` {(g \<circ> f) x} \<inter> space M =
     (\<Union>x\<in>?G. f -` {x} \<inter> space M)" by auto
   show "(g \<circ> f) -` {(g \<circ> f) x} \<inter> space M \<in> sets M"
     using assms unfolding simple_function_def *
     by (rule_tac sets.finite_UN) auto
 qed
 
 lemma simple_function_indicator[intro, simp]:
   assumes "A \<in> sets M"
   shows "simple_function M (indicator A)"
 proof -
   have "indicator A ` space M \<subseteq> {0, 1}" (is "?S \<subseteq> _")
     by (auto simp: indicator_def)
   hence "finite ?S" by (rule finite_subset) simp
   moreover have "- A \<inter> space M = space M - A" by auto
   ultimately show ?thesis unfolding simple_function_def
     using assms by (auto simp: indicator_def [abs_def])
 qed
 
 lemma simple_function_Pair[intro, simp]:
   assumes "simple_function M f"
   assumes "simple_function M g"
   shows "simple_function M (\<lambda>x. (f x, g x))" (is "simple_function M ?p")
   unfolding simple_function_def
 proof safe
   show "finite (?p ` space M)"
     using assms unfolding simple_function_def
     by (rule_tac finite_subset[of _ "f`space M \<times> g`space M"]) auto
 next
   fix x assume "x \<in> space M"
   have "(\<lambda>x. (f x, g x)) -` {(f x, g x)} \<inter> space M =
       (f -` {f x} \<inter> space M) \<inter> (g -` {g x} \<inter> space M)"
     by auto
   with \<open>x \<in> space M\<close> show "(\<lambda>x. (f x, g x)) -` {(f x, g x)} \<inter> space M \<in> sets M"
     using assms unfolding simple_function_def by auto
 qed
 
 lemma simple_function_compose1:
   assumes "simple_function M f"
   shows "simple_function M (\<lambda>x. g (f x))"
   using simple_function_compose[OF assms, of g]
   by (simp add: comp_def)
 
 lemma simple_function_compose2:
   assumes "simple_function M f" and "simple_function M g"
   shows "simple_function M (\<lambda>x. h (f x) (g x))"
 proof -
   have "simple_function M ((\<lambda>(x, y). h x y) \<circ> (\<lambda>x. (f x, g x)))"
     using assms by auto
   thus ?thesis by (simp_all add: comp_def)
 qed
 
 lemmas simple_function_add[intro, simp] = simple_function_compose2[where h="(+)"]
   and simple_function_diff[intro, simp] = simple_function_compose2[where h="(-)"]
   and simple_function_uminus[intro, simp] = simple_function_compose[where g="uminus"]
   and simple_function_mult[intro, simp] = simple_function_compose2[where h="(*)"]
   and simple_function_div[intro, simp] = simple_function_compose2[where h="(/)"]
   and simple_function_inverse[intro, simp] = simple_function_compose[where g="inverse"]
   and simple_function_max[intro, simp] = simple_function_compose2[where h=max]
 
 lemma simple_function_sum[intro, simp]:
   assumes "\<And>i. i \<in> P \<Longrightarrow> simple_function M (f i)"
   shows "simple_function M (\<lambda>x. \<Sum>i\<in>P. f i x)"
 proof cases
   assume "finite P" from this assms show ?thesis by induct auto
 qed auto
 
 lemma simple_function_ennreal[intro, simp]:
   fixes f g :: "'a \<Rightarrow> real" assumes sf: "simple_function M f"
   shows "simple_function M (\<lambda>x. ennreal (f x))"
   by (rule simple_function_compose1[OF sf])
 
 lemma simple_function_real_of_nat[intro, simp]:
   fixes f g :: "'a \<Rightarrow> nat" assumes sf: "simple_function M f"
   shows "simple_function M (\<lambda>x. real (f x))"
   by (rule simple_function_compose1[OF sf])
 
 lemma\<^marker>\<open>tag important\<close> borel_measurable_implies_simple_function_sequence:
   fixes u :: "'a \<Rightarrow> ennreal"
   assumes u[measurable]: "u \<in> borel_measurable M"
   shows "\<exists>f. incseq f \<and> (\<forall>i. (\<forall>x. f i x < top) \<and> simple_function M (f i)) \<and> u = (SUP i. f i)"
 proof -
   define f where [abs_def]:
     "f i x = real_of_int (floor (enn2real (min i (u x)) * 2^i)) / 2^i" for i x
 
   have [simp]: "0 \<le> f i x" for i x
     by (auto simp: f_def intro!: divide_nonneg_nonneg mult_nonneg_nonneg enn2real_nonneg)
 
   have *: "2^n * real_of_int x = real_of_int (2^n * x)" for n x
     by simp
 
   have "real_of_int \<lfloor>real i * 2 ^ i\<rfloor> = real_of_int \<lfloor>i * 2 ^ i\<rfloor>" for i
     by (intro arg_cong[where f=real_of_int]) simp
   then have [simp]: "real_of_int \<lfloor>real i * 2 ^ i\<rfloor> = i * 2 ^ i" for i
     unfolding floor_of_nat by simp
 
   have "incseq f"
   proof (intro monoI le_funI)
     fix m n :: nat and x assume "m \<le> n"
     moreover
     { fix d :: nat
       have "\<lfloor>2^d::real\<rfloor> * \<lfloor>2^m * enn2real (min (of_nat m) (u x))\<rfloor> \<le>
         \<lfloor>2^d * (2^m * enn2real (min (of_nat m) (u x)))\<rfloor>"
         by (rule le_mult_floor) (auto)
       also have "\<dots> \<le> \<lfloor>2^d * (2^m * enn2real (min (of_nat d + of_nat m) (u x)))\<rfloor>"
         by (intro floor_mono mult_mono enn2real_mono min.mono)
            (auto simp: min_less_iff_disj of_nat_less_top)
       finally have "f m x \<le> f (m + d) x"
         unfolding f_def
         by (auto simp: field_simps power_add * simp del: of_int_mult) }
     ultimately show "f m x \<le> f n x"
       by (auto simp add: le_iff_add)
   qed
   then have inc_f: "incseq (\<lambda>i. ennreal (f i x))" for x
     by (auto simp: incseq_def le_fun_def)
   then have "incseq (\<lambda>i x. ennreal (f i x))"
     by (auto simp: incseq_def le_fun_def)
   moreover
   have "simple_function M (f i)" for i
   proof (rule simple_function_borel_measurable)
     have "\<lfloor>enn2real (min (of_nat i) (u x)) * 2 ^ i\<rfloor> \<le> \<lfloor>int i * 2 ^ i\<rfloor>" for x
       by (cases "u x" rule: ennreal_cases)
          (auto split: split_min intro!: floor_mono)
     then have "f i ` space M \<subseteq> (\<lambda>n. real_of_int n / 2^i) ` {0 .. of_nat i * 2^i}"
       unfolding floor_of_int by (auto simp: f_def intro!: imageI)
     then show "finite (f i ` space M)"
       by (rule finite_subset) auto
     show "f i \<in> borel_measurable M"
       unfolding f_def enn2real_def by measurable
   qed
   moreover
   { fix x
     have "(SUP i. ennreal (f i x)) = u x"
     proof (cases "u x" rule: ennreal_cases)
       case top then show ?thesis
         by (simp add: f_def inf_min[symmetric] ennreal_of_nat_eq_real_of_nat[symmetric]
                       ennreal_SUP_of_nat_eq_top)
     next
       case (real r)
       obtain n where "r \<le> of_nat n" using real_arch_simple by auto
       then have min_eq_r: "\<forall>\<^sub>F x in sequentially. min (real x) r = r"
         by (auto simp: eventually_sequentially intro!: exI[of _ n] split: split_min)
 
       have "(\<lambda>i. real_of_int \<lfloor>min (real i) r * 2^i\<rfloor> / 2^i) \<longlonglongrightarrow> r"
       proof (rule tendsto_sandwich)
         show "(\<lambda>n. r - (1/2)^n) \<longlonglongrightarrow> r"
           by (auto intro!: tendsto_eq_intros LIMSEQ_power_zero)
         show "\<forall>\<^sub>F n in sequentially. real_of_int \<lfloor>min (real n) r * 2 ^ n\<rfloor> / 2 ^ n \<le> r"
           using min_eq_r by eventually_elim (auto simp: field_simps)
         have *: "r * (2 ^ n * 2 ^ n) \<le> 2^n + 2^n * real_of_int \<lfloor>r * 2 ^ n\<rfloor>" for n
           using real_of_int_floor_ge_diff_one[of "r * 2^n", THEN mult_left_mono, of "2^n"]
           by (auto simp: field_simps)
         show "\<forall>\<^sub>F n in sequentially. r - (1/2)^n \<le> real_of_int \<lfloor>min (real n) r * 2 ^ n\<rfloor> / 2 ^ n"
           using min_eq_r by eventually_elim (insert *, auto simp: field_simps)
       qed auto
       then have "(\<lambda>i. ennreal (f i x)) \<longlonglongrightarrow> ennreal r"
         by (simp add: real f_def ennreal_of_nat_eq_real_of_nat min_ennreal)
       from LIMSEQ_unique[OF LIMSEQ_SUP[OF inc_f] this]
       show ?thesis
         by (simp add: real)
     qed }
   ultimately show ?thesis
     by (intro exI [of _ "\<lambda>i x. ennreal (f i x)"]) (auto simp add: image_comp)
 qed
 
 lemma borel_measurable_implies_simple_function_sequence':
   fixes u :: "'a \<Rightarrow> ennreal"
   assumes u: "u \<in> borel_measurable M"
   obtains f where
     "\<And>i. simple_function M (f i)" "incseq f" "\<And>i x. f i x < top" "\<And>x. (SUP i. f i x) = u x"
   using borel_measurable_implies_simple_function_sequence [OF u]
   by (metis SUP_apply)
 
 lemma\<^marker>\<open>tag important\<close> simple_function_induct
     [consumes 1, case_names cong set mult add, induct set: simple_function]:
   fixes u :: "'a \<Rightarrow> ennreal"
   assumes u: "simple_function M u"
   assumes cong: "\<And>f g. simple_function M f \<Longrightarrow> simple_function M g \<Longrightarrow> (AE x in M. f x = g x) \<Longrightarrow> P f \<Longrightarrow> P g"
   assumes set: "\<And>A. A \<in> sets M \<Longrightarrow> P (indicator A)"
   assumes mult: "\<And>u c. P u \<Longrightarrow> P (\<lambda>x. c * u x)"
   assumes add: "\<And>u v. P u \<Longrightarrow> P v \<Longrightarrow> P (\<lambda>x. v x + u x)"
   shows "P u"
 proof (rule cong)
   from AE_space show "AE x in M. (\<Sum>y\<in>u ` space M. y * indicator (u -` {y} \<inter> space M) x) = u x"
   proof eventually_elim
     fix x assume x: "x \<in> space M"
     from simple_function_indicator_representation[OF u x]
     show "(\<Sum>y\<in>u ` space M. y * indicator (u -` {y} \<inter> space M) x) = u x" ..
   qed
 next
   from u have "finite (u ` space M)"
     unfolding simple_function_def by auto
   then show "P (\<lambda>x. \<Sum>y\<in>u ` space M. y * indicator (u -` {y} \<inter> space M) x)"
   proof induct
     case empty show ?case
       using set[of "{}"] by (simp add: indicator_def[abs_def])
   qed (auto intro!: add mult set simple_functionD u)
 next
   show "simple_function M (\<lambda>x. (\<Sum>y\<in>u ` space M. y * indicator (u -` {y} \<inter> space M) x))"
     apply (subst simple_function_cong)
     apply (rule simple_function_indicator_representation[symmetric])
     apply (auto intro: u)
     done
 qed fact
 
 lemma simple_function_induct_nn[consumes 1, case_names cong set mult add]:
   fixes u :: "'a \<Rightarrow> ennreal"
   assumes u: "simple_function M u"
   assumes cong: "\<And>f g. simple_function M f \<Longrightarrow> simple_function M g \<Longrightarrow> (\<And>x. x \<in> space M \<Longrightarrow> f x = g x) \<Longrightarrow> P f \<Longrightarrow> P g"
   assumes set: "\<And>A. A \<in> sets M \<Longrightarrow> P (indicator A)"
   assumes mult: "\<And>u c. simple_function M u \<Longrightarrow> P u \<Longrightarrow> P (\<lambda>x. c * u x)"
   assumes add: "\<And>u v. simple_function M u \<Longrightarrow> P u \<Longrightarrow> simple_function M v \<Longrightarrow> (\<And>x. x \<in> space M \<Longrightarrow> u x = 0 \<or> v x = 0) \<Longrightarrow> P v \<Longrightarrow> P (\<lambda>x. v x + u x)"
   shows "P u"
 proof -
   show ?thesis
   proof (rule cong)
     fix x assume x: "x \<in> space M"
     from simple_function_indicator_representation[OF u x]
     show "(\<Sum>y\<in>u ` space M. y * indicator (u -` {y} \<inter> space M) x) = u x" ..
   next
     show "simple_function M (\<lambda>x. (\<Sum>y\<in>u ` space M. y * indicator (u -` {y} \<inter> space M) x))"
       apply (subst simple_function_cong)
       apply (rule simple_function_indicator_representation[symmetric])
       apply (auto intro: u)
       done
   next
     from u have "finite (u ` space M)"
       unfolding simple_function_def by auto
     then show "P (\<lambda>x. \<Sum>y\<in>u ` space M. y * indicator (u -` {y} \<inter> space M) x)"
     proof induct
       case empty show ?case
         using set[of "{}"] by (simp add: indicator_def[abs_def])
     next
       case (insert x S)
       { fix z have "(\<Sum>y\<in>S. y * indicator (u -` {y} \<inter> space M) z) = 0 \<or>
           x * indicator (u -` {x} \<inter> space M) z = 0"
           using insert by (subst sum_eq_0_iff) (auto simp: indicator_def) }
       note disj = this
       from insert show ?case
         by (auto intro!: add mult set simple_functionD u simple_function_sum disj)
     qed
   qed fact
 qed
 
 lemma\<^marker>\<open>tag important\<close> borel_measurable_induct
     [consumes 1, case_names cong set mult add seq, induct set: borel_measurable]:
   fixes u :: "'a \<Rightarrow> ennreal"
   assumes u: "u \<in> borel_measurable M"
   assumes cong: "\<And>f g. f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow> (\<And>x. x \<in> space M \<Longrightarrow> f x = g x) \<Longrightarrow> P g \<Longrightarrow> P f"
   assumes set: "\<And>A. A \<in> sets M \<Longrightarrow> P (indicator A)"
   assumes mult': "\<And>u c. c < top \<Longrightarrow> u \<in> borel_measurable M \<Longrightarrow> (\<And>x. x \<in> space M \<Longrightarrow> u x < top) \<Longrightarrow> P u \<Longrightarrow> P (\<lambda>x. c * u x)"
   assumes add: "\<And>u v. u \<in> borel_measurable M\<Longrightarrow> (\<And>x. x \<in> space M \<Longrightarrow> u x < top) \<Longrightarrow> P u \<Longrightarrow> v \<in> borel_measurable M \<Longrightarrow> (\<And>x. x \<in> space M \<Longrightarrow> v x < top) \<Longrightarrow> (\<And>x. x \<in> space M \<Longrightarrow> u x = 0 \<or> v x = 0) \<Longrightarrow> P v \<Longrightarrow> P (\<lambda>x. v x + u x)"
   assumes seq: "\<And>U. (\<And>i. U i \<in> borel_measurable M) \<Longrightarrow> (\<And>i x. x \<in> space M \<Longrightarrow> U i x < top) \<Longrightarrow> (\<And>i. P (U i)) \<Longrightarrow> incseq U \<Longrightarrow> u = (SUP i. U i) \<Longrightarrow> P (SUP i. U i)"
   shows "P u"
   using u
 proof (induct rule: borel_measurable_implies_simple_function_sequence')
   fix U assume U: "\<And>i. simple_function M (U i)" "incseq U" "\<And>i x. U i x < top" and sup: "\<And>x. (SUP i. U i x) = u x"
   have u_eq: "u = (SUP i. U i)"
     using u by (auto simp add: image_comp sup)
 
   have not_inf: "\<And>x i. x \<in> space M \<Longrightarrow> U i x < top"
     using U by (auto simp: image_iff eq_commute)
 
   from U have "\<And>i. U i \<in> borel_measurable M"
     by (simp add: borel_measurable_simple_function)
 
   show "P u"
     unfolding u_eq
   proof (rule seq)
     fix i show "P (U i)"
       using \<open>simple_function M (U i)\<close> not_inf[of _ i]
     proof (induct rule: simple_function_induct_nn)
       case (mult u c)
       show ?case
       proof cases
         assume "c = 0 \<or> space M = {} \<or> (\<forall>x\<in>space M. u x = 0)"
         with mult(1) show ?thesis
           by (intro cong[of "\<lambda>x. c * u x" "indicator {}"] set)
              (auto dest!: borel_measurable_simple_function)
       next
         assume "\<not> (c = 0 \<or> space M = {} \<or> (\<forall>x\<in>space M. u x = 0))"
         then obtain x where "space M \<noteq> {}" and x: "x \<in> space M" "u x \<noteq> 0" "c \<noteq> 0"
           by auto
         with mult(3)[of x] have "c < top"
           by (auto simp: ennreal_mult_less_top)
         then have u_fin: "x' \<in> space M \<Longrightarrow> u x' < top" for x'
           using mult(3)[of x'] \<open>c \<noteq> 0\<close> by (auto simp: ennreal_mult_less_top)
         then have "P u"
           by (rule mult)
         with u_fin \<open>c < top\<close> mult(1) show ?thesis
           by (intro mult') (auto dest!: borel_measurable_simple_function)
       qed
     qed (auto intro: cong intro!: set add dest!: borel_measurable_simple_function)
   qed fact+
 qed
 
 lemma simple_function_If_set:
   assumes sf: "simple_function M f" "simple_function M g" and A: "A \<inter> space M \<in> sets M"
   shows "simple_function M (\<lambda>x. if x \<in> A then f x else g x)" (is "simple_function M ?IF")
 proof -
   define F where "F x = f -` {x} \<inter> space M" for x
   define G where "G x = g -` {x} \<inter> space M" for x
   show ?thesis unfolding simple_function_def
   proof safe
     have "?IF ` space M \<subseteq> f ` space M \<union> g ` space M" by auto
     from finite_subset[OF this] assms
     show "finite (?IF ` space M)" unfolding simple_function_def by auto
   next
     fix x assume "x \<in> space M"
     then have *: "?IF -` {?IF x} \<inter> space M = (if x \<in> A
       then ((F (f x) \<inter> (A \<inter> space M)) \<union> (G (f x) - (G (f x) \<inter> (A \<inter> space M))))
       else ((F (g x) \<inter> (A \<inter> space M)) \<union> (G (g x) - (G (g x) \<inter> (A \<inter> space M)))))"
       using sets.sets_into_space[OF A] by (auto split: if_split_asm simp: G_def F_def)
     have [intro]: "\<And>x. F x \<in> sets M" "\<And>x. G x \<in> sets M"
       unfolding F_def G_def using sf[THEN simple_functionD(2)] by auto
     show "?IF -` {?IF x} \<inter> space M \<in> sets M" unfolding * using A by auto
   qed
 qed
 
 lemma simple_function_If:
   assumes sf: "simple_function M f" "simple_function M g" and P: "{x\<in>space M. P x} \<in> sets M"
   shows "simple_function M (\<lambda>x. if P x then f x else g x)"
 proof -
   have "{x\<in>space M. P x} = {x. P x} \<inter> space M" by auto
   with simple_function_If_set[OF sf, of "{x. P x}"] P show ?thesis by simp
 qed
 
 lemma simple_function_subalgebra:
   assumes "simple_function N f"
   and N_subalgebra: "sets N \<subseteq> sets M" "space N = space M"
   shows "simple_function M f"
   using assms unfolding simple_function_def by auto
 
 lemma simple_function_comp:
   assumes T: "T \<in> measurable M M'"
     and f: "simple_function M' f"
   shows "simple_function M (\<lambda>x. f (T x))"
 proof (intro simple_function_def[THEN iffD2] conjI ballI)
   have "(\<lambda>x. f (T x)) ` space M \<subseteq> f ` space M'"
     using T unfolding measurable_def by auto
   then show "finite ((\<lambda>x. f (T x)) ` space M)"
     using f unfolding simple_function_def by (auto intro: finite_subset)
   fix i assume i: "i \<in> (\<lambda>x. f (T x)) ` space M"
   then have "i \<in> f ` space M'"
     using T unfolding measurable_def by auto
   then have "f -` {i} \<inter> space M' \<in> sets M'"
     using f unfolding simple_function_def by auto
   then have "T -` (f -` {i} \<inter> space M') \<inter> space M \<in> sets M"
     using T unfolding measurable_def by auto
   also have "T -` (f -` {i} \<inter> space M') \<inter> space M = (\<lambda>x. f (T x)) -` {i} \<inter> space M"
     using T unfolding measurable_def by auto
   finally show "(\<lambda>x. f (T x)) -` {i} \<inter> space M \<in> sets M" .
 qed
 
 subsection "Simple integral"
 
 definition\<^marker>\<open>tag important\<close> simple_integral :: "'a measure \<Rightarrow> ('a \<Rightarrow> ennreal) \<Rightarrow> ennreal" ("integral\<^sup>S") where
   "integral\<^sup>S M f = (\<Sum>x \<in> f ` space M. x * emeasure M (f -` {x} \<inter> space M))"
 
 syntax
   "_simple_integral" :: "pttrn \<Rightarrow> ennreal \<Rightarrow> 'a measure \<Rightarrow> ennreal" ("\<integral>\<^sup>S _. _ \<partial>_" [60,61] 110)
 
 translations
   "\<integral>\<^sup>S x. f \<partial>M" == "CONST simple_integral M (%x. f)"
 
 lemma simple_integral_cong:
   assumes "\<And>t. t \<in> space M \<Longrightarrow> f t = g t"
   shows "integral\<^sup>S M f = integral\<^sup>S M g"
 proof -
   have "f ` space M = g ` space M"
     "\<And>x. f -` {x} \<inter> space M = g -` {x} \<inter> space M"
     using assms by (auto intro!: image_eqI)
   thus ?thesis unfolding simple_integral_def by simp
 qed
 
 lemma simple_integral_const[simp]:
   "(\<integral>\<^sup>Sx. c \<partial>M) = c * (emeasure M) (space M)"
 proof (cases "space M = {}")
   case True thus ?thesis unfolding simple_integral_def by simp
 next
   case False hence "(\<lambda>x. c) ` space M = {c}" by auto
   thus ?thesis unfolding simple_integral_def by simp
 qed
 
 lemma simple_function_partition:
   assumes f: "simple_function M f" and g: "simple_function M g"
   assumes sub: "\<And>x y. x \<in> space M \<Longrightarrow> y \<in> space M \<Longrightarrow> g x = g y \<Longrightarrow> f x = f y"
   assumes v: "\<And>x. x \<in> space M \<Longrightarrow> f x = v (g x)"
   shows "integral\<^sup>S M f = (\<Sum>y\<in>g ` space M. v y * emeasure M {x\<in>space M. g x = y})"
     (is "_ = ?r")
 proof -
   from f g have [simp]: "finite (f`space M)" "finite (g`space M)"
     by (auto simp: simple_function_def)
   from f g have [measurable]: "f \<in> measurable M (count_space UNIV)" "g \<in> measurable M (count_space UNIV)"
     by (auto intro: measurable_simple_function)
 
   { fix y assume "y \<in> space M"
     then have "f ` space M \<inter> {i. \<exists>x\<in>space M. i = f x \<and> g y = g x} = {v (g y)}"
       by (auto cong: sub simp: v[symmetric]) }
   note eq = this
 
   have "integral\<^sup>S M f =
     (\<Sum>y\<in>f`space M. y * (\<Sum>z\<in>g`space M.
       if \<exists>x\<in>space M. y = f x \<and> z = g x then emeasure M {x\<in>space M. g x = z} else 0))"
     unfolding simple_integral_def
   proof (safe intro!: sum.cong ennreal_mult_left_cong)
     fix y assume y: "y \<in> space M" "f y \<noteq> 0"
     have [simp]: "g ` space M \<inter> {z. \<exists>x\<in>space M. f y = f x \<and> z = g x} =
         {z. \<exists>x\<in>space M. f y = f x \<and> z = g x}"
       by auto
     have eq:"(\<Union>i\<in>{z. \<exists>x\<in>space M. f y = f x \<and> z = g x}. {x \<in> space M. g x = i}) =
         f -` {f y} \<inter> space M"
       by (auto simp: eq_commute cong: sub rev_conj_cong)
     have "finite (g`space M)" by simp
     then have "finite {z. \<exists>x\<in>space M. f y = f x \<and> z = g x}"
       by (rule rev_finite_subset) auto
     then show "emeasure M (f -` {f y} \<inter> space M) =
       (\<Sum>z\<in>g ` space M. if \<exists>x\<in>space M. f y = f x \<and> z = g x then emeasure M {x \<in> space M. g x = z} else 0)"
       apply (simp add: sum.If_cases)
       apply (subst sum_emeasure)
       apply (auto simp: disjoint_family_on_def eq)
       done
   qed
   also have "\<dots> = (\<Sum>y\<in>f`space M. (\<Sum>z\<in>g`space M.
       if \<exists>x\<in>space M. y = f x \<and> z = g x then y * emeasure M {x\<in>space M. g x = z} else 0))"
     by (auto intro!: sum.cong simp: sum_distrib_left)
   also have "\<dots> = ?r"
     by (subst sum.swap)
        (auto intro!: sum.cong simp: sum.If_cases scaleR_sum_right[symmetric] eq)
   finally show "integral\<^sup>S M f = ?r" .
 qed
 
 lemma simple_integral_add[simp]:
   assumes f: "simple_function M f" and "\<And>x. 0 \<le> f x" and g: "simple_function M g" and "\<And>x. 0 \<le> g x"
   shows "(\<integral>\<^sup>Sx. f x + g x \<partial>M) = integral\<^sup>S M f + integral\<^sup>S M g"
 proof -
   have "(\<integral>\<^sup>Sx. f x + g x \<partial>M) =
     (\<Sum>y\<in>(\<lambda>x. (f x, g x))`space M. (fst y + snd y) * emeasure M {x\<in>space M. (f x, g x) = y})"
     by (intro simple_function_partition) (auto intro: f g)
   also have "\<dots> = (\<Sum>y\<in>(\<lambda>x. (f x, g x))`space M. fst y * emeasure M {x\<in>space M. (f x, g x) = y}) +
     (\<Sum>y\<in>(\<lambda>x. (f x, g x))`space M. snd y * emeasure M {x\<in>space M. (f x, g x) = y})"
     using assms(2,4) by (auto intro!: sum.cong distrib_right simp: sum.distrib[symmetric])
   also have "(\<Sum>y\<in>(\<lambda>x. (f x, g x))`space M. fst y * emeasure M {x\<in>space M. (f x, g x) = y}) = (\<integral>\<^sup>Sx. f x \<partial>M)"
     by (intro simple_function_partition[symmetric]) (auto intro: f g)
   also have "(\<Sum>y\<in>(\<lambda>x. (f x, g x))`space M. snd y * emeasure M {x\<in>space M. (f x, g x) = y}) = (\<integral>\<^sup>Sx. g x \<partial>M)"
     by (intro simple_function_partition[symmetric]) (auto intro: f g)
   finally show ?thesis .
 qed
 
 lemma simple_integral_sum[simp]:
   assumes "\<And>i x. i \<in> P \<Longrightarrow> 0 \<le> f i x"
   assumes "\<And>i. i \<in> P \<Longrightarrow> simple_function M (f i)"
   shows "(\<integral>\<^sup>Sx. (\<Sum>i\<in>P. f i x) \<partial>M) = (\<Sum>i\<in>P. integral\<^sup>S M (f i))"
 proof cases
   assume "finite P"
   from this assms show ?thesis
     by induct (auto)
 qed auto
 
 lemma simple_integral_mult[simp]:
   assumes f: "simple_function M f"
   shows "(\<integral>\<^sup>Sx. c * f x \<partial>M) = c * integral\<^sup>S M f"
 proof -
   have "(\<integral>\<^sup>Sx. c * f x \<partial>M) = (\<Sum>y\<in>f ` space M. (c * y) * emeasure M {x\<in>space M. f x = y})"
     using f by (intro simple_function_partition) auto
   also have "\<dots> = c * integral\<^sup>S M f"
     using f unfolding simple_integral_def
     by (subst sum_distrib_left) (auto simp: mult.assoc Int_def conj_commute)
   finally show ?thesis .
 qed
 
 lemma simple_integral_mono_AE:
   assumes f[measurable]: "simple_function M f" and g[measurable]: "simple_function M g"
   and mono: "AE x in M. f x \<le> g x"
   shows "integral\<^sup>S M f \<le> integral\<^sup>S M g"
 proof -
   let ?\<mu> = "\<lambda>P. emeasure M {x\<in>space M. P x}"
   have "integral\<^sup>S M f = (\<Sum>y\<in>(\<lambda>x. (f x, g x))`space M. fst y * ?\<mu> (\<lambda>x. (f x, g x) = y))"
     using f g by (intro simple_function_partition) auto
   also have "\<dots> \<le> (\<Sum>y\<in>(\<lambda>x. (f x, g x))`space M. snd y * ?\<mu> (\<lambda>x. (f x, g x) = y))"
   proof (clarsimp intro!: sum_mono)
     fix x assume "x \<in> space M"
     let ?M = "?\<mu> (\<lambda>y. f y = f x \<and> g y = g x)"
     show "f x * ?M \<le> g x * ?M"
     proof cases
       assume "?M \<noteq> 0"
       then have "0 < ?M"
         by (simp add: less_le)
       also have "\<dots> \<le> ?\<mu> (\<lambda>y. f x \<le> g x)"
         using mono by (intro emeasure_mono_AE) auto
       finally have "\<not> \<not> f x \<le> g x"
         by (intro notI) auto
       then show ?thesis
         by (intro mult_right_mono) auto
     qed simp
   qed
   also have "\<dots> = integral\<^sup>S M g"
     using f g by (intro simple_function_partition[symmetric]) auto
   finally show ?thesis .
 qed
 
 lemma simple_integral_mono:
   assumes "simple_function M f" and "simple_function M g"
   and mono: "\<And> x. x \<in> space M \<Longrightarrow> f x \<le> g x"
   shows "integral\<^sup>S M f \<le> integral\<^sup>S M g"
   using assms by (intro simple_integral_mono_AE) auto
 
 lemma simple_integral_cong_AE:
   assumes "simple_function M f" and "simple_function M g"
   and "AE x in M. f x = g x"
   shows "integral\<^sup>S M f = integral\<^sup>S M g"
   using assms by (auto simp: eq_iff intro!: simple_integral_mono_AE)
 
 lemma simple_integral_cong':
   assumes sf: "simple_function M f" "simple_function M g"
   and mea: "(emeasure M) {x\<in>space M. f x \<noteq> g x} = 0"
   shows "integral\<^sup>S M f = integral\<^sup>S M g"
 proof (intro simple_integral_cong_AE sf AE_I)
   show "(emeasure M) {x\<in>space M. f x \<noteq> g x} = 0" by fact
   show "{x \<in> space M. f x \<noteq> g x} \<in> sets M"
     using sf[THEN borel_measurable_simple_function] by auto
 qed simp
 
 lemma simple_integral_indicator:
   assumes A: "A \<in> sets M"
   assumes f: "simple_function M f"
   shows "(\<integral>\<^sup>Sx. f x * indicator A x \<partial>M) =
     (\<Sum>x \<in> f ` space M. x * emeasure M (f -` {x} \<inter> space M \<inter> A))"
 proof -
   have eq: "(\<lambda>x. (f x, indicator A x)) ` space M \<inter> {x. snd x = 1} = (\<lambda>x. (f x, 1::ennreal))`A"
     using A[THEN sets.sets_into_space] by (auto simp: indicator_def image_iff split: if_split_asm)
   have eq2: "\<And>x. f x \<notin> f ` A \<Longrightarrow> f -` {f x} \<inter> space M \<inter> A = {}"
     by (auto simp: image_iff)
 
   have "(\<integral>\<^sup>Sx. f x * indicator A x \<partial>M) =
     (\<Sum>y\<in>(\<lambda>x. (f x, indicator A x))`space M. (fst y * snd y) * emeasure M {x\<in>space M. (f x, indicator A x) = y})"
     using assms by (intro simple_function_partition) auto
   also have "\<dots> = (\<Sum>y\<in>(\<lambda>x. (f x, indicator A x::ennreal))`space M.
     if snd y = 1 then fst y * emeasure M (f -` {fst y} \<inter> space M \<inter> A) else 0)"
     by (auto simp: indicator_def split: if_split_asm intro!: arg_cong2[where f="(*)"] arg_cong2[where f=emeasure] sum.cong)
   also have "\<dots> = (\<Sum>y\<in>(\<lambda>x. (f x, 1::ennreal))`A. fst y * emeasure M (f -` {fst y} \<inter> space M \<inter> A))"
     using assms by (subst sum.If_cases) (auto intro!: simple_functionD(1) simp: eq)
   also have "\<dots> = (\<Sum>y\<in>fst`(\<lambda>x. (f x, 1::ennreal))`A. y * emeasure M (f -` {y} \<inter> space M \<inter> A))"
     by (subst sum.reindex [of fst]) (auto simp: inj_on_def)
   also have "\<dots> = (\<Sum>x \<in> f ` space M. x * emeasure M (f -` {x} \<inter> space M \<inter> A))"
     using A[THEN sets.sets_into_space]
     by (intro sum.mono_neutral_cong_left simple_functionD f) (auto simp: image_comp comp_def eq2)
   finally show ?thesis .
 qed
 
 lemma simple_integral_indicator_only[simp]:
   assumes "A \<in> sets M"
   shows "integral\<^sup>S M (indicator A) = emeasure M A"
   using simple_integral_indicator[OF assms, of "\<lambda>x. 1"] sets.sets_into_space[OF assms]
   by (simp_all add: image_constant_conv Int_absorb1 split: if_split_asm)
 
 lemma simple_integral_null_set:
   assumes "simple_function M u" "\<And>x. 0 \<le> u x" and "N \<in> null_sets M"
   shows "(\<integral>\<^sup>Sx. u x * indicator N x \<partial>M) = 0"
 proof -
   have "AE x in M. indicator N x = (0 :: ennreal)"
     using \<open>N \<in> null_sets M\<close> by (auto simp: indicator_def intro!: AE_I[of _ _ N])
   then have "(\<integral>\<^sup>Sx. u x * indicator N x \<partial>M) = (\<integral>\<^sup>Sx. 0 \<partial>M)"
     using assms apply (intro simple_integral_cong_AE) by auto
   then show ?thesis by simp
 qed
 
 lemma simple_integral_cong_AE_mult_indicator:
   assumes sf: "simple_function M f" and eq: "AE x in M. x \<in> S" and "S \<in> sets M"
   shows "integral\<^sup>S M f = (\<integral>\<^sup>Sx. f x * indicator S x \<partial>M)"
   using assms by (intro simple_integral_cong_AE) auto
 
 lemma simple_integral_cmult_indicator:
   assumes A: "A \<in> sets M"
   shows "(\<integral>\<^sup>Sx. c * indicator A x \<partial>M) = c * emeasure M A"
   using simple_integral_mult[OF simple_function_indicator[OF A]]
   unfolding simple_integral_indicator_only[OF A] by simp
 
 lemma simple_integral_nonneg:
   assumes f: "simple_function M f" and ae: "AE x in M. 0 \<le> f x"
   shows "0 \<le> integral\<^sup>S M f"
 proof -
   have "integral\<^sup>S M (\<lambda>x. 0) \<le> integral\<^sup>S M f"
     using simple_integral_mono_AE[OF _ f ae] by auto
   then show ?thesis by simp
 qed
 
 subsection \<open>Integral on nonnegative functions\<close>
 
 definition\<^marker>\<open>tag important\<close> nn_integral :: "'a measure \<Rightarrow> ('a \<Rightarrow> ennreal) \<Rightarrow> ennreal" ("integral\<^sup>N") where
   "integral\<^sup>N M f = (SUP g \<in> {g. simple_function M g \<and> g \<le> f}. integral\<^sup>S M g)"
 
 syntax
   "_nn_integral" :: "pttrn \<Rightarrow> ennreal \<Rightarrow> 'a measure \<Rightarrow> ennreal" ("\<integral>\<^sup>+((2 _./ _)/ \<partial>_)" [60,61] 110)
 
 translations
   "\<integral>\<^sup>+x. f \<partial>M" == "CONST nn_integral M (\<lambda>x. f)"
 
 lemma nn_integral_def_finite:
   "integral\<^sup>N M f = (SUP g \<in> {g. simple_function M g \<and> g \<le> f \<and> (\<forall>x. g x < top)}. integral\<^sup>S M g)"
     (is "_ = Sup (?A ` ?f)")
   unfolding nn_integral_def
 proof (safe intro!: antisym SUP_least)
   fix g assume g[measurable]: "simple_function M g" "g \<le> f"
 
   show "integral\<^sup>S M g \<le> Sup (?A ` ?f)"
   proof cases
     assume ae: "AE x in M. g x \<noteq> top"
     let ?G = "{x \<in> space M. g x \<noteq> top}"
     have "integral\<^sup>S M g = integral\<^sup>S M (\<lambda>x. g x * indicator ?G x)"
     proof (rule simple_integral_cong_AE)
       show "AE x in M. g x = g x * indicator ?G x"
         using ae AE_space by eventually_elim auto
     qed (insert g, auto)
     also have "\<dots> \<le> Sup (?A ` ?f)"
       using g by (intro SUP_upper) (auto simp: le_fun_def less_top split: split_indicator)
     finally show ?thesis .
   next
     assume nAE: "\<not> (AE x in M. g x \<noteq> top)"
     then have "emeasure M {x\<in>space M. g x = top} \<noteq> 0" (is "emeasure M ?G \<noteq> 0")
       by (subst (asm) AE_iff_measurable[OF _ refl]) auto
     then have "top = (SUP n. (\<integral>\<^sup>Sx. of_nat n * indicator ?G x \<partial>M))"
       by (simp add: ennreal_SUP_of_nat_eq_top ennreal_top_eq_mult_iff SUP_mult_right_ennreal[symmetric])
     also have "\<dots> \<le> Sup (?A ` ?f)"
       using g
       by (safe intro!: SUP_least SUP_upper)
          (auto simp: le_fun_def of_nat_less_top top_unique[symmetric] split: split_indicator
                intro: order_trans[of _ "g x" "f x" for x, OF order_trans[of _ top]])
     finally show ?thesis
       by (simp add: top_unique del: SUP_eq_top_iff Sup_eq_top_iff)
   qed
 qed (auto intro: SUP_upper)
 
 lemma nn_integral_mono_AE:
   assumes ae: "AE x in M. u x \<le> v x" shows "integral\<^sup>N M u \<le> integral\<^sup>N M v"
   unfolding nn_integral_def
 proof (safe intro!: SUP_mono)
   fix n assume n: "simple_function M n" "n \<le> u"
   from ae[THEN AE_E] guess N . note N = this
   then have ae_N: "AE x in M. x \<notin> N" by (auto intro: AE_not_in)
   let ?n = "\<lambda>x. n x * indicator (space M - N) x"
   have "AE x in M. n x \<le> ?n x" "simple_function M ?n"
     using n N ae_N by auto
   moreover
   { fix x have "?n x \<le> v x"
     proof cases
       assume x: "x \<in> space M - N"
       with N have "u x \<le> v x" by auto
       with n(2)[THEN le_funD, of x] x show ?thesis
         by (auto simp: max_def split: if_split_asm)
     qed simp }
   then have "?n \<le> v" by (auto simp: le_funI)
   moreover have "integral\<^sup>S M n \<le> integral\<^sup>S M ?n"
     using ae_N N n by (auto intro!: simple_integral_mono_AE)
   ultimately show "\<exists>m\<in>{g. simple_function M g \<and> g \<le> v}. integral\<^sup>S M n \<le> integral\<^sup>S M m"
     by force
 qed
 
 lemma nn_integral_mono:
   "(\<And>x. x \<in> space M \<Longrightarrow> u x \<le> v x) \<Longrightarrow> integral\<^sup>N M u \<le> integral\<^sup>N M v"
   by (auto intro: nn_integral_mono_AE)
 
 lemma mono_nn_integral: "mono F \<Longrightarrow> mono (\<lambda>x. integral\<^sup>N M (F x))"
   by (auto simp add: mono_def le_fun_def intro!: nn_integral_mono)
 
 lemma nn_integral_cong_AE:
   "AE x in M. u x = v x \<Longrightarrow> integral\<^sup>N M u = integral\<^sup>N M v"
   by (auto simp: eq_iff intro!: nn_integral_mono_AE)
 
 lemma nn_integral_cong:
   "(\<And>x. x \<in> space M \<Longrightarrow> u x = v x) \<Longrightarrow> integral\<^sup>N M u = integral\<^sup>N M v"
   by (auto intro: nn_integral_cong_AE)
 
 lemma nn_integral_cong_simp:
   "(\<And>x. x \<in> space M =simp=> u x = v x) \<Longrightarrow> integral\<^sup>N M u = integral\<^sup>N M v"
   by (auto intro: nn_integral_cong simp: simp_implies_def)
 
 lemma incseq_nn_integral:
   assumes "incseq f" shows "incseq (\<lambda>i. integral\<^sup>N M (f i))"
 proof -
   have "\<And>i x. f i x \<le> f (Suc i) x"
     using assms by (auto dest!: incseq_SucD simp: le_fun_def)
   then show ?thesis
     by (auto intro!: incseq_SucI nn_integral_mono)
 qed
 
 lemma nn_integral_eq_simple_integral:
   assumes f: "simple_function M f" shows "integral\<^sup>N M f = integral\<^sup>S M f"
 proof -
   let ?f = "\<lambda>x. f x * indicator (space M) x"
   have f': "simple_function M ?f" using f by auto
   have "integral\<^sup>N M ?f \<le> integral\<^sup>S M ?f" using f'
     by (force intro!: SUP_least simple_integral_mono simp: le_fun_def nn_integral_def)
   moreover have "integral\<^sup>S M ?f \<le> integral\<^sup>N M ?f"
     unfolding nn_integral_def
     using f' by (auto intro!: SUP_upper)
   ultimately show ?thesis
     by (simp cong: nn_integral_cong simple_integral_cong)
 qed
 
 text \<open>Beppo-Levi monotone convergence theorem\<close>
 lemma nn_integral_monotone_convergence_SUP:
   assumes f: "incseq f" and [measurable]: "\<And>i. f i \<in> borel_measurable M"
   shows "(\<integral>\<^sup>+ x. (SUP i. f i x) \<partial>M) = (SUP i. integral\<^sup>N M (f i))"
 proof (rule antisym)
   show "(\<integral>\<^sup>+ x. (SUP i. f i x) \<partial>M) \<le> (SUP i. (\<integral>\<^sup>+ x. f i x \<partial>M))"
     unfolding nn_integral_def_finite[of _ "\<lambda>x. SUP i. f i x"]
   proof (safe intro!: SUP_least)
     fix u assume sf_u[simp]: "simple_function M u" and
       u: "u \<le> (\<lambda>x. SUP i. f i x)" and u_range: "\<forall>x. u x < top"
     note sf_u[THEN borel_measurable_simple_function, measurable]
     show "integral\<^sup>S M u \<le> (SUP j. \<integral>\<^sup>+x. f j x \<partial>M)"
     proof (rule ennreal_approx_unit)
       fix a :: ennreal assume "a < 1"
       let ?au = "\<lambda>x. a * u x"
 
       let ?B = "\<lambda>c i. {x\<in>space M. ?au x = c \<and> c \<le> f i x}"
       have "integral\<^sup>S M ?au = (\<Sum>c\<in>?au`space M. c * (SUP i. emeasure M (?B c i)))"
         unfolding simple_integral_def
       proof (intro sum.cong ennreal_mult_left_cong refl)
         fix c assume "c \<in> ?au ` space M" "c \<noteq> 0"
         { fix x' assume x': "x' \<in> space M" "?au x' = c"
           with \<open>c \<noteq> 0\<close> u_range have "?au x' < 1 * u x'"
             by (intro ennreal_mult_strict_right_mono \<open>a < 1\<close>) (auto simp: less_le)
           also have "\<dots> \<le> (SUP i. f i x')"
             using u by (auto simp: le_fun_def)
           finally have "\<exists>i. ?au x' \<le> f i x'"
             by (auto simp: less_SUP_iff intro: less_imp_le) }
         then have *: "?au -` {c} \<inter> space M = (\<Union>i. ?B c i)"
           by auto
         show "emeasure M (?au -` {c} \<inter> space M) = (SUP i. emeasure M (?B c i))"
           unfolding * using f
           by (intro SUP_emeasure_incseq[symmetric])
              (auto simp: incseq_def le_fun_def intro: order_trans)
       qed
       also have "\<dots> = (SUP i. \<Sum>c\<in>?au`space M. c * emeasure M (?B c i))"
         unfolding SUP_mult_left_ennreal using f
         by (intro ennreal_SUP_sum[symmetric])
            (auto intro!: mult_mono emeasure_mono simp: incseq_def le_fun_def intro: order_trans)
       also have "\<dots> \<le> (SUP i. integral\<^sup>N M (f i))"
       proof (intro SUP_subset_mono order_refl)
         fix i
         have "(\<Sum>c\<in>?au`space M. c * emeasure M (?B c i)) =
           (\<integral>\<^sup>Sx. (a * u x) * indicator {x\<in>space M. a * u x \<le> f i x} x \<partial>M)"
           by (subst simple_integral_indicator)
              (auto intro!: sum.cong ennreal_mult_left_cong arg_cong2[where f=emeasure])
         also have "\<dots> = (\<integral>\<^sup>+x. (a * u x) * indicator {x\<in>space M. a * u x \<le> f i x} x \<partial>M)"
           by (rule nn_integral_eq_simple_integral[symmetric]) simp
         also have "\<dots> \<le> (\<integral>\<^sup>+x. f i x \<partial>M)"
           by (intro nn_integral_mono) (auto split: split_indicator)
         finally show "(\<Sum>c\<in>?au`space M. c * emeasure M (?B c i)) \<le> (\<integral>\<^sup>+x. f i x \<partial>M)" .
       qed
       finally show "a * integral\<^sup>S M u \<le> (SUP i. integral\<^sup>N M (f i))"
         by simp
     qed
   qed
 qed (auto intro!: SUP_least SUP_upper nn_integral_mono)
 
 lemma sup_continuous_nn_integral[order_continuous_intros]:
   assumes f: "\<And>y. sup_continuous (f y)"
   assumes [measurable]: "\<And>x. (\<lambda>y. f y x) \<in> borel_measurable M"
   shows "sup_continuous (\<lambda>x. (\<integral>\<^sup>+y. f y x \<partial>M))"
   unfolding sup_continuous_def
 proof safe
   fix C :: "nat \<Rightarrow> 'b" assume C: "incseq C"
   with sup_continuous_mono[OF f] show "(\<integral>\<^sup>+ y. f y (Sup (C ` UNIV)) \<partial>M) = (SUP i. \<integral>\<^sup>+ y. f y (C i) \<partial>M)"
     unfolding sup_continuousD[OF f C]
     by (subst nn_integral_monotone_convergence_SUP) (auto simp: mono_def le_fun_def)
 qed
 
 theorem nn_integral_monotone_convergence_SUP_AE:
   assumes f: "\<And>i. AE x in M. f i x \<le> f (Suc i) x" "\<And>i. f i \<in> borel_measurable M"
   shows "(\<integral>\<^sup>+ x. (SUP i. f i x) \<partial>M) = (SUP i. integral\<^sup>N M (f i))"
 proof -
   from f have "AE x in M. \<forall>i. f i x \<le> f (Suc i) x"
     by (simp add: AE_all_countable)
   from this[THEN AE_E] guess N . note N = this
   let ?f = "\<lambda>i x. if x \<in> space M - N then f i x else 0"
   have f_eq: "AE x in M. \<forall>i. ?f i x = f i x" using N by (auto intro!: AE_I[of _ _ N])
   then have "(\<integral>\<^sup>+ x. (SUP i. f i x) \<partial>M) = (\<integral>\<^sup>+ x. (SUP i. ?f i x) \<partial>M)"
     by (auto intro!: nn_integral_cong_AE)
   also have "\<dots> = (SUP i. (\<integral>\<^sup>+ x. ?f i x \<partial>M))"
   proof (rule nn_integral_monotone_convergence_SUP)
     show "incseq ?f" using N(1) by (force intro!: incseq_SucI le_funI)
     { fix i show "(\<lambda>x. if x \<in> space M - N then f i x else 0) \<in> borel_measurable M"
         using f N(3) by (intro measurable_If_set) auto }
   qed
   also have "\<dots> = (SUP i. (\<integral>\<^sup>+ x. f i x \<partial>M))"
     using f_eq by (force intro!: arg_cong[where f = "\<lambda>f. Sup (range f)"] nn_integral_cong_AE ext)
   finally show ?thesis .
 qed
 
 lemma nn_integral_monotone_convergence_simple:
   "incseq f \<Longrightarrow> (\<And>i. simple_function M (f i)) \<Longrightarrow> (SUP i. \<integral>\<^sup>S x. f i x \<partial>M) = (\<integral>\<^sup>+x. (SUP i. f i x) \<partial>M)"
   using nn_integral_monotone_convergence_SUP[of f M]
   by (simp add: nn_integral_eq_simple_integral[symmetric] borel_measurable_simple_function)
 
 lemma SUP_simple_integral_sequences:
   assumes f: "incseq f" "\<And>i. simple_function M (f i)"
   and g: "incseq g" "\<And>i. simple_function M (g i)"
   and eq: "AE x in M. (SUP i. f i x) = (SUP i. g i x)"
   shows "(SUP i. integral\<^sup>S M (f i)) = (SUP i. integral\<^sup>S M (g i))"
     (is "Sup (?F ` _) = Sup (?G ` _)")
 proof -
   have "(SUP i. integral\<^sup>S M (f i)) = (\<integral>\<^sup>+x. (SUP i. f i x) \<partial>M)"
     using f by (rule nn_integral_monotone_convergence_simple)
   also have "\<dots> = (\<integral>\<^sup>+x. (SUP i. g i x) \<partial>M)"
     unfolding eq[THEN nn_integral_cong_AE] ..
   also have "\<dots> = (SUP i. ?G i)"
     using g by (rule nn_integral_monotone_convergence_simple[symmetric])
   finally show ?thesis by simp
 qed
 
 lemma nn_integral_const[simp]: "(\<integral>\<^sup>+ x. c \<partial>M) = c * emeasure M (space M)"
   by (subst nn_integral_eq_simple_integral) auto
 
 lemma nn_integral_linear:
   assumes f: "f \<in> borel_measurable M" and g: "g \<in> borel_measurable M"
   shows "(\<integral>\<^sup>+ x. a * f x + g x \<partial>M) = a * integral\<^sup>N M f + integral\<^sup>N M g"
     (is "integral\<^sup>N M ?L = _")
 proof -
   from borel_measurable_implies_simple_function_sequence'[OF f(1)] guess u .
   note u = nn_integral_monotone_convergence_simple[OF this(2,1)] this
   from borel_measurable_implies_simple_function_sequence'[OF g(1)] guess v .
   note v = nn_integral_monotone_convergence_simple[OF this(2,1)] this
   let ?L' = "\<lambda>i x. a * u i x + v i x"
 
   have "?L \<in> borel_measurable M" using assms by auto
   from borel_measurable_implies_simple_function_sequence'[OF this] guess l .
   note l = nn_integral_monotone_convergence_simple[OF this(2,1)] this
 
   have inc: "incseq (\<lambda>i. a * integral\<^sup>S M (u i))" "incseq (\<lambda>i. integral\<^sup>S M (v i))"
     using u v by (auto simp: incseq_Suc_iff le_fun_def intro!: add_mono mult_left_mono simple_integral_mono)
 
   have l': "(SUP i. integral\<^sup>S M (l i)) = (SUP i. integral\<^sup>S M (?L' i))"
   proof (rule SUP_simple_integral_sequences[OF l(3,2)])
     show "incseq ?L'" "\<And>i. simple_function M (?L' i)"
       using u v unfolding incseq_Suc_iff le_fun_def
       by (auto intro!: add_mono mult_left_mono)
     { fix x
       have "(SUP i. a * u i x + v i x) = a * (SUP i. u i x) + (SUP i. v i x)"
         using u(3) v(3) u(4)[of _ x] v(4)[of _ x] unfolding SUP_mult_left_ennreal
         by (auto intro!: ennreal_SUP_add simp: incseq_Suc_iff le_fun_def add_mono mult_left_mono) }
     then show "AE x in M. (SUP i. l i x) = (SUP i. ?L' i x)"
       unfolding l(5) using u(5) v(5) by (intro AE_I2) auto
   qed
   also have "\<dots> = (SUP i. a * integral\<^sup>S M (u i) + integral\<^sup>S M (v i))"
     using u(2) v(2) by auto
   finally show ?thesis
     unfolding l(5)[symmetric] l(1)[symmetric]
     by (simp add: ennreal_SUP_add[OF inc] v u SUP_mult_left_ennreal[symmetric])
 qed
 
 lemma nn_integral_cmult: "f \<in> borel_measurable M \<Longrightarrow> (\<integral>\<^sup>+ x. c * f x \<partial>M) = c * integral\<^sup>N M f"
   using nn_integral_linear[of f M "\<lambda>x. 0" c] by simp
 
 lemma nn_integral_multc: "f \<in> borel_measurable M \<Longrightarrow> (\<integral>\<^sup>+ x. f x * c \<partial>M) = integral\<^sup>N M f * c"
   unfolding mult.commute[of _ c] nn_integral_cmult by simp
 
 lemma nn_integral_divide: "f \<in> borel_measurable M \<Longrightarrow> (\<integral>\<^sup>+ x. f x / c \<partial>M) = (\<integral>\<^sup>+ x. f x \<partial>M) / c"
    unfolding divide_ennreal_def by (rule nn_integral_multc)
 
 lemma nn_integral_indicator[simp]: "A \<in> sets M \<Longrightarrow> (\<integral>\<^sup>+ x. indicator A x\<partial>M) = (emeasure M) A"
   by (subst nn_integral_eq_simple_integral) (auto simp: simple_integral_indicator)
 
 lemma nn_integral_cmult_indicator: "A \<in> sets M \<Longrightarrow> (\<integral>\<^sup>+ x. c * indicator A x \<partial>M) = c * emeasure M A"
   by (subst nn_integral_eq_simple_integral) (auto)
 
 lemma nn_integral_indicator':
   assumes [measurable]: "A \<inter> space M \<in> sets M"
   shows "(\<integral>\<^sup>+ x. indicator A x \<partial>M) = emeasure M (A \<inter> space M)"
 proof -
   have "(\<integral>\<^sup>+ x. indicator A x \<partial>M) = (\<integral>\<^sup>+ x. indicator (A \<inter> space M) x \<partial>M)"
     by (intro nn_integral_cong) (simp split: split_indicator)
   also have "\<dots> = emeasure M (A \<inter> space M)"
     by simp
   finally show ?thesis .
 qed
 
 lemma nn_integral_indicator_singleton[simp]:
   assumes [measurable]: "{y} \<in> sets M" shows "(\<integral>\<^sup>+x. f x * indicator {y} x \<partial>M) = f y * emeasure M {y}"
 proof -
   have "(\<integral>\<^sup>+x. f x * indicator {y} x \<partial>M) = (\<integral>\<^sup>+x. f y * indicator {y} x \<partial>M)"
     by (auto intro!: nn_integral_cong split: split_indicator)
   then show ?thesis
     by (simp add: nn_integral_cmult)
 qed
 
 lemma nn_integral_set_ennreal:
   "(\<integral>\<^sup>+x. ennreal (f x) * indicator A x \<partial>M) = (\<integral>\<^sup>+x. ennreal (f x * indicator A x) \<partial>M)"
   by (rule nn_integral_cong) (simp split: split_indicator)
 
 lemma nn_integral_indicator_singleton'[simp]:
   assumes [measurable]: "{y} \<in> sets M"
   shows "(\<integral>\<^sup>+x. ennreal (f x * indicator {y} x) \<partial>M) = f y * emeasure M {y}"
   by (subst nn_integral_set_ennreal[symmetric]) (simp)
 
 lemma nn_integral_add:
   "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow> (\<integral>\<^sup>+ x. f x + g x \<partial>M) = integral\<^sup>N M f + integral\<^sup>N M g"
   using nn_integral_linear[of f M g 1] by simp
 
 lemma nn_integral_sum:
   "(\<And>i. i \<in> P \<Longrightarrow> f i \<in> borel_measurable M) \<Longrightarrow> (\<integral>\<^sup>+ x. (\<Sum>i\<in>P. f i x) \<partial>M) = (\<Sum>i\<in>P. integral\<^sup>N M (f i))"
   by (induction P rule: infinite_finite_induct) (auto simp: nn_integral_add)
 
 theorem nn_integral_suminf:
   assumes f: "\<And>i. f i \<in> borel_measurable M"
   shows "(\<integral>\<^sup>+ x. (\<Sum>i. f i x) \<partial>M) = (\<Sum>i. integral\<^sup>N M (f i))"
 proof -
   have all_pos: "AE x in M. \<forall>i. 0 \<le> f i x"
     using assms by (auto simp: AE_all_countable)
   have "(\<Sum>i. integral\<^sup>N M (f i)) = (SUP n. \<Sum>i<n. integral\<^sup>N M (f i))"
     by (rule suminf_eq_SUP)
   also have "\<dots> = (SUP n. \<integral>\<^sup>+x. (\<Sum>i<n. f i x) \<partial>M)"
     unfolding nn_integral_sum[OF f] ..
   also have "\<dots> = \<integral>\<^sup>+x. (SUP n. \<Sum>i<n. f i x) \<partial>M" using f all_pos
     by (intro nn_integral_monotone_convergence_SUP_AE[symmetric])
        (elim AE_mp, auto simp: sum_nonneg simp del: sum.lessThan_Suc intro!: AE_I2 sum_mono2)
   also have "\<dots> = \<integral>\<^sup>+x. (\<Sum>i. f i x) \<partial>M" using all_pos
     by (intro nn_integral_cong_AE) (auto simp: suminf_eq_SUP)
   finally show ?thesis by simp
 qed
 
 lemma nn_integral_bound_simple_function:
   assumes bnd: "\<And>x. x \<in> space M \<Longrightarrow> f x < \<infinity>"
   assumes f[measurable]: "simple_function M f"
   assumes supp: "emeasure M {x\<in>space M. f x \<noteq> 0} < \<infinity>"
   shows "nn_integral M f < \<infinity>"
 proof cases
   assume "space M = {}"
   then have "nn_integral M f = (\<integral>\<^sup>+x. 0 \<partial>M)"
     by (intro nn_integral_cong) auto
   then show ?thesis by simp
 next
   assume "space M \<noteq> {}"
   with simple_functionD(1)[OF f] bnd have bnd: "0 \<le> Max (f`space M) \<and> Max (f`space M) < \<infinity>"
     by (subst Max_less_iff) (auto simp: Max_ge_iff)
 
   have "nn_integral M f \<le> (\<integral>\<^sup>+x. Max (f`space M) * indicator {x\<in>space M. f x \<noteq> 0} x \<partial>M)"
   proof (rule nn_integral_mono)
     fix x assume "x \<in> space M"
     with f show "f x \<le> Max (f ` space M) * indicator {x \<in> space M. f x \<noteq> 0} x"
       by (auto split: split_indicator intro!: Max_ge simple_functionD)
   qed
   also have "\<dots> < \<infinity>"
     using bnd supp by (subst nn_integral_cmult) (auto simp: ennreal_mult_less_top)
   finally show ?thesis .
 qed
 
 theorem nn_integral_Markov_inequality:
   assumes u: "(\<lambda>x. u x * indicator A x) \<in> borel_measurable M" and "A \<in> sets M"
   shows "(emeasure M) ({x\<in>A. 1 \<le> c * u x}) \<le> c * (\<integral>\<^sup>+ x. u x * indicator A x \<partial>M)"
     (is "(emeasure M) ?A \<le> _ * ?PI")
 proof -
   define u' where "u' = (\<lambda>x. u x * indicator A x)"
   have [measurable]: "u' \<in> borel_measurable M"
     using u unfolding u'_def .
   have "{x\<in>space M. c * u' x \<ge> 1} \<in> sets M"
     by measurable
   also have "{x\<in>space M. c * u' x \<ge> 1} = ?A"
     using sets.sets_into_space[OF \<open>A \<in> sets M\<close>] by (auto simp: u'_def indicator_def)
   finally have "(emeasure M) ?A = (\<integral>\<^sup>+ x. indicator ?A x \<partial>M)"
     using nn_integral_indicator by simp
   also have "\<dots> \<le> (\<integral>\<^sup>+ x. c * (u x * indicator A x) \<partial>M)"
     using u by (auto intro!: nn_integral_mono_AE simp: indicator_def)
   also have "\<dots> = c * (\<integral>\<^sup>+ x. u x * indicator A x \<partial>M)"
     using assms by (auto intro!: nn_integral_cmult)
   finally show ?thesis .
 qed
 
 lemma Chernoff_ineq_nn_integral_ge:
   assumes s: "s > 0" and [measurable]: "A \<in> sets M"
   assumes [measurable]: "(\<lambda>x. f x * indicator A x) \<in> borel_measurable M"
   shows   "emeasure M {x\<in>A. f x \<ge> a} \<le>
            ennreal (exp (-s * a)) * nn_integral M (\<lambda>x. ennreal (exp (s * f x)) * indicator A x)"
 proof -
   define f' where "f' = (\<lambda>x. f x * indicator A x)"
   have [measurable]: "f' \<in> borel_measurable M"
     using assms(3) unfolding f'_def by assumption
   have "(\<lambda>x. ennreal (exp (s * f' x)) * indicator A x) \<in> borel_measurable M"
     by simp
   also have "(\<lambda>x. ennreal (exp (s * f' x)) * indicator A x) =
              (\<lambda>x. ennreal (exp (s * f x)) * indicator A x)"
     by (auto simp: f'_def indicator_def fun_eq_iff)
   finally have meas: "\<dots> \<in> borel_measurable M" .
 
   have "{x\<in>A. f x \<ge> a} = {x\<in>A. ennreal (exp (-s * a)) * ennreal (exp (s * f x)) \<ge> 1}"
     using s by (auto simp: exp_minus field_simps simp flip: ennreal_mult)
   also have "emeasure M \<dots> \<le> ennreal (exp (-s * a)) *
                (\<integral>\<^sup>+x. ennreal (exp (s * f x)) * indicator A x \<partial>M)"
     by (intro order.trans[OF nn_integral_Markov_inequality] meas) auto
   finally show ?thesis .
 qed
 
 lemma Chernoff_ineq_nn_integral_le:
   assumes s: "s > 0" and [measurable]: "A \<in> sets M"
   assumes [measurable]: "f \<in> borel_measurable M"
   shows   "emeasure M {x\<in>A. f x \<le> a} \<le>
            ennreal (exp (s * a)) * nn_integral M (\<lambda>x. ennreal (exp (-s * f x)) * indicator A x)"
   using Chernoff_ineq_nn_integral_ge[of s A M "\<lambda>x. -f x" "-a"] assms by simp
 
 lemma nn_integral_noteq_infinite:
   assumes g: "g \<in> borel_measurable M" and "integral\<^sup>N M g \<noteq> \<infinity>"
   shows "AE x in M. g x \<noteq> \<infinity>"
 proof (rule ccontr)
   assume c: "\<not> (AE x in M. g x \<noteq> \<infinity>)"
   have "(emeasure M) {x\<in>space M. g x = \<infinity>} \<noteq> 0"
     using c g by (auto simp add: AE_iff_null)
   then have "0 < (emeasure M) {x\<in>space M. g x = \<infinity>}"
     by (auto simp: zero_less_iff_neq_zero)
   then have "\<infinity> = \<infinity> * (emeasure M) {x\<in>space M. g x = \<infinity>}"
     by (auto simp: ennreal_top_eq_mult_iff)
   also have "\<dots> \<le> (\<integral>\<^sup>+x. \<infinity> * indicator {x\<in>space M. g x = \<infinity>} x \<partial>M)"
     using g by (subst nn_integral_cmult_indicator) auto
   also have "\<dots> \<le> integral\<^sup>N M g"
     using assms by (auto intro!: nn_integral_mono_AE simp: indicator_def)
   finally show False
     using \<open>integral\<^sup>N M g \<noteq> \<infinity>\<close> by (auto simp: top_unique)
 qed
 
 lemma nn_integral_PInf:
   assumes f: "f \<in> borel_measurable M" and not_Inf: "integral\<^sup>N M f \<noteq> \<infinity>"
   shows "emeasure M (f -` {\<infinity>} \<inter> space M) = 0"
 proof -
   have "\<infinity> * emeasure M (f -` {\<infinity>} \<inter> space M) = (\<integral>\<^sup>+ x. \<infinity> * indicator (f -` {\<infinity>} \<inter> space M) x \<partial>M)"
     using f by (subst nn_integral_cmult_indicator) (auto simp: measurable_sets)
   also have "\<dots> \<le> integral\<^sup>N M f"
     by (auto intro!: nn_integral_mono simp: indicator_def)
   finally have "\<infinity> * (emeasure M) (f -` {\<infinity>} \<inter> space M) \<le> integral\<^sup>N M f"
     by simp
   then show ?thesis
     using assms by (auto simp: ennreal_top_mult top_unique split: if_split_asm)
 qed
 
 lemma simple_integral_PInf:
   "simple_function M f \<Longrightarrow> integral\<^sup>S M f \<noteq> \<infinity> \<Longrightarrow> emeasure M (f -` {\<infinity>} \<inter> space M) = 0"
   by (rule nn_integral_PInf) (auto simp: nn_integral_eq_simple_integral borel_measurable_simple_function)
 
 lemma nn_integral_PInf_AE:
   assumes "f \<in> borel_measurable M" "integral\<^sup>N M f \<noteq> \<infinity>" shows "AE x in M. f x \<noteq> \<infinity>"
 proof (rule AE_I)
   show "(emeasure M) (f -` {\<infinity>} \<inter> space M) = 0"
     by (rule nn_integral_PInf[OF assms])
   show "f -` {\<infinity>} \<inter> space M \<in> sets M"
     using assms by (auto intro: borel_measurable_vimage)
 qed auto
 
 lemma nn_integral_diff:
   assumes f: "f \<in> borel_measurable M"
   and g: "g \<in> borel_measurable M"
   and fin: "integral\<^sup>N M g \<noteq> \<infinity>"
   and mono: "AE x in M. g x \<le> f x"
   shows "(\<integral>\<^sup>+ x. f x - g x \<partial>M) = integral\<^sup>N M f - integral\<^sup>N M g"
 proof -
   have diff: "(\<lambda>x. f x - g x) \<in> borel_measurable M"
     using assms by auto
   have "AE x in M. f x = f x - g x + g x"
     using diff_add_cancel_ennreal mono nn_integral_noteq_infinite[OF g fin] assms by auto
   then have **: "integral\<^sup>N M f = (\<integral>\<^sup>+x. f x - g x \<partial>M) + integral\<^sup>N M g"
     unfolding nn_integral_add[OF diff g, symmetric]
     by (rule nn_integral_cong_AE)
   show ?thesis unfolding **
     using fin
     by (cases rule: ennreal2_cases[of "\<integral>\<^sup>+ x. f x - g x \<partial>M" "integral\<^sup>N M g"]) auto
 qed
 
 lemma nn_integral_mult_bounded_inf:
   assumes f: "f \<in> borel_measurable M" "(\<integral>\<^sup>+x. f x \<partial>M) < \<infinity>" and c: "c \<noteq> \<infinity>" and ae: "AE x in M. g x \<le> c * f x"
   shows "(\<integral>\<^sup>+x. g x \<partial>M) < \<infinity>"
 proof -
   have "(\<integral>\<^sup>+x. g x \<partial>M) \<le> (\<integral>\<^sup>+x. c * f x \<partial>M)"
     by (intro nn_integral_mono_AE ae)
   also have "(\<integral>\<^sup>+x. c * f x \<partial>M) < \<infinity>"
     using c f by (subst nn_integral_cmult) (auto simp: ennreal_mult_less_top top_unique not_less)
   finally show ?thesis .
 qed
 
 text \<open>Fatou's lemma: convergence theorem on limes inferior\<close>
 
 lemma nn_integral_monotone_convergence_INF_AE':
   assumes f: "\<And>i. AE x in M. f (Suc i) x \<le> f i x" and [measurable]: "\<And>i. f i \<in> borel_measurable M"
     and *: "(\<integral>\<^sup>+ x. f 0 x \<partial>M) < \<infinity>"
   shows "(\<integral>\<^sup>+ x. (INF i. f i x) \<partial>M) = (INF i. integral\<^sup>N M (f i))"
 proof (rule ennreal_minus_cancel)
   have "integral\<^sup>N M (f 0) - (\<integral>\<^sup>+ x. (INF i. f i x) \<partial>M) = (\<integral>\<^sup>+x. f 0 x - (INF i. f i x) \<partial>M)"
   proof (rule nn_integral_diff[symmetric])
     have "(\<integral>\<^sup>+ x. (INF i. f i x) \<partial>M) \<le> (\<integral>\<^sup>+ x. f 0 x \<partial>M)"
       by (intro nn_integral_mono INF_lower) simp
     with * show "(\<integral>\<^sup>+ x. (INF i. f i x) \<partial>M) \<noteq> \<infinity>"
       by simp
   qed (auto intro: INF_lower)
   also have "\<dots> = (\<integral>\<^sup>+x. (SUP i. f 0 x - f i x) \<partial>M)"
     by (simp add: ennreal_INF_const_minus)
   also have "\<dots> = (SUP i. (\<integral>\<^sup>+x. f 0 x - f i x \<partial>M))"
   proof (intro nn_integral_monotone_convergence_SUP_AE)
     show "AE x in M. f 0 x - f i x \<le> f 0 x - f (Suc i) x" for i
       using f[of i] by eventually_elim (auto simp: ennreal_mono_minus)
   qed simp
   also have "\<dots> = (SUP i. nn_integral M (f 0) - (\<integral>\<^sup>+x. f i x \<partial>M))"
   proof (subst nn_integral_diff[symmetric])
     fix i
     have dec: "AE x in M. \<forall>i. f (Suc i) x \<le> f i x"
       unfolding AE_all_countable using f by auto
     then show "AE x in M. f i x \<le> f 0 x"
       using dec by eventually_elim (auto intro: lift_Suc_antimono_le[of "\<lambda>i. f i x" 0 i for x])
     then have "(\<integral>\<^sup>+ x. f i x \<partial>M) \<le> (\<integral>\<^sup>+ x. f 0 x \<partial>M)"
       by (rule nn_integral_mono_AE)
     with * show "(\<integral>\<^sup>+ x. f i x \<partial>M) \<noteq> \<infinity>"
       by simp
   qed (insert f, auto simp: decseq_def le_fun_def)
   finally show "integral\<^sup>N M (f 0) - (\<integral>\<^sup>+ x. (INF i. f i x) \<partial>M) =
     integral\<^sup>N M (f 0) - (INF i. \<integral>\<^sup>+ x. f i x \<partial>M)"
     by (simp add: ennreal_INF_const_minus)
 qed (insert *, auto intro!: nn_integral_mono intro: INF_lower)
 
 theorem nn_integral_monotone_convergence_INF_AE:
   fixes f :: "nat \<Rightarrow> 'a \<Rightarrow> ennreal"
   assumes f: "\<And>i. AE x in M. f (Suc i) x \<le> f i x"
     and [measurable]: "\<And>i. f i \<in> borel_measurable M"
     and fin: "(\<integral>\<^sup>+ x. f i x \<partial>M) < \<infinity>"
   shows "(\<integral>\<^sup>+ x. (INF i. f i x) \<partial>M) = (INF i. integral\<^sup>N M (f i))"
 proof -
   { fix f :: "nat \<Rightarrow> ennreal" and j assume "decseq f"
     then have "(INF i. f i) = (INF i. f (i + j))"
       apply (intro INF_eq)
       apply (rule_tac x="i" in bexI)
       apply (auto simp: decseq_def le_fun_def)
       done }
   note INF_shift = this
   have mono: "AE x in M. \<forall>i. f (Suc i) x \<le> f i x"
     using f by (auto simp: AE_all_countable)
   then have "AE x in M. (INF i. f i x) = (INF n. f (n + i) x)"
     by eventually_elim (auto intro!: decseq_SucI INF_shift)
   then have "(\<integral>\<^sup>+ x. (INF i. f i x) \<partial>M) = (\<integral>\<^sup>+ x. (INF n. f (n + i) x) \<partial>M)"
     by (rule nn_integral_cong_AE)
   also have "\<dots> = (INF n. (\<integral>\<^sup>+ x. f (n + i) x \<partial>M))"
     by (rule nn_integral_monotone_convergence_INF_AE') (insert assms, auto)
   also have "\<dots> = (INF n. (\<integral>\<^sup>+ x. f n x \<partial>M))"
     by (intro INF_shift[symmetric] decseq_SucI nn_integral_mono_AE f)
   finally show ?thesis .
 qed
 
 lemma nn_integral_monotone_convergence_INF_decseq:
   assumes f: "decseq f" and *: "\<And>i. f i \<in> borel_measurable M" "(\<integral>\<^sup>+ x. f i x \<partial>M) < \<infinity>"
   shows "(\<integral>\<^sup>+ x. (INF i. f i x) \<partial>M) = (INF i. integral\<^sup>N M (f i))"
   using nn_integral_monotone_convergence_INF_AE[of f M i, OF _ *] f by (auto simp: decseq_Suc_iff le_fun_def)
 
 theorem nn_integral_liminf:
   fixes u :: "nat \<Rightarrow> 'a \<Rightarrow> ennreal"
   assumes u: "\<And>i. u i \<in> borel_measurable M"
   shows "(\<integral>\<^sup>+ x. liminf (\<lambda>n. u n x) \<partial>M) \<le> liminf (\<lambda>n. integral\<^sup>N M (u n))"
 proof -
   have "(\<integral>\<^sup>+ x. liminf (\<lambda>n. u n x) \<partial>M) = (SUP n. \<integral>\<^sup>+ x. (INF i\<in>{n..}. u i x) \<partial>M)"
     unfolding liminf_SUP_INF using u
     by (intro nn_integral_monotone_convergence_SUP_AE)
        (auto intro!: AE_I2 intro: INF_greatest INF_superset_mono)
   also have "\<dots> \<le> liminf (\<lambda>n. integral\<^sup>N M (u n))"
     by (auto simp: liminf_SUP_INF intro!: SUP_mono INF_greatest nn_integral_mono INF_lower)
   finally show ?thesis .
 qed
 
 theorem nn_integral_limsup:
   fixes u :: "nat \<Rightarrow> 'a \<Rightarrow> ennreal"
   assumes [measurable]: "\<And>i. u i \<in> borel_measurable M" "w \<in> borel_measurable M"
   assumes bounds: "\<And>i. AE x in M. u i x \<le> w x" and w: "(\<integral>\<^sup>+x. w x \<partial>M) < \<infinity>"
   shows "limsup (\<lambda>n. integral\<^sup>N M (u n)) \<le> (\<integral>\<^sup>+ x. limsup (\<lambda>n. u n x) \<partial>M)"
 proof -
   have bnd: "AE x in M. \<forall>i. u i x \<le> w x"
     using bounds by (auto simp: AE_all_countable)
   then have "(\<integral>\<^sup>+ x. (SUP n. u n x) \<partial>M) \<le> (\<integral>\<^sup>+ x. w x \<partial>M)"
     by (auto intro!: nn_integral_mono_AE elim: eventually_mono intro: SUP_least)
   then have "(\<integral>\<^sup>+ x. limsup (\<lambda>n. u n x) \<partial>M) = (INF n. \<integral>\<^sup>+ x. (SUP i\<in>{n..}. u i x) \<partial>M)"
     unfolding limsup_INF_SUP using bnd w
     by (intro nn_integral_monotone_convergence_INF_AE')
        (auto intro!: AE_I2 intro: SUP_least SUP_subset_mono)
   also have "\<dots> \<ge> limsup (\<lambda>n. integral\<^sup>N M (u n))"
     by (auto simp: limsup_INF_SUP intro!: INF_mono SUP_least exI nn_integral_mono SUP_upper)
   finally (xtrans) show ?thesis .
 qed
 
 lemma nn_integral_LIMSEQ:
   assumes f: "incseq f" "\<And>i. f i \<in> borel_measurable M"
     and u: "\<And>x. (\<lambda>i. f i x) \<longlonglongrightarrow> u x"
   shows "(\<lambda>n. integral\<^sup>N M (f n)) \<longlonglongrightarrow> integral\<^sup>N M u"
 proof -
   have "(\<lambda>n. integral\<^sup>N M (f n)) \<longlonglongrightarrow> (SUP n. integral\<^sup>N M (f n))"
     using f by (intro LIMSEQ_SUP[of "\<lambda>n. integral\<^sup>N M (f n)"] incseq_nn_integral)
   also have "(SUP n. integral\<^sup>N M (f n)) = integral\<^sup>N M (\<lambda>x. SUP n. f n x)"
     using f by (intro nn_integral_monotone_convergence_SUP[symmetric])
   also have "integral\<^sup>N M (\<lambda>x. SUP n. f n x) = integral\<^sup>N M (\<lambda>x. u x)"
     using f by (subst LIMSEQ_SUP[THEN LIMSEQ_unique, OF _ u]) (auto simp: incseq_def le_fun_def)
   finally show ?thesis .
 qed
 
 theorem nn_integral_dominated_convergence:
   assumes [measurable]:
        "\<And>i. u i \<in> borel_measurable M" "u' \<in> borel_measurable M" "w \<in> borel_measurable M"
     and bound: "\<And>j. AE x in M. u j x \<le> w x"
     and w: "(\<integral>\<^sup>+x. w x \<partial>M) < \<infinity>"
     and u': "AE x in M. (\<lambda>i. u i x) \<longlonglongrightarrow> u' x"
   shows "(\<lambda>i. (\<integral>\<^sup>+x. u i x \<partial>M)) \<longlonglongrightarrow> (\<integral>\<^sup>+x. u' x \<partial>M)"
 proof -
   have "limsup (\<lambda>n. integral\<^sup>N M (u n)) \<le> (\<integral>\<^sup>+ x. limsup (\<lambda>n. u n x) \<partial>M)"
     by (intro nn_integral_limsup[OF _ _ bound w]) auto
   moreover have "(\<integral>\<^sup>+ x. limsup (\<lambda>n. u n x) \<partial>M) = (\<integral>\<^sup>+ x. u' x \<partial>M)"
     using u' by (intro nn_integral_cong_AE, eventually_elim) (metis tendsto_iff_Liminf_eq_Limsup sequentially_bot)
   moreover have "(\<integral>\<^sup>+ x. liminf (\<lambda>n. u n x) \<partial>M) = (\<integral>\<^sup>+ x. u' x \<partial>M)"
     using u' by (intro nn_integral_cong_AE, eventually_elim) (metis tendsto_iff_Liminf_eq_Limsup sequentially_bot)
   moreover have "(\<integral>\<^sup>+x. liminf (\<lambda>n. u n x) \<partial>M) \<le> liminf (\<lambda>n. integral\<^sup>N M (u n))"
     by (intro nn_integral_liminf) auto
   moreover have "liminf (\<lambda>n. integral\<^sup>N M (u n)) \<le> limsup (\<lambda>n. integral\<^sup>N M (u n))"
     by (intro Liminf_le_Limsup sequentially_bot)
   ultimately show ?thesis
     by (intro Liminf_eq_Limsup) auto
 qed
 
 lemma inf_continuous_nn_integral[order_continuous_intros]:
   assumes f: "\<And>y. inf_continuous (f y)"
   assumes [measurable]: "\<And>x. (\<lambda>y. f y x) \<in> borel_measurable M"
   assumes bnd: "\<And>x. (\<integral>\<^sup>+ y. f y x \<partial>M) \<noteq> \<infinity>"
   shows "inf_continuous (\<lambda>x. (\<integral>\<^sup>+y. f y x \<partial>M))"
   unfolding inf_continuous_def
 proof safe
   fix C :: "nat \<Rightarrow> 'b" assume C: "decseq C"
   then show "(\<integral>\<^sup>+ y. f y (Inf (C ` UNIV)) \<partial>M) = (INF i. \<integral>\<^sup>+ y. f y (C i) \<partial>M)"
     using inf_continuous_mono[OF f] bnd
     by (auto simp add: inf_continuousD[OF f C] fun_eq_iff antimono_def mono_def le_fun_def less_top
              intro!: nn_integral_monotone_convergence_INF_decseq)
 qed
 
 lemma nn_integral_null_set:
   assumes "N \<in> null_sets M" shows "(\<integral>\<^sup>+ x. u x * indicator N x \<partial>M) = 0"
 proof -
   have "(\<integral>\<^sup>+ x. u x * indicator N x \<partial>M) = (\<integral>\<^sup>+ x. 0 \<partial>M)"
   proof (intro nn_integral_cong_AE AE_I)
     show "{x \<in> space M. u x * indicator N x \<noteq> 0} \<subseteq> N"
       by (auto simp: indicator_def)
     show "(emeasure M) N = 0" "N \<in> sets M"
       using assms by auto
   qed
   then show ?thesis by simp
 qed
 
 lemma nn_integral_0_iff:
   assumes u [measurable]: "u \<in> borel_measurable M"
   shows "integral\<^sup>N M u = 0 \<longleftrightarrow> emeasure M {x\<in>space M. u x \<noteq> 0} = 0"
     (is "_ \<longleftrightarrow> (emeasure M) ?A = 0")
 proof -
   have u_eq: "(\<integral>\<^sup>+ x. u x * indicator ?A x \<partial>M) = integral\<^sup>N M u"
     by (auto intro!: nn_integral_cong simp: indicator_def)
   show ?thesis
   proof
     assume "(emeasure M) ?A = 0"
     with nn_integral_null_set[of ?A M u] u
     show "integral\<^sup>N M u = 0" by (simp add: u_eq null_sets_def)
   next
     assume *: "integral\<^sup>N M u = 0"
     let ?M = "\<lambda>n. {x \<in> space M. 1 \<le> real (n::nat) * u x}"
     have "0 = (SUP n. (emeasure M) (?M n \<inter> ?A))"
     proof -
       { fix n :: nat
         have "emeasure M {x \<in> ?A. 1 \<le> of_nat n * u x} \<le>
                 of_nat n * \<integral>\<^sup>+ x. u x * indicator ?A x \<partial>M"
           by (intro nn_integral_Markov_inequality) auto
         also have "{x \<in> ?A. 1 \<le> of_nat n * u x} = (?M n \<inter> ?A)"
           by (auto simp: ennreal_of_nat_eq_real_of_nat u_eq * )
         finally have "emeasure M (?M n \<inter> ?A) \<le> 0"
           by (simp add: ennreal_of_nat_eq_real_of_nat u_eq * )
         moreover have "0 \<le> (emeasure M) (?M n \<inter> ?A)" using u by auto
         ultimately have "(emeasure M) (?M n \<inter> ?A) = 0" by auto }
       thus ?thesis by simp
     qed
     also have "\<dots> = (emeasure M) (\<Union>n. ?M n \<inter> ?A)"
     proof (safe intro!: SUP_emeasure_incseq)
       fix n show "?M n \<inter> ?A \<in> sets M"
         using u by (auto intro!: sets.Int)
     next
       show "incseq (\<lambda>n. {x \<in> space M. 1 \<le> real n * u x} \<inter> {x \<in> space M. u x \<noteq> 0})"
       proof (safe intro!: incseq_SucI)
         fix n :: nat and x
         assume *: "1 \<le> real n * u x"
         also have "real n * u x \<le> real (Suc n) * u x"
           by (auto intro!: mult_right_mono)
         finally show "1 \<le> real (Suc n) * u x" by auto
       qed
     qed
     also have "\<dots> = (emeasure M) {x\<in>space M. 0 < u x}"
     proof (safe intro!: arg_cong[where f="(emeasure M)"])
       fix x assume "0 < u x" and [simp, intro]: "x \<in> space M"
       show "x \<in> (\<Union>n. ?M n \<inter> ?A)"
       proof (cases "u x" rule: ennreal_cases)
         case (real r) with \<open>0 < u x\<close> have "0 < r" by auto
         obtain j :: nat where "1 / r \<le> real j" using real_arch_simple ..
         hence "1 / r * r \<le> real j * r" unfolding mult_le_cancel_right using \<open>0 < r\<close> by auto
         hence "1 \<le> real j * r" using real \<open>0 < r\<close> by auto
         thus ?thesis using \<open>0 < r\<close> real
           by (auto simp: ennreal_of_nat_eq_real_of_nat ennreal_1[symmetric] ennreal_mult[symmetric]
                    simp del: ennreal_1)
       qed (insert \<open>0 < u x\<close>, auto simp: ennreal_mult_top)
     qed (auto simp: zero_less_iff_neq_zero)
     finally show "emeasure M ?A = 0"
       by (simp add: zero_less_iff_neq_zero)
   qed
 qed
 
 lemma nn_integral_0_iff_AE:
   assumes u: "u \<in> borel_measurable M"
   shows "integral\<^sup>N M u = 0 \<longleftrightarrow> (AE x in M. u x = 0)"
 proof -
   have sets: "{x\<in>space M. u x \<noteq> 0} \<in> sets M"
     using u by auto
   show "integral\<^sup>N M u = 0 \<longleftrightarrow> (AE x in M. u x = 0)"
     using nn_integral_0_iff[of u] AE_iff_null[OF sets] u by auto
 qed
 
 lemma AE_iff_nn_integral:
   "{x\<in>space M. P x} \<in> sets M \<Longrightarrow> (AE x in M. P x) \<longleftrightarrow> integral\<^sup>N M (indicator {x. \<not> P x}) = 0"
   by (subst nn_integral_0_iff_AE) (auto simp: indicator_def[abs_def])
 
 lemma nn_integral_less:
   assumes [measurable]: "f \<in> borel_measurable M" "g \<in> borel_measurable M"
   assumes f: "(\<integral>\<^sup>+x. f x \<partial>M) \<noteq> \<infinity>"
   assumes ord: "AE x in M. f x \<le> g x" "\<not> (AE x in M. g x \<le> f x)"
   shows "(\<integral>\<^sup>+x. f x \<partial>M) < (\<integral>\<^sup>+x. g x \<partial>M)"
 proof -
   have "0 < (\<integral>\<^sup>+x. g x - f x \<partial>M)"
   proof (intro order_le_neq_trans notI)
     assume "0 = (\<integral>\<^sup>+x. g x - f x \<partial>M)"
     then have "AE x in M. g x - f x = 0"
       using nn_integral_0_iff_AE[of "\<lambda>x. g x - f x" M] by simp
     with ord(1) have "AE x in M. g x \<le> f x"
       by eventually_elim (auto simp: ennreal_minus_eq_0)
     with ord show False
       by simp
   qed simp
   also have "\<dots> = (\<integral>\<^sup>+x. g x \<partial>M) - (\<integral>\<^sup>+x. f x \<partial>M)"
     using f by (subst nn_integral_diff) (auto simp: ord)
   finally show ?thesis
     using f by (auto dest!: ennreal_minus_pos_iff[rotated] simp: less_top)
 qed
 
 lemma nn_integral_subalgebra:
   assumes f: "f \<in> borel_measurable N"
   and N: "sets N \<subseteq> sets M" "space N = space M" "\<And>A. A \<in> sets N \<Longrightarrow> emeasure N A = emeasure M A"
   shows "integral\<^sup>N N f = integral\<^sup>N M f"
 proof -
   have [simp]: "\<And>f :: 'a \<Rightarrow> ennreal. f \<in> borel_measurable N \<Longrightarrow> f \<in> borel_measurable M"
     using N by (auto simp: measurable_def)
   have [simp]: "\<And>P. (AE x in N. P x) \<Longrightarrow> (AE x in M. P x)"
     using N by (auto simp add: eventually_ae_filter null_sets_def subset_eq)
   have [simp]: "\<And>A. A \<in> sets N \<Longrightarrow> A \<in> sets M"
     using N by auto
   from f show ?thesis
     apply induct
     apply (simp_all add: nn_integral_add nn_integral_cmult nn_integral_monotone_convergence_SUP N image_comp)
     apply (auto intro!: nn_integral_cong cong: nn_integral_cong simp: N(2)[symmetric])
     done
 qed
 
 lemma nn_integral_nat_function:
   fixes f :: "'a \<Rightarrow> nat"
   assumes "f \<in> measurable M (count_space UNIV)"
   shows "(\<integral>\<^sup>+x. of_nat (f x) \<partial>M) = (\<Sum>t. emeasure M {x\<in>space M. t < f x})"
 proof -
   define F where "F i = {x\<in>space M. i < f x}" for i
   with assms have [measurable]: "\<And>i. F i \<in> sets M"
     by auto
 
   { fix x assume "x \<in> space M"
     have "(\<lambda>i. if i < f x then 1 else 0) sums (of_nat (f x)::real)"
       using sums_If_finite[of "\<lambda>i. i < f x" "\<lambda>_. 1::real"] by simp
     then have "(\<lambda>i. ennreal (if i < f x then 1 else 0)) sums of_nat(f x)"
       unfolding ennreal_of_nat_eq_real_of_nat
       by (subst sums_ennreal) auto
     moreover have "\<And>i. ennreal (if i < f x then 1 else 0) = indicator (F i) x"
       using \<open>x \<in> space M\<close> by (simp add: one_ennreal_def F_def)
     ultimately have "of_nat (f x) = (\<Sum>i. indicator (F i) x :: ennreal)"
       by (simp add: sums_iff) }
   then have "(\<integral>\<^sup>+x. of_nat (f x) \<partial>M) = (\<integral>\<^sup>+x. (\<Sum>i. indicator (F i) x) \<partial>M)"
     by (simp cong: nn_integral_cong)
   also have "\<dots> = (\<Sum>i. emeasure M (F i))"
     by (simp add: nn_integral_suminf)
   finally show ?thesis
     by (simp add: F_def)
 qed
 
 theorem nn_integral_lfp:
   assumes sets[simp]: "\<And>s. sets (M s) = sets N"
   assumes f: "sup_continuous f"
   assumes g: "sup_continuous g"
   assumes meas: "\<And>F. F \<in> borel_measurable N \<Longrightarrow> f F \<in> borel_measurable N"
   assumes step: "\<And>F s. F \<in> borel_measurable N \<Longrightarrow> integral\<^sup>N (M s) (f F) = g (\<lambda>s. integral\<^sup>N (M s) F) s"
   shows "(\<integral>\<^sup>+\<omega>. lfp f \<omega> \<partial>M s) = lfp g s"
 proof (subst lfp_transfer_bounded[where \<alpha>="\<lambda>F s. \<integral>\<^sup>+x. F x \<partial>M s" and g=g and f=f and P="\<lambda>f. f \<in> borel_measurable N", symmetric])
   fix C :: "nat \<Rightarrow> 'b \<Rightarrow> ennreal" assume "incseq C" "\<And>i. C i \<in> borel_measurable N"
   then show "(\<lambda>s. \<integral>\<^sup>+x. (SUP i. C i) x \<partial>M s) = (SUP i. (\<lambda>s. \<integral>\<^sup>+x. C i x \<partial>M s))"
     unfolding SUP_apply[abs_def]
     by (subst nn_integral_monotone_convergence_SUP)
        (auto simp: mono_def fun_eq_iff intro!: arg_cong2[where f=emeasure] cong: measurable_cong_sets)
 qed (auto simp add: step le_fun_def SUP_apply[abs_def] bot_fun_def bot_ennreal intro!: meas f g)
 
 theorem nn_integral_gfp:
   assumes sets[simp]: "\<And>s. sets (M s) = sets N"
   assumes f: "inf_continuous f" and g: "inf_continuous g"
   assumes meas: "\<And>F. F \<in> borel_measurable N \<Longrightarrow> f F \<in> borel_measurable N"
   assumes bound: "\<And>F s. F \<in> borel_measurable N \<Longrightarrow> (\<integral>\<^sup>+x. f F x \<partial>M s) < \<infinity>"
   assumes non_zero: "\<And>s. emeasure (M s) (space (M s)) \<noteq> 0"
   assumes step: "\<And>F s. F \<in> borel_measurable N \<Longrightarrow> integral\<^sup>N (M s) (f F) = g (\<lambda>s. integral\<^sup>N (M s) F) s"
   shows "(\<integral>\<^sup>+\<omega>. gfp f \<omega> \<partial>M s) = gfp g s"
 proof (subst gfp_transfer_bounded[where \<alpha>="\<lambda>F s. \<integral>\<^sup>+x. F x \<partial>M s" and g=g and f=f
     and P="\<lambda>F. F \<in> borel_measurable N \<and> (\<forall>s. (\<integral>\<^sup>+x. F x \<partial>M s) < \<infinity>)", symmetric])
   fix C :: "nat \<Rightarrow> 'b \<Rightarrow> ennreal" assume "decseq C" "\<And>i. C i \<in> borel_measurable N \<and> (\<forall>s. integral\<^sup>N (M s) (C i) < \<infinity>)"
   then show "(\<lambda>s. \<integral>\<^sup>+x. (INF i. C i) x \<partial>M s) = (INF i. (\<lambda>s. \<integral>\<^sup>+x. C i x \<partial>M s))"
     unfolding INF_apply[abs_def]
     by (subst nn_integral_monotone_convergence_INF_decseq)
        (auto simp: mono_def fun_eq_iff intro!: arg_cong2[where f=emeasure] cong: measurable_cong_sets)
 next
   show "\<And>x. g x \<le> (\<lambda>s. integral\<^sup>N (M s) (f top))"
     by (subst step)
        (auto simp add: top_fun_def less_le non_zero le_fun_def ennreal_top_mult
              cong del: if_weak_cong intro!: monoD[OF inf_continuous_mono[OF g], THEN le_funD])
 next
   fix C assume "\<And>i::nat. C i \<in> borel_measurable N \<and> (\<forall>s. integral\<^sup>N (M s) (C i) < \<infinity>)" "decseq C"
   with bound show "Inf (C ` UNIV) \<in> borel_measurable N \<and> (\<forall>s. integral\<^sup>N (M s) (Inf (C ` UNIV)) < \<infinity>)"
     unfolding INF_apply[abs_def]
     by (subst nn_integral_monotone_convergence_INF_decseq)
        (auto simp: INF_less_iff cong: measurable_cong_sets intro!: borel_measurable_INF)
 next
   show "\<And>x. x \<in> borel_measurable N \<and> (\<forall>s. integral\<^sup>N (M s) x < \<infinity>) \<Longrightarrow>
          (\<lambda>s. integral\<^sup>N (M s) (f x)) = g (\<lambda>s. integral\<^sup>N (M s) x)"
     by (subst step) auto
 qed (insert bound, auto simp add: le_fun_def INF_apply[abs_def] top_fun_def intro!: meas f g)
 
 
 text \<open>Cauchy--Schwarz inequality for \<^const>\<open>nn_integral\<close>\<close>
 
 lemma sum_of_squares_ge_ennreal:
   fixes a b :: ennreal
   shows "2 * a * b \<le> a\<^sup>2 + b\<^sup>2"
 proof (cases a; cases b)
   fix x y
   assume xy: "x \<ge> 0" "y \<ge> 0" and [simp]: "a = ennreal x" "b = ennreal y"
   have "0 \<le> (x - y)\<^sup>2"
     by simp
   also have "\<dots> = x\<^sup>2 + y\<^sup>2 - 2 * x * y"
     by (simp add: algebra_simps power2_eq_square)
   finally have "2 * x * y \<le> x\<^sup>2 + y\<^sup>2"
     by simp
   hence "ennreal (2 * x * y) \<le> ennreal (x\<^sup>2 + y\<^sup>2)"
     by (intro ennreal_leI)
   thus ?thesis using xy
     by (simp add: ennreal_mult ennreal_power)
 qed auto
 
 lemma Cauchy_Schwarz_nn_integral:
   assumes [measurable]: "f \<in> borel_measurable M" "g \<in> borel_measurable M"
   shows "(\<integral>\<^sup>+x. f x * g x \<partial>M)\<^sup>2 \<le> (\<integral>\<^sup>+x. f x ^ 2 \<partial>M) * (\<integral>\<^sup>+x. g x ^ 2 \<partial>M)"
 proof (cases "(\<integral>\<^sup>+x. f x * g x \<partial>M) = 0")
   case False
   define F where "F = nn_integral M (\<lambda>x. f x ^ 2)"
   define G where "G = nn_integral M (\<lambda>x. g x ^ 2)"
   from False have "\<not>(AE x in M. f x = 0 \<or> g x = 0)"
     by (auto simp: nn_integral_0_iff_AE)
   hence "\<not>(AE x in M. f x = 0)" and "\<not>(AE x in M. g x = 0)"
     by (auto intro: AE_disjI1 AE_disjI2)
   hence nz: "F \<noteq> 0" "G \<noteq> 0"
     by (auto simp: nn_integral_0_iff_AE F_def G_def)
 
   show ?thesis
   proof (cases "F = \<infinity> \<or> G = \<infinity>")
     case True
     thus ?thesis using nz
       by (auto simp: F_def G_def)
   next
     case False
     define F' where "F' = ennreal (sqrt (enn2real F))"
     define G' where "G' = ennreal (sqrt (enn2real G))"
     from False have fin: "F < top" "G < top"
       by (simp_all add: top.not_eq_extremum)
     have F'_sqr: "F'\<^sup>2 = F"
       using False by (cases F) (auto simp: F'_def ennreal_power)
     have G'_sqr: "G'\<^sup>2 = G"
       using False by (cases G) (auto simp: G'_def ennreal_power)
     have nz': "F' \<noteq> 0" "G' \<noteq> 0" and fin': "F' \<noteq> \<infinity>" "G' \<noteq> \<infinity>"
       using F'_sqr G'_sqr nz fin by auto
     from fin' have fin'': "F' < top" "G' < top"
       by (auto simp: top.not_eq_extremum)
 
     have "2 * (F' / F') * (G' / G') * (\<integral>\<^sup>+x. f x * g x \<partial>M) =
           F' * G' * (\<integral>\<^sup>+x. 2 * (f x / F') * (g x / G') \<partial>M)"
       using nz' fin''
       by (simp add: divide_ennreal_def algebra_simps ennreal_inverse_mult flip: nn_integral_cmult)
     also have "F'/ F' = 1"
       using nz' fin'' by simp
     also have "G'/ G' = 1"
       using nz' fin'' by simp
     also have "2 * 1 * 1 = (2 :: ennreal)" by simp
     also have "F' * G' * (\<integral>\<^sup>+ x. 2 * (f x / F') * (g x / G') \<partial>M) \<le>
                F' * G' * (\<integral>\<^sup>+x. (f x / F')\<^sup>2 + (g x / G')\<^sup>2 \<partial>M)"
       by (intro mult_left_mono nn_integral_mono sum_of_squares_ge_ennreal) auto
     also have "\<dots> = F' * G' * (F / F'\<^sup>2 + G / G'\<^sup>2)" using nz
       by (auto simp: nn_integral_add algebra_simps nn_integral_divide F_def G_def)
     also have "F / F'\<^sup>2 = 1"
       using nz F'_sqr fin by simp
     also have "G / G'\<^sup>2 = 1"
       using nz G'_sqr fin by simp
     also have "F' * G' * (1 + 1) = 2 * (F' * G')"
       by (simp add: mult_ac)
     finally have "(\<integral>\<^sup>+x. f x * g x \<partial>M) \<le> F' * G'"
       by (subst (asm) ennreal_mult_le_mult_iff) auto
     hence "(\<integral>\<^sup>+x. f x * g x \<partial>M)\<^sup>2 \<le> (F' * G')\<^sup>2"
       by (intro power_mono_ennreal)
     also have "\<dots> = F * G"
       by (simp add: algebra_simps F'_sqr G'_sqr)
     finally show ?thesis
       by (simp add: F_def G_def)
   qed
 qed auto
 
 
 (* TODO: rename? *)
 subsection \<open>Integral under concrete measures\<close>
 
 lemma nn_integral_mono_measure:
   assumes "sets M = sets N" "M \<le> N" shows "nn_integral M f \<le> nn_integral N f"
   unfolding nn_integral_def
 proof (intro SUP_subset_mono)
   note \<open>sets M = sets N\<close>[simp]  \<open>sets M = sets N\<close>[THEN sets_eq_imp_space_eq, simp]
   show "{g. simple_function M g \<and> g \<le> f} \<subseteq> {g. simple_function N g \<and> g \<le> f}"
     by (simp add: simple_function_def)
   show "integral\<^sup>S M x \<le> integral\<^sup>S N x" for x
     using le_measureD3[OF \<open>M \<le> N\<close>]
     by (auto simp add: simple_integral_def intro!: sum_mono mult_mono)
 qed
 
 lemma nn_integral_empty:
   assumes "space M = {}"
   shows "nn_integral M f = 0"
 proof -
   have "(\<integral>\<^sup>+ x. f x \<partial>M) = (\<integral>\<^sup>+ x. 0 \<partial>M)"
     by(rule nn_integral_cong)(simp add: assms)
   thus ?thesis by simp
 qed
 
 lemma nn_integral_bot[simp]: "nn_integral bot f = 0"
   by (simp add: nn_integral_empty)
 
 subsubsection\<^marker>\<open>tag unimportant\<close> \<open>Distributions\<close>
 
 lemma nn_integral_distr:
   assumes T: "T \<in> measurable M M'" and f: "f \<in> borel_measurable (distr M M' T)"
   shows "integral\<^sup>N (distr M M' T) f = (\<integral>\<^sup>+ x. f (T x) \<partial>M)"
   using f
 proof induct
   case (cong f g)
   with T show ?case
     apply (subst nn_integral_cong[of _ f g])
     apply simp
     apply (subst nn_integral_cong[of _ "\<lambda>x. f (T x)" "\<lambda>x. g (T x)"])
     apply (simp add: measurable_def Pi_iff)
     apply simp
     done
 next
   case (set A)
   then have eq: "\<And>x. x \<in> space M \<Longrightarrow> indicator A (T x) = indicator (T -` A \<inter> space M) x"
     by (auto simp: indicator_def)
   from set T show ?case
     by (subst nn_integral_cong[OF eq])
        (auto simp add: emeasure_distr intro!: nn_integral_indicator[symmetric] measurable_sets)
 qed (simp_all add: measurable_compose[OF T] T nn_integral_cmult nn_integral_add
                    nn_integral_monotone_convergence_SUP le_fun_def incseq_def image_comp)
 
 subsubsection\<^marker>\<open>tag unimportant\<close> \<open>Counting space\<close>
 
 lemma simple_function_count_space[simp]:
   "simple_function (count_space A) f \<longleftrightarrow> finite (f ` A)"
   unfolding simple_function_def by simp
 
 lemma nn_integral_count_space:
   assumes A: "finite {a\<in>A. 0 < f a}"
   shows "integral\<^sup>N (count_space A) f = (\<Sum>a|a\<in>A \<and> 0 < f a. f a)"
 proof -
   have *: "(\<integral>\<^sup>+x. max 0 (f x) \<partial>count_space A) =
     (\<integral>\<^sup>+ x. (\<Sum>a|a\<in>A \<and> 0 < f a. f a * indicator {a} x) \<partial>count_space A)"
     by (auto intro!: nn_integral_cong
-             simp add: indicator_def if_distrib sum.If_cases[OF A] max_def le_less)
+             simp add: indicator_def of_bool_def if_distrib sum.If_cases[OF A] max_def le_less)
   also have "\<dots> = (\<Sum>a|a\<in>A \<and> 0 < f a. \<integral>\<^sup>+ x. f a * indicator {a} x \<partial>count_space A)"
     by (subst nn_integral_sum) (simp_all add: AE_count_space  less_imp_le)
   also have "\<dots> = (\<Sum>a|a\<in>A \<and> 0 < f a. f a)"
     by (auto intro!: sum.cong simp: one_ennreal_def[symmetric] max_def)
   finally show ?thesis by (simp add: max.absorb2)
 qed
 
 lemma nn_integral_count_space_finite:
     "finite A \<Longrightarrow> (\<integral>\<^sup>+x. f x \<partial>count_space A) = (\<Sum>a\<in>A. f a)"
   by (auto intro!: sum.mono_neutral_left simp: nn_integral_count_space less_le)
 
 lemma nn_integral_count_space':
   assumes "finite A" "\<And>x. x \<in> B \<Longrightarrow> x \<notin> A \<Longrightarrow> f x = 0" "A \<subseteq> B"
   shows "(\<integral>\<^sup>+x. f x \<partial>count_space B) = (\<Sum>x\<in>A. f x)"
 proof -
   have "(\<integral>\<^sup>+x. f x \<partial>count_space B) = (\<Sum>a | a \<in> B \<and> 0 < f a. f a)"
     using assms(2,3)
     by (intro nn_integral_count_space finite_subset[OF _ \<open>finite A\<close>]) (auto simp: less_le)
   also have "\<dots> = (\<Sum>a\<in>A. f a)"
     using assms by (intro sum.mono_neutral_cong_left) (auto simp: less_le)
   finally show ?thesis .
 qed
 
 lemma nn_integral_bij_count_space:
   assumes g: "bij_betw g A B"
   shows "(\<integral>\<^sup>+x. f (g x) \<partial>count_space A) = (\<integral>\<^sup>+x. f x \<partial>count_space B)"
   using g[THEN bij_betw_imp_funcset]
   by (subst distr_bij_count_space[OF g, symmetric])
      (auto intro!: nn_integral_distr[symmetric])
 
 lemma nn_integral_indicator_finite:
   fixes f :: "'a \<Rightarrow> ennreal"
   assumes f: "finite A" and [measurable]: "\<And>a. a \<in> A \<Longrightarrow> {a} \<in> sets M"
   shows "(\<integral>\<^sup>+x. f x * indicator A x \<partial>M) = (\<Sum>x\<in>A. f x * emeasure M {x})"
 proof -
   from f have "(\<integral>\<^sup>+x. f x * indicator A x \<partial>M) = (\<integral>\<^sup>+x. (\<Sum>a\<in>A. f a * indicator {a} x) \<partial>M)"
     by (intro nn_integral_cong) (auto simp: indicator_def if_distrib[where f="\<lambda>a. x * a" for x] sum.If_cases)
   also have "\<dots> = (\<Sum>a\<in>A. f a * emeasure M {a})"
     by (subst nn_integral_sum) auto
   finally show ?thesis .
 qed
 
 lemma nn_integral_count_space_nat:
   fixes f :: "nat \<Rightarrow> ennreal"
   shows "(\<integral>\<^sup>+i. f i \<partial>count_space UNIV) = (\<Sum>i. f i)"
 proof -
   have "(\<integral>\<^sup>+i. f i \<partial>count_space UNIV) =
     (\<integral>\<^sup>+i. (\<Sum>j. f j * indicator {j} i) \<partial>count_space UNIV)"
   proof (intro nn_integral_cong)
     fix i
     have "f i = (\<Sum>j\<in>{i}. f j * indicator {j} i)"
       by simp
     also have "\<dots> = (\<Sum>j. f j * indicator {j} i)"
       by (rule suminf_finite[symmetric]) auto
     finally show "f i = (\<Sum>j. f j * indicator {j} i)" .
   qed
   also have "\<dots> = (\<Sum>j. (\<integral>\<^sup>+i. f j * indicator {j} i \<partial>count_space UNIV))"
     by (rule nn_integral_suminf) auto
   finally show ?thesis
     by simp
 qed
 
 lemma nn_integral_enat_function:
   assumes f: "f \<in> measurable M (count_space UNIV)"
   shows "(\<integral>\<^sup>+ x. ennreal_of_enat (f x) \<partial>M) = (\<Sum>t. emeasure M {x \<in> space M. t < f x})"
 proof -
   define F where "F i = {x\<in>space M. i < f x}" for i :: nat
   with assms have [measurable]: "\<And>i. F i \<in> sets M"
     by auto
 
   { fix x assume "x \<in> space M"
     have "(\<lambda>i::nat. if i < f x then 1 else 0) sums ennreal_of_enat (f x)"
       using sums_If_finite[of "\<lambda>r. r < f x" "\<lambda>_. 1 :: ennreal"]
       by (cases "f x") (simp_all add: sums_def of_nat_tendsto_top_ennreal)
     also have "(\<lambda>i. (if i < f x then 1 else 0)) = (\<lambda>i. indicator (F i) x)"
       using \<open>x \<in> space M\<close> by (simp add: one_ennreal_def F_def fun_eq_iff)
     finally have "ennreal_of_enat (f x) = (\<Sum>i. indicator (F i) x)"
       by (simp add: sums_iff) }
   then have "(\<integral>\<^sup>+x. ennreal_of_enat (f x) \<partial>M) = (\<integral>\<^sup>+x. (\<Sum>i. indicator (F i) x) \<partial>M)"
     by (simp cong: nn_integral_cong)
   also have "\<dots> = (\<Sum>i. emeasure M (F i))"
     by (simp add: nn_integral_suminf)
   finally show ?thesis
     by (simp add: F_def)
 qed
 
 lemma nn_integral_count_space_nn_integral:
   fixes f :: "'i \<Rightarrow> 'a \<Rightarrow> ennreal"
   assumes "countable I" and [measurable]: "\<And>i. i \<in> I \<Longrightarrow> f i \<in> borel_measurable M"
   shows "(\<integral>\<^sup>+x. \<integral>\<^sup>+i. f i x \<partial>count_space I \<partial>M) = (\<integral>\<^sup>+i. \<integral>\<^sup>+x. f i x \<partial>M \<partial>count_space I)"
 proof cases
   assume "finite I" then show ?thesis
     by (simp add: nn_integral_count_space_finite nn_integral_sum)
 next
   assume "infinite I"
   then have [simp]: "I \<noteq> {}"
     by auto
   note * = bij_betw_from_nat_into[OF \<open>countable I\<close> \<open>infinite I\<close>]
   have **: "\<And>f. (\<And>i. 0 \<le> f i) \<Longrightarrow> (\<integral>\<^sup>+i. f i \<partial>count_space I) = (\<Sum>n. f (from_nat_into I n))"
     by (simp add: nn_integral_bij_count_space[symmetric, OF *] nn_integral_count_space_nat)
   show ?thesis
     by (simp add: ** nn_integral_suminf from_nat_into)
 qed
 
 lemma of_bool_Bex_eq_nn_integral:
   assumes unique: "\<And>x y. x \<in> X \<Longrightarrow> y \<in> X \<Longrightarrow> P x \<Longrightarrow> P y \<Longrightarrow> x = y"
   shows "of_bool (\<exists>y\<in>X. P y) = (\<integral>\<^sup>+y. of_bool (P y) \<partial>count_space X)"
 proof cases
   assume "\<exists>y\<in>X. P y"
   then obtain y where "P y" "y \<in> X" by auto
   then show ?thesis
     by (subst nn_integral_count_space'[where A="{y}"]) (auto dest: unique)
 qed (auto cong: nn_integral_cong_simp)
 
 lemma emeasure_UN_countable:
   assumes sets[measurable]: "\<And>i. i \<in> I \<Longrightarrow> X i \<in> sets M" and I[simp]: "countable I"
   assumes disj: "disjoint_family_on X I"
   shows "emeasure M (\<Union>(X ` I)) = (\<integral>\<^sup>+i. emeasure M (X i) \<partial>count_space I)"
 proof -
   have eq: "\<And>x. indicator (\<Union>(X ` I)) x = \<integral>\<^sup>+ i. indicator (X i) x \<partial>count_space I"
   proof cases
     fix x assume x: "x \<in> \<Union>(X ` I)"
     then obtain j where j: "x \<in> X j" "j \<in> I"
       by auto
     with disj have "\<And>i. i \<in> I \<Longrightarrow> indicator (X i) x = (indicator {j} i::ennreal)"
       by (auto simp: disjoint_family_on_def split: split_indicator)
     with x j show "?thesis x"
       by (simp cong: nn_integral_cong_simp)
   qed (auto simp: nn_integral_0_iff_AE)
 
   note sets.countable_UN'[unfolded subset_eq, measurable]
   have "emeasure M (\<Union>(X ` I)) = (\<integral>\<^sup>+x. indicator (\<Union>(X ` I)) x \<partial>M)"
     by simp
   also have "\<dots> = (\<integral>\<^sup>+i. \<integral>\<^sup>+x. indicator (X i) x \<partial>M \<partial>count_space I)"
     by (simp add: eq nn_integral_count_space_nn_integral)
   finally show ?thesis
     by (simp cong: nn_integral_cong_simp)
 qed
 
 lemma emeasure_countable_singleton:
   assumes sets: "\<And>x. x \<in> X \<Longrightarrow> {x} \<in> sets M" and X: "countable X"
   shows "emeasure M X = (\<integral>\<^sup>+x. emeasure M {x} \<partial>count_space X)"
 proof -
   have "emeasure M (\<Union>i\<in>X. {i}) = (\<integral>\<^sup>+x. emeasure M {x} \<partial>count_space X)"
     using assms by (intro emeasure_UN_countable) (auto simp: disjoint_family_on_def)
   also have "(\<Union>i\<in>X. {i}) = X" by auto
   finally show ?thesis .
 qed
 
 lemma measure_eqI_countable:
   assumes [simp]: "sets M = Pow A" "sets N = Pow A" and A: "countable A"
   assumes eq: "\<And>a. a \<in> A \<Longrightarrow> emeasure M {a} = emeasure N {a}"
   shows "M = N"
 proof (rule measure_eqI)
   fix X assume "X \<in> sets M"
   then have X: "X \<subseteq> A" by auto
   moreover from A X have "countable X" by (auto dest: countable_subset)
   ultimately have
     "emeasure M X = (\<integral>\<^sup>+a. emeasure M {a} \<partial>count_space X)"
     "emeasure N X = (\<integral>\<^sup>+a. emeasure N {a} \<partial>count_space X)"
     by (auto intro!: emeasure_countable_singleton)
   moreover have "(\<integral>\<^sup>+a. emeasure M {a} \<partial>count_space X) = (\<integral>\<^sup>+a. emeasure N {a} \<partial>count_space X)"
     using X by (intro nn_integral_cong eq) auto
   ultimately show "emeasure M X = emeasure N X"
     by simp
 qed simp
 
 lemma measure_eqI_countable_AE:
   assumes [simp]: "sets M = UNIV" "sets N = UNIV"
   assumes ae: "AE x in M. x \<in> \<Omega>" "AE x in N. x \<in> \<Omega>" and [simp]: "countable \<Omega>"
   assumes eq: "\<And>x. x \<in> \<Omega> \<Longrightarrow> emeasure M {x} = emeasure N {x}"
   shows "M = N"
 proof (rule measure_eqI)
   fix A
   have "emeasure N A = emeasure N {x\<in>\<Omega>. x \<in> A}"
     using ae by (intro emeasure_eq_AE) auto
   also have "\<dots> = (\<integral>\<^sup>+x. emeasure N {x} \<partial>count_space {x\<in>\<Omega>. x \<in> A})"
     by (intro emeasure_countable_singleton) auto
   also have "\<dots> = (\<integral>\<^sup>+x. emeasure M {x} \<partial>count_space {x\<in>\<Omega>. x \<in> A})"
     by (intro nn_integral_cong eq[symmetric]) auto
   also have "\<dots> = emeasure M {x\<in>\<Omega>. x \<in> A}"
     by (intro emeasure_countable_singleton[symmetric]) auto
   also have "\<dots> = emeasure M A"
     using ae by (intro emeasure_eq_AE) auto
   finally show "emeasure M A = emeasure N A" ..
 qed simp
 
 lemma nn_integral_monotone_convergence_SUP_nat:
   fixes f :: "'a \<Rightarrow> nat \<Rightarrow> ennreal"
   assumes chain: "Complete_Partial_Order.chain (\<le>) (f ` Y)"
   and nonempty: "Y \<noteq> {}"
   shows "(\<integral>\<^sup>+ x. (SUP i\<in>Y. f i x) \<partial>count_space UNIV) = (SUP i\<in>Y. (\<integral>\<^sup>+ x. f i x \<partial>count_space UNIV))"
   (is "?lhs = ?rhs" is "integral\<^sup>N ?M _ = _")
 proof (rule order_class.order.antisym)
   show "?rhs \<le> ?lhs"
     by (auto intro!: SUP_least SUP_upper nn_integral_mono)
 next
   have "\<exists>g. incseq g \<and> range g \<subseteq> (\<lambda>i. f i x) ` Y \<and> (SUP i\<in>Y. f i x) = (SUP i. g i)" for x
     by (rule ennreal_Sup_countable_SUP) (simp add: nonempty)
   then obtain g where incseq: "\<And>x. incseq (g x)"
     and range: "\<And>x. range (g x) \<subseteq> (\<lambda>i. f i x) ` Y"
     and sup: "\<And>x. (SUP i\<in>Y. f i x) = (SUP i. g x i)" by moura
   from incseq have incseq': "incseq (\<lambda>i x. g x i)"
     by(blast intro: incseq_SucI le_funI dest: incseq_SucD)
 
   have "?lhs = \<integral>\<^sup>+ x. (SUP i. g x i) \<partial>?M" by(simp add: sup)
   also have "\<dots> = (SUP i. \<integral>\<^sup>+ x. g x i \<partial>?M)" using incseq'
     by(rule nn_integral_monotone_convergence_SUP) simp
   also have "\<dots> \<le> (SUP i\<in>Y. \<integral>\<^sup>+ x. f i x \<partial>?M)"
   proof(rule SUP_least)
     fix n
     have "\<And>x. \<exists>i. g x n = f i x \<and> i \<in> Y" using range by blast
     then obtain I where I: "\<And>x. g x n = f (I x) x" "\<And>x. I x \<in> Y" by moura
 
     have "(\<integral>\<^sup>+ x. g x n \<partial>count_space UNIV) = (\<Sum>x. g x n)"
       by(rule nn_integral_count_space_nat)
     also have "\<dots> = (SUP m. \<Sum>x<m. g x n)"
       by(rule suminf_eq_SUP)
     also have "\<dots> \<le> (SUP i\<in>Y. \<integral>\<^sup>+ x. f i x \<partial>?M)"
     proof(rule SUP_mono)
       fix m
       show "\<exists>m'\<in>Y. (\<Sum>x<m. g x n) \<le> (\<integral>\<^sup>+ x. f m' x \<partial>?M)"
       proof(cases "m > 0")
         case False
         thus ?thesis using nonempty by auto
       next
         case True
         let ?Y = "I ` {..<m}"
         have "f ` ?Y \<subseteq> f ` Y" using I by auto
         with chain have chain': "Complete_Partial_Order.chain (\<le>) (f ` ?Y)" by(rule chain_subset)
         hence "Sup (f ` ?Y) \<in> f ` ?Y"
           by(rule ccpo_class.in_chain_finite)(auto simp add: True lessThan_empty_iff)
         then obtain m' where "m' < m" and m': "(SUP i\<in>?Y. f i) = f (I m')" by auto
         have "I m' \<in> Y" using I by blast
         have "(\<Sum>x<m. g x n) \<le> (\<Sum>x<m. f (I m') x)"
         proof(rule sum_mono)
           fix x
           assume "x \<in> {..<m}"
           hence "x < m" by simp
           have "g x n = f (I x) x" by(simp add: I)
           also have "\<dots> \<le> (SUP i\<in>?Y. f i) x" unfolding Sup_fun_def image_image
             using \<open>x \<in> {..<m}\<close> by (rule Sup_upper [OF imageI])
           also have "\<dots> = f (I m') x" unfolding m' by simp
           finally show "g x n \<le> f (I m') x" .
         qed
         also have "\<dots> \<le> (SUP m. (\<Sum>x<m. f (I m') x))"
           by(rule SUP_upper) simp
         also have "\<dots> = (\<Sum>x. f (I m') x)"
           by(rule suminf_eq_SUP[symmetric])
         also have "\<dots> = (\<integral>\<^sup>+ x. f (I m') x \<partial>?M)"
           by(rule nn_integral_count_space_nat[symmetric])
         finally show ?thesis using \<open>I m' \<in> Y\<close> by blast
       qed
     qed
     finally show "(\<integral>\<^sup>+ x. g x n \<partial>count_space UNIV) \<le> \<dots>" .
   qed
   finally show "?lhs \<le> ?rhs" .
 qed
 
 lemma power_series_tendsto_at_left:
   assumes nonneg: "\<And>i. 0 \<le> f i" and summable: "\<And>z. 0 \<le> z \<Longrightarrow> z < 1 \<Longrightarrow> summable (\<lambda>n. f n * z^n)"
   shows "((\<lambda>z. ennreal (\<Sum>n. f n * z^n)) \<longlongrightarrow> (\<Sum>n. ennreal (f n))) (at_left (1::real))"
 proof (intro tendsto_at_left_sequentially)
   show "0 < (1::real)" by simp
   fix S :: "nat \<Rightarrow> real" assume S: "\<And>n. S n < 1" "\<And>n. 0 < S n" "S \<longlonglongrightarrow> 1" "incseq S"
   then have S_nonneg: "\<And>i. 0 \<le> S i" by (auto intro: less_imp_le)
 
   have "(\<lambda>i. (\<integral>\<^sup>+n. f n * S i^n \<partial>count_space UNIV)) \<longlonglongrightarrow> (\<integral>\<^sup>+n. ennreal (f n) \<partial>count_space UNIV)"
   proof (rule nn_integral_LIMSEQ)
     show "incseq (\<lambda>i n. ennreal (f n * S i^n))"
       using S by (auto intro!: mult_mono power_mono nonneg ennreal_leI
                        simp: incseq_def le_fun_def less_imp_le)
     fix n have "(\<lambda>i. ennreal (f n * S i^n)) \<longlonglongrightarrow> ennreal (f n * 1^n)"
       by (intro tendsto_intros tendsto_ennrealI S)
     then show "(\<lambda>i. ennreal (f n * S i^n)) \<longlonglongrightarrow> ennreal (f n)"
       by simp
   qed (auto simp: S_nonneg intro!: mult_nonneg_nonneg nonneg)
   also have "(\<lambda>i. (\<integral>\<^sup>+n. f n * S i^n \<partial>count_space UNIV)) = (\<lambda>i. \<Sum>n. f n * S i^n)"
     by (subst nn_integral_count_space_nat)
        (intro ext suminf_ennreal2 mult_nonneg_nonneg nonneg S_nonneg
               zero_le_power summable S)+
   also have "(\<integral>\<^sup>+n. ennreal (f n) \<partial>count_space UNIV) = (\<Sum>n. ennreal (f n))"
     by (simp add: nn_integral_count_space_nat nonneg)
   finally show "(\<lambda>n. ennreal (\<Sum>na. f na * S n ^ na)) \<longlonglongrightarrow> (\<Sum>n. ennreal (f n))" .
 qed
 
 subsubsection \<open>Measures with Restricted Space\<close>
 
 lemma simple_function_restrict_space_ennreal:
   fixes f :: "'a \<Rightarrow> ennreal"
   assumes "\<Omega> \<inter> space M \<in> sets M"
   shows "simple_function (restrict_space M \<Omega>) f \<longleftrightarrow> simple_function M (\<lambda>x. f x * indicator \<Omega> x)"
 proof -
   { assume "finite (f ` space (restrict_space M \<Omega>))"
     then have "finite (f ` space (restrict_space M \<Omega>) \<union> {0})" by simp
     then have "finite ((\<lambda>x. f x * indicator \<Omega> x) ` space M)"
       by (rule rev_finite_subset) (auto split: split_indicator simp: space_restrict_space) }
   moreover
   { assume "finite ((\<lambda>x. f x * indicator \<Omega> x) ` space M)"
     then have "finite (f ` space (restrict_space M \<Omega>))"
       by (rule rev_finite_subset) (auto split: split_indicator simp: space_restrict_space) }
   ultimately show ?thesis
     unfolding
       simple_function_iff_borel_measurable borel_measurable_restrict_space_iff_ennreal[OF assms]
     by auto
 qed
 
 lemma simple_function_restrict_space:
   fixes f :: "'a \<Rightarrow> 'b::real_normed_vector"
   assumes "\<Omega> \<inter> space M \<in> sets M"
   shows "simple_function (restrict_space M \<Omega>) f \<longleftrightarrow> simple_function M (\<lambda>x. indicator \<Omega> x *\<^sub>R f x)"
 proof -
   { assume "finite (f ` space (restrict_space M \<Omega>))"
     then have "finite (f ` space (restrict_space M \<Omega>) \<union> {0})" by simp
     then have "finite ((\<lambda>x. indicator \<Omega> x *\<^sub>R f x) ` space M)"
       by (rule rev_finite_subset) (auto split: split_indicator simp: space_restrict_space) }
   moreover
   { assume "finite ((\<lambda>x. indicator \<Omega> x *\<^sub>R f x) ` space M)"
     then have "finite (f ` space (restrict_space M \<Omega>))"
       by (rule rev_finite_subset) (auto split: split_indicator simp: space_restrict_space) }
   ultimately show ?thesis
     unfolding simple_function_iff_borel_measurable
       borel_measurable_restrict_space_iff[OF assms]
     by auto
 qed
 
 lemma simple_integral_restrict_space:
   assumes \<Omega>: "\<Omega> \<inter> space M \<in> sets M" "simple_function (restrict_space M \<Omega>) f"
   shows "simple_integral (restrict_space M \<Omega>) f = simple_integral M (\<lambda>x. f x * indicator \<Omega> x)"
   using simple_function_restrict_space_ennreal[THEN iffD1, OF \<Omega>, THEN simple_functionD(1)]
   by (auto simp add: space_restrict_space emeasure_restrict_space[OF \<Omega>(1)] le_infI2 simple_integral_def
            split: split_indicator split_indicator_asm
            intro!: sum.mono_neutral_cong_left ennreal_mult_left_cong arg_cong2[where f=emeasure])
 
 lemma nn_integral_restrict_space:
   assumes \<Omega>[simp]: "\<Omega> \<inter> space M \<in> sets M"
   shows "nn_integral (restrict_space M \<Omega>) f = nn_integral M (\<lambda>x. f x * indicator \<Omega> x)"
 proof -
   let ?R = "restrict_space M \<Omega>" and ?X = "\<lambda>M f. {s. simple_function M s \<and> s \<le> f \<and> (\<forall>x. s x < top)}"
   have "integral\<^sup>S ?R ` ?X ?R f = integral\<^sup>S M ` ?X M (\<lambda>x. f x * indicator \<Omega> x)"
   proof (safe intro!: image_eqI)
     fix s assume s: "simple_function ?R s" "s \<le> f" "\<forall>x. s x < top"
     from s show "integral\<^sup>S (restrict_space M \<Omega>) s = integral\<^sup>S M (\<lambda>x. s x * indicator \<Omega> x)"
       by (intro simple_integral_restrict_space) auto
     from s show "simple_function M (\<lambda>x. s x * indicator \<Omega> x)"
       by (simp add: simple_function_restrict_space_ennreal)
     from s show "(\<lambda>x. s x * indicator \<Omega> x) \<le> (\<lambda>x. f x * indicator \<Omega> x)"
       "\<And>x. s x * indicator \<Omega> x < top"
       by (auto split: split_indicator simp: le_fun_def image_subset_iff)
   next
     fix s assume s: "simple_function M s" "s \<le> (\<lambda>x. f x * indicator \<Omega> x)" "\<forall>x. s x < top"
     then have "simple_function M (\<lambda>x. s x * indicator (\<Omega> \<inter> space M) x)" (is ?s')
       by (intro simple_function_mult simple_function_indicator) auto
     also have "?s' \<longleftrightarrow> simple_function M (\<lambda>x. s x * indicator \<Omega> x)"
       by (rule simple_function_cong) (auto split: split_indicator)
     finally show sf: "simple_function (restrict_space M \<Omega>) s"
       by (simp add: simple_function_restrict_space_ennreal)
 
     from s have s_eq: "s = (\<lambda>x. s x * indicator \<Omega> x)"
       by (auto simp add: fun_eq_iff le_fun_def image_subset_iff
                   split: split_indicator split_indicator_asm
                   intro: antisym)
 
     show "integral\<^sup>S M s = integral\<^sup>S (restrict_space M \<Omega>) s"
       by (subst s_eq) (rule simple_integral_restrict_space[symmetric, OF \<Omega> sf])
     show "\<And>x. s x < top"
       using s by (auto simp: image_subset_iff)
     from s show "s \<le> f"
       by (subst s_eq) (auto simp: image_subset_iff le_fun_def split: split_indicator split_indicator_asm)
   qed
   then show ?thesis
     unfolding nn_integral_def_finite by (simp cong del: SUP_cong_simp)
 qed
 
 lemma nn_integral_count_space_indicator:
   assumes "NO_MATCH (UNIV::'a set) (X::'a set)"
   shows "(\<integral>\<^sup>+x. f x \<partial>count_space X) = (\<integral>\<^sup>+x. f x * indicator X x \<partial>count_space UNIV)"
   by (simp add: nn_integral_restrict_space[symmetric] restrict_count_space)
 
 lemma nn_integral_count_space_eq:
   "(\<And>x. x \<in> A - B \<Longrightarrow> f x = 0) \<Longrightarrow> (\<And>x. x \<in> B - A \<Longrightarrow> f x = 0) \<Longrightarrow>
     (\<integral>\<^sup>+x. f x \<partial>count_space A) = (\<integral>\<^sup>+x. f x \<partial>count_space B)"
   by (auto simp: nn_integral_count_space_indicator intro!: nn_integral_cong split: split_indicator)
 
 lemma nn_integral_ge_point:
   assumes "x \<in> A"
   shows "p x \<le> \<integral>\<^sup>+ x. p x \<partial>count_space A"
 proof -
   from assms have "p x \<le> \<integral>\<^sup>+ x. p x \<partial>count_space {x}"
     by(auto simp add: nn_integral_count_space_finite max_def)
   also have "\<dots> = \<integral>\<^sup>+ x'. p x' * indicator {x} x' \<partial>count_space A"
     using assms by(auto simp add: nn_integral_count_space_indicator indicator_def intro!: nn_integral_cong)
   also have "\<dots> \<le> \<integral>\<^sup>+ x. p x \<partial>count_space A"
     by(rule nn_integral_mono)(simp add: indicator_def)
   finally show ?thesis .
 qed
 
 subsubsection \<open>Measure spaces with an associated density\<close>
 
 definition\<^marker>\<open>tag important\<close> density :: "'a measure \<Rightarrow> ('a \<Rightarrow> ennreal) \<Rightarrow> 'a measure" where
   "density M f = measure_of (space M) (sets M) (\<lambda>A. \<integral>\<^sup>+ x. f x * indicator A x \<partial>M)"
 
 lemma
   shows sets_density[simp, measurable_cong]: "sets (density M f) = sets M"
     and space_density[simp]: "space (density M f) = space M"
   by (auto simp: density_def)
 
 (* FIXME: add conversion to simplify space, sets and measurable *)
 lemma space_density_imp[measurable_dest]:
   "\<And>x M f. x \<in> space (density M f) \<Longrightarrow> x \<in> space M" by auto
 
 lemma
   shows measurable_density_eq1[simp]: "g \<in> measurable (density Mg f) Mg' \<longleftrightarrow> g \<in> measurable Mg Mg'"
     and measurable_density_eq2[simp]: "h \<in> measurable Mh (density Mh' f) \<longleftrightarrow> h \<in> measurable Mh Mh'"
     and simple_function_density_eq[simp]: "simple_function (density Mu f) u \<longleftrightarrow> simple_function Mu u"
   unfolding measurable_def simple_function_def by simp_all
 
 lemma density_cong: "f \<in> borel_measurable M \<Longrightarrow> f' \<in> borel_measurable M \<Longrightarrow>
   (AE x in M. f x = f' x) \<Longrightarrow> density M f = density M f'"
   unfolding density_def by (auto intro!: measure_of_eq nn_integral_cong_AE sets.space_closed)
 
 lemma emeasure_density:
   assumes f[measurable]: "f \<in> borel_measurable M" and A[measurable]: "A \<in> sets M"
   shows "emeasure (density M f) A = (\<integral>\<^sup>+ x. f x * indicator A x \<partial>M)"
     (is "_ = ?\<mu> A")
   unfolding density_def
 proof (rule emeasure_measure_of_sigma)
   show "sigma_algebra (space M) (sets M)" ..
   show "positive (sets M) ?\<mu>"
     using f by (auto simp: positive_def)
   show "countably_additive (sets M) ?\<mu>"
   proof (intro countably_additiveI)
     fix A :: "nat \<Rightarrow> 'a set" assume "range A \<subseteq> sets M"
     then have "\<And>i. A i \<in> sets M" by auto
     then have *: "\<And>i. (\<lambda>x. f x * indicator (A i) x) \<in> borel_measurable M"
       by auto
     assume disj: "disjoint_family A"
     then have "(\<Sum>n. ?\<mu> (A n)) = (\<integral>\<^sup>+ x. (\<Sum>n. f x * indicator (A n) x) \<partial>M)"
        using f * by (subst nn_integral_suminf) auto
     also have "(\<integral>\<^sup>+ x. (\<Sum>n. f x * indicator (A n) x) \<partial>M) = (\<integral>\<^sup>+ x. f x * (\<Sum>n. indicator (A n) x) \<partial>M)"
       using f by (auto intro!: ennreal_suminf_cmult nn_integral_cong_AE)
     also have "\<dots> = (\<integral>\<^sup>+ x. f x * indicator (\<Union>n. A n) x \<partial>M)"
       unfolding suminf_indicator[OF disj] ..
     finally show "(\<Sum>i. \<integral>\<^sup>+ x. f x * indicator (A i) x \<partial>M) = \<integral>\<^sup>+ x. f x * indicator (\<Union>i. A i) x \<partial>M" .
   qed
 qed fact
 
 lemma null_sets_density_iff:
   assumes f: "f \<in> borel_measurable M"
   shows "A \<in> null_sets (density M f) \<longleftrightarrow> A \<in> sets M \<and> (AE x in M. x \<in> A \<longrightarrow> f x = 0)"
 proof -
   { assume "A \<in> sets M"
     have "(\<integral>\<^sup>+x. f x * indicator A x \<partial>M) = 0 \<longleftrightarrow> emeasure M {x \<in> space M. f x * indicator A x \<noteq> 0} = 0"
       using f \<open>A \<in> sets M\<close> by (intro nn_integral_0_iff) auto
     also have "\<dots> \<longleftrightarrow> (AE x in M. f x * indicator A x = 0)"
       using f \<open>A \<in> sets M\<close> by (intro AE_iff_measurable[OF _ refl, symmetric]) auto
     also have "(AE x in M. f x * indicator A x = 0) \<longleftrightarrow> (AE x in M. x \<in> A \<longrightarrow> f x \<le> 0)"
       by (auto simp add: indicator_def max_def split: if_split_asm)
     finally have "(\<integral>\<^sup>+x. f x * indicator A x \<partial>M) = 0 \<longleftrightarrow> (AE x in M. x \<in> A \<longrightarrow> f x \<le> 0)" . }
   with f show ?thesis
     by (simp add: null_sets_def emeasure_density cong: conj_cong)
 qed
 
 lemma AE_density:
   assumes f: "f \<in> borel_measurable M"
   shows "(AE x in density M f. P x) \<longleftrightarrow> (AE x in M. 0 < f x \<longrightarrow> P x)"
 proof
   assume "AE x in density M f. P x"
   with f obtain N where "{x \<in> space M. \<not> P x} \<subseteq> N" "N \<in> sets M" and ae: "AE x in M. x \<in> N \<longrightarrow> f x = 0"
     by (auto simp: eventually_ae_filter null_sets_density_iff)
   then have "AE x in M. x \<notin> N \<longrightarrow> P x" by auto
   with ae show "AE x in M. 0 < f x \<longrightarrow> P x"
     by (rule eventually_elim2) auto
 next
   fix N assume ae: "AE x in M. 0 < f x \<longrightarrow> P x"
   then obtain N where "{x \<in> space M. \<not> (0 < f x \<longrightarrow> P x)} \<subseteq> N" "N \<in> null_sets M"
     by (auto simp: eventually_ae_filter)
   then have *: "{x \<in> space (density M f). \<not> P x} \<subseteq> N \<union> {x\<in>space M. f x = 0}"
     "N \<union> {x\<in>space M. f x = 0} \<in> sets M" and ae2: "AE x in M. x \<notin> N"
     using f by (auto simp: subset_eq zero_less_iff_neq_zero intro!: AE_not_in)
   show "AE x in density M f. P x"
     using ae2
     unfolding eventually_ae_filter[of _ "density M f"] Bex_def null_sets_density_iff[OF f]
     by (intro exI[of _ "N \<union> {x\<in>space M. f x = 0}"] conjI *) (auto elim: eventually_elim2)
 qed
 
 lemma\<^marker>\<open>tag important\<close> nn_integral_density:
   assumes f: "f \<in> borel_measurable M"
   assumes g: "g \<in> borel_measurable M"
   shows "integral\<^sup>N (density M f) g = (\<integral>\<^sup>+ x. f x * g x \<partial>M)"
 using g proof induct
   case (cong u v)
   then show ?case
     apply (subst nn_integral_cong[OF cong(3)])
     apply (simp_all cong: nn_integral_cong)
     done
 next
   case (set A) then show ?case
     by (simp add: emeasure_density f)
 next
   case (mult u c)
   moreover have "\<And>x. f x * (c * u x) = c * (f x * u x)" by (simp add: field_simps)
   ultimately show ?case
     using f by (simp add: nn_integral_cmult)
 next
   case (add u v)
   then have "\<And>x. f x * (v x + u x) = f x * v x + f x * u x"
     by (simp add: distrib_left)
   with add f show ?case
     by (auto simp add: nn_integral_add intro!: nn_integral_add[symmetric])
 next
   case (seq U)
   have eq: "AE x in M. f x * (SUP i. U i x) = (SUP i. f x * U i x)"
     by eventually_elim (simp add: SUP_mult_left_ennreal seq)
   from seq f show ?case
     apply (simp add: nn_integral_monotone_convergence_SUP image_comp)
     apply (subst nn_integral_cong_AE[OF eq])
     apply (subst nn_integral_monotone_convergence_SUP_AE)
     apply (auto simp: incseq_def le_fun_def intro!: mult_left_mono)
     done
 qed
 
 lemma density_distr:
   assumes [measurable]: "f \<in> borel_measurable N" "X \<in> measurable M N"
   shows "density (distr M N X) f = distr (density M (\<lambda>x. f (X x))) N X"
   by (intro measure_eqI)
      (auto simp add: emeasure_density nn_integral_distr emeasure_distr
            split: split_indicator intro!: nn_integral_cong)
 
 lemma emeasure_restricted:
   assumes S: "S \<in> sets M" and X: "X \<in> sets M"
   shows "emeasure (density M (indicator S)) X = emeasure M (S \<inter> X)"
 proof -
   have "emeasure (density M (indicator S)) X = (\<integral>\<^sup>+x. indicator S x * indicator X x \<partial>M)"
     using S X by (simp add: emeasure_density)
   also have "\<dots> = (\<integral>\<^sup>+x. indicator (S \<inter> X) x \<partial>M)"
     by (auto intro!: nn_integral_cong simp: indicator_def)
   also have "\<dots> = emeasure M (S \<inter> X)"
     using S X by (simp add: sets.Int)
   finally show ?thesis .
 qed
 
 lemma measure_restricted:
   "S \<in> sets M \<Longrightarrow> X \<in> sets M \<Longrightarrow> measure (density M (indicator S)) X = measure M (S \<inter> X)"
   by (simp add: emeasure_restricted measure_def)
 
 lemma (in finite_measure) finite_measure_restricted:
   "S \<in> sets M \<Longrightarrow> finite_measure (density M (indicator S))"
   by standard (simp add: emeasure_restricted)
 
 lemma emeasure_density_const:
   "A \<in> sets M \<Longrightarrow> emeasure (density M (\<lambda>_. c)) A = c * emeasure M A"
   by (auto simp: nn_integral_cmult_indicator emeasure_density)
 
 lemma measure_density_const:
   "A \<in> sets M \<Longrightarrow> c \<noteq> \<infinity> \<Longrightarrow> measure (density M (\<lambda>_. c)) A = enn2real c * measure M A"
   by (auto simp: emeasure_density_const measure_def enn2real_mult)
 
 lemma density_density_eq:
    "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow>
    density (density M f) g = density M (\<lambda>x. f x * g x)"
   by (auto intro!: measure_eqI simp: emeasure_density nn_integral_density ac_simps)
 
 lemma distr_density_distr:
   assumes T: "T \<in> measurable M M'" and T': "T' \<in> measurable M' M"
     and inv: "\<forall>x\<in>space M. T' (T x) = x"
   assumes f: "f \<in> borel_measurable M'"
   shows "distr (density (distr M M' T) f) M T' = density M (f \<circ> T)" (is "?R = ?L")
 proof (rule measure_eqI)
   fix A assume A: "A \<in> sets ?R"
   { fix x assume "x \<in> space M"
     with sets.sets_into_space[OF A]
     have "indicator (T' -` A \<inter> space M') (T x) = (indicator A x :: ennreal)"
       using T inv by (auto simp: indicator_def measurable_space) }
   with A T T' f show "emeasure ?R A = emeasure ?L A"
     by (simp add: measurable_comp emeasure_density emeasure_distr
                   nn_integral_distr measurable_sets cong: nn_integral_cong)
 qed simp
 
 lemma density_density_divide:
   fixes f g :: "'a \<Rightarrow> real"
   assumes f: "f \<in> borel_measurable M" "AE x in M. 0 \<le> f x"
   assumes g: "g \<in> borel_measurable M" "AE x in M. 0 \<le> g x"
   assumes ac: "AE x in M. f x = 0 \<longrightarrow> g x = 0"
   shows "density (density M f) (\<lambda>x. g x / f x) = density M g"
 proof -
   have "density M g = density M (\<lambda>x. ennreal (f x) * ennreal (g x / f x))"
     using f g ac by (auto intro!: density_cong measurable_If simp: ennreal_mult[symmetric])
   then show ?thesis
     using f g by (subst density_density_eq) auto
 qed
 
 lemma density_1: "density M (\<lambda>_. 1) = M"
   by (intro measure_eqI) (auto simp: emeasure_density)
 
 lemma emeasure_density_add:
   assumes X: "X \<in> sets M"
   assumes Mf[measurable]: "f \<in> borel_measurable M"
   assumes Mg[measurable]: "g \<in> borel_measurable M"
   shows "emeasure (density M f) X + emeasure (density M g) X =
            emeasure (density M (\<lambda>x. f x + g x)) X"
   using assms
   apply (subst (1 2 3) emeasure_density, simp_all) []
   apply (subst nn_integral_add[symmetric], simp_all) []
   apply (intro nn_integral_cong, simp split: split_indicator)
   done
 
 subsubsection \<open>Point measure\<close>
 
 definition\<^marker>\<open>tag important\<close> point_measure :: "'a set \<Rightarrow> ('a \<Rightarrow> ennreal) \<Rightarrow> 'a measure" where
   "point_measure A f = density (count_space A) f"
 
 lemma
   shows space_point_measure: "space (point_measure A f) = A"
     and sets_point_measure: "sets (point_measure A f) = Pow A"
   by (auto simp: point_measure_def)
 
 lemma sets_point_measure_count_space[measurable_cong]: "sets (point_measure A f) = sets (count_space A)"
   by (simp add: sets_point_measure)
 
 lemma measurable_point_measure_eq1[simp]:
   "g \<in> measurable (point_measure A f) M \<longleftrightarrow> g \<in> A \<rightarrow> space M"
   unfolding point_measure_def by simp
 
 lemma measurable_point_measure_eq2_finite[simp]:
   "finite A \<Longrightarrow>
    g \<in> measurable M (point_measure A f) \<longleftrightarrow>
     (g \<in> space M \<rightarrow> A \<and> (\<forall>a\<in>A. g -` {a} \<inter> space M \<in> sets M))"
   unfolding point_measure_def by (simp add: measurable_count_space_eq2)
 
 lemma simple_function_point_measure[simp]:
   "simple_function (point_measure A f) g \<longleftrightarrow> finite (g ` A)"
   by (simp add: point_measure_def)
 
 lemma emeasure_point_measure:
   assumes A: "finite {a\<in>X. 0 < f a}" "X \<subseteq> A"
   shows "emeasure (point_measure A f) X = (\<Sum>a|a\<in>X \<and> 0 < f a. f a)"
 proof -
   have "{a. (a \<in> X \<longrightarrow> a \<in> A \<and> 0 < f a) \<and> a \<in> X} = {a\<in>X. 0 < f a}"
     using \<open>X \<subseteq> A\<close> by auto
   with A show ?thesis
-    by (simp add: emeasure_density nn_integral_count_space point_measure_def indicator_def)
+    by (simp add: emeasure_density nn_integral_count_space point_measure_def indicator_def of_bool_def)
 qed
 
 lemma emeasure_point_measure_finite:
   "finite A \<Longrightarrow> X \<subseteq> A \<Longrightarrow> emeasure (point_measure A f) X = (\<Sum>a\<in>X. f a)"
   by (subst emeasure_point_measure) (auto dest: finite_subset intro!: sum.mono_neutral_left simp: less_le)
 
 lemma emeasure_point_measure_finite2:
   "X \<subseteq> A \<Longrightarrow> finite X \<Longrightarrow> emeasure (point_measure A f) X = (\<Sum>a\<in>X. f a)"
   by (subst emeasure_point_measure)
      (auto dest: finite_subset intro!: sum.mono_neutral_left simp: less_le)
 
 lemma null_sets_point_measure_iff:
   "X \<in> null_sets (point_measure A f) \<longleftrightarrow> X \<subseteq> A \<and> (\<forall>x\<in>X. f x = 0)"
  by (auto simp: AE_count_space null_sets_density_iff point_measure_def)
 
 lemma AE_point_measure:
   "(AE x in point_measure A f. P x) \<longleftrightarrow> (\<forall>x\<in>A. 0 < f x \<longrightarrow> P x)"
   unfolding point_measure_def
   by (subst AE_density) (auto simp: AE_density AE_count_space point_measure_def)
 
 lemma nn_integral_point_measure:
   "finite {a\<in>A. 0 < f a \<and> 0 < g a} \<Longrightarrow>
     integral\<^sup>N (point_measure A f) g = (\<Sum>a|a\<in>A \<and> 0 < f a \<and> 0 < g a. f a * g a)"
   unfolding point_measure_def
   by (subst nn_integral_density)
      (simp_all add: nn_integral_density nn_integral_count_space ennreal_zero_less_mult_iff)
 
 lemma nn_integral_point_measure_finite:
   "finite A \<Longrightarrow> integral\<^sup>N (point_measure A f) g = (\<Sum>a\<in>A. f a * g a)"
   by (subst nn_integral_point_measure) (auto intro!: sum.mono_neutral_left simp: less_le)
 
 subsubsection \<open>Uniform measure\<close>
 
 definition\<^marker>\<open>tag important\<close> "uniform_measure M A = density M (\<lambda>x. indicator A x / emeasure M A)"
 
 lemma
   shows sets_uniform_measure[simp, measurable_cong]: "sets (uniform_measure M A) = sets M"
     and space_uniform_measure[simp]: "space (uniform_measure M A) = space M"
   by (auto simp: uniform_measure_def)
 
 lemma emeasure_uniform_measure[simp]:
   assumes A: "A \<in> sets M" and B: "B \<in> sets M"
   shows "emeasure (uniform_measure M A) B = emeasure M (A \<inter> B) / emeasure M A"
 proof -
   from A B have "emeasure (uniform_measure M A) B = (\<integral>\<^sup>+x. (1 / emeasure M A) * indicator (A \<inter> B) x \<partial>M)"
     by (auto simp add: uniform_measure_def emeasure_density divide_ennreal_def split: split_indicator
              intro!: nn_integral_cong)
   also have "\<dots> = emeasure M (A \<inter> B) / emeasure M A"
     using A B
     by (subst nn_integral_cmult_indicator) (simp_all add: sets.Int divide_ennreal_def mult.commute)
   finally show ?thesis .
 qed
 
 lemma measure_uniform_measure[simp]:
   assumes A: "emeasure M A \<noteq> 0" "emeasure M A \<noteq> \<infinity>" and B: "B \<in> sets M"
   shows "measure (uniform_measure M A) B = measure M (A \<inter> B) / measure M A"
   using emeasure_uniform_measure[OF emeasure_neq_0_sets[OF A(1)] B] A
   by (cases "emeasure M A" "emeasure M (A \<inter> B)" rule: ennreal2_cases)
      (simp_all add: measure_def divide_ennreal top_ennreal.rep_eq top_ereal_def ennreal_top_divide)
 
 lemma AE_uniform_measureI:
   "A \<in> sets M \<Longrightarrow> (AE x in M. x \<in> A \<longrightarrow> P x) \<Longrightarrow> (AE x in uniform_measure M A. P x)"
   unfolding uniform_measure_def by (auto simp: AE_density divide_ennreal_def)
 
 lemma emeasure_uniform_measure_1:
   "emeasure M S \<noteq> 0 \<Longrightarrow> emeasure M S \<noteq> \<infinity> \<Longrightarrow> emeasure (uniform_measure M S) S = 1"
   by (subst emeasure_uniform_measure)
      (simp_all add: emeasure_neq_0_sets emeasure_eq_ennreal_measure divide_ennreal
                     zero_less_iff_neq_zero[symmetric])
 
 lemma nn_integral_uniform_measure:
   assumes f[measurable]: "f \<in> borel_measurable M" and S[measurable]: "S \<in> sets M"
   shows "(\<integral>\<^sup>+x. f x \<partial>uniform_measure M S) = (\<integral>\<^sup>+x. f x * indicator S x \<partial>M) / emeasure M S"
 proof -
   { assume "emeasure M S = \<infinity>"
     then have ?thesis
       by (simp add: uniform_measure_def nn_integral_density f) }
   moreover
   { assume [simp]: "emeasure M S = 0"
     then have ae: "AE x in M. x \<notin> S"
       using sets.sets_into_space[OF S]
       by (subst AE_iff_measurable[OF _ refl]) (simp_all add: subset_eq cong: rev_conj_cong)
     from ae have "(\<integral>\<^sup>+ x. indicator S x / 0 * f x \<partial>M) = 0"
       by (subst nn_integral_0_iff_AE) auto
     moreover from ae have "(\<integral>\<^sup>+ x. f x * indicator S x \<partial>M) = 0"
       by (subst nn_integral_0_iff_AE) auto
     ultimately have ?thesis
       by (simp add: uniform_measure_def nn_integral_density f) }
   moreover have "emeasure M S \<noteq> 0 \<Longrightarrow> emeasure M S \<noteq> \<infinity> \<Longrightarrow> ?thesis"
     unfolding uniform_measure_def
     by (subst nn_integral_density)
        (auto simp: ennreal_times_divide f nn_integral_divide[symmetric] mult.commute)
   ultimately show ?thesis by blast
 qed
 
 lemma AE_uniform_measure:
   assumes "emeasure M A \<noteq> 0" "emeasure M A < \<infinity>"
   shows "(AE x in uniform_measure M A. P x) \<longleftrightarrow> (AE x in M. x \<in> A \<longrightarrow> P x)"
 proof -
   have "A \<in> sets M"
     using \<open>emeasure M A \<noteq> 0\<close> by (metis emeasure_notin_sets)
   moreover have "\<And>x. 0 < indicator A x / emeasure M A \<longleftrightarrow> x \<in> A"
     using assms
     by (cases "emeasure M A") (auto split: split_indicator simp: ennreal_zero_less_divide)
   ultimately show ?thesis
     unfolding uniform_measure_def by (simp add: AE_density)
 qed
 
 subsubsection\<^marker>\<open>tag unimportant\<close> \<open>Null measure\<close>
 
 lemma null_measure_eq_density: "null_measure M = density M (\<lambda>_. 0)"
   by (intro measure_eqI) (simp_all add: emeasure_density)
 
 lemma nn_integral_null_measure[simp]: "(\<integral>\<^sup>+x. f x \<partial>null_measure M) = 0"
   by (auto simp add: nn_integral_def simple_integral_def SUP_constant bot_ennreal_def le_fun_def
            intro!: exI[of _ "\<lambda>x. 0"])
 
 lemma density_null_measure[simp]: "density (null_measure M) f = null_measure M"
 proof (intro measure_eqI)
   fix A show "emeasure (density (null_measure M) f) A = emeasure (null_measure M) A"
     by (simp add: density_def) (simp only: null_measure_def[symmetric] emeasure_null_measure)
 qed simp
 
 subsubsection \<open>Uniform count measure\<close>
 
 definition\<^marker>\<open>tag important\<close> "uniform_count_measure A = point_measure A (\<lambda>x. 1 / card A)"
 
 lemma
   shows space_uniform_count_measure: "space (uniform_count_measure A) = A"
     and sets_uniform_count_measure: "sets (uniform_count_measure A) = Pow A"
     unfolding uniform_count_measure_def by (auto simp: space_point_measure sets_point_measure)
 
 lemma sets_uniform_count_measure_count_space[measurable_cong]:
   "sets (uniform_count_measure A) = sets (count_space A)"
   by (simp add: sets_uniform_count_measure)
 
 lemma emeasure_uniform_count_measure:
   "finite A \<Longrightarrow> X \<subseteq> A \<Longrightarrow> emeasure (uniform_count_measure A) X = card X / card A"
   by (simp add: emeasure_point_measure_finite uniform_count_measure_def divide_inverse ennreal_mult
                 ennreal_of_nat_eq_real_of_nat)
 
 lemma measure_uniform_count_measure:
   "finite A \<Longrightarrow> X \<subseteq> A \<Longrightarrow> measure (uniform_count_measure A) X = card X / card A"
   by (simp add: emeasure_point_measure_finite uniform_count_measure_def measure_def enn2real_mult)
 
 lemma space_uniform_count_measure_empty_iff [simp]:
   "space (uniform_count_measure X) = {} \<longleftrightarrow> X = {}"
 by(simp add: space_uniform_count_measure)
 
 lemma sets_uniform_count_measure_eq_UNIV [simp]:
   "sets (uniform_count_measure UNIV) = UNIV \<longleftrightarrow> True"
   "UNIV = sets (uniform_count_measure UNIV) \<longleftrightarrow> True"
 by(simp_all add: sets_uniform_count_measure)
 
 subsubsection\<^marker>\<open>tag unimportant\<close> \<open>Scaled measure\<close>
 
 lemma nn_integral_scale_measure:
   assumes f: "f \<in> borel_measurable M"
   shows "nn_integral (scale_measure r M) f = r * nn_integral M f"
   using f
 proof induction
   case (cong f g)
   thus ?case
     by(simp add: cong.hyps space_scale_measure cong: nn_integral_cong_simp)
 next
   case (mult f c)
   thus ?case
     by(simp add: nn_integral_cmult max_def mult.assoc mult.left_commute)
 next
   case (add f g)
   thus ?case
     by(simp add: nn_integral_add distrib_left)
 next
   case (seq U)
   thus ?case
     by(simp add: nn_integral_monotone_convergence_SUP SUP_mult_left_ennreal image_comp)
 qed simp
 
 end
diff --git a/src/HOL/Analysis/Set_Integral.thy b/src/HOL/Analysis/Set_Integral.thy
--- a/src/HOL/Analysis/Set_Integral.thy
+++ b/src/HOL/Analysis/Set_Integral.thy
@@ -1,1165 +1,1163 @@
 (*  Title:      HOL/Analysis/Set_Integral.thy
     Author:     Jeremy Avigad (CMU), Johannes Hölzl (TUM), Luke Serafin (CMU)
     Author:  Sébastien Gouëzel   sebastien.gouezel@univ-rennes1.fr
 
 Notation and useful facts for working with integrals over a set.
 
 TODO: keep all these? Need unicode translations as well.
 *)
 
 theory Set_Integral
   imports Radon_Nikodym
 begin
 
 (*
     Notation
 *)
 
 definition\<^marker>\<open>tag important\<close> "set_borel_measurable M A f \<equiv> (\<lambda>x. indicator A x *\<^sub>R f x) \<in> borel_measurable M"
 
 definition\<^marker>\<open>tag important\<close>  "set_integrable M A f \<equiv> integrable M (\<lambda>x. indicator A x *\<^sub>R f x)"
 
 definition\<^marker>\<open>tag important\<close>  "set_lebesgue_integral M A f \<equiv> lebesgue_integral M (\<lambda>x. indicator A x *\<^sub>R f x)"
 
 syntax
   "_ascii_set_lebesgue_integral" :: "pttrn \<Rightarrow> 'a set \<Rightarrow> 'a measure \<Rightarrow> real \<Rightarrow> real"
   ("(4LINT (_):(_)/|(_)./ _)" [0,60,110,61] 60)
 
 translations
   "LINT x:A|M. f" == "CONST set_lebesgue_integral M A (\<lambda>x. f)"
 
 (*
     Notation for integration wrt lebesgue measure on the reals:
 
       LBINT x. f
       LBINT x : A. f
 
     TODO: keep all these? Need unicode.
 *)
 
 syntax
   "_lebesgue_borel_integral" :: "pttrn \<Rightarrow> real \<Rightarrow> real"
   ("(2LBINT _./ _)" [0,60] 60)
 
 syntax
   "_set_lebesgue_borel_integral" :: "pttrn \<Rightarrow> real set \<Rightarrow> real \<Rightarrow> real"
   ("(3LBINT _:_./ _)" [0,60,61] 60)
 
 (*
     Basic properties
 *)
 
 (*
 lemma indicator_abs_eq: "\<And>A x. \<bar>indicator A x\<bar> = ((indicator A x) :: real)"
   by (auto simp add: indicator_def)
 *)
 
 lemma set_integrable_cong:
   assumes "M = M'" "A = A'" "\<And>x. x \<in> A \<Longrightarrow> f x = f' x"
   shows   "set_integrable M A f = set_integrable M' A' f'"
 proof -
   have "(\<lambda>x. indicator A x *\<^sub>R f x) = (\<lambda>x. indicator A' x *\<^sub>R f' x)"
-    using assms by (auto simp: indicator_def)
+    using assms by (auto simp: indicator_def of_bool_def)
   thus ?thesis by (simp add: set_integrable_def assms)
 qed
 
 lemma set_borel_measurable_sets:
   fixes f :: "_ \<Rightarrow> _::real_normed_vector"
   assumes "set_borel_measurable M X f" "B \<in> sets borel" "X \<in> sets M"
   shows "f -` B \<inter> X \<in> sets M"
 proof -
   have "f \<in> borel_measurable (restrict_space M X)"
     using assms unfolding set_borel_measurable_def by (subst borel_measurable_restrict_space_iff) auto
   then have "f -` B \<inter> space (restrict_space M X) \<in> sets (restrict_space M X)"
     by (rule measurable_sets) fact
   with \<open>X \<in> sets M\<close> show ?thesis
     by (subst (asm) sets_restrict_space_iff) (auto simp: space_restrict_space)
 qed
 
 lemma set_lebesgue_integral_zero [simp]: "set_lebesgue_integral M A (\<lambda>x. 0) = 0"
   by (auto simp: set_lebesgue_integral_def)
 
 lemma set_lebesgue_integral_cong:
   assumes "A \<in> sets M" and "\<forall>x. x \<in> A \<longrightarrow> f x = g x"
   shows "(LINT x:A|M. f x) = (LINT x:A|M. g x)"
   unfolding set_lebesgue_integral_def
   using assms
   by (metis indicator_simps(2) real_vector.scale_zero_left)
 
 lemma set_lebesgue_integral_cong_AE:
   assumes [measurable]: "A \<in> sets M" "f \<in> borel_measurable M" "g \<in> borel_measurable M"
   assumes "AE x \<in> A in M. f x = g x"
   shows "LINT x:A|M. f x = LINT x:A|M. g x"
 proof-
   have "AE x in M. indicator A x *\<^sub>R f x = indicator A x *\<^sub>R g x"
     using assms by auto
   thus ?thesis
   unfolding set_lebesgue_integral_def by (intro integral_cong_AE) auto
 qed
 
 lemma set_integrable_cong_AE:
     "f \<in> borel_measurable M \<Longrightarrow> g \<in> borel_measurable M \<Longrightarrow>
     AE x \<in> A in M. f x = g x \<Longrightarrow> A \<in> sets M \<Longrightarrow>
     set_integrable M A f = set_integrable M A g"
   unfolding set_integrable_def
   by (rule integrable_cong_AE) auto
 
 lemma set_integrable_subset:
   fixes M A B and f :: "_ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes "set_integrable M A f" "B \<in> sets M" "B \<subseteq> A"
   shows "set_integrable M B f"
 proof -
   have "set_integrable M B (\<lambda>x. indicator A x *\<^sub>R f x)"
     using assms integrable_mult_indicator set_integrable_def by blast
   with \<open>B \<subseteq> A\<close> show ?thesis
     unfolding set_integrable_def
     by (simp add: indicator_inter_arith[symmetric] Int_absorb2)
 qed
 
 lemma set_integrable_restrict_space:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes f: "set_integrable M S f" and T: "T \<in> sets (restrict_space M S)"
   shows "set_integrable M T f"
 proof -
   obtain T' where T_eq: "T = S \<inter> T'" and "T' \<in> sets M" 
     using T by (auto simp: sets_restrict_space)
   have \<open>integrable M (\<lambda>x. indicator T' x *\<^sub>R (indicator S x *\<^sub>R f x))\<close>
     using \<open>T' \<in> sets M\<close> f integrable_mult_indicator set_integrable_def by blast
   then show ?thesis
     unfolding set_integrable_def
     unfolding T_eq indicator_inter_arith by (simp add: ac_simps)
 qed
 
 (* TODO: integral_cmul_indicator should be named set_integral_const *)
 (* TODO: borel_integrable_atLeastAtMost should be named something like set_integrable_Icc_isCont *)
 
 lemma set_integral_scaleR_right [simp]: "LINT t:A|M. a *\<^sub>R f t = a *\<^sub>R (LINT t:A|M. f t)"
   unfolding set_lebesgue_integral_def
   by (subst integral_scaleR_right[symmetric]) (auto intro!: Bochner_Integration.integral_cong)
 
 lemma set_integral_mult_right [simp]:
   fixes a :: "'a::{real_normed_field, second_countable_topology}"
   shows "LINT t:A|M. a * f t = a * (LINT t:A|M. f t)"
   unfolding set_lebesgue_integral_def
   by (subst integral_mult_right_zero[symmetric]) auto
 
 lemma set_integral_mult_left [simp]:
   fixes a :: "'a::{real_normed_field, second_countable_topology}"
   shows "LINT t:A|M. f t * a = (LINT t:A|M. f t) * a"
   unfolding set_lebesgue_integral_def
   by (subst integral_mult_left_zero[symmetric]) auto
 
 lemma set_integral_divide_zero [simp]:
   fixes a :: "'a::{real_normed_field, field, second_countable_topology}"
   shows "LINT t:A|M. f t / a = (LINT t:A|M. f t) / a"
   unfolding set_lebesgue_integral_def
   by (subst integral_divide_zero[symmetric], intro Bochner_Integration.integral_cong)
      (auto split: split_indicator)
 
 lemma set_integrable_scaleR_right [simp, intro]:
   shows "(a \<noteq> 0 \<Longrightarrow> set_integrable M A f) \<Longrightarrow> set_integrable M A (\<lambda>t. a *\<^sub>R f t)"
   unfolding set_integrable_def
   unfolding scaleR_left_commute by (rule integrable_scaleR_right)
 
 lemma set_integrable_scaleR_left [simp, intro]:
   fixes a :: "_ :: {banach, second_countable_topology}"
   shows "(a \<noteq> 0 \<Longrightarrow> set_integrable M A f) \<Longrightarrow> set_integrable M A (\<lambda>t. f t *\<^sub>R a)"
   unfolding set_integrable_def
   using integrable_scaleR_left[of a M "\<lambda>x. indicator A x *\<^sub>R f x"] by simp
 
 lemma set_integrable_mult_right [simp, intro]:
   fixes a :: "'a::{real_normed_field, second_countable_topology}"
   shows "(a \<noteq> 0 \<Longrightarrow> set_integrable M A f) \<Longrightarrow> set_integrable M A (\<lambda>t. a * f t)"
   unfolding set_integrable_def
   using integrable_mult_right[of a M "\<lambda>x. indicator A x *\<^sub>R f x"] by simp
 
 lemma set_integrable_mult_right_iff [simp]:
   fixes a :: "'a::{real_normed_field, second_countable_topology}"
   assumes "a \<noteq> 0"
   shows "set_integrable M A (\<lambda>t. a * f t) \<longleftrightarrow> set_integrable M A f"
 proof
   assume "set_integrable M A (\<lambda>t. a * f t)"
   then have "set_integrable M A (\<lambda>t. 1/a * (a * f t))"
     using set_integrable_mult_right by blast
   then show "set_integrable M A f"
     using assms by auto
 qed auto
 
 lemma set_integrable_mult_left [simp, intro]:
   fixes a :: "'a::{real_normed_field, second_countable_topology}"
   shows "(a \<noteq> 0 \<Longrightarrow> set_integrable M A f) \<Longrightarrow> set_integrable M A (\<lambda>t. f t * a)"
   unfolding set_integrable_def
   using integrable_mult_left[of a M "\<lambda>x. indicator A x *\<^sub>R f x"] by simp
 
 lemma set_integrable_mult_left_iff [simp]:
   fixes a :: "'a::{real_normed_field, second_countable_topology}"
   assumes "a \<noteq> 0"
   shows "set_integrable M A (\<lambda>t. f t * a) \<longleftrightarrow> set_integrable M A f"
   using assms by (subst set_integrable_mult_right_iff [symmetric]) (auto simp: mult.commute)
 
 lemma set_integrable_divide [simp, intro]:
   fixes a :: "'a::{real_normed_field, field, second_countable_topology}"
   assumes "a \<noteq> 0 \<Longrightarrow> set_integrable M A f"
   shows "set_integrable M A (\<lambda>t. f t / a)"
 proof -
   have "integrable M (\<lambda>x. indicator A x *\<^sub>R f x / a)"
     using assms unfolding set_integrable_def by (rule integrable_divide_zero)
   also have "(\<lambda>x. indicator A x *\<^sub>R f x / a) = (\<lambda>x. indicator A x *\<^sub>R (f x / a))"
     by (auto split: split_indicator)
   finally show ?thesis 
     unfolding set_integrable_def .
 qed
 
 lemma set_integrable_mult_divide_iff [simp]:
   fixes a :: "'a::{real_normed_field, second_countable_topology}"
   assumes "a \<noteq> 0"
   shows "set_integrable M A (\<lambda>t. f t / a) \<longleftrightarrow> set_integrable M A f"
   by (simp add: divide_inverse assms)
 
 lemma set_integral_add [simp, intro]:
   fixes f g :: "_ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes "set_integrable M A f" "set_integrable M A g"
   shows "set_integrable M A (\<lambda>x. f x + g x)"
     and "LINT x:A|M. f x + g x = (LINT x:A|M. f x) + (LINT x:A|M. g x)"
   using assms unfolding set_integrable_def set_lebesgue_integral_def by (simp_all add: scaleR_add_right)
 
 lemma set_integral_diff [simp, intro]:
   assumes "set_integrable M A f" "set_integrable M A g"
   shows "set_integrable M A (\<lambda>x. f x - g x)" and "LINT x:A|M. f x - g x =
     (LINT x:A|M. f x) - (LINT x:A|M. g x)"
   using assms unfolding set_integrable_def set_lebesgue_integral_def by (simp_all add: scaleR_diff_right)
 
 lemma set_integral_uminus: "set_integrable M A f \<Longrightarrow> LINT x:A|M. - f x = - (LINT x:A|M. f x)"
   unfolding set_integrable_def set_lebesgue_integral_def
   by (subst integral_minus[symmetric]) simp_all
 
 lemma set_integral_complex_of_real:
   "LINT x:A|M. complex_of_real (f x) = of_real (LINT x:A|M. f x)"
   unfolding set_lebesgue_integral_def
   by (subst integral_complex_of_real[symmetric])
      (auto intro!: Bochner_Integration.integral_cong split: split_indicator)
 
 lemma set_integral_mono:
   fixes f g :: "_ \<Rightarrow> real"
   assumes "set_integrable M A f" "set_integrable M A g"
     "\<And>x. x \<in> A \<Longrightarrow> f x \<le> g x"
   shows "(LINT x:A|M. f x) \<le> (LINT x:A|M. g x)"
   using assms unfolding set_integrable_def set_lebesgue_integral_def
   by (auto intro: integral_mono split: split_indicator)
 
 lemma set_integral_mono_AE:
   fixes f g :: "_ \<Rightarrow> real"
   assumes "set_integrable M A f" "set_integrable M A g"
     "AE x \<in> A in M. f x \<le> g x"
   shows "(LINT x:A|M. f x) \<le> (LINT x:A|M. g x)"
   using assms unfolding set_integrable_def set_lebesgue_integral_def
   by (auto intro: integral_mono_AE split: split_indicator)
 
 lemma set_integrable_abs: "set_integrable M A f \<Longrightarrow> set_integrable M A (\<lambda>x. \<bar>f x\<bar> :: real)"
   using integrable_abs[of M "\<lambda>x. f x * indicator A x"]unfolding set_integrable_def by (simp add: abs_mult ac_simps)
 
 lemma set_integrable_abs_iff:
   fixes f :: "_ \<Rightarrow> real"
   shows "set_borel_measurable M A f \<Longrightarrow> set_integrable M A (\<lambda>x. \<bar>f x\<bar>) = set_integrable M A f"
   unfolding set_integrable_def set_borel_measurable_def
   by (subst (2) integrable_abs_iff[symmetric]) (simp_all add: abs_mult ac_simps)
 
 lemma set_integrable_abs_iff':
   fixes f :: "_ \<Rightarrow> real"
   shows "f \<in> borel_measurable M \<Longrightarrow> A \<in> sets M \<Longrightarrow>
     set_integrable M A (\<lambda>x. \<bar>f x\<bar>) = set_integrable M A f"
   by (simp add: set_borel_measurable_def set_integrable_abs_iff)
 
 lemma set_integrable_discrete_difference:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes "countable X"
   assumes diff: "(A - B) \<union> (B - A) \<subseteq> X"
   assumes "\<And>x. x \<in> X \<Longrightarrow> emeasure M {x} = 0" "\<And>x. x \<in> X \<Longrightarrow> {x} \<in> sets M"
   shows "set_integrable M A f \<longleftrightarrow> set_integrable M B f"
   unfolding set_integrable_def
 proof (rule integrable_discrete_difference[where X=X])
   show "\<And>x. x \<in> space M \<Longrightarrow> x \<notin> X \<Longrightarrow> indicator A x *\<^sub>R f x = indicator B x *\<^sub>R f x"
     using diff by (auto split: split_indicator)
 qed fact+
 
 lemma set_integral_discrete_difference:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes "countable X"
   assumes diff: "(A - B) \<union> (B - A) \<subseteq> X"
   assumes "\<And>x. x \<in> X \<Longrightarrow> emeasure M {x} = 0" "\<And>x. x \<in> X \<Longrightarrow> {x} \<in> sets M"
   shows "set_lebesgue_integral M A f = set_lebesgue_integral M B f"
   unfolding set_lebesgue_integral_def
 proof (rule integral_discrete_difference[where X=X])
   show "\<And>x. x \<in> space M \<Longrightarrow> x \<notin> X \<Longrightarrow> indicator A x *\<^sub>R f x = indicator B x *\<^sub>R f x"
     using diff by (auto split: split_indicator)
 qed fact+
 
 lemma set_integrable_Un:
   fixes f g :: "_ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes f_A: "set_integrable M A f" and f_B:  "set_integrable M B f"
     and [measurable]: "A \<in> sets M" "B \<in> sets M"
   shows "set_integrable M (A \<union> B) f"
 proof -
   have "set_integrable M (A - B) f"
     using f_A by (rule set_integrable_subset) auto
   with f_B have "integrable M (\<lambda>x. indicator (A - B) x *\<^sub>R f x + indicator B x *\<^sub>R f x)"
     unfolding set_integrable_def using integrable_add by blast
   then show ?thesis
     unfolding set_integrable_def
     by (rule integrable_cong[THEN iffD1, rotated 2]) (auto split: split_indicator)
 qed
 
 lemma set_integrable_empty [simp]: "set_integrable M {} f"
   by (auto simp: set_integrable_def)
 
 lemma set_integrable_UN:
   fixes f :: "_ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes "finite I" "\<And>i. i\<in>I \<Longrightarrow> set_integrable M (A i) f"
     "\<And>i. i\<in>I \<Longrightarrow> A i \<in> sets M"
   shows "set_integrable M (\<Union>i\<in>I. A i) f"
   using assms
   by (induct I) (auto simp: set_integrable_Un sets.finite_UN)
 
 lemma set_integral_Un:
   fixes f :: "_ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes "A \<inter> B = {}"
   and "set_integrable M A f"
   and "set_integrable M B f"
 shows "LINT x:A\<union>B|M. f x = (LINT x:A|M. f x) + (LINT x:B|M. f x)"
   using assms
   unfolding set_integrable_def set_lebesgue_integral_def
   by (auto simp add: indicator_union_arith indicator_inter_arith[symmetric] scaleR_add_left)
 
 lemma set_integral_cong_set:
   fixes f :: "_ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes "set_borel_measurable M A f" "set_borel_measurable M B f"
     and ae: "AE x in M. x \<in> A \<longleftrightarrow> x \<in> B"
   shows "LINT x:B|M. f x = LINT x:A|M. f x"
   unfolding set_lebesgue_integral_def
 proof (rule integral_cong_AE)
   show "AE x in M. indicator B x *\<^sub>R f x = indicator A x *\<^sub>R f x"
     using ae by (auto simp: subset_eq split: split_indicator)
 qed (use assms in \<open>auto simp: set_borel_measurable_def\<close>)
 
 proposition set_borel_measurable_subset:
   fixes f :: "_ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes [measurable]: "set_borel_measurable M A f" "B \<in> sets M" and "B \<subseteq> A"
   shows "set_borel_measurable M B f"
 proof-
   have "set_borel_measurable M B (\<lambda>x. indicator A x *\<^sub>R f x)"
     using assms unfolding set_borel_measurable_def
     using borel_measurable_indicator borel_measurable_scaleR by blast 
   moreover have "(\<lambda>x. indicator B x *\<^sub>R indicator A x *\<^sub>R f x) = (\<lambda>x. indicator B x *\<^sub>R f x)"
     using \<open>B \<subseteq> A\<close> by (auto simp: fun_eq_iff split: split_indicator)
   ultimately show ?thesis 
     unfolding set_borel_measurable_def by simp
 qed
 
 lemma set_integral_Un_AE:
   fixes f :: "_ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes ae: "AE x in M. \<not> (x \<in> A \<and> x \<in> B)" and [measurable]: "A \<in> sets M" "B \<in> sets M"
   and "set_integrable M A f"
   and "set_integrable M B f"
   shows "LINT x:A\<union>B|M. f x = (LINT x:A|M. f x) + (LINT x:B|M. f x)"
 proof -
   have f: "set_integrable M (A \<union> B) f"
     by (intro set_integrable_Un assms)
   then have f': "set_borel_measurable M (A \<union> B) f"
     using integrable_iff_bounded set_borel_measurable_def set_integrable_def by blast
   have "LINT x:A\<union>B|M. f x = LINT x:(A - A \<inter> B) \<union> (B - A \<inter> B)|M. f x"
   proof (rule set_integral_cong_set)
     show "AE x in M. (x \<in> A - A \<inter> B \<union> (B - A \<inter> B)) = (x \<in> A \<union> B)"
       using ae by auto
     show "set_borel_measurable M (A - A \<inter> B \<union> (B - A \<inter> B)) f"
       using f' by (rule set_borel_measurable_subset) auto
   qed fact
   also have "\<dots> = (LINT x:(A - A \<inter> B)|M. f x) + (LINT x:(B - A \<inter> B)|M. f x)"
     by (auto intro!: set_integral_Un set_integrable_subset[OF f])
   also have "\<dots> = (LINT x:A|M. f x) + (LINT x:B|M. f x)"
     using ae
     by (intro arg_cong2[where f="(+)"] set_integral_cong_set)
        (auto intro!: set_borel_measurable_subset[OF f'])
   finally show ?thesis .
 qed
 
 lemma set_integral_finite_Union:
   fixes f :: "_ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes "finite I" "disjoint_family_on A I"
     and "\<And>i. i \<in> I \<Longrightarrow> set_integrable M (A i) f" "\<And>i. i \<in> I \<Longrightarrow> A i \<in> sets M"
   shows "(LINT x:(\<Union>i\<in>I. A i)|M. f x) = (\<Sum>i\<in>I. LINT x:A i|M. f x)"
   using assms
 proof induction
   case (insert x F)
   then have "A x \<inter> \<Union>(A ` F) = {}"
     by (meson disjoint_family_on_insert)
   with insert show ?case
     by (simp add: set_integral_Un set_integrable_Un set_integrable_UN disjoint_family_on_insert)
 qed (simp add: set_lebesgue_integral_def)
 
 (* TODO: find a better name? *)
 lemma pos_integrable_to_top:
   fixes l::real
   assumes "\<And>i. A i \<in> sets M" "mono A"
   assumes nneg: "\<And>x i. x \<in> A i \<Longrightarrow> 0 \<le> f x"
   and intgbl: "\<And>i::nat. set_integrable M (A i) f"
   and lim: "(\<lambda>i::nat. LINT x:A i|M. f x) \<longlonglongrightarrow> l"
 shows "set_integrable M (\<Union>i. A i) f"
     unfolding set_integrable_def
   apply (rule integrable_monotone_convergence[where f = "\<lambda>i::nat. \<lambda>x. indicator (A i) x *\<^sub>R f x" and x = l])
   apply (rule intgbl [unfolded set_integrable_def])
   prefer 3 apply (rule lim [unfolded set_lebesgue_integral_def])
   apply (rule AE_I2)
   using \<open>mono A\<close> apply (auto simp: mono_def nneg split: split_indicator) []
 proof (rule AE_I2)
   { fix x assume "x \<in> space M"
     show "(\<lambda>i. indicator (A i) x *\<^sub>R f x) \<longlonglongrightarrow> indicator (\<Union>i. A i) x *\<^sub>R f x"
     proof cases
       assume "\<exists>i. x \<in> A i"
       then guess i ..
       then have *: "eventually (\<lambda>i. x \<in> A i) sequentially"
         using \<open>x \<in> A i\<close> \<open>mono A\<close> by (auto simp: eventually_sequentially mono_def)
       show ?thesis
         apply (intro tendsto_eventually)
         using *
         apply eventually_elim
         apply (auto split: split_indicator)
         done
     qed auto }
   then show "(\<lambda>x. indicator (\<Union>i. A i) x *\<^sub>R f x) \<in> borel_measurable M"
     apply (rule borel_measurable_LIMSEQ_real)
     apply assumption
     using intgbl set_integrable_def by blast
 qed
 
 (* Proof from Royden Real Analysis, p. 91. *)
 lemma lebesgue_integral_countable_add:
   fixes f :: "_ \<Rightarrow> 'a :: {banach, second_countable_topology}"
   assumes meas[intro]: "\<And>i::nat. A i \<in> sets M"
     and disj: "\<And>i j. i \<noteq> j \<Longrightarrow> A i \<inter> A j = {}"
     and intgbl: "set_integrable M (\<Union>i. A i) f"
   shows "LINT x:(\<Union>i. A i)|M. f x = (\<Sum>i. (LINT x:(A i)|M. f x))"
     unfolding set_lebesgue_integral_def
 proof (subst integral_suminf[symmetric])
   show int_A: "integrable M (\<lambda>x. indicat_real (A i) x *\<^sub>R f x)" for i
     using intgbl unfolding set_integrable_def [symmetric]
     by (rule set_integrable_subset) auto
   { fix x assume "x \<in> space M"
     have "(\<lambda>i. indicator (A i) x *\<^sub>R f x) sums (indicator (\<Union>i. A i) x *\<^sub>R f x)"
       by (intro sums_scaleR_left indicator_sums) fact }
   note sums = this
 
   have norm_f: "\<And>i. set_integrable M (A i) (\<lambda>x. norm (f x))"
     using int_A[THEN integrable_norm] unfolding set_integrable_def by auto
 
   show "AE x in M. summable (\<lambda>i. norm (indicator (A i) x *\<^sub>R f x))"
     using disj by (intro AE_I2) (auto intro!: summable_mult2 sums_summable[OF indicator_sums])
 
   show "summable (\<lambda>i. LINT x|M. norm (indicator (A i) x *\<^sub>R f x))"
   proof (rule summableI_nonneg_bounded)
     fix n
     show "0 \<le> LINT x|M. norm (indicator (A n) x *\<^sub>R f x)"
       using norm_f by (auto intro!: integral_nonneg_AE)
 
     have "(\<Sum>i<n. LINT x|M. norm (indicator (A i) x *\<^sub>R f x)) = (\<Sum>i<n. LINT x:A i|M. norm (f x))"
       by (simp add: abs_mult set_lebesgue_integral_def)
     also have "\<dots> = set_lebesgue_integral M (\<Union>i<n. A i) (\<lambda>x. norm (f x))"
       using norm_f
       by (subst set_integral_finite_Union) (auto simp: disjoint_family_on_def disj)
     also have "\<dots> \<le> set_lebesgue_integral M (\<Union>i. A i) (\<lambda>x. norm (f x))"
       using intgbl[unfolded set_integrable_def, THEN integrable_norm] norm_f
       unfolding set_lebesgue_integral_def set_integrable_def
       apply (intro integral_mono set_integrable_UN[of "{..<n}", unfolded set_integrable_def])
           apply (auto split: split_indicator)
       done
     finally show "(\<Sum>i<n. LINT x|M. norm (indicator (A i) x *\<^sub>R f x)) \<le>
       set_lebesgue_integral M (\<Union>i. A i) (\<lambda>x. norm (f x))"
       by simp
   qed
   show "LINT x|M. indicator (\<Union>(A ` UNIV)) x *\<^sub>R f x = LINT x|M. (\<Sum>i. indicator (A i) x *\<^sub>R f x)"
     apply (rule Bochner_Integration.integral_cong[OF refl])
     apply (subst suminf_scaleR_left[OF sums_summable[OF indicator_sums, OF disj], symmetric])
     using sums_unique[OF indicator_sums[OF disj]]
     apply auto
     done
 qed
 
 lemma set_integral_cont_up:
   fixes f :: "_ \<Rightarrow> 'a :: {banach, second_countable_topology}"
   assumes [measurable]: "\<And>i. A i \<in> sets M" and A: "incseq A"
   and intgbl: "set_integrable M (\<Union>i. A i) f"
 shows "(\<lambda>i. LINT x:(A i)|M. f x) \<longlonglongrightarrow> LINT x:(\<Union>i. A i)|M. f x"
   unfolding set_lebesgue_integral_def
 proof (intro integral_dominated_convergence[where w="\<lambda>x. indicator (\<Union>i. A i) x *\<^sub>R norm (f x)"])
   have int_A: "\<And>i. set_integrable M (A i) f"
     using intgbl by (rule set_integrable_subset) auto
   show "\<And>i. (\<lambda>x. indicator (A i) x *\<^sub>R f x) \<in> borel_measurable M"
     using int_A integrable_iff_bounded set_integrable_def by blast
   show "(\<lambda>x. indicator (\<Union>(A ` UNIV)) x *\<^sub>R f x) \<in> borel_measurable M"
     using integrable_iff_bounded intgbl set_integrable_def by blast
   show "integrable M (\<lambda>x. indicator (\<Union>i. A i) x *\<^sub>R norm (f x))"
     using int_A intgbl integrable_norm unfolding set_integrable_def 
     by fastforce
   { fix x i assume "x \<in> A i"
     with A have "(\<lambda>xa. indicator (A xa) x::real) \<longlonglongrightarrow> 1 \<longleftrightarrow> (\<lambda>xa. 1::real) \<longlonglongrightarrow> 1"
       by (intro filterlim_cong refl)
          (fastforce simp: eventually_sequentially incseq_def subset_eq intro!: exI[of _ i]) }
   then show "AE x in M. (\<lambda>i. indicator (A i) x *\<^sub>R f x) \<longlonglongrightarrow> indicator (\<Union>i. A i) x *\<^sub>R f x"
     by (intro AE_I2 tendsto_intros) (auto split: split_indicator)
 qed (auto split: split_indicator)
 
 (* Can the int0 hypothesis be dropped? *)
 lemma set_integral_cont_down:
   fixes f :: "_ \<Rightarrow> 'a :: {banach, second_countable_topology}"
   assumes [measurable]: "\<And>i. A i \<in> sets M" and A: "decseq A"
   and int0: "set_integrable M (A 0) f"
   shows "(\<lambda>i::nat. LINT x:(A i)|M. f x) \<longlonglongrightarrow> LINT x:(\<Inter>i. A i)|M. f x"
   unfolding set_lebesgue_integral_def
 proof (rule integral_dominated_convergence)
   have int_A: "\<And>i. set_integrable M (A i) f"
     using int0 by (rule set_integrable_subset) (insert A, auto simp: decseq_def)
   have "integrable M (\<lambda>c. norm (indicat_real (A 0) c *\<^sub>R f c))"
     by (metis (no_types) int0 integrable_norm set_integrable_def)
   then show "integrable M (\<lambda>x. indicator (A 0) x *\<^sub>R norm (f x))"
     by force
   have "set_integrable M (\<Inter>i. A i) f"
     using int0 by (rule set_integrable_subset) (insert A, auto simp: decseq_def)
   with int_A show "(\<lambda>x. indicat_real (\<Inter>(A ` UNIV)) x *\<^sub>R f x) \<in> borel_measurable M"
                   "\<And>i. (\<lambda>x. indicat_real (A i) x *\<^sub>R f x) \<in> borel_measurable M"
     by (auto simp: set_integrable_def)
   show "\<And>i. AE x in M. norm (indicator (A i) x *\<^sub>R f x) \<le> indicator (A 0) x *\<^sub>R norm (f x)"
     using A by (auto split: split_indicator simp: decseq_def)
   { fix x i assume "x \<in> space M" "x \<notin> A i"
     with A have "(\<lambda>i. indicator (A i) x::real) \<longlonglongrightarrow> 0 \<longleftrightarrow> (\<lambda>i. 0::real) \<longlonglongrightarrow> 0"
       by (intro filterlim_cong refl)
          (auto split: split_indicator simp: eventually_sequentially decseq_def intro!: exI[of _ i]) }
   then show "AE x in M. (\<lambda>i. indicator (A i) x *\<^sub>R f x) \<longlonglongrightarrow> indicator (\<Inter>i. A i) x *\<^sub>R f x"
     by (intro AE_I2 tendsto_intros) (auto split: split_indicator)
 qed
 
 lemma set_integral_at_point:
   fixes a :: real
   assumes "set_integrable M {a} f"
   and [simp]: "{a} \<in> sets M" and "(emeasure M) {a} \<noteq> \<infinity>"
   shows "(LINT x:{a} | M. f x) = f a * measure M {a}"
 proof-
   have "set_lebesgue_integral M {a} f = set_lebesgue_integral M {a} (%x. f a)"
     by (intro set_lebesgue_integral_cong) simp_all
   then show ?thesis using assms
     unfolding set_lebesgue_integral_def by simp
 qed
 
 
 abbreviation complex_integrable :: "'a measure \<Rightarrow> ('a \<Rightarrow> complex) \<Rightarrow> bool" where
   "complex_integrable M f \<equiv> integrable M f"
 
 abbreviation complex_lebesgue_integral :: "'a measure \<Rightarrow> ('a \<Rightarrow> complex) \<Rightarrow> complex" ("integral\<^sup>C") where
   "integral\<^sup>C M f == integral\<^sup>L M f"
 
 syntax
   "_complex_lebesgue_integral" :: "pttrn \<Rightarrow> complex \<Rightarrow> 'a measure \<Rightarrow> complex"
  ("\<integral>\<^sup>C _. _ \<partial>_" [60,61] 110)
 
 translations
   "\<integral>\<^sup>Cx. f \<partial>M" == "CONST complex_lebesgue_integral M (\<lambda>x. f)"
 
 syntax
   "_ascii_complex_lebesgue_integral" :: "pttrn \<Rightarrow> 'a measure \<Rightarrow> real \<Rightarrow> real"
   ("(3CLINT _|_. _)" [0,110,60] 60)
 
 translations
   "CLINT x|M. f" == "CONST complex_lebesgue_integral M (\<lambda>x. f)"
 
 lemma complex_integrable_cnj [simp]:
   "complex_integrable M (\<lambda>x. cnj (f x)) \<longleftrightarrow> complex_integrable M f"
 proof
   assume "complex_integrable M (\<lambda>x. cnj (f x))"
   then have "complex_integrable M (\<lambda>x. cnj (cnj (f x)))"
     by (rule integrable_cnj)
   then show "complex_integrable M f"
     by simp
 qed simp
 
 lemma complex_of_real_integrable_eq:
   "complex_integrable M (\<lambda>x. complex_of_real (f x)) \<longleftrightarrow> integrable M f"
 proof
   assume "complex_integrable M (\<lambda>x. complex_of_real (f x))"
   then have "integrable M (\<lambda>x. Re (complex_of_real (f x)))"
     by (rule integrable_Re)
   then show "integrable M f"
     by simp
 qed simp
 
 
 abbreviation complex_set_integrable :: "'a measure \<Rightarrow> 'a set \<Rightarrow> ('a \<Rightarrow> complex) \<Rightarrow> bool" where
   "complex_set_integrable M A f \<equiv> set_integrable M A f"
 
 abbreviation complex_set_lebesgue_integral :: "'a measure \<Rightarrow> 'a set \<Rightarrow> ('a \<Rightarrow> complex) \<Rightarrow> complex" where
   "complex_set_lebesgue_integral M A f \<equiv> set_lebesgue_integral M A f"
 
 syntax
 "_ascii_complex_set_lebesgue_integral" :: "pttrn \<Rightarrow> 'a set \<Rightarrow> 'a measure \<Rightarrow> real \<Rightarrow> real"
 ("(4CLINT _:_|_. _)" [0,60,110,61] 60)
 
 translations
 "CLINT x:A|M. f" == "CONST complex_set_lebesgue_integral M A (\<lambda>x. f)"
 
 lemma set_measurable_continuous_on_ivl:
   assumes "continuous_on {a..b} (f :: real \<Rightarrow> real)"
   shows "set_borel_measurable borel {a..b} f"
   unfolding set_borel_measurable_def
   by (rule borel_measurable_continuous_on_indicator[OF _ assms]) simp
 
 
 text\<open>This notation is from Sébastien Gouëzel: His use is not directly in line with the
 notations in this file, they are more in line with sum, and more readable he thinks.\<close>
 
 abbreviation "set_nn_integral M A f \<equiv> nn_integral M (\<lambda>x. f x * indicator A x)"
 
 syntax
 "_set_nn_integral" :: "pttrn => 'a set => 'a measure => ereal => ereal"
 ("(\<integral>\<^sup>+((_)\<in>(_)./ _)/\<partial>_)" [0,60,110,61] 60)
 
 "_set_lebesgue_integral" :: "pttrn => 'a set => 'a measure => ereal => ereal"
 ("(\<integral>((_)\<in>(_)./ _)/\<partial>_)" [0,60,110,61] 60)
 
 translations
 "\<integral>\<^sup>+x \<in> A. f \<partial>M" == "CONST set_nn_integral M A (\<lambda>x. f)"
 "\<integral>x \<in> A. f \<partial>M" == "CONST set_lebesgue_integral M A (\<lambda>x. f)"
 
 lemma nn_integral_disjoint_pair:
   assumes [measurable]: "f \<in> borel_measurable M"
           "B \<in> sets M" "C \<in> sets M"
           "B \<inter> C = {}"
   shows "(\<integral>\<^sup>+x \<in> B \<union> C. f x \<partial>M) = (\<integral>\<^sup>+x \<in> B. f x \<partial>M) + (\<integral>\<^sup>+x \<in> C. f x \<partial>M)"
 proof -
   have mes: "\<And>D. D \<in> sets M \<Longrightarrow> (\<lambda>x. f x * indicator D x) \<in> borel_measurable M" by simp
   have pos: "\<And>D. AE x in M. f x * indicator D x \<ge> 0" using assms(2) by auto
   have "\<And>x. f x * indicator (B \<union> C) x = f x * indicator B x + f x * indicator C x" using assms(4)
     by (auto split: split_indicator)
   then have "(\<integral>\<^sup>+x. f x * indicator (B \<union> C) x \<partial>M) = (\<integral>\<^sup>+x. f x * indicator B x + f x * indicator C x \<partial>M)"
     by simp
   also have "... = (\<integral>\<^sup>+x. f x * indicator B x \<partial>M) + (\<integral>\<^sup>+x. f x * indicator C x \<partial>M)"
     by (rule nn_integral_add) (auto simp add: assms mes pos)
   finally show ?thesis by simp
 qed
 
 lemma nn_integral_disjoint_pair_countspace:
   assumes "B \<inter> C = {}"
   shows "(\<integral>\<^sup>+x \<in> B \<union> C. f x \<partial>count_space UNIV) = (\<integral>\<^sup>+x \<in> B. f x \<partial>count_space UNIV) + (\<integral>\<^sup>+x \<in> C. f x \<partial>count_space UNIV)"
 by (rule nn_integral_disjoint_pair) (simp_all add: assms)
 
 lemma nn_integral_null_delta:
   assumes "A \<in> sets M" "B \<in> sets M"
           "(A - B) \<union> (B - A) \<in> null_sets M"
   shows "(\<integral>\<^sup>+x \<in> A. f x \<partial>M) = (\<integral>\<^sup>+x \<in> B. f x \<partial>M)"
-proof (rule nn_integral_cong_AE, auto simp add: indicator_def)
+proof (rule nn_integral_cong_AE)
   have *: "AE a in M. a \<notin> (A - B) \<union> (B - A)"
     using assms(3) AE_not_in by blast
-  then show "AE a in M. a \<notin> A \<longrightarrow> a \<in> B \<longrightarrow> f a = 0"
+  then show \<open>AE x in M. f x * indicator A x = f x * indicator B x\<close>
     by auto
-  show "AE x\<in>A in M. x \<notin> B \<longrightarrow> f x = 0"
-    using * by auto
 qed
 
 proposition nn_integral_disjoint_family:
   assumes [measurable]: "f \<in> borel_measurable M" "\<And>(n::nat). B n \<in> sets M"
       and "disjoint_family B"
   shows "(\<integral>\<^sup>+x \<in> (\<Union>n. B n). f x \<partial>M) = (\<Sum>n. (\<integral>\<^sup>+x \<in> B n. f x \<partial>M))"
 proof -
   have "(\<integral>\<^sup>+ x. (\<Sum>n. f x * indicator (B n) x) \<partial>M) = (\<Sum>n. (\<integral>\<^sup>+ x. f x * indicator (B n) x \<partial>M))"
     by (rule nn_integral_suminf) simp
   moreover have "(\<Sum>n. f x * indicator (B n) x) = f x * indicator (\<Union>n. B n) x" for x
   proof (cases)
     assume "x \<in> (\<Union>n. B n)"
     then obtain n where "x \<in> B n" by blast
     have a: "finite {n}" by simp
     have "\<And>i. i \<noteq> n \<Longrightarrow> x \<notin> B i" using \<open>x \<in> B n\<close> assms(3) disjoint_family_on_def
       by (metis IntI UNIV_I empty_iff)
     then have "\<And>i. i \<notin> {n} \<Longrightarrow> indicator (B i) x = (0::ennreal)" using indicator_def by simp
     then have b: "\<And>i. i \<notin> {n} \<Longrightarrow> f x * indicator (B i) x = (0::ennreal)" by simp
 
     define h where "h = (\<lambda>i. f x * indicator (B i) x)"
     then have "\<And>i. i \<notin> {n} \<Longrightarrow> h i = 0" using b by simp
     then have "(\<Sum>i. h i) = (\<Sum>i\<in>{n}. h i)"
       by (metis sums_unique[OF sums_finite[OF a]])
     then have "(\<Sum>i. h i) = h n" by simp
     then have "(\<Sum>n. f x * indicator (B n) x) = f x * indicator (B n) x" using h_def by simp
     then have "(\<Sum>n. f x * indicator (B n) x) = f x" using \<open>x \<in> B n\<close> indicator_def by simp
     then show ?thesis using \<open>x \<in> (\<Union>n. B n)\<close> by auto
   next
     assume "x \<notin> (\<Union>n. B n)"
     then have "\<And>n. f x * indicator (B n) x = 0" by simp
     have "(\<Sum>n. f x * indicator (B n) x) = 0"
       by (simp add: \<open>\<And>n. f x * indicator (B n) x = 0\<close>)
     then show ?thesis using \<open>x \<notin> (\<Union>n. B n)\<close> by auto
   qed
   ultimately show ?thesis by simp
 qed
 
 lemma nn_set_integral_add:
   assumes [measurable]: "f \<in> borel_measurable M" "g \<in> borel_measurable M"
           "A \<in> sets M"
   shows "(\<integral>\<^sup>+x \<in> A. (f x + g x) \<partial>M) = (\<integral>\<^sup>+x \<in> A. f x \<partial>M) + (\<integral>\<^sup>+x \<in> A. g x \<partial>M)"
 proof -
   have "(\<integral>\<^sup>+x \<in> A. (f x + g x) \<partial>M) = (\<integral>\<^sup>+x. (f x * indicator A x + g x * indicator A x) \<partial>M)"
     by (auto simp add: indicator_def intro!: nn_integral_cong)
   also have "... = (\<integral>\<^sup>+x. f x * indicator A x \<partial>M) + (\<integral>\<^sup>+x. g x * indicator A x \<partial>M)"
     apply (rule nn_integral_add) using assms(1) assms(2) by auto
   finally show ?thesis by simp
 qed
 
 lemma nn_set_integral_cong:
   assumes "AE x in M. f x = g x"
   shows "(\<integral>\<^sup>+x \<in> A. f x \<partial>M) = (\<integral>\<^sup>+x \<in> A. g x \<partial>M)"
 apply (rule nn_integral_cong_AE) using assms(1) by auto
 
 lemma nn_set_integral_set_mono:
   "A \<subseteq> B \<Longrightarrow> (\<integral>\<^sup>+ x \<in> A. f x \<partial>M) \<le> (\<integral>\<^sup>+ x \<in> B. f x \<partial>M)"
 by (auto intro!: nn_integral_mono split: split_indicator)
 
 lemma nn_set_integral_mono:
   assumes [measurable]: "f \<in> borel_measurable M" "g \<in> borel_measurable M"
           "A \<in> sets M"
       and "AE x\<in>A in M. f x \<le> g x"
   shows "(\<integral>\<^sup>+x \<in> A. f x \<partial>M) \<le> (\<integral>\<^sup>+x \<in> A. g x \<partial>M)"
 by (auto intro!: nn_integral_mono_AE split: split_indicator simp: assms)
 
 lemma nn_set_integral_space [simp]:
   shows "(\<integral>\<^sup>+ x \<in> space M. f x \<partial>M) = (\<integral>\<^sup>+x. f x \<partial>M)"
 by (metis (mono_tags, lifting) indicator_simps(1) mult.right_neutral nn_integral_cong)
 
 lemma nn_integral_count_compose_inj:
   assumes "inj_on g A"
   shows "(\<integral>\<^sup>+x \<in> A. f (g x) \<partial>count_space UNIV) = (\<integral>\<^sup>+y \<in> g`A. f y \<partial>count_space UNIV)"
 proof -
   have "(\<integral>\<^sup>+x \<in> A. f (g x) \<partial>count_space UNIV) = (\<integral>\<^sup>+x. f (g x) \<partial>count_space A)"
     by (auto simp add: nn_integral_count_space_indicator[symmetric])
   also have "... = (\<integral>\<^sup>+y. f y \<partial>count_space (g`A))"
     by (simp add: assms nn_integral_bij_count_space inj_on_imp_bij_betw)
   also have "... = (\<integral>\<^sup>+y \<in> g`A. f y \<partial>count_space UNIV)"
     by (auto simp add: nn_integral_count_space_indicator[symmetric])
   finally show ?thesis by simp
 qed
 
 lemma nn_integral_count_compose_bij:
   assumes "bij_betw g A B"
   shows "(\<integral>\<^sup>+x \<in> A. f (g x) \<partial>count_space UNIV) = (\<integral>\<^sup>+y \<in> B. f y \<partial>count_space UNIV)"
 proof -
   have "inj_on g A" using assms bij_betw_def by auto
   then have "(\<integral>\<^sup>+x \<in> A. f (g x) \<partial>count_space UNIV) = (\<integral>\<^sup>+y \<in> g`A. f y \<partial>count_space UNIV)"
     by (rule nn_integral_count_compose_inj)
   then show ?thesis using assms by (simp add: bij_betw_def)
 qed
 
 lemma set_integral_null_delta:
   fixes f::"_ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes [measurable]: "integrable M f" "A \<in> sets M" "B \<in> sets M"
     and null: "(A - B) \<union> (B - A) \<in> null_sets M"
   shows "(\<integral>x \<in> A. f x \<partial>M) = (\<integral>x \<in> B. f x \<partial>M)"
 proof (rule set_integral_cong_set)
   have *: "AE a in M. a \<notin> (A - B) \<union> (B - A)"
     using null AE_not_in by blast
   then show "AE x in M. (x \<in> B) = (x \<in> A)"
     by auto
 qed (simp_all add: set_borel_measurable_def)
 
 lemma set_integral_space:
   assumes "integrable M f"
   shows "(\<integral>x \<in> space M. f x \<partial>M) = (\<integral>x. f x \<partial>M)"
   by (metis (no_types, lifting) indicator_simps(1) integral_cong scaleR_one set_lebesgue_integral_def)
 
 lemma null_if_pos_func_has_zero_nn_int:
   fixes f::"'a \<Rightarrow> ennreal"
   assumes [measurable]: "f \<in> borel_measurable M" "A \<in> sets M"
     and "AE x\<in>A in M. f x > 0" "(\<integral>\<^sup>+x\<in>A. f x \<partial>M) = 0"
   shows "A \<in> null_sets M"
 proof -
   have "AE x in M. f x * indicator A x = 0"
     by (subst nn_integral_0_iff_AE[symmetric], auto simp add: assms(4))
   then have "AE x\<in>A in M. False" using assms(3) by auto
   then show "A \<in> null_sets M" using assms(2) by (simp add: AE_iff_null_sets)
 qed
 
 lemma null_if_pos_func_has_zero_int:
   assumes [measurable]: "integrable M f" "A \<in> sets M"
       and "AE x\<in>A in M. f x > 0" "(\<integral>x\<in>A. f x \<partial>M) = (0::real)"
   shows "A \<in> null_sets M"
 proof -
   have "AE x in M. indicator A x * f x = 0"
     apply (subst integral_nonneg_eq_0_iff_AE[symmetric])
     using assms integrable_mult_indicator[OF \<open>A \<in> sets M\<close> assms(1)]
     by (auto simp: set_lebesgue_integral_def)
   then have "AE x\<in>A in M. f x = 0" by auto
   then have "AE x\<in>A in M. False" using assms(3) by auto
   then show "A \<in> null_sets M" using assms(2) by (simp add: AE_iff_null_sets)
 qed
 
 text\<open>The next lemma is a variant of \<open>density_unique\<close>. Note that it uses the notation
 for nonnegative set integrals introduced earlier.\<close>
 
 lemma (in sigma_finite_measure) density_unique2:
   assumes [measurable]: "f \<in> borel_measurable M" "f' \<in> borel_measurable M"
   assumes density_eq: "\<And>A. A \<in> sets M \<Longrightarrow> (\<integral>\<^sup>+ x \<in> A. f x \<partial>M) = (\<integral>\<^sup>+ x \<in> A. f' x \<partial>M)"
   shows "AE x in M. f x = f' x"
 proof (rule density_unique)
   show "density M f = density M f'"
     by (intro measure_eqI) (auto simp: emeasure_density intro!: density_eq)
 qed (auto simp add: assms)
 
 
 text \<open>The next lemma implies the same statement for Banach-space valued functions
 using Hahn-Banach theorem and linear forms. Since they are not yet easily available, I
 only formulate it for real-valued functions.\<close>
 
 lemma density_unique_real:
   fixes f f'::"_ \<Rightarrow> real"
   assumes M[measurable]: "integrable M f" "integrable M f'"
   assumes density_eq: "\<And>A. A \<in> sets M \<Longrightarrow> (\<integral>x \<in> A. f x \<partial>M) = (\<integral>x \<in> A. f' x \<partial>M)"
   shows "AE x in M. f x = f' x"
 proof -
   define A where "A = {x \<in> space M. f x < f' x}"
   then have [measurable]: "A \<in> sets M" by simp
   have "(\<integral>x \<in> A. (f' x - f x) \<partial>M) = (\<integral>x \<in> A. f' x \<partial>M) - (\<integral>x \<in> A. f x \<partial>M)"
     using \<open>A \<in> sets M\<close> M integrable_mult_indicator set_integrable_def by blast
   then have "(\<integral>x \<in> A. (f' x - f x) \<partial>M) = 0" using assms(3) by simp
   then have "A \<in> null_sets M"
     using A_def null_if_pos_func_has_zero_int[where ?f = "\<lambda>x. f' x - f x" and ?A = A] assms by auto
   then have "AE x in M. x \<notin> A" by (simp add: AE_not_in)
   then have *: "AE x in M. f' x \<le> f x" unfolding A_def by auto
 
   define B where "B = {x \<in> space M. f' x < f x}"
   then have [measurable]: "B \<in> sets M" by simp
   have "(\<integral>x \<in> B. (f x - f' x) \<partial>M) = (\<integral>x \<in> B. f x \<partial>M) - (\<integral>x \<in> B. f' x \<partial>M)"
     using \<open>B \<in> sets M\<close> M integrable_mult_indicator set_integrable_def by blast
   then have "(\<integral>x \<in> B. (f x - f' x) \<partial>M) = 0" using assms(3) by simp
   then have "B \<in> null_sets M"
     using B_def null_if_pos_func_has_zero_int[where ?f = "\<lambda>x. f x - f' x" and ?A = B] assms by auto
   then have "AE x in M. x \<notin> B" by (simp add: AE_not_in)
   then have "AE x in M. f' x \<ge> f x" unfolding B_def by auto
   then show ?thesis using * by auto
 qed
 
 text \<open>The next lemma shows that \<open>L\<^sup>1\<close> convergence of a sequence of functions follows from almost
 everywhere convergence and the weaker condition of the convergence of the integrated norms (or even
 just the nontrivial inequality about them). Useful in a lot of contexts! This statement (or its
 variations) are known as Scheffe lemma.
 
 The formalization is more painful as one should jump back and forth between reals and ereals and justify
 all the time positivity or integrability (thankfully, measurability is handled more or less automatically).\<close>
 
 proposition Scheffe_lemma1:
   assumes "\<And>n. integrable M (F n)" "integrable M f"
           "AE x in M. (\<lambda>n. F n x) \<longlonglongrightarrow> f x"
           "limsup (\<lambda>n. \<integral>\<^sup>+ x. norm(F n x) \<partial>M) \<le> (\<integral>\<^sup>+ x. norm(f x) \<partial>M)"
   shows "(\<lambda>n. \<integral>\<^sup>+ x. norm(F n x - f x) \<partial>M) \<longlonglongrightarrow> 0"
 proof -
   have [measurable]: "\<And>n. F n \<in> borel_measurable M" "f \<in> borel_measurable M"
     using assms(1) assms(2) by simp_all
   define G where "G = (\<lambda>n x. norm(f x) + norm(F n x) - norm(F n x - f x))"
   have [measurable]: "\<And>n. G n \<in> borel_measurable M" unfolding G_def by simp
   have G_pos[simp]: "\<And>n x. G n x \<ge> 0"
     unfolding G_def by (metis ge_iff_diff_ge_0 norm_minus_commute norm_triangle_ineq4)
   have finint: "(\<integral>\<^sup>+ x. norm(f x) \<partial>M) \<noteq> \<infinity>"
     using has_bochner_integral_implies_finite_norm[OF has_bochner_integral_integrable[OF \<open>integrable M f\<close>]]
     by simp
   then have fin2: "2 * (\<integral>\<^sup>+ x. norm(f x) \<partial>M) \<noteq> \<infinity>"
     by (auto simp: ennreal_mult_eq_top_iff)
 
   {
     fix x assume *: "(\<lambda>n. F n x) \<longlonglongrightarrow> f x"
     then have "(\<lambda>n. norm(F n x)) \<longlonglongrightarrow> norm(f x)" using tendsto_norm by blast
     moreover have "(\<lambda>n. norm(F n x - f x)) \<longlonglongrightarrow> 0" using * Lim_null tendsto_norm_zero_iff by fastforce
     ultimately have a: "(\<lambda>n. norm(F n x) - norm(F n x - f x)) \<longlonglongrightarrow> norm(f x)" using tendsto_diff by fastforce
     have "(\<lambda>n. norm(f x) + (norm(F n x) - norm(F n x - f x))) \<longlonglongrightarrow> norm(f x) + norm(f x)"
       by (rule tendsto_add) (auto simp add: a)
     moreover have "\<And>n. G n x = norm(f x) + (norm(F n x) - norm(F n x - f x))" unfolding G_def by simp
     ultimately have "(\<lambda>n. G n x) \<longlonglongrightarrow> 2 * norm(f x)" by simp
     then have "(\<lambda>n. ennreal(G n x)) \<longlonglongrightarrow> ennreal(2 * norm(f x))" by simp
     then have "liminf (\<lambda>n. ennreal(G n x)) = ennreal(2 * norm(f x))"
       using sequentially_bot tendsto_iff_Liminf_eq_Limsup by blast
   }
   then have "AE x in M. liminf (\<lambda>n. ennreal(G n x)) = ennreal(2 * norm(f x))" using assms(3) by auto
   then have "(\<integral>\<^sup>+ x. liminf (\<lambda>n. ennreal (G n x)) \<partial>M) = (\<integral>\<^sup>+ x. 2 * ennreal(norm(f x)) \<partial>M)"
     by (simp add: nn_integral_cong_AE ennreal_mult)
   also have "... = 2 * (\<integral>\<^sup>+ x. norm(f x) \<partial>M)" by (rule nn_integral_cmult) auto
   finally have int_liminf: "(\<integral>\<^sup>+ x. liminf (\<lambda>n. ennreal (G n x)) \<partial>M) = 2 * (\<integral>\<^sup>+ x. norm(f x) \<partial>M)"
     by simp
 
   have "(\<integral>\<^sup>+x. ennreal(norm(f x)) + ennreal(norm(F n x)) \<partial>M) = (\<integral>\<^sup>+x. norm(f x) \<partial>M) + (\<integral>\<^sup>+x. norm(F n x) \<partial>M)" for n
     by (rule nn_integral_add) (auto simp add: assms)
   then have "limsup (\<lambda>n. (\<integral>\<^sup>+x. ennreal(norm(f x)) + ennreal(norm(F n x)) \<partial>M)) =
       limsup (\<lambda>n. (\<integral>\<^sup>+x. norm(f x) \<partial>M) + (\<integral>\<^sup>+x. norm(F n x) \<partial>M))"
     by simp
   also have "... = (\<integral>\<^sup>+x. norm(f x) \<partial>M) + limsup (\<lambda>n. (\<integral>\<^sup>+x. norm(F n x) \<partial>M))"
     by (rule Limsup_const_add, auto simp add: finint)
   also have "... \<le> (\<integral>\<^sup>+x. norm(f x) \<partial>M) + (\<integral>\<^sup>+x. norm(f x) \<partial>M)"
     using assms(4) by (simp add: add_left_mono)
   also have "... = 2 * (\<integral>\<^sup>+x. norm(f x) \<partial>M)"
     unfolding one_add_one[symmetric] distrib_right by simp
   ultimately have a: "limsup (\<lambda>n. (\<integral>\<^sup>+x. ennreal(norm(f x)) + ennreal(norm(F n x)) \<partial>M)) \<le>
     2 * (\<integral>\<^sup>+x. norm(f x) \<partial>M)" by simp
 
   have le: "ennreal (norm (F n x - f x)) \<le> ennreal (norm (f x)) + ennreal (norm (F n x))" for n x
     by (simp add: norm_minus_commute norm_triangle_ineq4 ennreal_minus flip: ennreal_plus)
   then have le2: "(\<integral>\<^sup>+ x. ennreal (norm (F n x - f x)) \<partial>M) \<le> (\<integral>\<^sup>+ x. ennreal (norm (f x)) + ennreal (norm (F n x)) \<partial>M)" for n
     by (rule nn_integral_mono)
 
   have "2 * (\<integral>\<^sup>+ x. norm(f x) \<partial>M) = (\<integral>\<^sup>+ x. liminf (\<lambda>n. ennreal (G n x)) \<partial>M)"
     by (simp add: int_liminf)
   also have "\<dots> \<le> liminf (\<lambda>n. (\<integral>\<^sup>+x. G n x \<partial>M))"
     by (rule nn_integral_liminf) auto
   also have "liminf (\<lambda>n. (\<integral>\<^sup>+x. G n x \<partial>M)) =
     liminf (\<lambda>n. (\<integral>\<^sup>+x. ennreal(norm(f x)) + ennreal(norm(F n x)) \<partial>M) - (\<integral>\<^sup>+x. norm(F n x - f x) \<partial>M))"
   proof (intro arg_cong[where f=liminf] ext)
     fix n
     have "\<And>x. ennreal(G n x) = ennreal(norm(f x)) + ennreal(norm(F n x)) - ennreal(norm(F n x - f x))"
       unfolding G_def by (simp add: ennreal_minus flip: ennreal_plus)
     moreover have "(\<integral>\<^sup>+x. ennreal(norm(f x)) + ennreal(norm(F n x)) - ennreal(norm(F n x - f x)) \<partial>M)
             = (\<integral>\<^sup>+x. ennreal(norm(f x)) + ennreal(norm(F n x)) \<partial>M) - (\<integral>\<^sup>+x. norm(F n x - f x) \<partial>M)"
     proof (rule nn_integral_diff)
       from le show "AE x in M. ennreal (norm (F n x - f x)) \<le> ennreal (norm (f x)) + ennreal (norm (F n x))"
         by simp
       from le2 have "(\<integral>\<^sup>+x. ennreal (norm (F n x - f x)) \<partial>M) < \<infinity>" using assms(1) assms(2)
         by (metis has_bochner_integral_implies_finite_norm integrable.simps Bochner_Integration.integrable_diff)
       then show "(\<integral>\<^sup>+x. ennreal (norm (F n x - f x)) \<partial>M) \<noteq> \<infinity>" by simp
     qed (auto simp add: assms)
     ultimately show "(\<integral>\<^sup>+x. G n x \<partial>M) = (\<integral>\<^sup>+x. ennreal(norm(f x)) + ennreal(norm(F n x)) \<partial>M) - (\<integral>\<^sup>+x. norm(F n x - f x) \<partial>M)"
       by simp
   qed
   finally have "2 * (\<integral>\<^sup>+ x. norm(f x) \<partial>M) + limsup (\<lambda>n. (\<integral>\<^sup>+x. norm(F n x - f x) \<partial>M)) \<le>
     liminf (\<lambda>n. (\<integral>\<^sup>+x. ennreal(norm(f x)) + ennreal(norm(F n x)) \<partial>M) - (\<integral>\<^sup>+x. norm(F n x - f x) \<partial>M)) +
     limsup (\<lambda>n. (\<integral>\<^sup>+x. norm(F n x - f x) \<partial>M))"
     by (intro add_mono) auto
   also have "\<dots> \<le> (limsup (\<lambda>n. \<integral>\<^sup>+x. ennreal(norm(f x)) + ennreal(norm(F n x)) \<partial>M) - limsup (\<lambda>n. \<integral>\<^sup>+x. norm (F n x - f x) \<partial>M)) +
     limsup (\<lambda>n. (\<integral>\<^sup>+x. norm(F n x - f x) \<partial>M))"
     by (intro add_mono liminf_minus_ennreal le2) auto
   also have "\<dots> = limsup (\<lambda>n. (\<integral>\<^sup>+x. ennreal(norm(f x)) + ennreal(norm(F n x)) \<partial>M))"
     by (intro diff_add_cancel_ennreal Limsup_mono always_eventually allI le2)
   also have "\<dots> \<le> 2 * (\<integral>\<^sup>+x. norm(f x) \<partial>M)"
     by fact
   finally have "limsup (\<lambda>n. (\<integral>\<^sup>+x. norm(F n x - f x) \<partial>M)) = 0"
     using fin2 by simp
   then show ?thesis
     by (rule tendsto_0_if_Limsup_eq_0_ennreal)
 qed
 
 proposition Scheffe_lemma2:
   fixes F::"nat \<Rightarrow> 'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes "\<And> n::nat. F n \<in> borel_measurable M" "integrable M f"
           "AE x in M. (\<lambda>n. F n x) \<longlonglongrightarrow> f x"
           "\<And>n. (\<integral>\<^sup>+ x. norm(F n x) \<partial>M) \<le> (\<integral>\<^sup>+ x. norm(f x) \<partial>M)"
   shows "(\<lambda>n. \<integral>\<^sup>+ x. norm(F n x - f x) \<partial>M) \<longlonglongrightarrow> 0"
 proof (rule Scheffe_lemma1)
   fix n::nat
   have "(\<integral>\<^sup>+ x. norm(f x) \<partial>M) < \<infinity>" using assms(2) by (metis has_bochner_integral_implies_finite_norm integrable.cases)
   then have "(\<integral>\<^sup>+ x. norm(F n x) \<partial>M) < \<infinity>" using assms(4)[of n] by auto
   then show "integrable M (F n)" by (subst integrable_iff_bounded, simp add: assms(1)[of n])
 qed (auto simp add: assms Limsup_bounded)
 
 lemma tendsto_set_lebesgue_integral_at_right:
   fixes a b :: real and f :: "real \<Rightarrow> 'a :: {banach,second_countable_topology}"
   assumes "a < b" and sets: "\<And>a'. a' \<in> {a<..b} \<Longrightarrow> {a'..b} \<in> sets M"
       and "set_integrable M {a<..b} f"
   shows   "((\<lambda>a'. set_lebesgue_integral M {a'..b} f) \<longlongrightarrow>
              set_lebesgue_integral M {a<..b} f) (at_right a)"
 proof (rule tendsto_at_right_sequentially[OF assms(1)], goal_cases)
   case (1 S)
   have eq: "(\<Union>n. {S n..b}) = {a<..b}"
   proof safe
     fix x n assume "x \<in> {S n..b}"
     with 1(1,2)[of n] show "x \<in> {a<..b}" by auto
   next
     fix x assume "x \<in> {a<..b}"
     with order_tendstoD[OF \<open>S \<longlonglongrightarrow> a\<close>, of x] show "x \<in> (\<Union>n. {S n..b})"
       by (force simp: eventually_at_top_linorder dest: less_imp_le)
   qed
   have "(\<lambda>n. set_lebesgue_integral M {S n..b} f) \<longlonglongrightarrow> set_lebesgue_integral M (\<Union>n. {S n..b}) f"
     by (rule set_integral_cont_up) (insert assms 1, auto simp: eq incseq_def decseq_def less_imp_le)
   with eq show ?case by simp
 qed
 
 
 text \<open>
   The next lemmas relate convergence of integrals over an interval to
   improper integrals.
 \<close>
 lemma tendsto_set_lebesgue_integral_at_left:
   fixes a b :: real and f :: "real \<Rightarrow> 'a :: {banach,second_countable_topology}"
   assumes "a < b" and sets: "\<And>b'. b' \<in> {a..<b} \<Longrightarrow> {a..b'} \<in> sets M"
       and "set_integrable M {a..<b} f"
   shows   "((\<lambda>b'. set_lebesgue_integral M {a..b'} f) \<longlongrightarrow>
              set_lebesgue_integral M {a..<b} f) (at_left b)"
 proof (rule tendsto_at_left_sequentially[OF assms(1)], goal_cases)
   case (1 S)
   have eq: "(\<Union>n. {a..S n}) = {a..<b}"
   proof safe
     fix x n assume "x \<in> {a..S n}"
     with 1(1,2)[of n] show "x \<in> {a..<b}" by auto
   next
     fix x assume "x \<in> {a..<b}"
     with order_tendstoD[OF \<open>S \<longlonglongrightarrow> b\<close>, of x] show "x \<in> (\<Union>n. {a..S n})"
       by (force simp: eventually_at_top_linorder dest: less_imp_le)
   qed
   have "(\<lambda>n. set_lebesgue_integral M {a..S n} f) \<longlonglongrightarrow> set_lebesgue_integral M (\<Union>n. {a..S n}) f"
     by (rule set_integral_cont_up) (insert assms 1, auto simp: eq incseq_def decseq_def less_imp_le)
   with eq show ?case by simp
 qed
 
 proposition tendsto_set_lebesgue_integral_at_top:
   fixes f :: "real \<Rightarrow> 'a::{banach, second_countable_topology}"
   assumes sets: "\<And>b. b \<ge> a \<Longrightarrow> {a..b} \<in> sets M"
       and int: "set_integrable M {a..} f"
   shows "((\<lambda>b. set_lebesgue_integral M {a..b} f) \<longlongrightarrow> set_lebesgue_integral M {a..} f) at_top"
 proof (rule tendsto_at_topI_sequentially)
   fix X :: "nat \<Rightarrow> real" assume "filterlim X at_top sequentially"
   show "(\<lambda>n. set_lebesgue_integral M {a..X n} f) \<longlonglongrightarrow> set_lebesgue_integral M {a..} f"
     unfolding set_lebesgue_integral_def
   proof (rule integral_dominated_convergence)
     show "integrable M (\<lambda>x. indicat_real {a..} x *\<^sub>R norm (f x))"
       using integrable_norm[OF int[unfolded set_integrable_def]] by simp
     show "AE x in M. (\<lambda>n. indicator {a..X n} x *\<^sub>R f x) \<longlonglongrightarrow> indicat_real {a..} x *\<^sub>R f x"
     proof
       fix x
       from \<open>filterlim X at_top sequentially\<close>
       have "eventually (\<lambda>n. x \<le> X n) sequentially"
         unfolding filterlim_at_top_ge[where c=x] by auto
       then show "(\<lambda>n. indicator {a..X n} x *\<^sub>R f x) \<longlonglongrightarrow> indicat_real {a..} x *\<^sub>R f x"
         by (intro tendsto_eventually) (auto split: split_indicator elim!: eventually_mono)
     qed
     fix n show "AE x in M. norm (indicator {a..X n} x *\<^sub>R f x) \<le> 
                              indicator {a..} x *\<^sub>R norm (f x)"
       by (auto split: split_indicator)
   next
     from int show "(\<lambda>x. indicat_real {a..} x *\<^sub>R f x) \<in> borel_measurable M"
       by (simp add: set_integrable_def)
   next
     fix n :: nat
     from sets have "{a..X n} \<in> sets M" by (cases "X n \<ge> a") auto
     with int have "set_integrable M {a..X n} f"
       by (rule set_integrable_subset) auto
     thus "(\<lambda>x. indicat_real {a..X n} x *\<^sub>R f x) \<in> borel_measurable M"
       by (simp add: set_integrable_def)
   qed
 qed
 
 proposition tendsto_set_lebesgue_integral_at_bot:
   fixes f :: "real \<Rightarrow> 'a::{banach, second_countable_topology}"
   assumes sets: "\<And>a. a \<le> b \<Longrightarrow> {a..b} \<in> sets M"
       and int: "set_integrable M {..b} f"
     shows "((\<lambda>a. set_lebesgue_integral M {a..b} f) \<longlongrightarrow> set_lebesgue_integral M {..b} f) at_bot"
 proof (rule tendsto_at_botI_sequentially)
   fix X :: "nat \<Rightarrow> real" assume "filterlim X at_bot sequentially"
   show "(\<lambda>n. set_lebesgue_integral M {X n..b} f) \<longlonglongrightarrow> set_lebesgue_integral M {..b} f"
     unfolding set_lebesgue_integral_def
   proof (rule integral_dominated_convergence)
     show "integrable M (\<lambda>x. indicat_real {..b} x *\<^sub>R norm (f x))"
       using integrable_norm[OF int[unfolded set_integrable_def]] by simp
     show "AE x in M. (\<lambda>n. indicator {X n..b} x *\<^sub>R f x) \<longlonglongrightarrow> indicat_real {..b} x *\<^sub>R f x"
     proof
       fix x
       from \<open>filterlim X at_bot sequentially\<close>
       have "eventually (\<lambda>n. x \<ge> X n) sequentially"
         unfolding filterlim_at_bot_le[where c=x] by auto
       then show "(\<lambda>n. indicator {X n..b} x *\<^sub>R f x) \<longlonglongrightarrow> indicat_real {..b} x *\<^sub>R f x"
         by (intro tendsto_eventually) (auto split: split_indicator elim!: eventually_mono)
     qed
     fix n show "AE x in M. norm (indicator {X n..b} x *\<^sub>R f x) \<le> 
                              indicator {..b} x *\<^sub>R norm (f x)"
       by (auto split: split_indicator)
   next
     from int show "(\<lambda>x. indicat_real {..b} x *\<^sub>R f x) \<in> borel_measurable M"
       by (simp add: set_integrable_def)
   next
     fix n :: nat
     from sets have "{X n..b} \<in> sets M" by (cases "X n \<le> b") auto
     with int have "set_integrable M {X n..b} f"
       by (rule set_integrable_subset) auto
     thus "(\<lambda>x. indicat_real {X n..b} x *\<^sub>R f x) \<in> borel_measurable M"
       by (simp add: set_integrable_def)
   qed
 qed
 
 
 
 theorem integral_Markov_inequality':
   fixes u :: "'a \<Rightarrow> real"
   assumes [measurable]: "set_integrable M A u" and "A \<in> sets M"
   assumes "AE x in M. x \<in> A \<longrightarrow> u x \<ge> 0" and "0 < (c::real)"
   shows "emeasure M {x\<in>A. u x \<ge> c} \<le> (1/c::real) * (\<integral>x\<in>A. u x \<partial>M)"
 proof -
   have "(\<lambda>x. u x * indicator A x) \<in> borel_measurable M" 
     using assms by (auto simp: set_integrable_def mult_ac)
   hence "(\<lambda>x. ennreal (u x * indicator A x)) \<in> borel_measurable M"
     by measurable
   also have "(\<lambda>x. ennreal (u x * indicator A x)) = (\<lambda>x. ennreal (u x) * indicator A x)"
     by (intro ext) (auto simp: indicator_def)
   finally have meas: "\<dots> \<in> borel_measurable M" .
   from assms(3) have AE: "AE x in M. 0 \<le> u x * indicator A x"
     by eventually_elim (auto simp: indicator_def)
   have nonneg: "set_lebesgue_integral M A u \<ge> 0"
     unfolding set_lebesgue_integral_def
     by (intro Bochner_Integration.integral_nonneg_AE eventually_mono[OF AE]) (auto simp: mult_ac)
 
   have A: "A \<subseteq> space M"
     using \<open>A \<in> sets M\<close> by (simp add: sets.sets_into_space)
   have "{x \<in> A. u x \<ge> c} = {x \<in> A. ennreal(1/c) * u x \<ge> 1}"
     using \<open>c>0\<close> A by (auto simp: ennreal_mult'[symmetric])
   then have "emeasure M {x \<in> A. u x \<ge> c} = emeasure M ({x \<in> A. ennreal(1/c) * u x \<ge> 1})"
     by simp
   also have "... \<le> ennreal(1/c) * (\<integral>\<^sup>+ x. ennreal(u x) * indicator A x \<partial>M)"
     by (intro nn_integral_Markov_inequality meas assms)
   also have "(\<integral>\<^sup>+ x. ennreal(u x) * indicator A x \<partial>M) = ennreal (set_lebesgue_integral M A u)"
     unfolding set_lebesgue_integral_def nn_integral_set_ennreal using assms AE
     by (subst nn_integral_eq_integral) (simp_all add: mult_ac set_integrable_def)
   finally show ?thesis
     using \<open>c > 0\<close> nonneg by (subst ennreal_mult) auto
 qed
 
 theorem integral_Markov_inequality'_measure:
   assumes [measurable]: "set_integrable M A u" and "A \<in> sets M" 
      and "AE x in M. x \<in> A \<longrightarrow> 0 \<le> u x" "0 < (c::real)"
   shows "measure M {x\<in>A. u x \<ge> c} \<le> (\<integral>x\<in>A. u x \<partial>M) / c"
 proof -
   have nonneg: "set_lebesgue_integral M A u \<ge> 0"
     unfolding set_lebesgue_integral_def
     by (intro Bochner_Integration.integral_nonneg_AE eventually_mono[OF assms(3)])
        (auto simp: mult_ac)
   have le: "emeasure M {x\<in>A. u x \<ge> c} \<le> ennreal ((1/c) * (\<integral>x\<in>A. u x \<partial>M))"
     by (rule integral_Markov_inequality') (use assms in auto)
   also have "\<dots> < top"
     by auto
   finally have "ennreal (measure M {x\<in>A. u x \<ge> c}) = emeasure M {x\<in>A. u x \<ge> c}"
     by (intro emeasure_eq_ennreal_measure [symmetric]) auto
   also note le
   finally show ?thesis using nonneg
     by (subst (asm) ennreal_le_iff)
        (auto intro!: divide_nonneg_pos Bochner_Integration.integral_nonneg_AE assms)
 qed
 
 theorem%important (in finite_measure) Chernoff_ineq_ge:
   assumes s: "s > 0"
   assumes integrable: "set_integrable M A (\<lambda>x. exp (s * f x))" and "A \<in> sets M"
   shows   "measure M {x\<in>A. f x \<ge> a} \<le> exp (-s * a) * (\<integral>x\<in>A. exp (s * f x) \<partial>M)"
 proof -
   have "{x\<in>A. f x \<ge> a} = {x\<in>A. exp (s * f x) \<ge> exp (s * a)}"
     using s by auto
   also have "measure M \<dots> \<le> set_lebesgue_integral M A (\<lambda>x. exp (s * f x)) / exp (s * a)"
     by (intro integral_Markov_inequality'_measure assms) auto
   finally show ?thesis 
     by (simp add: exp_minus field_simps)
 qed
 
 theorem%important (in finite_measure) Chernoff_ineq_le:
   assumes s: "s > 0"
   assumes integrable: "set_integrable M A (\<lambda>x. exp (-s * f x))" and "A \<in> sets M"
   shows   "measure M {x\<in>A. f x \<le> a} \<le> exp (s * a) * (\<integral>x\<in>A. exp (-s * f x) \<partial>M)"
 proof -
   have "{x\<in>A. f x \<le> a} = {x\<in>A. exp (-s * f x) \<ge> exp (-s * a)}"
     using s by auto
   also have "measure M \<dots> \<le> set_lebesgue_integral M A (\<lambda>x. exp (-s * f x)) / exp (-s * a)"
     by (intro integral_Markov_inequality'_measure assms) auto
   finally show ?thesis 
     by (simp add: exp_minus field_simps)
 qed
 
 end
diff --git a/src/HOL/Library/Indicator_Function.thy b/src/HOL/Library/Indicator_Function.thy
--- a/src/HOL/Library/Indicator_Function.thy
+++ b/src/HOL/Library/Indicator_Function.thy
@@ -1,208 +1,208 @@
 (*  Title:      HOL/Library/Indicator_Function.thy
     Author:     Johannes Hoelzl (TU Muenchen)
 *)
 
 section \<open>Indicator Function\<close>
 
 theory Indicator_Function
 imports Complex_Main Disjoint_Sets
 begin
 
-definition "indicator S x = (if x \<in> S then 1 else 0)"
+definition "indicator S x = of_bool (x \<in> S)"
 
 text\<open>Type constrained version\<close>
 abbreviation indicat_real :: "'a set \<Rightarrow> 'a \<Rightarrow> real" where "indicat_real S \<equiv> indicator S"
 
 lemma indicator_simps[simp]:
   "x \<in> S \<Longrightarrow> indicator S x = 1"
   "x \<notin> S \<Longrightarrow> indicator S x = 0"
   unfolding indicator_def by auto
 
 lemma indicator_pos_le[intro, simp]: "(0::'a::linordered_semidom) \<le> indicator S x"
   and indicator_le_1[intro, simp]: "indicator S x \<le> (1::'a::linordered_semidom)"
   unfolding indicator_def by auto
 
 lemma indicator_abs_le_1: "\<bar>indicator S x\<bar> \<le> (1::'a::linordered_idom)"
   unfolding indicator_def by auto
 
 lemma indicator_eq_0_iff: "indicator A x = (0::'a::zero_neq_one) \<longleftrightarrow> x \<notin> A"
   by (auto simp: indicator_def)
 
 lemma indicator_eq_1_iff: "indicator A x = (1::'a::zero_neq_one) \<longleftrightarrow> x \<in> A"
   by (auto simp: indicator_def)
 
 lemma indicator_UNIV [simp]: "indicator UNIV = (\<lambda>x. 1)"
   by auto
 
 lemma indicator_leI:
   "(x \<in> A \<Longrightarrow> y \<in> B) \<Longrightarrow> (indicator A x :: 'a::linordered_nonzero_semiring) \<le> indicator B y"
   by (auto simp: indicator_def)
 
 lemma split_indicator: "P (indicator S x) \<longleftrightarrow> ((x \<in> S \<longrightarrow> P 1) \<and> (x \<notin> S \<longrightarrow> P 0))"
   unfolding indicator_def by auto
 
 lemma split_indicator_asm: "P (indicator S x) \<longleftrightarrow> (\<not> (x \<in> S \<and> \<not> P 1 \<or> x \<notin> S \<and> \<not> P 0))"
   unfolding indicator_def by auto
 
 lemma indicator_inter_arith: "indicator (A \<inter> B) x = indicator A x * (indicator B x::'a::semiring_1)"
   unfolding indicator_def by (auto simp: min_def max_def)
 
 lemma indicator_union_arith:
   "indicator (A \<union> B) x = indicator A x + indicator B x - indicator A x * (indicator B x :: 'a::ring_1)"
   unfolding indicator_def by (auto simp: min_def max_def)
 
 lemma indicator_inter_min: "indicator (A \<inter> B) x = min (indicator A x) (indicator B x::'a::linordered_semidom)"
   and indicator_union_max: "indicator (A \<union> B) x = max (indicator A x) (indicator B x::'a::linordered_semidom)"
   unfolding indicator_def by (auto simp: min_def max_def)
 
 lemma indicator_disj_union:
   "A \<inter> B = {} \<Longrightarrow> indicator (A \<union> B) x = (indicator A x + indicator B x :: 'a::linordered_semidom)"
   by (auto split: split_indicator)
 
 lemma indicator_compl: "indicator (- A) x = 1 - (indicator A x :: 'a::ring_1)"
   and indicator_diff: "indicator (A - B) x = indicator A x * (1 - indicator B x ::'a::ring_1)"
   unfolding indicator_def by (auto simp: min_def max_def)
 
 lemma indicator_times:
   "indicator (A \<times> B) x = indicator A (fst x) * (indicator B (snd x) :: 'a::semiring_1)"
   unfolding indicator_def by (cases x) auto
 
 lemma indicator_sum:
   "indicator (A <+> B) x = (case x of Inl x \<Rightarrow> indicator A x | Inr x \<Rightarrow> indicator B x)"
   unfolding indicator_def by (cases x) auto
 
 lemma indicator_image: "inj f \<Longrightarrow> indicator (f ` X) (f x) = (indicator X x::_::zero_neq_one)"
   by (auto simp: indicator_def inj_def)
 
 lemma indicator_vimage: "indicator (f -` A) x = indicator A (f x)"
   by (auto split: split_indicator)
 
 lemma  (* FIXME unnamed!? *)
   fixes f :: "'a \<Rightarrow> 'b::semiring_1"
   assumes "finite A"
   shows sum_mult_indicator[simp]: "(\<Sum>x \<in> A. f x * indicator B x) = (\<Sum>x \<in> A \<inter> B. f x)"
     and sum_indicator_mult[simp]: "(\<Sum>x \<in> A. indicator B x * f x) = (\<Sum>x \<in> A \<inter> B. f x)"
   unfolding indicator_def
   using assms by (auto intro!: sum.mono_neutral_cong_right split: if_split_asm)
 
 lemma sum_indicator_eq_card:
   assumes "finite A"
   shows "(\<Sum>x \<in> A. indicator B x) = card (A Int B)"
   using sum_mult_indicator [OF assms, of "\<lambda>x. 1::nat"]
   unfolding card_eq_sum by simp
 
 lemma sum_indicator_scaleR[simp]:
   "finite A \<Longrightarrow>
     (\<Sum>x \<in> A. indicator (B x) (g x) *\<^sub>R f x) = (\<Sum>x \<in> {x\<in>A. g x \<in> B x}. f x :: 'a::real_vector)"
   by (auto intro!: sum.mono_neutral_cong_right split: if_split_asm simp: indicator_def)
 
 lemma LIMSEQ_indicator_incseq:
   assumes "incseq A"
-  shows "(\<lambda>i. indicator (A i) x :: 'a::{topological_space,one,zero}) \<longlonglongrightarrow> indicator (\<Union>i. A i) x"
+  shows "(\<lambda>i. indicator (A i) x :: 'a::{topological_space,zero_neq_one}) \<longlonglongrightarrow> indicator (\<Union>i. A i) x"
 proof (cases "\<exists>i. x \<in> A i")
   case True
   then obtain i where "x \<in> A i"
     by auto
   then have *:
     "\<And>n. (indicator (A (n + i)) x :: 'a) = 1"
     "(indicator (\<Union>i. A i) x :: 'a) = 1"
     using incseqD[OF \<open>incseq A\<close>, of i "n + i" for n] \<open>x \<in> A i\<close> by (auto simp: indicator_def)
   show ?thesis
     by (rule LIMSEQ_offset[of _ i]) (use * in simp)
 next
   case False
   then show ?thesis by (simp add: indicator_def)
 qed
 
 lemma LIMSEQ_indicator_UN:
-  "(\<lambda>k. indicator (\<Union>i<k. A i) x :: 'a::{topological_space,one,zero}) \<longlonglongrightarrow> indicator (\<Union>i. A i) x"
+  "(\<lambda>k. indicator (\<Union>i<k. A i) x :: 'a::{topological_space,zero_neq_one}) \<longlonglongrightarrow> indicator (\<Union>i. A i) x"
 proof -
   have "(\<lambda>k. indicator (\<Union>i<k. A i) x::'a) \<longlonglongrightarrow> indicator (\<Union>k. \<Union>i<k. A i) x"
     by (intro LIMSEQ_indicator_incseq) (auto simp: incseq_def intro: less_le_trans)
   also have "(\<Union>k. \<Union>i<k. A i) = (\<Union>i. A i)"
     by auto
   finally show ?thesis .
 qed
 
 lemma LIMSEQ_indicator_decseq:
   assumes "decseq A"
-  shows "(\<lambda>i. indicator (A i) x :: 'a::{topological_space,one,zero}) \<longlonglongrightarrow> indicator (\<Inter>i. A i) x"
+  shows "(\<lambda>i. indicator (A i) x :: 'a::{topological_space,zero_neq_one}) \<longlonglongrightarrow> indicator (\<Inter>i. A i) x"
 proof (cases "\<exists>i. x \<notin> A i")
   case True
   then obtain i where "x \<notin> A i"
     by auto
   then have *:
     "\<And>n. (indicator (A (n + i)) x :: 'a) = 0"
     "(indicator (\<Inter>i. A i) x :: 'a) = 0"
     using decseqD[OF \<open>decseq A\<close>, of i "n + i" for n] \<open>x \<notin> A i\<close> by (auto simp: indicator_def)
   show ?thesis
     by (rule LIMSEQ_offset[of _ i]) (use * in simp)
 next
   case False
   then show ?thesis by (simp add: indicator_def)
 qed
 
 lemma LIMSEQ_indicator_INT:
-  "(\<lambda>k. indicator (\<Inter>i<k. A i) x :: 'a::{topological_space,one,zero}) \<longlonglongrightarrow> indicator (\<Inter>i. A i) x"
+  "(\<lambda>k. indicator (\<Inter>i<k. A i) x :: 'a::{topological_space,zero_neq_one}) \<longlonglongrightarrow> indicator (\<Inter>i. A i) x"
 proof -
   have "(\<lambda>k. indicator (\<Inter>i<k. A i) x::'a) \<longlonglongrightarrow> indicator (\<Inter>k. \<Inter>i<k. A i) x"
     by (intro LIMSEQ_indicator_decseq) (auto simp: decseq_def intro: less_le_trans)
   also have "(\<Inter>k. \<Inter>i<k. A i) = (\<Inter>i. A i)"
     by auto
   finally show ?thesis .
 qed
 
 lemma indicator_add:
   "A \<inter> B = {} \<Longrightarrow> (indicator A x::_::monoid_add) + indicator B x = indicator (A \<union> B) x"
   unfolding indicator_def by auto
 
 lemma of_real_indicator: "of_real (indicator A x) = indicator A x"
   by (simp split: split_indicator)
 
 lemma real_of_nat_indicator: "real (indicator A x :: nat) = indicator A x"
   by (simp split: split_indicator)
 
 lemma abs_indicator: "\<bar>indicator A x :: 'a::linordered_idom\<bar> = indicator A x"
   by (simp split: split_indicator)
 
 lemma mult_indicator_subset:
   "A \<subseteq> B \<Longrightarrow> indicator A x * indicator B x = (indicator A x :: 'a::comm_semiring_1)"
   by (auto split: split_indicator simp: fun_eq_iff)
 
 lemma indicator_times_eq_if:
   fixes f :: "'a \<Rightarrow> 'b::comm_ring_1"
   shows "indicator S x * f x = (if x \<in> S then f x else 0)" "f x * indicator S x = (if x \<in> S then f x else 0)"
   by auto
 
 lemma indicator_scaleR_eq_if:
   fixes f :: "'a \<Rightarrow> 'b::real_vector"
   shows "indicator S x *\<^sub>R f x = (if x \<in> S then f x else 0)"
   by simp
 
 lemma indicator_sums:
   assumes "\<And>i j. i \<noteq> j \<Longrightarrow> A i \<inter> A j = {}"
   shows "(\<lambda>i. indicator (A i) x::real) sums indicator (\<Union>i. A i) x"
 proof (cases "\<exists>i. x \<in> A i")
   case True
   then obtain i where i: "x \<in> A i" ..
   with assms have "(\<lambda>i. indicator (A i) x::real) sums (\<Sum>i\<in>{i}. indicator (A i) x)"
     by (intro sums_finite) (auto split: split_indicator)
   also have "(\<Sum>i\<in>{i}. indicator (A i) x) = indicator (\<Union>i. A i) x"
     using i by (auto split: split_indicator)
   finally show ?thesis .
 next
   case False
   then show ?thesis by simp
 qed
 
 text \<open>
   The indicator function of the union of a disjoint family of sets is the
   sum over all the individual indicators.
 \<close>
 
 lemma indicator_UN_disjoint:
   "finite A \<Longrightarrow> disjoint_family_on f A \<Longrightarrow> indicator (\<Union>(f ` A)) x = (\<Sum>y\<in>A. indicator (f y) x)"
   by (induct A rule: finite_induct)
     (auto simp: disjoint_family_on_def indicator_def split: if_splits)
 
 end
diff --git a/src/HOL/Probability/Product_PMF.thy b/src/HOL/Probability/Product_PMF.thy
--- a/src/HOL/Probability/Product_PMF.thy
+++ b/src/HOL/Probability/Product_PMF.thy
@@ -1,910 +1,910 @@
 (*
   File:    Product_PMF.thy
   Authors: Manuel Eberl, Max W. Haslbeck
 *)
 section \<open>Indexed products of PMFs\<close>
 theory Product_PMF
   imports Probability_Mass_Function Independent_Family
 begin
 
 subsection \<open>Preliminaries\<close>
 
 lemma pmf_expectation_eq_infsetsum: "measure_pmf.expectation p f = infsetsum (\<lambda>x. pmf p x * f x) UNIV"
   unfolding infsetsum_def measure_pmf_eq_density by (subst integral_density) simp_all
 
 lemma measure_pmf_prob_product:
   assumes "countable A" "countable B"
   shows "measure_pmf.prob (pair_pmf M N) (A \<times> B) = measure_pmf.prob M A * measure_pmf.prob N B"
 proof -
   have "measure_pmf.prob (pair_pmf M N) (A \<times> B) = (\<Sum>\<^sub>a(a, b)\<in>A \<times> B. pmf M a * pmf N b)"
     by (auto intro!: infsetsum_cong simp add: measure_pmf_conv_infsetsum pmf_pair)
   also have "\<dots> = measure_pmf.prob M A * measure_pmf.prob N B"
     using assms by (subst infsetsum_product) (auto simp add: measure_pmf_conv_infsetsum)
   finally show ?thesis
     by simp
 qed
 
 
 subsection \<open>Definition\<close>
 
 text \<open>
   In analogy to @{const PiM}, we define an indexed product of PMFs. In the literature, this
   is typically called taking a vector of independent random variables. Note that the components
   do not have to be identically distributed.
 
   The operation takes an explicit index set \<^term>\<open>A :: 'a set\<close> and a function \<^term>\<open>f :: 'a \<Rightarrow> 'b pmf\<close>
   that maps each element from \<^term>\<open>A\<close> to a PMF and defines the product measure
   $\bigotimes_{i\in A} f(i)$ , which is represented as a \<^typ>\<open>('a \<Rightarrow> 'b) pmf\<close>.
 
   Note that unlike @{const PiM}, this only works for \<^emph>\<open>finite\<close> index sets. It could
   be extended to countable sets and beyond, but the construction becomes somewhat more involved.
 \<close>
 definition Pi_pmf :: "'a set \<Rightarrow> 'b \<Rightarrow> ('a \<Rightarrow> 'b pmf) \<Rightarrow> ('a \<Rightarrow> 'b) pmf" where
   "Pi_pmf A dflt p =
      embed_pmf (\<lambda>f. if (\<forall>x. x \<notin> A \<longrightarrow> f x = dflt) then \<Prod>x\<in>A. pmf (p x) (f x) else 0)"
 
 text \<open>
   A technical subtlety that needs to be addressed is this: Intuitively, the functions in the
   support of a product distribution have domain \<open>A\<close>. However, since HOL is a total logic, these
   functions must still return \<^emph>\<open>some\<close> value for inputs outside \<open>A\<close>. The product measure
   @{const PiM} simply lets these functions return @{const undefined} in these cases. We chose a
   different solution here, which is to supply a default value \<^term>\<open>dflt :: 'b\<close> that is returned
   in these cases.
 
   As one possible application, one could model the result of \<open>n\<close> different independent coin
   tosses as @{term "Pi_pmf {0..<n} False (\<lambda>_. bernoulli_pmf (1 / 2))"}. This returns a function
   of type \<^typ>\<open>nat \<Rightarrow> bool\<close> that maps every natural number below \<open>n\<close> to the result of the
   corresponding coin toss, and every other natural number to \<^term>\<open>False\<close>.
 \<close>
 
 lemma pmf_Pi:
   assumes A: "finite A"
   shows   "pmf (Pi_pmf A dflt p) f =
              (if (\<forall>x. x \<notin> A \<longrightarrow> f x = dflt) then \<Prod>x\<in>A. pmf (p x) (f x) else 0)"
   unfolding Pi_pmf_def
 proof (rule pmf_embed_pmf, goal_cases)
   case 2
   define S where "S = {f. \<forall>x. x \<notin> A \<longrightarrow> f x = dflt}"
   define B where "B = (\<lambda>x. set_pmf (p x))"
 
   have neutral_left: "(\<Prod>xa\<in>A. pmf (p xa) (f xa)) = 0"
     if "f \<in> PiE A B - (\<lambda>f. restrict f A) ` S" for f
   proof -
     have "restrict (\<lambda>x. if x \<in> A then f x else dflt) A \<in> (\<lambda>f. restrict f A) ` S"
       by (intro imageI) (auto simp: S_def)
     also have "restrict (\<lambda>x. if x \<in> A then f x else dflt) A = f"
       using that by (auto simp: PiE_def Pi_def extensional_def fun_eq_iff)
     finally show ?thesis using that by blast
   qed
   have neutral_right: "(\<Prod>xa\<in>A. pmf (p xa) (f xa)) = 0"
     if "f \<in> (\<lambda>f. restrict f A) ` S - PiE A B" for f
   proof -
     from that obtain f' where f': "f = restrict f' A" "f' \<in> S" by auto
     moreover from this and that have "restrict f' A \<notin> PiE A B" by simp
     then obtain x where "x \<in> A" "pmf (p x) (f' x) = 0" by (auto simp: B_def set_pmf_eq)
     with f' and A show ?thesis by auto
   qed
 
   have "(\<lambda>f. \<Prod>x\<in>A. pmf (p x) (f x)) abs_summable_on PiE A B"
     by (intro abs_summable_on_prod_PiE A) (auto simp: B_def)
   also have "?this \<longleftrightarrow> (\<lambda>f. \<Prod>x\<in>A. pmf (p x) (f x)) abs_summable_on (\<lambda>f. restrict f A) ` S"
     by (intro abs_summable_on_cong_neutral neutral_left neutral_right) auto
   also have "\<dots> \<longleftrightarrow> (\<lambda>f. \<Prod>x\<in>A. pmf (p x) (restrict f A x)) abs_summable_on S"
     by (rule abs_summable_on_reindex_iff [symmetric]) (force simp: inj_on_def fun_eq_iff S_def)
   also have "\<dots> \<longleftrightarrow> (\<lambda>f. if \<forall>x. x \<notin> A \<longrightarrow> f x = dflt then \<Prod>x\<in>A. pmf (p x) (f x) else 0)
                           abs_summable_on UNIV"
     by (intro abs_summable_on_cong_neutral) (auto simp: S_def)
   finally have summable: \<dots> .
 
   have "1 = (\<Prod>x\<in>A. 1::real)" by simp
   also have "(\<Prod>x\<in>A. 1) = (\<Prod>x\<in>A. \<Sum>\<^sub>ay\<in>B x. pmf (p x) y)"
     unfolding B_def by (subst infsetsum_pmf_eq_1) auto
   also have "(\<Prod>x\<in>A. \<Sum>\<^sub>ay\<in>B x. pmf (p x) y) = (\<Sum>\<^sub>af\<in>Pi\<^sub>E A B. \<Prod>x\<in>A. pmf (p x) (f x))"
     by (intro infsetsum_prod_PiE [symmetric] A) (auto simp: B_def)
   also have "\<dots> = (\<Sum>\<^sub>af\<in>(\<lambda>f. restrict f A) ` S. \<Prod>x\<in>A. pmf (p x) (f x))" using A
     by (intro infsetsum_cong_neutral neutral_left neutral_right refl)
   also have "\<dots> = (\<Sum>\<^sub>af\<in>S. \<Prod>x\<in>A. pmf (p x) (restrict f A x))"
     by (rule infsetsum_reindex) (force simp: inj_on_def fun_eq_iff S_def)
   also have "\<dots> = (\<Sum>\<^sub>af\<in>S. \<Prod>x\<in>A. pmf (p x) (f x))"
     by (intro infsetsum_cong) (auto simp: S_def)
   also have "\<dots> = (\<Sum>\<^sub>af. if \<forall>x. x \<notin> A \<longrightarrow> f x = dflt then \<Prod>x\<in>A. pmf (p x) (f x) else 0)"
     by (intro infsetsum_cong_neutral) (auto simp: S_def)
   also have "ennreal \<dots> = (\<integral>\<^sup>+f. ennreal (if \<forall>x. x \<notin> A \<longrightarrow> f x = dflt
                              then \<Prod>x\<in>A. pmf (p x) (f x) else 0) \<partial>count_space UNIV)"
     by (intro nn_integral_conv_infsetsum [symmetric] summable) (auto simp: prod_nonneg)
   finally show ?case by simp
 qed (auto simp: prod_nonneg)
 
 lemma Pi_pmf_cong:
   assumes "A = A'" "dflt = dflt'" "\<And>x. x \<in> A \<Longrightarrow> f x = f' x"
   shows   "Pi_pmf A dflt f = Pi_pmf A' dflt' f'"
 proof -
   have "(\<lambda>fa. if \<forall>x. x \<notin> A \<longrightarrow> fa x = dflt then \<Prod>x\<in>A. pmf (f x) (fa x) else 0) =
         (\<lambda>f. if \<forall>x. x \<notin> A' \<longrightarrow> f x = dflt' then \<Prod>x\<in>A'. pmf (f' x) (f x) else 0)"
     using assms by (intro ext) (auto intro!: prod.cong)
   thus ?thesis
     by (simp only: Pi_pmf_def)
 qed
 
 lemma pmf_Pi':
   assumes "finite A" "\<And>x. x \<notin> A \<Longrightarrow> f x = dflt"
   shows   "pmf (Pi_pmf A dflt p) f = (\<Prod>x\<in>A. pmf (p x) (f x))"
   using assms by (subst pmf_Pi) auto
 
 lemma pmf_Pi_outside:
   assumes "finite A" "\<exists>x. x \<notin> A \<and> f x \<noteq> dflt"
   shows   "pmf (Pi_pmf A dflt p) f = 0"
   using assms by (subst pmf_Pi) auto
 
 lemma pmf_Pi_empty [simp]: "Pi_pmf {} dflt p = return_pmf (\<lambda>_. dflt)"
   by (intro pmf_eqI, subst pmf_Pi) (auto simp: indicator_def)
 
 lemma set_Pi_pmf_subset: "finite A \<Longrightarrow> set_pmf (Pi_pmf A dflt p) \<subseteq> {f. \<forall>x. x \<notin> A \<longrightarrow> f x = dflt}"
   by (auto simp: set_pmf_eq pmf_Pi)
 
 
 subsection \<open>Dependent product sets with a default\<close>
 
 text \<open>
   The following describes a dependent product of sets where the functions are required to return
   the default value \<^term>\<open>dflt\<close> outside their domain, in analogy to @{const PiE}, which uses
   @{const undefined}.
 \<close>
 definition PiE_dflt
   where "PiE_dflt A dflt B = {f. \<forall>x. (x \<in> A \<longrightarrow> f x \<in> B x) \<and> (x \<notin> A \<longrightarrow> f x = dflt)}"
 
 lemma restrict_PiE_dflt: "(\<lambda>h. restrict h A) ` PiE_dflt A dflt B = PiE A B"
 proof (intro equalityI subsetI)
   fix h assume "h \<in> (\<lambda>h. restrict h A) ` PiE_dflt A dflt B"
   thus "h \<in> PiE A B"
     by (auto simp: PiE_dflt_def)
 next
   fix h assume h: "h \<in> PiE A B"
   hence "restrict (\<lambda>x. if x \<in> A then h x else dflt) A \<in> (\<lambda>h. restrict h A) ` PiE_dflt A dflt B"
     by (intro imageI) (auto simp: PiE_def extensional_def PiE_dflt_def)
   also have "restrict (\<lambda>x. if x \<in> A then h x else dflt) A = h"
     using h by (auto simp: fun_eq_iff)
   finally show "h \<in> (\<lambda>h. restrict h A) ` PiE_dflt A dflt B" .
 qed
 
 lemma dflt_image_PiE: "(\<lambda>h x. if x \<in> A then h x else dflt) ` PiE A B = PiE_dflt A dflt B"
   (is "?f ` ?X = ?Y")
 proof (intro equalityI subsetI)
   fix h assume "h \<in> ?f ` ?X"
   thus "h \<in> ?Y"
     by (auto simp: PiE_dflt_def PiE_def)
 next
   fix h assume h: "h \<in> ?Y"
   hence "?f (restrict h A) \<in> ?f ` ?X"
     by (intro imageI) (auto simp: PiE_def extensional_def PiE_dflt_def)
   also have "?f (restrict h A) = h"
     using h by (auto simp: fun_eq_iff PiE_dflt_def)
   finally show "h \<in> ?f ` ?X" .
 qed
 
 lemma finite_PiE_dflt [intro]:
   assumes "finite A" "\<And>x. x \<in> A \<Longrightarrow> finite (B x)"
   shows   "finite (PiE_dflt A d B)"
 proof -
   have "PiE_dflt A d B = (\<lambda>f x. if x \<in> A then f x else d) ` PiE A B"
     by (rule dflt_image_PiE [symmetric])
   also have "finite \<dots>"
     by (intro finite_imageI finite_PiE assms)
   finally show ?thesis .
 qed
 
 lemma card_PiE_dflt:
   assumes "finite A" "\<And>x. x \<in> A \<Longrightarrow> finite (B x)"
   shows   "card (PiE_dflt A d B) = (\<Prod>x\<in>A. card (B x))"
 proof -
   from assms have "(\<Prod>x\<in>A. card (B x)) = card (PiE A B)"
     by (intro card_PiE [symmetric]) auto
   also have "PiE A B = (\<lambda>f. restrict f A) ` PiE_dflt A d B"
     by (rule restrict_PiE_dflt [symmetric])
   also have "card \<dots> = card (PiE_dflt A d B)"
     by (intro card_image) (force simp: inj_on_def restrict_def fun_eq_iff PiE_dflt_def)
   finally show ?thesis ..
 qed
 
 lemma PiE_dflt_empty_iff [simp]: "PiE_dflt A dflt B = {} \<longleftrightarrow> (\<exists>x\<in>A. B x = {})"
   by (simp add: dflt_image_PiE [symmetric] PiE_eq_empty_iff)
 
 lemma set_Pi_pmf_subset':
   assumes "finite A"
   shows   "set_pmf (Pi_pmf A dflt p) \<subseteq> PiE_dflt A dflt (set_pmf \<circ> p)"
   using assms by (auto simp: set_pmf_eq pmf_Pi PiE_dflt_def)
 
 lemma set_Pi_pmf:
   assumes "finite A"
   shows   "set_pmf (Pi_pmf A dflt p) = PiE_dflt A dflt (set_pmf \<circ> p)"
 proof (rule equalityI)
   show "PiE_dflt A dflt (set_pmf \<circ> p) \<subseteq> set_pmf (Pi_pmf A dflt p)"
   proof safe
     fix f assume f: "f \<in> PiE_dflt A dflt (set_pmf \<circ> p)"
     hence "pmf (Pi_pmf A dflt p) f = (\<Prod>x\<in>A. pmf (p x) (f x))"
       using assms by (auto simp: pmf_Pi PiE_dflt_def)
     also have "\<dots> > 0"
       using f by (intro prod_pos) (auto simp: PiE_dflt_def set_pmf_eq)
     finally show "f \<in> set_pmf (Pi_pmf A dflt p)"
       by (auto simp: set_pmf_eq)
   qed
 qed (use set_Pi_pmf_subset'[OF assms, of dflt p] in auto)
 
 text \<open>
   The probability of an independent combination of events is precisely the product
   of the probabilities of each individual event.
 \<close>
 lemma measure_Pi_pmf_PiE_dflt:
   assumes [simp]: "finite A"
   shows   "measure_pmf.prob (Pi_pmf A dflt p) (PiE_dflt A dflt B) =
              (\<Prod>x\<in>A. measure_pmf.prob (p x) (B x))"
 proof -
   define B' where "B' = (\<lambda>x. B x \<inter> set_pmf (p x))"
   have "measure_pmf.prob (Pi_pmf A dflt p) (PiE_dflt A dflt B) =
           (\<Sum>\<^sub>ah\<in>PiE_dflt A dflt B. pmf (Pi_pmf A dflt p) h)"
     by (rule measure_pmf_conv_infsetsum)
   also have "\<dots> = (\<Sum>\<^sub>ah\<in>PiE_dflt A dflt B. \<Prod>x\<in>A. pmf (p x) (h x))"
     by (intro infsetsum_cong, subst pmf_Pi') (auto simp: PiE_dflt_def)
   also have "\<dots> = (\<Sum>\<^sub>ah\<in>(\<lambda>h. restrict h A) ` PiE_dflt A dflt B. \<Prod>x\<in>A. pmf (p x) (h x))"
     by (subst infsetsum_reindex) (force simp: inj_on_def PiE_dflt_def fun_eq_iff)+
   also have "(\<lambda>h. restrict h A) ` PiE_dflt A dflt B = PiE A B"
     by (rule restrict_PiE_dflt)
   also have "(\<Sum>\<^sub>ah\<in>PiE A B. \<Prod>x\<in>A. pmf (p x) (h x)) = (\<Sum>\<^sub>ah\<in>PiE A B'. \<Prod>x\<in>A. pmf (p x) (h x))"
     by (intro infsetsum_cong_neutral) (auto simp: B'_def set_pmf_eq)
   also have "(\<Sum>\<^sub>ah\<in>PiE A B'. \<Prod>x\<in>A. pmf (p x) (h x)) = (\<Prod>x\<in>A. infsetsum (pmf (p x)) (B' x))"
     by (intro infsetsum_prod_PiE) (auto simp: B'_def)
   also have "\<dots> = (\<Prod>x\<in>A. infsetsum (pmf (p x)) (B x))"
     by (intro prod.cong infsetsum_cong_neutral) (auto simp: B'_def set_pmf_eq)
   also have "\<dots> = (\<Prod>x\<in>A. measure_pmf.prob (p x) (B x))"
     by (subst measure_pmf_conv_infsetsum) (rule refl)
   finally show ?thesis .
 qed
 
 lemma measure_Pi_pmf_Pi:
   fixes t::nat
   assumes [simp]: "finite A"
   shows   "measure_pmf.prob (Pi_pmf A dflt p) (Pi A B) =
              (\<Prod>x\<in>A. measure_pmf.prob (p x) (B x))" (is "?lhs = ?rhs")
 proof -
   have "?lhs = measure_pmf.prob (Pi_pmf A dflt p) (PiE_dflt A dflt B)"
     by (intro measure_prob_cong_0)
        (auto simp: PiE_dflt_def PiE_def intro!: pmf_Pi_outside)+
   also have "\<dots> = ?rhs"
     using assms by (simp add: measure_Pi_pmf_PiE_dflt)
   finally show ?thesis
     by simp
 qed
 
 
 subsection \<open>Common PMF operations on products\<close>
 
 text \<open>
   @{const Pi_pmf} distributes over the `bind' operation in the Giry monad:
 \<close>
 lemma Pi_pmf_bind:
   assumes "finite A"
   shows   "Pi_pmf A d (\<lambda>x. bind_pmf (p x) (q x)) =
              do {f \<leftarrow> Pi_pmf A d' p; Pi_pmf A d (\<lambda>x. q x (f x))}" (is "?lhs = ?rhs")
 proof (rule pmf_eqI, goal_cases)
   case (1 f)
   show ?case
   proof (cases "\<exists>x\<in>-A. f x \<noteq> d")
     case False
     define B where "B = (\<lambda>x. set_pmf (p x))"
     have [simp]: "countable (B x)" for x by (auto simp: B_def)
 
     {
       fix x :: 'a
       have "(\<lambda>a. pmf (p x) a * 1) abs_summable_on B x"
         by (simp add: pmf_abs_summable)
       moreover have "norm (pmf (p x) a * 1) \<ge> norm (pmf (p x) a * pmf (q x a) (f x))" for a
         unfolding norm_mult by (intro mult_left_mono) (auto simp: pmf_le_1)
       ultimately have "(\<lambda>a. pmf (p x) a * pmf (q x a) (f x)) abs_summable_on B x"
         by (rule abs_summable_on_comparison_test)
     } note summable = this
 
     have "pmf ?rhs f = (\<Sum>\<^sub>ag. pmf (Pi_pmf A d' p) g * (\<Prod>x\<in>A. pmf (q x (g x)) (f x)))"
       by (subst pmf_bind, subst pmf_Pi')
          (insert assms False, simp_all add: pmf_expectation_eq_infsetsum)
     also have "\<dots> = (\<Sum>\<^sub>ag\<in>PiE_dflt A d' B.
                       pmf (Pi_pmf A d' p) g * (\<Prod>x\<in>A. pmf (q x (g x)) (f x)))" unfolding B_def
       using assms by (intro infsetsum_cong_neutral) (auto simp: pmf_Pi PiE_dflt_def set_pmf_eq)
     also have "\<dots> = (\<Sum>\<^sub>ag\<in>PiE_dflt A d' B.
                       (\<Prod>x\<in>A. pmf (p x) (g x) * pmf (q x (g x)) (f x)))"
       using assms by (intro infsetsum_cong) (auto simp: pmf_Pi PiE_dflt_def prod.distrib)
     also have "\<dots> = (\<Sum>\<^sub>ag\<in>(\<lambda>g. restrict g A) ` PiE_dflt A d' B.
                       (\<Prod>x\<in>A. pmf (p x) (g x) * pmf (q x (g x)) (f x)))"
       by (subst infsetsum_reindex) (force simp: PiE_dflt_def inj_on_def fun_eq_iff)+
     also have "(\<lambda>g. restrict g A) ` PiE_dflt A d' B = PiE A B"
       by (rule restrict_PiE_dflt)
     also have "(\<Sum>\<^sub>ag\<in>\<dots>. (\<Prod>x\<in>A. pmf (p x) (g x) * pmf (q x (g x)) (f x))) =
                  (\<Prod>x\<in>A. \<Sum>\<^sub>aa\<in>B x. pmf (p x) a * pmf (q x a) (f x))"
       using assms summable by (subst infsetsum_prod_PiE) simp_all
     also have "\<dots> = (\<Prod>x\<in>A. \<Sum>\<^sub>aa. pmf (p x) a * pmf (q x a) (f x))"
       by (intro prod.cong infsetsum_cong_neutral) (auto simp: B_def set_pmf_eq)
     also have "\<dots> = pmf ?lhs f"
       using False assms by (subst pmf_Pi') (simp_all add: pmf_bind pmf_expectation_eq_infsetsum)
     finally show ?thesis ..
   next
     case True
     have "pmf ?rhs f =
             measure_pmf.expectation (Pi_pmf A d' p) (\<lambda>x. pmf (Pi_pmf A d (\<lambda>xa. q xa (x xa))) f)"
       using assms by (simp add: pmf_bind)
     also have "\<dots> = measure_pmf.expectation (Pi_pmf A d' p) (\<lambda>x. 0)"
       using assms True by (intro Bochner_Integration.integral_cong pmf_Pi_outside) auto
     also have "\<dots> = pmf ?lhs f"
       using assms True by (subst pmf_Pi_outside) auto
     finally show ?thesis ..
   qed
 qed
 
 lemma Pi_pmf_return_pmf [simp]:
   assumes "finite A"
   shows   "Pi_pmf A dflt (\<lambda>x. return_pmf (f x)) = return_pmf (\<lambda>x. if x \<in> A then f x else dflt)"
-  using assms by (intro pmf_eqI) (auto simp: pmf_Pi simp: indicator_def)
+  using assms by (intro pmf_eqI) (auto simp: pmf_Pi simp: indicator_def split: if_splits)
 
 text \<open>
   Analogously any componentwise mapping can be pulled outside the product:
 \<close>
 lemma Pi_pmf_map:
   assumes [simp]: "finite A" and "f dflt = dflt'"
   shows   "Pi_pmf A dflt' (\<lambda>x. map_pmf f (g x)) = map_pmf (\<lambda>h. f \<circ> h) (Pi_pmf A dflt g)"
 proof -
   have "Pi_pmf A dflt' (\<lambda>x. map_pmf f (g x)) =
           Pi_pmf A dflt' (\<lambda>x. g x \<bind> (\<lambda>x. return_pmf (f x)))"
     using assms by (simp add: map_pmf_def Pi_pmf_bind)
   also have "\<dots> = Pi_pmf A dflt g \<bind> (\<lambda>h. return_pmf (\<lambda>x. if x \<in> A then f (h x) else dflt'))"
    by (subst Pi_pmf_bind[where d' = dflt]) (auto simp: )
   also have "\<dots> = map_pmf (\<lambda>h. f \<circ> h) (Pi_pmf A dflt g)"
     unfolding map_pmf_def using set_Pi_pmf_subset'[of A dflt g]
     by (intro bind_pmf_cong refl arg_cong[of _ _ return_pmf])
        (auto dest: simp: fun_eq_iff PiE_dflt_def assms(2))
   finally show ?thesis .
 qed
 
 text \<open>
   We can exchange the default value in a product of PMFs like this:
 \<close>
 lemma Pi_pmf_default_swap:
   assumes "finite A"
   shows   "map_pmf (\<lambda>f x. if x \<in> A then f x else dflt') (Pi_pmf A dflt p) =
              Pi_pmf A dflt' p" (is "?lhs = ?rhs")
 proof (rule pmf_eqI, goal_cases)
   case (1 f)
   let ?B = "(\<lambda>f x. if x \<in> A then f x else dflt') -` {f} \<inter> PiE_dflt A dflt (\<lambda>_. UNIV)"
   show ?case
   proof (cases "\<exists>x\<in>-A. f x \<noteq> dflt'")
     case False
     let ?f' = "\<lambda>x. if x \<in> A then f x else dflt"
     from False have "pmf ?lhs f = measure_pmf.prob (Pi_pmf A dflt p) ?B"
       using assms unfolding pmf_map
       by (intro measure_prob_cong_0) (auto simp: PiE_dflt_def pmf_Pi_outside)
     also from False have "?B = {?f'}"
       by (auto simp: fun_eq_iff PiE_dflt_def)
     also have "measure_pmf.prob (Pi_pmf A dflt p) {?f'} = pmf (Pi_pmf A dflt p) ?f'"
       by (simp add: measure_pmf_single)
     also have "\<dots> = pmf ?rhs f"
       using False assms by (subst (1 2) pmf_Pi) auto
     finally show ?thesis .
   next
     case True
     have "pmf ?lhs f = measure_pmf.prob (Pi_pmf A dflt p) ?B"
       using assms unfolding pmf_map
       by (intro measure_prob_cong_0) (auto simp: PiE_dflt_def pmf_Pi_outside)
     also from True have "?B = {}" by auto
     also have "measure_pmf.prob (Pi_pmf A dflt p) \<dots> = 0"
       by simp
     also have "0 = pmf ?rhs f"
       using True assms by (intro pmf_Pi_outside [symmetric]) auto
     finally show ?thesis .
   qed
 qed
 
 text \<open>
   The following rule allows reindexing the product:
 \<close>
 lemma Pi_pmf_bij_betw:
   assumes "finite A" "bij_betw h A B" "\<And>x. x \<notin> A \<Longrightarrow> h x \<notin> B"
   shows "Pi_pmf A dflt (\<lambda>_. f) = map_pmf (\<lambda>g. g \<circ> h) (Pi_pmf B dflt (\<lambda>_. f))"
     (is "?lhs = ?rhs")
 proof -
   have B: "finite B"
     using assms bij_betw_finite by auto
   have "pmf ?lhs g = pmf ?rhs g" for g
   proof (cases "\<forall>a. a \<notin> A \<longrightarrow> g a = dflt")
     case True
     define h' where "h' = the_inv_into A h"
     have h': "h' (h x) = x" if "x \<in> A" for x
       unfolding h'_def using that assms by (auto simp add: bij_betw_def the_inv_into_f_f)
     have h: "h (h' x) = x" if "x \<in> B" for x
       unfolding h'_def using that assms f_the_inv_into_f_bij_betw by fastforce
     have "pmf ?rhs g = measure_pmf.prob (Pi_pmf B dflt (\<lambda>_. f)) ((\<lambda>g. g \<circ> h) -` {g})"
       unfolding pmf_map by simp
     also have "\<dots> = measure_pmf.prob (Pi_pmf B dflt (\<lambda>_. f))
                                 (((\<lambda>g. g \<circ> h) -` {g}) \<inter> PiE_dflt B dflt (\<lambda>_. UNIV))"
       using B by (intro measure_prob_cong_0) (auto simp: PiE_dflt_def pmf_Pi_outside)
     also have "\<dots> = pmf (Pi_pmf B dflt (\<lambda>_. f)) (\<lambda>x. if x \<in> B then g (h' x) else dflt)"
     proof -
       have "(if h x \<in> B then g (h' (h x)) else dflt) = g x" for x
         using h' assms True by (cases "x \<in> A") (auto simp add: bij_betwE)
       then have "(\<lambda>g. g \<circ> h) -` {g} \<inter> PiE_dflt B dflt (\<lambda>_. UNIV) =
             {(\<lambda>x. if x \<in> B then g (h' x) else dflt)}"
         using assms h' h True unfolding PiE_dflt_def by auto
       then show ?thesis
         by (simp add: measure_pmf_single)
     qed
     also have "\<dots> = pmf (Pi_pmf A dflt (\<lambda>_. f)) g"
       using B assms True  h'_def
       by (auto simp add: pmf_Pi intro!: prod.reindex_bij_betw bij_betw_the_inv_into)
     finally show ?thesis
       by simp
   next
     case False
     have "pmf ?rhs g = infsetsum (pmf (Pi_pmf B dflt (\<lambda>_. f))) ((\<lambda>g. g \<circ> h) -` {g})"
       using assms by (auto simp add: measure_pmf_conv_infsetsum pmf_map)
     also have "\<dots> = infsetsum (\<lambda>_. 0) ((\<lambda>g x. g (h x)) -` {g})"
       using B False assms by (intro infsetsum_cong pmf_Pi_outside) fastforce+
     also have "\<dots> = 0"
       by simp
     finally show ?thesis
       using assms False by (auto simp add: pmf_Pi pmf_map)
   qed
   then show ?thesis
     by (rule pmf_eqI)
 qed
 
 text \<open>
   A product of uniform random choices is again a uniform distribution.
 \<close>
 lemma Pi_pmf_of_set:
   assumes "finite A" "\<And>x. x \<in> A \<Longrightarrow> finite (B x)" "\<And>x. x \<in> A \<Longrightarrow> B x \<noteq> {}"
   shows   "Pi_pmf A d (\<lambda>x. pmf_of_set (B x)) = pmf_of_set (PiE_dflt A d B)" (is "?lhs = ?rhs")
 proof (rule pmf_eqI, goal_cases)
   case (1 f)
   show ?case
   proof (cases "\<exists>x. x \<notin> A \<and> f x \<noteq> d")
     case True
     hence "pmf ?lhs f = 0"
       using assms by (intro pmf_Pi_outside) (auto simp: PiE_dflt_def)
     also from True have "f \<notin> PiE_dflt A d B"
       by (auto simp: PiE_dflt_def)
     hence "0 = pmf ?rhs f"
       using assms by (subst pmf_of_set) auto
     finally show ?thesis .
   next
     case False
     hence "pmf ?lhs f = (\<Prod>x\<in>A. pmf (pmf_of_set (B x)) (f x))"
       using assms by (subst pmf_Pi') auto
     also have "\<dots> = (\<Prod>x\<in>A. indicator (B x) (f x) / real (card (B x)))"
       by (intro prod.cong refl, subst pmf_of_set) (use assms False in auto)
     also have "\<dots> = (\<Prod>x\<in>A. indicator (B x) (f x)) / real (\<Prod>x\<in>A. card (B x))"
       by (subst prod_dividef) simp_all
     also have "(\<Prod>x\<in>A. indicator (B x) (f x) :: real) = indicator (PiE_dflt A d B) f"
       using assms False by (auto simp: indicator_def PiE_dflt_def)
     also have "(\<Prod>x\<in>A. card (B x)) = card (PiE_dflt A d B)"
       using assms by (intro card_PiE_dflt [symmetric]) auto
     also have "indicator (PiE_dflt A d B) f / \<dots> = pmf ?rhs f"
       using assms by (intro pmf_of_set [symmetric]) auto
     finally show ?thesis .
   qed
 qed
 
 
 subsection \<open>Merging and splitting PMF products\<close>
 
 text \<open>
   The following lemma shows that we can add a single PMF to a product:
 \<close>
 lemma Pi_pmf_insert:
   assumes "finite A" "x \<notin> A"
   shows   "Pi_pmf (insert x A) dflt p = map_pmf (\<lambda>(y,f). f(x:=y)) (pair_pmf (p x) (Pi_pmf A dflt p))"
 proof (intro pmf_eqI)
   fix f
   let ?M = "pair_pmf (p x) (Pi_pmf A dflt p)"
   have "pmf (map_pmf (\<lambda>(y, f). f(x := y)) ?M) f =
           measure_pmf.prob ?M ((\<lambda>(y, f). f(x := y)) -` {f})"
     by (subst pmf_map) auto
   also have "((\<lambda>(y, f). f(x := y)) -` {f}) = (\<Union>y'. {(f x, f(x := y'))})"
     by (auto simp: fun_upd_def fun_eq_iff)
   also have "measure_pmf.prob ?M \<dots> = measure_pmf.prob ?M {(f x, f(x := dflt))}"
     using assms by (intro measure_prob_cong_0) (auto simp: pmf_pair pmf_Pi split: if_splits)
   also have "\<dots> = pmf (p x) (f x) * pmf (Pi_pmf A dflt p) (f(x := dflt))"
     by (simp add: measure_pmf_single pmf_pair pmf_Pi)
   also have "\<dots> = pmf (Pi_pmf (insert x A) dflt p) f"
   proof (cases "\<forall>y. y \<notin> insert x A \<longrightarrow> f y = dflt")
     case True
     with assms have "pmf (p x) (f x) * pmf (Pi_pmf A dflt p) (f(x := dflt)) =
                        pmf (p x) (f x) * (\<Prod>xa\<in>A. pmf (p xa) ((f(x := dflt)) xa))"
       by (subst pmf_Pi') auto
     also have "(\<Prod>xa\<in>A. pmf (p xa) ((f(x := dflt)) xa)) = (\<Prod>xa\<in>A. pmf (p xa) (f xa))"
       using assms by (intro prod.cong) auto
     also have "pmf (p x) (f x) * \<dots> = pmf (Pi_pmf (insert x A) dflt p) f"
       using assms True by (subst pmf_Pi') auto
     finally show ?thesis .
   qed (insert assms, auto simp: pmf_Pi)
   finally show "\<dots> = pmf (map_pmf (\<lambda>(y, f). f(x := y)) ?M) f" ..
 qed
 
 lemma Pi_pmf_insert':
   assumes "finite A"  "x \<notin> A"
   shows   "Pi_pmf (insert x A) dflt p =
              do {y \<leftarrow> p x; f \<leftarrow> Pi_pmf A dflt p; return_pmf (f(x := y))}"
   using assms
   by (subst Pi_pmf_insert)
      (auto simp add: map_pmf_def pair_pmf_def case_prod_beta' bind_return_pmf bind_assoc_pmf)
 
 lemma Pi_pmf_singleton:
   "Pi_pmf {x} dflt p = map_pmf (\<lambda>a b. if b = x then a else dflt) (p x)"
 proof -
   have "Pi_pmf {x} dflt p = map_pmf (fun_upd (\<lambda>_. dflt) x) (p x)"
     by (subst Pi_pmf_insert) (simp_all add: pair_return_pmf2 pmf.map_comp o_def)
   also have "fun_upd (\<lambda>_. dflt) x = (\<lambda>z y. if y = x then z else dflt)"
     by (simp add: fun_upd_def fun_eq_iff)
   finally show ?thesis .
 qed
 
 text \<open>
   Projecting a product of PMFs onto a component yields the expected result:
 \<close>
 lemma Pi_pmf_component:
   assumes "finite A"
   shows   "map_pmf (\<lambda>f. f x) (Pi_pmf A dflt p) = (if x \<in> A then p x else return_pmf dflt)"
 proof (cases "x \<in> A")
   case True
   define A' where "A' = A - {x}"
   from assms and True have A': "A = insert x A'"
     by (auto simp: A'_def)
   from assms have "map_pmf (\<lambda>f. f x) (Pi_pmf A dflt p) = p x" unfolding A'
     by (subst Pi_pmf_insert)
        (auto simp: A'_def pmf.map_comp o_def case_prod_unfold map_fst_pair_pmf)
   with True show ?thesis by simp
 next
   case False
   have "map_pmf (\<lambda>f. f x) (Pi_pmf A dflt p) = map_pmf (\<lambda>_. dflt) (Pi_pmf A dflt p)"
     using assms False set_Pi_pmf_subset[of A dflt p]
     by (intro pmf.map_cong refl) (auto simp: set_pmf_eq pmf_Pi_outside)
   with False show ?thesis by simp
 qed
 
 text \<open>
   We can take merge two PMF products on disjoint sets like this:
 \<close>
 lemma Pi_pmf_union:
   assumes "finite A" "finite B" "A \<inter> B = {}"
   shows   "Pi_pmf (A \<union> B) dflt p =
              map_pmf (\<lambda>(f,g) x. if x \<in> A then f x else g x)
              (pair_pmf (Pi_pmf A dflt p) (Pi_pmf B dflt p))" (is "_ = map_pmf (?h A) (?q A)")
   using assms(1,3)
 proof (induction rule: finite_induct)
   case (insert x A)
   have "map_pmf (?h (insert x A)) (?q (insert x A)) =
           do {v \<leftarrow> p x; (f, g) \<leftarrow> pair_pmf (Pi_pmf A dflt p) (Pi_pmf B dflt p);
               return_pmf (\<lambda>y. if y \<in> insert x A then (f(x := v)) y else g y)}"
     by (subst Pi_pmf_insert)
        (insert insert.hyps insert.prems,
         simp_all add: pair_pmf_def map_bind_pmf bind_map_pmf bind_assoc_pmf bind_return_pmf)
   also have "\<dots> = do {v \<leftarrow> p x; (f, g) \<leftarrow> ?q A; return_pmf ((?h A (f,g))(x := v))}"
     by (intro bind_pmf_cong refl) (auto simp: fun_eq_iff)
   also have "\<dots> = do {v \<leftarrow> p x; f \<leftarrow> map_pmf (?h A) (?q A); return_pmf (f(x := v))}"
     by (simp add: bind_map_pmf map_bind_pmf case_prod_unfold cong: if_cong)
   also have "\<dots> = do {v \<leftarrow> p x; f \<leftarrow> Pi_pmf (A \<union> B) dflt p; return_pmf (f(x := v))}"
     using insert.hyps and insert.prems by (intro bind_pmf_cong insert.IH [symmetric] refl) auto
   also have "\<dots> = Pi_pmf (insert x (A \<union> B)) dflt p"
     by (subst Pi_pmf_insert)
        (insert assms insert.hyps insert.prems, auto simp: pair_pmf_def map_bind_pmf)
   also have "insert x (A \<union> B) = insert x A \<union> B"
     by simp
   finally show ?case ..
 qed (simp_all add: case_prod_unfold map_snd_pair_pmf)
 
 text \<open>
   We can also project a product to a subset of the indices by mapping all the other
   indices to the default value:
 \<close>
 lemma Pi_pmf_subset:
   assumes "finite A" "A' \<subseteq> A"
   shows   "Pi_pmf A' dflt p = map_pmf (\<lambda>f x. if x \<in> A' then f x else dflt) (Pi_pmf A dflt p)"
 proof -
   let ?P = "pair_pmf (Pi_pmf A' dflt p) (Pi_pmf (A - A') dflt p)"
   from assms have [simp]: "finite A'"
     by (blast dest: finite_subset)
   from assms have "A = A' \<union> (A - A')"
     by blast
   also have "Pi_pmf \<dots> dflt p = map_pmf (\<lambda>(f,g) x. if x \<in> A' then f x else g x) ?P"
     using assms by (intro Pi_pmf_union) auto
   also have "map_pmf (\<lambda>f x. if x \<in> A' then f x else dflt) \<dots> = map_pmf fst ?P"
     unfolding map_pmf_comp o_def case_prod_unfold
     using set_Pi_pmf_subset[of A' dflt p] by (intro map_pmf_cong refl) (auto simp: fun_eq_iff)
   also have "\<dots> = Pi_pmf A' dflt p"
     by (simp add: map_fst_pair_pmf)
   finally show ?thesis ..
 qed
 
 lemma Pi_pmf_subset':
   fixes f :: "'a \<Rightarrow> 'b pmf"
   assumes "finite A" "B \<subseteq> A" "\<And>x. x \<in> A - B \<Longrightarrow> f x = return_pmf dflt"
   shows "Pi_pmf A dflt f = Pi_pmf B dflt f"
 proof -
   have "Pi_pmf (B \<union> (A - B)) dflt f =
           map_pmf (\<lambda>(f, g) x. if x \<in> B then f x else g x)
                   (pair_pmf (Pi_pmf B dflt f) (Pi_pmf (A - B) dflt f))"
     using assms by (intro Pi_pmf_union) (auto dest: finite_subset)
   also have "Pi_pmf (A - B) dflt f = Pi_pmf (A - B) dflt (\<lambda>_. return_pmf dflt)"
     using assms by (intro Pi_pmf_cong) auto
   also have "\<dots> = return_pmf (\<lambda>_. dflt)"
     using assms by simp
   also have "map_pmf (\<lambda>(f, g) x. if x \<in> B then f x else g x)
                   (pair_pmf (Pi_pmf B dflt f) (return_pmf (\<lambda>_. dflt))) =
              map_pmf (\<lambda>f x. if x \<in> B then f x else dflt) (Pi_pmf B dflt f)"
     by (simp add: map_pmf_def pair_pmf_def bind_assoc_pmf bind_return_pmf bind_return_pmf')
   also have "\<dots> = Pi_pmf B dflt f"
     using assms by (intro Pi_pmf_default_swap) (auto dest: finite_subset)
   also have "B \<union> (A - B) = A"
     using assms by auto
   finally show ?thesis .
 qed
 
 lemma Pi_pmf_if_set:
   assumes "finite A"
   shows "Pi_pmf A dflt (\<lambda>x. if b x then f x else return_pmf dflt) =
            Pi_pmf {x\<in>A. b x} dflt f"
 proof -
   have "Pi_pmf A dflt (\<lambda>x. if b x then f x else return_pmf dflt) =
           Pi_pmf {x\<in>A. b x} dflt (\<lambda>x. if b x then f x else return_pmf dflt)"
     using assms by (intro Pi_pmf_subset') auto
   also have "\<dots> = Pi_pmf {x\<in>A. b x} dflt f"
     by (intro Pi_pmf_cong) auto
   finally show ?thesis .
 qed
 
 lemma Pi_pmf_if_set':
   assumes "finite A"
   shows "Pi_pmf A dflt (\<lambda>x. if b x then return_pmf dflt else f x) =
          Pi_pmf {x\<in>A. \<not>b x} dflt f"
 proof -
   have "Pi_pmf A dflt (\<lambda>x. if b x then return_pmf dflt else  f x) =
           Pi_pmf {x\<in>A. \<not>b x} dflt (\<lambda>x. if b x then return_pmf dflt else  f x)"
     using assms by (intro Pi_pmf_subset') auto
   also have "\<dots> = Pi_pmf {x\<in>A. \<not>b x} dflt f"
     by (intro Pi_pmf_cong) auto
   finally show ?thesis .
 qed
 
 text \<open>
   Lastly, we can delete a single component from a product:
 \<close>
 lemma Pi_pmf_remove:
   assumes "finite A"
   shows   "Pi_pmf (A - {x}) dflt p = map_pmf (\<lambda>f. f(x := dflt)) (Pi_pmf A dflt p)"
 proof -
   have "Pi_pmf (A - {x}) dflt p =
           map_pmf (\<lambda>f xa. if xa \<in> A - {x} then f xa else dflt) (Pi_pmf A dflt p)"
     using assms by (intro Pi_pmf_subset) auto
   also have "\<dots> = map_pmf (\<lambda>f. f(x := dflt)) (Pi_pmf A dflt p)"
     using set_Pi_pmf_subset[of A dflt p] assms
     by (intro map_pmf_cong refl) (auto simp: fun_eq_iff)
   finally show ?thesis .
 qed
 
 
 subsection \<open>Additional properties\<close>
 
 lemma nn_integral_prod_Pi_pmf:
   assumes "finite A"
   shows   "nn_integral (Pi_pmf A dflt p) (\<lambda>y. \<Prod>x\<in>A. f x (y x)) = (\<Prod>x\<in>A. nn_integral (p x) (f x))"
   using assms
 proof (induction rule: finite_induct)
   case (insert x A)
   have "nn_integral (Pi_pmf (insert x A) dflt p) (\<lambda>y. \<Prod>z\<in>insert x A. f z (y z)) =
           (\<integral>\<^sup>+a. \<integral>\<^sup>+b. f x a * (\<Prod>z\<in>A. f z (if z = x then a else b z)) \<partial>Pi_pmf A dflt p \<partial>p x)"
     using insert by (auto simp: Pi_pmf_insert case_prod_unfold nn_integral_pair_pmf' cong: if_cong)
   also have "(\<lambda>a b. \<Prod>z\<in>A. f z (if z = x then a else b z)) = (\<lambda>a b. \<Prod>z\<in>A. f z (b z))"
     by (intro ext prod.cong) (use insert.hyps in auto)
   also have "(\<integral>\<^sup>+a. \<integral>\<^sup>+b. f x a * (\<Prod>z\<in>A. f z (b z)) \<partial>Pi_pmf A dflt p \<partial>p x) =
              (\<integral>\<^sup>+y. f x y \<partial>(p x)) * (\<integral>\<^sup>+y. (\<Prod>z\<in>A. f z (y z)) \<partial>(Pi_pmf A dflt p))"
     by (simp add: nn_integral_multc nn_integral_cmult)
   also have "(\<integral>\<^sup>+y. (\<Prod>z\<in>A. f z (y z)) \<partial>(Pi_pmf A dflt p)) = (\<Prod>x\<in>A. nn_integral (p x) (f x))"
     by (rule insert.IH)
   also have "(\<integral>\<^sup>+y. f x y \<partial>(p x)) * \<dots> = (\<Prod>x\<in>insert x A. nn_integral (p x) (f x))"
     using insert.hyps by simp
   finally show ?case .
 qed auto
 
 lemma integrable_prod_Pi_pmf:
   fixes f :: "'a \<Rightarrow> 'b \<Rightarrow> 'c :: {real_normed_field, second_countable_topology, banach}"
   assumes "finite A" and "\<And>x. x \<in> A \<Longrightarrow> integrable (measure_pmf (p x)) (f x)"
   shows   "integrable (measure_pmf (Pi_pmf A dflt p)) (\<lambda>h. \<Prod>x\<in>A. f x (h x))"
 proof (intro integrableI_bounded)
   have "(\<integral>\<^sup>+ x. ennreal (norm (\<Prod>xa\<in>A. f xa (x xa))) \<partial>measure_pmf (Pi_pmf A dflt p)) =
         (\<integral>\<^sup>+ x. (\<Prod>y\<in>A. ennreal (norm (f y (x y)))) \<partial>measure_pmf (Pi_pmf A dflt p))"
     by (simp flip: prod_norm prod_ennreal)
   also have "\<dots> = (\<Prod>x\<in>A. \<integral>\<^sup>+ a. ennreal (norm (f x a)) \<partial>measure_pmf (p x))"
     by (intro nn_integral_prod_Pi_pmf) fact
   also have "(\<integral>\<^sup>+a. ennreal (norm (f i a)) \<partial>measure_pmf (p i)) \<noteq> top" if i: "i \<in> A" for i
     using assms(2)[OF i] by (simp add: integrable_iff_bounded)
   hence "(\<Prod>x\<in>A. \<integral>\<^sup>+ a. ennreal (norm (f x a)) \<partial>measure_pmf (p x)) \<noteq> top"
     by (subst ennreal_prod_eq_top) auto
   finally show "(\<integral>\<^sup>+ x. ennreal (norm (\<Prod>xa\<in>A. f xa (x xa))) \<partial>measure_pmf (Pi_pmf A dflt p)) < \<infinity>"
     by (simp add: top.not_eq_extremum)
 qed auto
 
 lemma expectation_prod_Pi_pmf:
   fixes f :: "_ \<Rightarrow> _ \<Rightarrow> real"
   assumes "finite A"
   assumes "\<And>x. x \<in> A \<Longrightarrow> integrable (measure_pmf (p x)) (f x)"
   assumes "\<And>x y. x \<in> A \<Longrightarrow> y \<in> set_pmf (p x) \<Longrightarrow> f x y \<ge> 0"
   shows   "measure_pmf.expectation (Pi_pmf A dflt p) (\<lambda>y. \<Prod>x\<in>A. f x (y x)) =
              (\<Prod>x\<in>A. measure_pmf.expectation (p x) (\<lambda>v. f x v))"
 proof -
   have nonneg: "measure_pmf.expectation (p x) (f x) \<ge> 0" if "x \<in> A" for x
     using that by (intro Bochner_Integration.integral_nonneg_AE AE_pmfI assms)
   have nonneg': "0 \<le> measure_pmf.expectation (Pi_pmf A dflt p) (\<lambda>y. \<Prod>x\<in>A. f x (y x))"
     by (intro Bochner_Integration.integral_nonneg_AE AE_pmfI assms prod_nonneg)
        (use assms in \<open>auto simp: set_Pi_pmf PiE_dflt_def\<close>)
 
   have "ennreal (measure_pmf.expectation (Pi_pmf A dflt p) (\<lambda>y. \<Prod>x\<in>A. f x (y x))) =
           nn_integral (Pi_pmf A dflt p) (\<lambda>y. ennreal (\<Prod>x\<in>A. f x (y x)))" using assms
     by (intro nn_integral_eq_integral [symmetric] assms integrable_prod_Pi_pmf)
        (auto simp: AE_measure_pmf_iff set_Pi_pmf PiE_dflt_def prod_nonneg)
   also have "\<dots> = nn_integral (Pi_pmf A dflt p) (\<lambda>y. (\<Prod>x\<in>A. ennreal (f x (y x))))"
     by (intro nn_integral_cong_AE AE_pmfI prod_ennreal [symmetric])
        (use assms(1) in \<open>auto simp: set_Pi_pmf PiE_dflt_def intro!: assms(3)\<close>)
   also have "\<dots> = (\<Prod>x\<in>A. \<integral>\<^sup>+ a. ennreal (f x a) \<partial>measure_pmf (p x))"
     by (rule nn_integral_prod_Pi_pmf) fact+
   also have "\<dots> = (\<Prod>x\<in>A. ennreal (measure_pmf.expectation (p x) (f x)))"
     by (intro prod.cong nn_integral_eq_integral assms AE_pmfI) auto
   also have "\<dots> = ennreal (\<Prod>x\<in>A. measure_pmf.expectation (p x) (f x))"
     by (intro prod_ennreal nonneg)
   finally show ?thesis
     using nonneg nonneg' by (subst (asm) ennreal_inj) (auto intro!: prod_nonneg)
 qed
 
 lemma indep_vars_Pi_pmf:
   assumes fin: "finite I"
   shows   "prob_space.indep_vars (measure_pmf (Pi_pmf I dflt p))
              (\<lambda>_. count_space UNIV) (\<lambda>x f. f x) I"
 proof (cases "I = {}")
   case True
   show ?thesis 
     by (subst prob_space.indep_vars_def [OF measure_pmf.prob_space_axioms],
         subst prob_space.indep_sets_def [OF measure_pmf.prob_space_axioms]) (simp_all add: True)
 next
   case [simp]: False
   show ?thesis
   proof (subst prob_space.indep_vars_iff_distr_eq_PiM')
     show "distr (measure_pmf (Pi_pmf I dflt p)) (Pi\<^sub>M I (\<lambda>i. count_space UNIV)) (\<lambda>x. restrict x I) =
           Pi\<^sub>M I (\<lambda>i. distr (measure_pmf (Pi_pmf I dflt p)) (count_space UNIV) (\<lambda>f. f i))"
     proof (rule product_sigma_finite.PiM_eqI, goal_cases)
       case 1
       interpret product_prob_space "\<lambda>i. distr (measure_pmf (Pi_pmf I dflt p)) (count_space UNIV) (\<lambda>f. f i)"
         by (intro product_prob_spaceI prob_space.prob_space_distr measure_pmf.prob_space_axioms)
            simp_all
       show ?case by unfold_locales
     next
       case 3
       have "sets (Pi\<^sub>M I (\<lambda>i. distr (measure_pmf (Pi_pmf I dflt p)) (count_space UNIV) (\<lambda>f. f i))) =
             sets (Pi\<^sub>M I (\<lambda>_. count_space UNIV))"
         by (intro sets_PiM_cong) simp_all
       thus ?case by simp
     next
       case (4 A)
       have "Pi\<^sub>E I A \<in> sets (Pi\<^sub>M I (\<lambda>i. count_space UNIV))"
         using 4 by (intro sets_PiM_I_finite fin) auto
       hence "emeasure (distr (measure_pmf (Pi_pmf I dflt p)) (Pi\<^sub>M I (\<lambda>i. count_space UNIV))
               (\<lambda>x. restrict x I)) (Pi\<^sub>E I A) =
              emeasure (measure_pmf (Pi_pmf I dflt p)) ((\<lambda>x. restrict x I) -` Pi\<^sub>E I A)"
         using 4 by (subst emeasure_distr) (auto simp: space_PiM)
       also have "\<dots> = emeasure (measure_pmf (Pi_pmf I dflt p)) (PiE_dflt I dflt A)"
         by (intro emeasure_eq_AE AE_pmfI) (auto simp: PiE_dflt_def set_Pi_pmf fin)
       also have "\<dots> = (\<Prod>i\<in>I. emeasure (measure_pmf (p i)) (A i))"
         by (simp add: measure_pmf.emeasure_eq_measure measure_Pi_pmf_PiE_dflt fin prod_ennreal)
       also have "\<dots> = (\<Prod>i\<in>I. emeasure (measure_pmf (map_pmf (\<lambda>f. f i) (Pi_pmf I dflt p))) (A i))"
         by (intro prod.cong refl, subst Pi_pmf_component) (auto simp: fin)
       finally show ?case
         by (simp add: map_pmf_rep_eq)
     qed fact+
   qed (simp_all add: measure_pmf.prob_space_axioms)
 qed
 
 lemma
   fixes h :: "'a :: comm_monoid_add \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes fin: "finite I"
   assumes integrable: "\<And>i. i \<in> I \<Longrightarrow> integrable (measure_pmf (D i)) h"
   shows   integrable_sum_Pi_pmf: "integrable (Pi_pmf I dflt D) (\<lambda>g. \<Sum>i\<in>I. h (g i))"
     and   expectation_sum_Pi_pmf:
             "measure_pmf.expectation (Pi_pmf I dflt D) (\<lambda>g. \<Sum>i\<in>I. h (g i)) =
              (\<Sum>i\<in>I. measure_pmf.expectation (D i) h)"
 proof -
   have integrable': "integrable (Pi_pmf I dflt D) (\<lambda>g. h (g i))" if i: "i \<in> I" for i
   proof -
     have "integrable (D i) h"
       using i by (rule assms)
     also have "D i = map_pmf (\<lambda>g. g i) (Pi_pmf I dflt D)"
       by (subst Pi_pmf_component) (use fin i in auto)
     finally show "integrable (measure_pmf (Pi_pmf I dflt D)) (\<lambda>x. h (x i))"
       by simp
   qed
   thus "integrable (Pi_pmf I dflt D) (\<lambda>g. \<Sum>i\<in>I. h (g i))"
     by (intro Bochner_Integration.integrable_sum)
 
   have "measure_pmf.expectation (Pi_pmf I dflt D) (\<lambda>x. \<Sum>i\<in>I. h (x i)) =
                (\<Sum>i\<in>I. measure_pmf.expectation (map_pmf (\<lambda>x. x i) (Pi_pmf I dflt D)) h)"
     using integrable' by (subst Bochner_Integration.integral_sum) auto
   also have "\<dots> = (\<Sum>i\<in>I. measure_pmf.expectation (D i) h)"
     by (intro sum.cong refl, subst Pi_pmf_component) (use fin in auto)
   finally show "measure_pmf.expectation (Pi_pmf I dflt D) (\<lambda>g. \<Sum>i\<in>I. h (g i)) =
                   (\<Sum>i\<in>I. measure_pmf.expectation (D i) h)" .
 qed
 
 
 subsection \<open>Applications\<close>
 
 text \<open>
   Choosing a subset of a set uniformly at random is equivalent to tossing a fair coin
   independently for each element and collecting all the elements that came up heads.
 \<close>
 lemma pmf_of_set_Pow_conv_bernoulli:
   assumes "finite (A :: 'a set)"
   shows "map_pmf (\<lambda>b. {x\<in>A. b x}) (Pi_pmf A P (\<lambda>_. bernoulli_pmf (1/2))) = pmf_of_set (Pow A)"
 proof -
   have "Pi_pmf A P (\<lambda>_. bernoulli_pmf (1/2)) = pmf_of_set (PiE_dflt A P (\<lambda>x. UNIV))"
     using assms by (simp add: bernoulli_pmf_half_conv_pmf_of_set Pi_pmf_of_set)
   also have "map_pmf (\<lambda>b. {x\<in>A. b x}) \<dots> = pmf_of_set (Pow A)"
   proof -
     have "bij_betw (\<lambda>b. {x \<in> A. b x}) (PiE_dflt A P (\<lambda>_. UNIV)) (Pow A)"
       by (rule bij_betwI[of _ _ _ "\<lambda>B b. if b \<in> A then b \<in> B else P"]) (auto simp add: PiE_dflt_def)
     then show ?thesis
       using assms by (intro map_pmf_of_set_bij_betw) auto
   qed
   finally show ?thesis
     by simp
 qed
 
 text \<open>
   A binomial distribution can be seen as the number of successes in \<open>n\<close> independent coin tosses.
 \<close>
 lemma binomial_pmf_altdef':
   fixes A :: "'a set"
   assumes "finite A" and "card A = n" and p: "p \<in> {0..1}"
   shows   "binomial_pmf n p =
              map_pmf (\<lambda>f. card {x\<in>A. f x}) (Pi_pmf A dflt (\<lambda>_. bernoulli_pmf p))" (is "?lhs = ?rhs")
 proof -
   from assms have "?lhs = binomial_pmf (card A) p"
     by simp
   also have "\<dots> = ?rhs"
   using assms(1)
   proof (induction rule: finite_induct)
     case empty
     with p show ?case by (simp add: binomial_pmf_0)
   next
     case (insert x A)
     from insert.hyps have "card (insert x A) = Suc (card A)"
       by simp
     also have "binomial_pmf \<dots> p = do {
                                      b \<leftarrow> bernoulli_pmf p;
                                      f \<leftarrow> Pi_pmf A dflt (\<lambda>_. bernoulli_pmf p);
                                      return_pmf ((if b then 1 else 0) + card {y \<in> A. f y})
                                    }"
       using p by (simp add: binomial_pmf_Suc insert.IH bind_map_pmf)
     also have "\<dots> = do {
                       b \<leftarrow> bernoulli_pmf p;
                       f \<leftarrow> Pi_pmf A dflt (\<lambda>_. bernoulli_pmf p);
                       return_pmf (card {y \<in> insert x A. (f(x := b)) y})
                     }"
     proof (intro bind_pmf_cong refl, goal_cases)
       case (1 b f)
       have "(if b then 1 else 0) + card {y\<in>A. f y} = card ((if b then {x} else {}) \<union> {y\<in>A. f y})"
         using insert.hyps by auto
       also have "(if b then {x} else {}) \<union> {y\<in>A. f y} = {y\<in>insert x A. (f(x := b)) y}"
         using insert.hyps by auto
       finally show ?case by simp
     qed
     also have "\<dots> = map_pmf (\<lambda>f. card {y\<in>insert x A. f y})
                       (Pi_pmf (insert x A) dflt (\<lambda>_. bernoulli_pmf p))"
       using insert.hyps by (subst Pi_pmf_insert) (simp_all add: pair_pmf_def map_bind_pmf)
     finally show ?case .
   qed
   finally show ?thesis .
 qed
 
 end