diff --git a/src/HOL/Analysis/Change_Of_Vars.thy b/src/HOL/Analysis/Change_Of_Vars.thy
--- a/src/HOL/Analysis/Change_Of_Vars.thy
+++ b/src/HOL/Analysis/Change_Of_Vars.thy
@@ -1,3474 +1,3478 @@
 (*  Title:      HOL/Analysis/Change_Of_Vars.thy
     Authors:    LC Paulson, based on material from HOL Light
 *)
 
 section\<open>Change of Variables Theorems\<close>
 
 theory Change_Of_Vars
   imports Vitali_Covering_Theorem Determinants
 
 begin
 
 subsection \<open>Measurable Shear and Stretch\<close>
 
 proposition
   fixes a :: "real^'n"
   assumes "m \<noteq> n" and ab_ne: "cbox a b \<noteq> {}" and an: "0 \<le> a$n"
   shows measurable_shear_interval: "(\<lambda>x. \<chi> i. if i = m then x$m + x$n else x$i) ` (cbox a b) \<in> lmeasurable"
        (is  "?f ` _ \<in> _")
    and measure_shear_interval: "measure lebesgue ((\<lambda>x. \<chi> i. if i = m then x$m + x$n else x$i) ` cbox a b)
                = measure lebesgue (cbox a b)" (is "?Q")
 proof -
   have lin: "linear ?f"
     by (rule linearI) (auto simp: plus_vec_def scaleR_vec_def algebra_simps)
   show fab: "?f ` cbox a b \<in> lmeasurable"
     by (simp add: lin measurable_linear_image_interval)
   let ?c = "\<chi> i. if i = m then b$m + b$n else b$i"
   let ?mn = "axis m 1 - axis n (1::real)"
   have eq1: "measure lebesgue (cbox a ?c)
             = measure lebesgue (?f ` cbox a b)
             + measure lebesgue (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a$m})
             + measure lebesgue (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m})"
   proof (rule measure_Un3_negligible)
     show "cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a$m} \<in> lmeasurable" "cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m} \<in> lmeasurable"
       by (auto simp: convex_Int convex_halfspace_le convex_halfspace_ge bounded_Int measurable_convex)
     have "negligible {x. ?mn \<bullet> x = a$m}"
       by (metis \<open>m \<noteq> n\<close> axis_index_axis eq_iff_diff_eq_0 negligible_hyperplane)
     moreover have "?f ` cbox a b \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m}) \<subseteq> {x. ?mn \<bullet> x = a$m}"
       using \<open>m \<noteq> n\<close> antisym_conv by (fastforce simp: algebra_simps mem_box_cart inner_axis')
     ultimately show "negligible ((?f ` cbox a b) \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m}))"
       by (rule negligible_subset)
     have "negligible {x. ?mn \<bullet> x = b$m}"
       by (metis \<open>m \<noteq> n\<close> axis_index_axis eq_iff_diff_eq_0 negligible_hyperplane)
     moreover have "(?f ` cbox a b) \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m}) \<subseteq> {x. ?mn \<bullet> x = b$m}"
       using \<open>m \<noteq> n\<close> antisym_conv by (fastforce simp: algebra_simps mem_box_cart inner_axis')
     ultimately show "negligible (?f ` cbox a b \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m}))"
       by (rule negligible_subset)
     have "negligible {x. ?mn \<bullet> x = b$m}"
       by (metis \<open>m \<noteq> n\<close> axis_index_axis eq_iff_diff_eq_0 negligible_hyperplane)
     moreover have "(cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m})) \<subseteq> {x. ?mn \<bullet> x = b$m}"
       using \<open>m \<noteq> n\<close> ab_ne
       apply (auto simp: algebra_simps mem_box_cart inner_axis')
       apply (drule_tac x=m in spec)+
       apply simp
       done
     ultimately show "negligible (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<inter> (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m}))"
       by (rule negligible_subset)
     show "?f ` cbox a b \<union> cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<union> cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m} = cbox a ?c" (is "?lhs = _")
     proof
       show "?lhs \<subseteq> cbox a ?c"
         by (auto simp: mem_box_cart add_mono) (meson add_increasing2 an order_trans)
       show "cbox a ?c \<subseteq> ?lhs"
         apply (auto simp: algebra_simps image_iff inner_axis' lambda_add_Galois [OF \<open>m \<noteq> n\<close>])
         apply (auto simp: mem_box_cart split: if_split_asm)
         done
     qed
   qed (fact fab)
   let ?d = "\<chi> i. if i = m then a $ m - b $ m else 0"
   have eq2: "measure lebesgue (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m}) + measure lebesgue (cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m})
            = measure lebesgue (cbox a (\<chi> i. if i = m then a $ m + b $ n else b $ i))"
   proof (rule measure_translate_add[of "cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a$m}" "cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m}"
      "(\<chi> i. if i = m then a$m - b$m else 0)" "cbox a (\<chi> i. if i = m then a$m + b$n else b$i)"])
     show "(cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a$m}) \<in> lmeasurable"
       "cbox a ?c \<inter> {x. ?mn \<bullet> x \<ge> b$m} \<in> lmeasurable"
       by (auto simp: convex_Int convex_halfspace_le convex_halfspace_ge bounded_Int measurable_convex)
     have "\<And>x. \<lbrakk>x $ n + a $ m \<le> x $ m\<rbrakk>
          \<Longrightarrow> x \<in> (+) (\<chi> i. if i = m then a $ m - b $ m else 0) ` {x. x $ n + b $ m \<le> x $ m}"
       using \<open>m \<noteq> n\<close>
       by (rule_tac x="x - (\<chi> i. if i = m then a$m - b$m else 0)" in image_eqI)
          (simp_all add: mem_box_cart)
     then have imeq: "(+) ?d ` {x. b $ m \<le> ?mn \<bullet> x} = {x. a $ m \<le> ?mn \<bullet> x}"
       using \<open>m \<noteq> n\<close> by (auto simp: mem_box_cart inner_axis' algebra_simps)
     have "\<And>x. \<lbrakk>0 \<le> a $ n; x $ n + a $ m \<le> x $ m;
                 \<forall>i. i \<noteq> m \<longrightarrow> a $ i \<le> x $ i \<and> x $ i \<le> b $ i\<rbrakk>
          \<Longrightarrow> a $ m \<le> x $ m"
       using \<open>m \<noteq> n\<close>  by force
     then have "(+) ?d ` (cbox a ?c \<inter> {x. b $ m \<le> ?mn \<bullet> x})
             = cbox a (\<chi> i. if i = m then a $ m + b $ n else b $ i) \<inter> {x. a $ m \<le> ?mn \<bullet> x}"
       using an ab_ne
       apply (simp add: cbox_translation [symmetric] translation_Int interval_ne_empty_cart imeq)
       apply (auto simp: mem_box_cart inner_axis' algebra_simps if_distrib all_if_distrib)
       by (metis (full_types) add_mono mult_2_right)
     then show "cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<union>
           (+) ?d ` (cbox a ?c \<inter> {x. b $ m \<le> ?mn \<bullet> x}) =
           cbox a (\<chi> i. if i = m then a $ m + b $ n else b $ i)"  (is "?lhs = ?rhs")
       using an \<open>m \<noteq> n\<close>
       apply (auto simp: mem_box_cart inner_axis' algebra_simps if_distrib all_if_distrib, force)
         apply (drule_tac x=n in spec)+
       by (meson ab_ne add_mono_thms_linordered_semiring(3) dual_order.trans interval_ne_empty_cart(1))
     have "negligible{x. ?mn \<bullet> x = a$m}"
       by (metis \<open>m \<noteq> n\<close> axis_index_axis eq_iff_diff_eq_0 negligible_hyperplane)
     moreover have "(cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<inter>
                                  (+) ?d ` (cbox a ?c \<inter> {x. b $ m \<le> ?mn \<bullet> x})) \<subseteq> {x. ?mn \<bullet> x = a$m}"
       using \<open>m \<noteq> n\<close> antisym_conv by (fastforce simp: algebra_simps mem_box_cart inner_axis')
     ultimately show "negligible (cbox a ?c \<inter> {x. ?mn \<bullet> x \<le> a $ m} \<inter>
                                  (+) ?d ` (cbox a ?c \<inter> {x. b $ m \<le> ?mn \<bullet> x}))"
       by (rule negligible_subset)
   qed
   have ac_ne: "cbox a ?c \<noteq> {}"
     using ab_ne an
     by (clarsimp simp: interval_eq_empty_cart) (meson add_less_same_cancel1 le_less_linear less_le_trans)
   have ax_ne: "cbox a (\<chi> i. if i = m then a $ m + b $ n else b $ i) \<noteq> {}"
     using ab_ne an
     by (clarsimp simp: interval_eq_empty_cart) (meson add_less_same_cancel1 le_less_linear less_le_trans)
   have eq3: "measure lebesgue (cbox a ?c) = measure lebesgue (cbox a (\<chi> i. if i = m then a$m + b$n else b$i)) + measure lebesgue (cbox a b)"
     by (simp add: content_cbox_if_cart ab_ne ac_ne ax_ne algebra_simps prod.delta_remove
              if_distrib [of "\<lambda>u. u - z" for z] prod.remove)
   show ?Q
     using eq1 eq2 eq3
     by (simp add: algebra_simps)
 qed
 
 
 proposition
   fixes S :: "(real^'n) set"
   assumes "S \<in> lmeasurable"
   shows measurable_stretch: "((\<lambda>x. \<chi> k. m k * x$k) ` S) \<in> lmeasurable" (is  "?f ` S \<in> _")
     and measure_stretch: "measure lebesgue ((\<lambda>x. \<chi> k. m k * x$k) ` S) = \<bar>prod m UNIV\<bar> * measure lebesgue S"
     (is "?MEQ")
 proof -
   have "(?f ` S) \<in> lmeasurable \<and> ?MEQ"
   proof (cases "\<forall>k. m k \<noteq> 0")
     case True
     have m0: "0 < \<bar>prod m UNIV\<bar>"
       using True by simp
     have "(indicat_real (?f ` S) has_integral \<bar>prod m UNIV\<bar> * measure lebesgue S) UNIV"
     proof (clarsimp simp add: has_integral_alt [where i=UNIV])
       fix e :: "real"
       assume "e > 0"
       have "(indicat_real S has_integral (measure lebesgue S)) UNIV"
         using assms lmeasurable_iff_has_integral by blast
       then obtain B where "B>0"
         and B: "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow>
                         \<exists>z. (indicat_real S has_integral z) (cbox a b) \<and>
                             \<bar>z - measure lebesgue S\<bar> < e / \<bar>prod m UNIV\<bar>"
         by (simp add: has_integral_alt [where i=UNIV]) (metis (full_types) divide_pos_pos m0  m0 \<open>e > 0\<close>)
       show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
                   (\<exists>z. (indicat_real (?f ` S) has_integral z) (cbox a b) \<and>
                        \<bar>z - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar> < e)"
       proof (intro exI conjI allI)
         let ?C = "Max (range (\<lambda>k. \<bar>m k\<bar>)) * B"
         show "?C > 0"
           using True \<open>B > 0\<close> by (simp add: Max_gr_iff)
         show "ball 0 ?C \<subseteq> cbox u v \<longrightarrow>
                   (\<exists>z. (indicat_real (?f ` S) has_integral z) (cbox u v) \<and>
                        \<bar>z - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar> < e)" for u v
         proof
           assume uv: "ball 0 ?C \<subseteq> cbox u v"
           with \<open>?C > 0\<close> have cbox_ne: "cbox u v \<noteq> {}"
             using centre_in_ball by blast
           let ?\<alpha> = "\<lambda>k. u$k / m k"
           let ?\<beta> = "\<lambda>k. v$k / m k"
           have invm0: "\<And>k. inverse (m k) \<noteq> 0"
             using True by auto
           have "ball 0 B \<subseteq> (\<lambda>x. \<chi> k. x $ k / m k) ` ball 0 ?C"
           proof clarsimp
             fix x :: "real^'n"
             assume x: "norm x < B"
             have [simp]: "\<bar>Max (range (\<lambda>k. \<bar>m k\<bar>))\<bar> = Max (range (\<lambda>k. \<bar>m k\<bar>))"
               by (meson Max_ge abs_ge_zero abs_of_nonneg finite finite_imageI order_trans rangeI)
             have "norm (\<chi> k. m k * x $ k) \<le> norm (Max (range (\<lambda>k. \<bar>m k\<bar>)) *\<^sub>R x)"
               by (rule norm_le_componentwise_cart) (auto simp: abs_mult intro: mult_right_mono)
             also have "\<dots> < ?C"
               using x by simp (metis \<open>B > 0\<close> \<open>?C > 0\<close> mult.commute real_mult_less_iff1 zero_less_mult_pos)
             finally have "norm (\<chi> k. m k * x $ k) < ?C" .
             then show "x \<in> (\<lambda>x. \<chi> k. x $ k / m k) ` ball 0 ?C"
               using stretch_Galois [of "inverse \<circ> m"] True by (auto simp: image_iff field_simps)
           qed
           then have Bsub: "ball 0 B \<subseteq> cbox (\<chi> k. min (?\<alpha> k) (?\<beta> k)) (\<chi> k. max (?\<alpha> k) (?\<beta> k))"
             using cbox_ne uv image_stretch_interval_cart [of "inverse \<circ> m" u v, symmetric]
             by (force simp: field_simps)
           obtain z where zint: "(indicat_real S has_integral z) (cbox (\<chi> k. min (?\<alpha> k) (?\<beta> k)) (\<chi> k. max (?\<alpha> k) (?\<beta> k)))"
                    and zless: "\<bar>z - measure lebesgue S\<bar> < e / \<bar>prod m UNIV\<bar>"
             using B [OF Bsub] by blast
           have ind: "indicat_real (?f ` S) = (\<lambda>x. indicator S (\<chi> k. x$k / m k))"
             using True stretch_Galois [of m] by (force simp: indicator_def)
           show "\<exists>z. (indicat_real (?f ` S) has_integral z) (cbox u v) \<and>
                        \<bar>z - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar> < e"
           proof (simp add: ind, intro conjI exI)
             have "((\<lambda>x. indicat_real S (\<chi> k. x $ k/ m k)) has_integral z *\<^sub>R \<bar>prod m UNIV\<bar>)
                 ((\<lambda>x. \<chi> k. x $ k * m k) ` cbox (\<chi> k. min (?\<alpha> k) (?\<beta> k)) (\<chi> k. max (?\<alpha> k) (?\<beta> k)))"
               using True has_integral_stretch_cart [OF zint, of "inverse \<circ> m"]
               by (simp add: field_simps prod_dividef)
             moreover have "((\<lambda>x. \<chi> k. x $ k * m k) ` cbox (\<chi> k. min (?\<alpha> k) (?\<beta> k)) (\<chi> k. max (?\<alpha> k) (?\<beta> k))) = cbox u v"
               using True image_stretch_interval_cart [of "inverse \<circ> m" u v, symmetric]
                 image_stretch_interval_cart [of "\<lambda>k. 1" u v, symmetric] \<open>cbox u v \<noteq> {}\<close>
               by (simp add: field_simps image_comp o_def)
             ultimately show "((\<lambda>x. indicat_real S (\<chi> k. x $ k/ m k)) has_integral z *\<^sub>R \<bar>prod m UNIV\<bar>) (cbox u v)"
               by simp
             have "\<bar>z *\<^sub>R \<bar>prod m UNIV\<bar> - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar>
                  = \<bar>prod m UNIV\<bar> * \<bar>z - measure lebesgue S\<bar>"
               by (metis (no_types, hide_lams) abs_abs abs_scaleR mult.commute real_scaleR_def right_diff_distrib')
             also have "\<dots> < e"
               using zless True by (simp add: field_simps)
             finally show "\<bar>z *\<^sub>R \<bar>prod m UNIV\<bar> - \<bar>prod m UNIV\<bar> * measure lebesgue S\<bar> < e" .
           qed
         qed
       qed
     qed
     then show ?thesis
       by (auto simp: has_integral_integrable integral_unique lmeasure_integral_UNIV measurable_integrable)
   next
     case False
     then obtain k where "m k = 0" and prm: "prod m UNIV = 0"
       by auto
     have nfS: "negligible (?f ` S)"
       by (rule negligible_subset [OF negligible_standard_hyperplane_cart]) (use \<open>m k = 0\<close> in auto)
     then have "(?f ` S) \<in> lmeasurable"
       by (simp add: negligible_iff_measure)
     with nfS show ?thesis
       by (simp add: prm negligible_iff_measure0)
   qed
   then show "(?f ` S) \<in> lmeasurable" ?MEQ
     by metis+
 qed
 
 
 proposition
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes "linear f" "S \<in> lmeasurable"
   shows measurable_linear_image: "(f ` S) \<in> lmeasurable"
     and measure_linear_image: "measure lebesgue (f ` S) = \<bar>det (matrix f)\<bar> * measure lebesgue S" (is "?Q f S")
 proof -
   have "\<forall>S \<in> lmeasurable. (f ` S) \<in> lmeasurable \<and> ?Q f S"
   proof (rule induct_linear_elementary [OF \<open>linear f\<close>]; intro ballI)
     fix f g and S :: "(real,'n) vec set"
     assume "linear f" and "linear g"
       and f [rule_format]: "\<forall>S \<in> lmeasurable. f ` S \<in> lmeasurable \<and> ?Q f S"
       and g [rule_format]: "\<forall>S \<in> lmeasurable. g ` S \<in> lmeasurable \<and> ?Q g S"
       and S: "S \<in> lmeasurable"
     then have gS: "g ` S \<in> lmeasurable"
       by blast
     show "(f \<circ> g) ` S \<in> lmeasurable \<and> ?Q (f \<circ> g) S"
       using f [OF gS] g [OF S] matrix_compose [OF \<open>linear g\<close> \<open>linear f\<close>]
       by (simp add: o_def image_comp abs_mult det_mul)
   next
     fix f :: "real^'n::_ \<Rightarrow> real^'n::_" and i and S :: "(real^'n::_) set"
     assume "linear f" and 0: "\<And>x. f x $ i = 0" and "S \<in> lmeasurable"
     then have "\<not> inj f"
       by (metis (full_types) linear_injective_imp_surjective one_neq_zero surjE vec_component)
     have detf: "det (matrix f) = 0"
       using \<open>\<not> inj f\<close> det_nz_iff_inj[OF \<open>linear f\<close>] by blast
     show "f ` S \<in> lmeasurable \<and> ?Q f S"
     proof
       show "f ` S \<in> lmeasurable"
         using lmeasurable_iff_indicator_has_integral \<open>linear f\<close> \<open>\<not> inj f\<close> negligible_UNIV negligible_linear_singular_image by blast
       have "measure lebesgue (f ` S) = 0"
         by (meson \<open>\<not> inj f\<close> \<open>linear f\<close> negligible_imp_measure0 negligible_linear_singular_image)
       also have "\<dots> = \<bar>det (matrix f)\<bar> * measure lebesgue S"
         by (simp add: detf)
       finally show "?Q f S" .
     qed
   next
     fix c and S :: "(real^'n::_) set"
     assume "S \<in> lmeasurable"
     show "(\<lambda>a. \<chi> i. c i * a $ i) ` S \<in> lmeasurable \<and> ?Q (\<lambda>a. \<chi> i. c i * a $ i) S"
     proof
       show "(\<lambda>a. \<chi> i. c i * a $ i) ` S \<in> lmeasurable"
         by (simp add: \<open>S \<in> lmeasurable\<close> measurable_stretch)
       show "?Q (\<lambda>a. \<chi> i. c i * a $ i) S"
         by (simp add: measure_stretch [OF \<open>S \<in> lmeasurable\<close>, of c] axis_def matrix_def det_diagonal)
     qed
   next
     fix m :: "'n" and n :: "'n" and S :: "(real, 'n) vec set"
     assume "m \<noteq> n" and "S \<in> lmeasurable"
     let ?h = "\<lambda>v::(real, 'n) vec. \<chi> i. v $ Fun.swap m n id i"
     have lin: "linear ?h"
       by (rule linearI) (simp_all add: plus_vec_def scaleR_vec_def)
     have meq: "measure lebesgue ((\<lambda>v::(real, 'n) vec. \<chi> i. v $ Fun.swap m n id i) ` cbox a b)
              = measure lebesgue (cbox a b)" for a b
     proof (cases "cbox a b = {}")
       case True then show ?thesis
         by simp
     next
       case False
       then have him: "?h ` (cbox a b) \<noteq> {}"
         by blast
       have eq: "?h ` (cbox a b) = cbox (?h a) (?h b)"
         by (auto simp: image_iff lambda_swap_Galois mem_box_cart) (metis swap_id_eq)+
       show ?thesis
         using him prod.permute [OF permutes_swap_id, where S=UNIV and g="\<lambda>i. (b - a)$i", symmetric]
         by (simp add: eq content_cbox_cart False)
     qed
     have "(\<chi> i j. if Fun.swap m n id i = j then 1 else 0) = (\<chi> i j. if j = Fun.swap m n id i then 1 else (0::real))"
       by (auto intro!: Cart_lambda_cong)
     then have "matrix ?h = transpose(\<chi> i j. mat 1 $ i $ Fun.swap m n id j)"
       by (auto simp: matrix_eq transpose_def axis_def mat_def matrix_def)
     then have 1: "\<bar>det (matrix ?h)\<bar> = 1"
       by (simp add: det_permute_columns permutes_swap_id sign_swap_id abs_mult)
     show "?h ` S \<in> lmeasurable \<and> ?Q ?h S"
     proof
       show "?h ` S \<in> lmeasurable" "?Q ?h S"
         using measure_linear_sufficient [OF lin \<open>S \<in> lmeasurable\<close>] meq 1 by force+
     qed
   next
     fix m n :: "'n" and S :: "(real, 'n) vec set"
     assume "m \<noteq> n" and "S \<in> lmeasurable"
     let ?h = "\<lambda>v::(real, 'n) vec. \<chi> i. if i = m then v $ m + v $ n else v $ i"
     have lin: "linear ?h"
       by (rule linearI) (auto simp: algebra_simps plus_vec_def scaleR_vec_def vec_eq_iff)
     consider "m < n" | " n < m"
       using \<open>m \<noteq> n\<close> less_linear by blast
     then have 1: "det(matrix ?h) = 1"
     proof cases
       assume "m < n"
       have *: "matrix ?h $ i $ j = (0::real)" if "j < i" for i j :: 'n
       proof -
         have "axis j 1 = (\<chi> n. if n = j then 1 else (0::real))"
           using axis_def by blast
         then have "(\<chi> p q. if p = m then axis q 1 $ m + axis q 1 $ n else axis q 1 $ p) $ i $ j = (0::real)"
           using \<open>j < i\<close> axis_def \<open>m < n\<close> by auto
         with \<open>m < n\<close> show ?thesis
           by (auto simp: matrix_def axis_def cong: if_cong)
       qed
       show ?thesis
         using \<open>m \<noteq> n\<close> by (subst det_upperdiagonal [OF *]) (auto simp: matrix_def axis_def cong: if_cong)
     next
       assume "n < m"
       have *: "matrix ?h $ i $ j = (0::real)" if "j > i" for i j :: 'n
       proof -
         have "axis j 1 = (\<chi> n. if n = j then 1 else (0::real))"
           using axis_def by blast
         then have "(\<chi> p q. if p = m then axis q 1 $ m + axis q 1 $ n else axis q 1 $ p) $ i $ j = (0::real)"
           using \<open>j > i\<close> axis_def \<open>m > n\<close> by auto
         with \<open>m > n\<close> show ?thesis
           by (auto simp: matrix_def axis_def cong: if_cong)
       qed
       show ?thesis
         using \<open>m \<noteq> n\<close>
         by (subst det_lowerdiagonal [OF *]) (auto simp: matrix_def axis_def cong: if_cong)
     qed
     have meq: "measure lebesgue (?h ` (cbox a b)) = measure lebesgue (cbox a b)" for a b
     proof (cases "cbox a b = {}")
       case True then show ?thesis by simp
     next
       case False
       then have ne: "(+) (\<chi> i. if i = n then - a $ n else 0) ` cbox a b \<noteq> {}"
         by auto
       let ?v = "\<chi> i. if i = n then - a $ n else 0"
       have "?h ` cbox a b
             = (+) (\<chi> i. if i = m \<or> i = n then a $ n else 0) ` ?h ` (+) ?v ` (cbox a b)"
         using \<open>m \<noteq> n\<close> unfolding image_comp o_def by (force simp: vec_eq_iff)
       then have "measure lebesgue (?h ` (cbox a b))
                = measure lebesgue ((\<lambda>v. \<chi> i. if i = m then v $ m + v $ n else v $ i) `
                                    (+) ?v ` cbox a b)"
         by (rule ssubst) (rule measure_translation)
       also have "\<dots> = measure lebesgue ((\<lambda>v. \<chi> i. if i = m then v $ m + v $ n else v $ i) ` cbox (?v +a) (?v + b))"
         by (metis (no_types, lifting) cbox_translation)
       also have "\<dots> = measure lebesgue ((+) (\<chi> i. if i = n then - a $ n else 0) ` cbox a b)"
         apply (subst measure_shear_interval)
         using \<open>m \<noteq> n\<close> ne apply auto
         apply (simp add: cbox_translation)
         by (metis cbox_borel cbox_translation measure_completion sets_lborel)
       also have "\<dots> = measure lebesgue (cbox a b)"
         by (rule measure_translation)
         finally show ?thesis .
       qed
     show "?h ` S \<in> lmeasurable \<and> ?Q ?h S"
       using measure_linear_sufficient [OF lin \<open>S \<in> lmeasurable\<close>] meq 1 by force
   qed
   with assms show "(f ` S) \<in> lmeasurable" "?Q f S"
     by metis+
 qed
 
 
 lemma
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes f: "orthogonal_transformation f" and S: "S \<in> lmeasurable"
   shows measurable_orthogonal_image: "f ` S \<in> lmeasurable"
     and measure_orthogonal_image: "measure lebesgue (f ` S) = measure lebesgue S"
 proof -
   have "linear f"
     by (simp add: f orthogonal_transformation_linear)
   then show "f ` S \<in> lmeasurable"
     by (metis S measurable_linear_image)
   show "measure lebesgue (f ` S) = measure lebesgue S"
     by (simp add: measure_linear_image \<open>linear f\<close> S f)
 qed
 
 proposition measure_semicontinuous_with_hausdist_explicit:
   assumes "bounded S" and neg: "negligible(frontier S)" and "e > 0"
   obtains d where "d > 0"
                   "\<And>T. \<lbrakk>T \<in> lmeasurable; \<And>y. y \<in> T \<Longrightarrow> \<exists>x. x \<in> S \<and> dist x y < d\<rbrakk>
                         \<Longrightarrow> measure lebesgue T < measure lebesgue S + e"
 proof (cases "S = {}")
   case True
   with that \<open>e > 0\<close> show ?thesis by force
 next
   case False
   then have frS: "frontier S \<noteq> {}"
     using \<open>bounded S\<close> frontier_eq_empty not_bounded_UNIV by blast
   have "S \<in> lmeasurable"
     by (simp add: \<open>bounded S\<close> measurable_Jordan neg)
   have null: "(frontier S) \<in> null_sets lebesgue"
     by (metis neg negligible_iff_null_sets)
   have "frontier S \<in> lmeasurable" and mS0: "measure lebesgue (frontier S) = 0"
     using neg negligible_imp_measurable negligible_iff_measure by blast+
   with \<open>e > 0\<close> sets_lebesgue_outer_open
   obtain U where "open U"
     and U: "frontier S \<subseteq> U" "U - frontier S \<in> lmeasurable" "emeasure lebesgue (U - frontier S) < e"
     by (metis fmeasurableD)
   with null have "U \<in> lmeasurable"
     by (metis borel_open measurable_Diff_null_set sets_completionI_sets sets_lborel)
   have "measure lebesgue (U - frontier S) = measure lebesgue U"
     using mS0 by (simp add: \<open>U \<in> lmeasurable\<close> fmeasurableD measure_Diff_null_set null)
   with U have mU: "measure lebesgue U < e"
     by (simp add: emeasure_eq_measure2 ennreal_less_iff)
   show ?thesis
   proof
     have "U \<noteq> UNIV"
       using \<open>U \<in> lmeasurable\<close> by auto
     then have "- U \<noteq> {}"
       by blast
     with \<open>open U\<close> \<open>frontier S \<subseteq> U\<close> show "setdist (frontier S) (- U) > 0"
       by (auto simp: \<open>bounded S\<close> open_closed compact_frontier_bounded setdist_gt_0_compact_closed frS)
     fix T
     assume "T \<in> lmeasurable"
       and T: "\<And>t. t \<in> T \<Longrightarrow> \<exists>y. y \<in> S \<and> dist y t < setdist (frontier S) (- U)"
     then have "measure lebesgue T - measure lebesgue S \<le> measure lebesgue (T - S)"
       by (simp add: \<open>S \<in> lmeasurable\<close> measure_diff_le_measure_setdiff)
     also have "\<dots>  \<le> measure lebesgue U"
     proof -
       have "T - S \<subseteq> U"
       proof clarify
         fix x
         assume "x \<in> T" and "x \<notin> S"
         then obtain y where "y \<in> S" and y: "dist y x < setdist (frontier S) (- U)"
           using T by blast
         have "closed_segment x y \<inter> frontier S \<noteq> {}"
           using connected_Int_frontier \<open>x \<notin> S\<close> \<open>y \<in> S\<close> by blast
         then obtain z where z: "z \<in> closed_segment x y" "z \<in> frontier S"
           by auto
         with y have "dist z x < setdist(frontier S) (- U)"
           by (auto simp: dist_commute dest!: dist_in_closed_segment)
         with z have False if "x \<in> -U"
           using setdist_le_dist [OF \<open>z \<in> frontier S\<close> that] by auto
         then show "x \<in> U"
           by blast
       qed
       then show ?thesis
         by (simp add: \<open>S \<in> lmeasurable\<close> \<open>T \<in> lmeasurable\<close> \<open>U \<in> lmeasurable\<close> fmeasurableD measure_mono_fmeasurable sets.Diff)
     qed
     finally have "measure lebesgue T - measure lebesgue S \<le> measure lebesgue U" .
     with mU show "measure lebesgue T < measure lebesgue S + e"
       by linarith
   qed
 qed
 
 proposition
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> lmeasurable"
   and deriv: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   and int: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   and bounded: "\<And>x. x \<in> S \<Longrightarrow> \<bar>det (matrix (f' x))\<bar> \<le> B"
   shows measurable_bounded_differentiable_image:
        "f ` S \<in> lmeasurable"
     and measure_bounded_differentiable_image:
        "measure lebesgue (f ` S) \<le> B * measure lebesgue S" (is "?M")
 proof -
   have "f ` S \<in> lmeasurable \<and> measure lebesgue (f ` S) \<le> B * measure lebesgue S"
   proof (cases "B < 0")
     case True
     then have "S = {}"
       by (meson abs_ge_zero bounded empty_iff equalityI less_le_trans linorder_not_less subsetI)
     then show ?thesis
       by auto
   next
     case False
     then have "B \<ge> 0"
       by arith
     let ?\<mu> = "measure lebesgue"
     have f_diff: "f differentiable_on S"
       using deriv by (auto simp: differentiable_on_def differentiable_def)
     have eps: "f ` S \<in> lmeasurable" "?\<mu> (f ` S) \<le> (B+e) * ?\<mu> S" (is "?ME")
               if "e > 0" for e
     proof -
       have eps_d: "f ` S \<in> lmeasurable"  "?\<mu> (f ` S) \<le> (B+e) * (?\<mu> S + d)" (is "?MD")
                   if "d > 0" for d
       proof -
         obtain T where T: "open T" "S \<subseteq> T" and TS: "(T-S) \<in> lmeasurable" and "emeasure lebesgue (T-S) < ennreal d"
           using S \<open>d > 0\<close> sets_lebesgue_outer_open by blast
         then have "?\<mu> (T-S) < d"
           by (metis emeasure_eq_measure2 ennreal_leI not_less)
         with S T TS have "T \<in> lmeasurable" and Tless: "?\<mu> T < ?\<mu> S + d"
           by (auto simp: measurable_measure_Diff dest!: fmeasurable_Diff_D)
         have "\<exists>r. 0 < r \<and> r < d \<and> ball x r \<subseteq> T \<and> f ` (S \<inter> ball x r) \<in> lmeasurable \<and>
                   ?\<mu> (f ` (S \<inter> ball x r)) \<le> (B + e) * ?\<mu> (ball x r)"
           if "x \<in> S" "d > 0" for x d
         proof -
           have lin: "linear (f' x)"
             and lim0: "((\<lambda>y. (f y - (f x + f' x (y - x))) /\<^sub>R norm(y - x)) \<longlongrightarrow> 0) (at x within S)"
             using deriv \<open>x \<in> S\<close> by (auto simp: has_derivative_within bounded_linear.linear field_simps)
           have bo: "bounded (f' x ` ball 0 1)"
             by (simp add: bounded_linear_image linear_linear lin)
           have neg: "negligible (frontier (f' x ` ball 0 1))"
             using deriv has_derivative_linear \<open>x \<in> S\<close>
             by (auto intro!: negligible_convex_frontier [OF convex_linear_image])
-          have 0: "0 < e * unit_ball_vol (real CARD('n))"
-            using  \<open>e > 0\<close> by simp
+          let ?unit_vol = "content (ball (0 :: real ^ 'n :: {finite, wellorder}) 1)"
+          have 0: "0 < e * ?unit_vol"
+            using \<open>e > 0\<close> by (simp add: content_ball_pos)
           obtain k where "k > 0" and k:
                   "\<And>U. \<lbrakk>U \<in> lmeasurable; \<And>y. y \<in> U \<Longrightarrow> \<exists>z. z \<in> f' x ` ball 0 1 \<and> dist z y < k\<rbrakk>
-                        \<Longrightarrow> ?\<mu> U < ?\<mu> (f' x ` ball 0 1) + e * unit_ball_vol (CARD('n))"
+                        \<Longrightarrow> ?\<mu> U < ?\<mu> (f' x ` ball 0 1) + e * ?unit_vol"
             using measure_semicontinuous_with_hausdist_explicit [OF bo neg 0] by blast
           obtain l where "l > 0" and l: "ball x l \<subseteq> T"
             using \<open>x \<in> S\<close> \<open>open T\<close> \<open>S \<subseteq> T\<close> openE by blast
           obtain \<zeta> where "0 < \<zeta>"
             and \<zeta>: "\<And>y. \<lbrakk>y \<in> S; y \<noteq> x; dist y x < \<zeta>\<rbrakk>
                         \<Longrightarrow> norm (f y - (f x + f' x (y - x))) / norm (y - x) < k"
             using lim0 \<open>k > 0\<close> by (simp add: Lim_within) (auto simp add: field_simps)
           define r where "r \<equiv> min (min l (\<zeta>/2)) (min 1 (d/2))"
           show ?thesis
           proof (intro exI conjI)
             show "r > 0" "r < d"
               using \<open>l > 0\<close> \<open>\<zeta> > 0\<close> \<open>d > 0\<close> by (auto simp: r_def)
             have "r \<le> l"
               by (auto simp: r_def)
             with l show "ball x r \<subseteq> T"
               by auto
             have ex_lessK: "\<exists>x' \<in> ball 0 1. dist (f' x x') ((f y - f x) /\<^sub>R r) < k"
               if "y \<in> S" and "dist x y < r" for y
             proof (cases "y = x")
               case True
               with lin linear_0 \<open>k > 0\<close> that show ?thesis
                 by (rule_tac x=0 in bexI) (auto simp: linear_0)
             next
               case False
               then show ?thesis
               proof (rule_tac x="(y - x) /\<^sub>R r" in bexI)
                 have "f' x ((y - x) /\<^sub>R r) = f' x (y - x) /\<^sub>R r"
                   by (simp add: lin linear_scale)
                 then have "dist (f' x ((y - x) /\<^sub>R r)) ((f y - f x) /\<^sub>R r) = norm (f' x (y - x) /\<^sub>R r - (f y - f x) /\<^sub>R r)"
                   by (simp add: dist_norm)
                 also have "\<dots> = norm (f' x (y - x) - (f y - f x)) / r"
                   using \<open>r > 0\<close> by (simp add: divide_simps scale_right_diff_distrib [symmetric])
                 also have "\<dots> \<le> norm (f y - (f x + f' x (y - x))) / norm (y - x)"
                   using that \<open>r > 0\<close> False by (simp add: algebra_simps field_split_simps dist_norm norm_minus_commute mult_right_mono)
                 also have "\<dots> < k"
                   using that \<open>0 < \<zeta>\<close> by (simp add: dist_commute r_def  \<zeta> [OF \<open>y \<in> S\<close> False])
                 finally show "dist (f' x ((y - x) /\<^sub>R r)) ((f y - f x) /\<^sub>R r) < k" .
                 show "(y - x) /\<^sub>R r \<in> ball 0 1"
                   using that \<open>r > 0\<close> by (simp add: dist_norm divide_simps norm_minus_commute)
               qed
             qed
             let ?rfs = "(\<lambda>x. x /\<^sub>R r) ` (+) (- f x) ` f ` (S \<inter> ball x r)"
             have rfs_mble: "?rfs \<in> lmeasurable"
             proof (rule bounded_set_imp_lmeasurable)
               have "f differentiable_on S \<inter> ball x r"
                 using f_diff by (auto simp: fmeasurableD differentiable_on_subset)
               with S show "?rfs \<in> sets lebesgue"
                 by (auto simp: sets.Int intro!: lebesgue_sets_translation differentiable_image_in_sets_lebesgue)
               let ?B = "(\<lambda>(x, y). x + y) ` (f' x ` ball 0 1 \<times> ball 0 k)"
               have "bounded ?B"
                 by (simp add: bounded_plus [OF bo])
               moreover have "?rfs \<subseteq> ?B"
                 apply (auto simp: dist_norm image_iff dest!: ex_lessK)
                 by (metis (no_types, hide_lams) add.commute diff_add_cancel dist_0_norm dist_commute dist_norm mem_ball)
               ultimately show "bounded (?rfs)"
                 by (rule bounded_subset)
             qed
             then have "(\<lambda>x. r *\<^sub>R x) ` ?rfs \<in> lmeasurable"
               by (simp add: measurable_linear_image)
             with \<open>r > 0\<close> have "(+) (- f x) ` f ` (S \<inter> ball x r) \<in> lmeasurable"
               by (simp add: image_comp o_def)
             then have "(+) (f x) ` (+) (- f x) ` f ` (S \<inter> ball x r) \<in> lmeasurable"
               using  measurable_translation by blast
             then show fsb: "f ` (S \<inter> ball x r) \<in> lmeasurable"
               by (simp add: image_comp o_def)
             have "?\<mu> (f ` (S \<inter> ball x r)) = ?\<mu> (?rfs) * r ^ CARD('n)"
               using \<open>r > 0\<close> fsb
               by (simp add: measure_linear_image measure_translation_subtract measurable_translation_subtract field_simps cong: image_cong_simp)
-            also have "\<dots> \<le> (\<bar>det (matrix (f' x))\<bar> * unit_ball_vol (CARD('n)) + e * unit_ball_vol (CARD('n))) * r ^ CARD('n)"
+            also have "\<dots> \<le> (\<bar>det (matrix (f' x))\<bar> * ?unit_vol + e * ?unit_vol) * r ^ CARD('n)"
             proof -
-              have "?\<mu> (?rfs) < ?\<mu> (f' x ` ball 0 1) + e * unit_ball_vol (CARD('n))"
+              have "?\<mu> (?rfs) < ?\<mu> (f' x ` ball 0 1) + e * ?unit_vol"
                 using rfs_mble by (force intro: k dest!: ex_lessK)
-              then have "?\<mu> (?rfs) < \<bar>det (matrix (f' x))\<bar> * unit_ball_vol (CARD('n)) + e * unit_ball_vol (CARD('n))"
-                by (simp add: lin measure_linear_image [of "f' x"] content_ball)
+              then have "?\<mu> (?rfs) < \<bar>det (matrix (f' x))\<bar> * ?unit_vol + e * ?unit_vol"
+                by (simp add: lin measure_linear_image [of "f' x"])
               with \<open>r > 0\<close> show ?thesis
                 by auto
             qed
             also have "\<dots> \<le> (B + e) * ?\<mu> (ball x r)"
-              using bounded [OF \<open>x \<in> S\<close>] \<open>r > 0\<close> by (simp add: content_ball algebra_simps)
+              using bounded [OF \<open>x \<in> S\<close>] \<open>r > 0\<close>
+              by (simp add: algebra_simps content_ball_conv_unit_ball[of r] content_ball_pos)
             finally show "?\<mu> (f ` (S \<inter> ball x r)) \<le> (B + e) * ?\<mu> (ball x r)" .
           qed
         qed
         then obtain r where
           r0d: "\<And>x d. \<lbrakk>x \<in> S; d > 0\<rbrakk> \<Longrightarrow> 0 < r x d \<and> r x d < d"
           and rT: "\<And>x d. \<lbrakk>x \<in> S; d > 0\<rbrakk> \<Longrightarrow> ball x (r x d) \<subseteq> T"
           and r: "\<And>x d. \<lbrakk>x \<in> S; d > 0\<rbrakk> \<Longrightarrow>
                   (f ` (S \<inter> ball x (r x d))) \<in> lmeasurable \<and>
                   ?\<mu> (f ` (S \<inter> ball x (r x d))) \<le> (B + e) * ?\<mu> (ball x (r x d))"
           by metis
         obtain C where "countable C" and Csub: "C \<subseteq> {(x,r x t) |x t. x \<in> S \<and> 0 < t}"
           and pwC: "pairwise (\<lambda>i j. disjnt (ball (fst i) (snd i)) (ball (fst j) (snd j))) C"
           and negC: "negligible(S - (\<Union>i \<in> C. ball (fst i) (snd i)))"
           apply (rule Vitali_covering_theorem_balls [of S "{(x,r x t) |x t. x \<in> S \<and> 0 < t}" fst snd])
            apply auto
           by (metis dist_eq_0_iff r0d)
         let ?UB = "(\<Union>(x,s) \<in> C. ball x s)"
         have eq: "f ` (S \<inter> ?UB) = (\<Union>(x,s) \<in> C. f ` (S \<inter> ball x s))"
           by auto
         have mle: "?\<mu> (\<Union>(x,s) \<in> K. f ` (S \<inter> ball x s)) \<le> (B + e) * (?\<mu> S + d)"  (is "?l \<le> ?r")
           if "K \<subseteq> C" and "finite K" for K
         proof -
           have gt0: "b > 0" if "(a, b) \<in> K" for a b
             using Csub that \<open>K \<subseteq> C\<close> r0d by auto
           have inj: "inj_on (\<lambda>(x, y). ball x y) K"
             by (force simp: inj_on_def ball_eq_ball_iff dest: gt0)
           have disjnt: "disjoint ((\<lambda>(x, y). ball x y) ` K)"
             using pwC that
             apply (clarsimp simp: pairwise_def case_prod_unfold ball_eq_ball_iff)
             by (metis subsetD fst_conv snd_conv)
           have "?l \<le> (\<Sum>i\<in>K. ?\<mu> (case i of (x, s) \<Rightarrow> f ` (S \<inter> ball x s)))"
           proof (rule measure_UNION_le [OF \<open>finite K\<close>], clarify)
             fix x r
             assume "(x,r) \<in> K"
             then have "x \<in> S"
               using Csub \<open>K \<subseteq> C\<close> by auto
             show "f ` (S \<inter> ball x r) \<in> sets lebesgue"
               by (meson Int_lower1 S differentiable_on_subset f_diff fmeasurableD lmeasurable_ball order_refl sets.Int differentiable_image_in_sets_lebesgue)
           qed
           also have "\<dots> \<le> (\<Sum>(x,s) \<in> K. (B + e) * ?\<mu> (ball x s))"
             apply (rule sum_mono)
             using Csub r \<open>K \<subseteq> C\<close> by auto
           also have "\<dots> = (B + e) * (\<Sum>(x,s) \<in> K. ?\<mu> (ball x s))"
             by (simp add: prod.case_distrib sum_distrib_left)
           also have "\<dots> = (B + e) * sum ?\<mu> ((\<lambda>(x, y). ball x y) ` K)"
             using \<open>B \<ge> 0\<close> \<open>e > 0\<close> by (simp add: inj sum.reindex prod.case_distrib)
           also have "\<dots> = (B + e) * ?\<mu> (\<Union>(x,s) \<in> K. ball x s)"
             using \<open>B \<ge> 0\<close> \<open>e > 0\<close> that
             by (subst measure_Union') (auto simp: disjnt measure_Union')
           also have "\<dots> \<le> (B + e) * ?\<mu> T"
             using \<open>B \<ge> 0\<close> \<open>e > 0\<close> that apply simp
             apply (rule measure_mono_fmeasurable [OF _ _ \<open>T \<in> lmeasurable\<close>])
             using Csub rT by force+
           also have "\<dots> \<le> (B + e) * (?\<mu> S + d)"
             using \<open>B \<ge> 0\<close> \<open>e > 0\<close> Tless by simp
           finally show ?thesis .
         qed
         have fSUB_mble: "(f ` (S \<inter> ?UB)) \<in> lmeasurable"
           unfolding eq using Csub r False \<open>e > 0\<close> that
           by (auto simp: intro!: fmeasurable_UN_bound [OF \<open>countable C\<close> _ mle])
         have fSUB_meas: "?\<mu> (f ` (S \<inter> ?UB)) \<le> (B + e) * (?\<mu> S + d)"  (is "?MUB")
           unfolding eq using Csub r False \<open>e > 0\<close> that
           by (auto simp: intro!: measure_UN_bound [OF \<open>countable C\<close> _ mle])
         have neg: "negligible ((f ` (S \<inter> ?UB) - f ` S) \<union> (f ` S - f ` (S \<inter> ?UB)))"
         proof (rule negligible_subset [OF negligible_differentiable_image_negligible [OF order_refl negC, where f=f]])
           show "f differentiable_on S - (\<Union>i\<in>C. ball (fst i) (snd i))"
             by (meson DiffE differentiable_on_subset subsetI f_diff)
         qed force
         show "f ` S \<in> lmeasurable"
           by (rule lmeasurable_negligible_symdiff [OF fSUB_mble neg])
         show ?MD
           using fSUB_meas measure_negligible_symdiff [OF fSUB_mble neg] by simp
       qed
       show "f ` S \<in> lmeasurable"
         using eps_d [of 1] by simp
       show ?ME
       proof (rule field_le_epsilon)
         fix \<delta> :: real
         assume "0 < \<delta>"
         then show "?\<mu> (f ` S) \<le> (B + e) * ?\<mu> S + \<delta>"
           using eps_d [of "\<delta> / (B+e)"] \<open>e > 0\<close> \<open>B \<ge> 0\<close> by (auto simp: divide_simps mult_ac)
       qed
     qed
     show ?thesis
     proof (cases "?\<mu> S = 0")
       case True
       with eps have "?\<mu> (f ` S) = 0"
         by (metis mult_zero_right not_le zero_less_measure_iff)
       then show ?thesis
         using eps [of 1] by (simp add: True)
     next
       case False
       have "?\<mu> (f ` S) \<le> B * ?\<mu> S"
       proof (rule field_le_epsilon)
         fix e :: real
         assume "e > 0"
         then show "?\<mu> (f ` S) \<le> B * ?\<mu> S + e"
           using eps [of "e / ?\<mu> S"] False by (auto simp: algebra_simps zero_less_measure_iff)
       qed
       with eps [of 1] show ?thesis by auto
     qed
   qed
   then show "f ` S \<in> lmeasurable" ?M by blast+
 qed
 
 lemma m_diff_image_weak:
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> lmeasurable"
     and deriv: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and int: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   shows "f ` S \<in> lmeasurable \<and> measure lebesgue (f ` S) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
 proof -
   let ?\<mu> = "measure lebesgue"
   have aint_S: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on S"
     using int unfolding absolutely_integrable_on_def by auto
   define m where "m \<equiv> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
   have *: "f ` S \<in> lmeasurable" "?\<mu> (f ` S) \<le> m + e * ?\<mu> S"
     if "e > 0" for e
   proof -
     define T where "T \<equiv> \<lambda>n. {x \<in> S. n * e \<le> \<bar>det (matrix (f' x))\<bar> \<and>
                                      \<bar>det (matrix (f' x))\<bar> < (Suc n) * e}"
     have meas_t: "T n \<in> lmeasurable" for n
     proof -
       have *: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) \<in> borel_measurable (lebesgue_on S)"
         using aint_S by (simp add: S borel_measurable_restrict_space_iff fmeasurableD set_integrable_def)
       have [intro]: "x \<in> sets (lebesgue_on S) \<Longrightarrow> x \<in> sets lebesgue" for x
         using S sets_restrict_space_subset by blast
       have "{x \<in> S. real n * e \<le> \<bar>det (matrix (f' x))\<bar>} \<in> sets lebesgue"
         using * by (auto simp: borel_measurable_iff_halfspace_ge space_restrict_space)
       then have 1: "{x \<in> S. real n * e \<le> \<bar>det (matrix (f' x))\<bar>} \<in> lmeasurable"
         using S by (simp add: fmeasurableI2)
       have "{x \<in> S. \<bar>det (matrix (f' x))\<bar> < (1 + real n) * e} \<in> sets lebesgue"
         using * by (auto simp: borel_measurable_iff_halfspace_less space_restrict_space)
       then have 2: "{x \<in> S. \<bar>det (matrix (f' x))\<bar> < (1 + real n) * e} \<in> lmeasurable"
         using S by (simp add: fmeasurableI2)
       show ?thesis
         using fmeasurable.Int [OF 1 2] by (simp add: T_def Int_def cong: conj_cong)
     qed
     have aint_T: "\<And>k. (\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on T k"
       using set_integrable_subset [OF aint_S] meas_t T_def by blast
     have Seq: "S = (\<Union>n. T n)"
       apply (auto simp: T_def)
       apply (rule_tac x="nat(floor(abs(det(matrix(f' x))) / e))" in exI)
       using that apply auto
       using of_int_floor_le pos_le_divide_eq apply blast
       by (metis add.commute pos_divide_less_eq real_of_int_floor_add_one_gt)
     have meas_ft: "f ` T n \<in> lmeasurable" for n
     proof (rule measurable_bounded_differentiable_image)
       show "T n \<in> lmeasurable"
         by (simp add: meas_t)
     next
       fix x :: "(real,'n) vec"
       assume "x \<in> T n"
       show "(f has_derivative f' x) (at x within T n)"
         by (metis (no_types, lifting) \<open>x \<in> T n\<close> deriv has_derivative_within_subset mem_Collect_eq subsetI T_def)
       show "\<bar>det (matrix (f' x))\<bar> \<le> (Suc n) * e"
         using \<open>x \<in> T n\<close> T_def by auto
     next
       show "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on T n"
         using aint_T absolutely_integrable_on_def by blast
     qed
     have disT: "disjoint (range T)"
       unfolding disjoint_def
     proof clarsimp
       show "T m \<inter> T n = {}" if "T m \<noteq> T n" for m n
         using that
       proof (induction m n rule: linorder_less_wlog)
         case (less m n)
         with \<open>e > 0\<close> show ?case
           unfolding T_def
           proof (clarsimp simp add: Collect_conj_eq [symmetric])
             fix x
             assume "e > 0"  "m < n"  "n * e \<le> \<bar>det (matrix (f' x))\<bar>"  "\<bar>det (matrix (f' x))\<bar> < (1 + real m) * e"
             then have "n < 1 + real m"
               by (metis (no_types, hide_lams) less_le_trans mult.commute not_le real_mult_le_cancel_iff2)
             then show "False"
               using less.hyps by linarith
           qed
       qed auto
     qed
     have injT: "inj_on T ({n. T n \<noteq> {}})"
       unfolding inj_on_def
     proof clarsimp
       show "m = n" if "T m = T n" "T n \<noteq> {}" for m n
         using that
       proof (induction m n rule: linorder_less_wlog)
         case (less m n)
         have False if "T n \<subseteq> T m" "x \<in> T n" for x
           using \<open>e > 0\<close> \<open>m < n\<close> that
           apply (auto simp: T_def  mult.commute intro: less_le_trans dest!: subsetD)
           by (metis add.commute less_le_trans nat_less_real_le not_le real_mult_le_cancel_iff2)
         then show ?case
           using less.prems by blast
       qed auto
     qed
     have sum_eq_Tim: "(\<Sum>k\<le>n. f (T k)) = sum f (T ` {..n})" if "f {} = 0" for f :: "_ \<Rightarrow> real" and n
     proof (subst sum.reindex_nontrivial)
       fix i j  assume "i \<in> {..n}" "j \<in> {..n}" "i \<noteq> j" "T i = T j"
       with that  injT [unfolded inj_on_def] show "f (T i) = 0"
         by simp metis
     qed (use atMost_atLeast0 in auto)
     let ?B = "m + e * ?\<mu> S"
     have "(\<Sum>k\<le>n. ?\<mu> (f ` T k)) \<le> ?B" for n
     proof -
       have "(\<Sum>k\<le>n. ?\<mu> (f ` T k)) \<le> (\<Sum>k\<le>n. ((k+1) * e) * ?\<mu>(T k))"
       proof (rule sum_mono [OF measure_bounded_differentiable_image])
         show "(f has_derivative f' x) (at x within T k)" if "x \<in> T k" for k x
           using that unfolding T_def by (blast intro: deriv has_derivative_within_subset)
         show "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on T k" for k
           using absolutely_integrable_on_def aint_T by blast
         show "\<bar>det (matrix (f' x))\<bar> \<le> real (k + 1) * e" if "x \<in> T k" for k x
           using T_def that by auto
       qed (use meas_t in auto)
       also have "\<dots> \<le> (\<Sum>k\<le>n. (k * e) * ?\<mu>(T k)) + (\<Sum>k\<le>n. e * ?\<mu>(T k))"
         by (simp add: algebra_simps sum.distrib)
       also have "\<dots> \<le> ?B"
       proof (rule add_mono)
         have "(\<Sum>k\<le>n. real k * e * ?\<mu> (T k)) = (\<Sum>k\<le>n. integral (T k) (\<lambda>x. k * e))"
           by (simp add: lmeasure_integral [OF meas_t]
                    flip: integral_mult_right integral_mult_left)
         also have "\<dots> \<le> (\<Sum>k\<le>n. integral (T k) (\<lambda>x.  (abs (det (matrix (f' x))))))"
         proof (rule sum_mono)
           fix k
           assume "k \<in> {..n}"
           show "integral (T k) (\<lambda>x. k * e) \<le> integral (T k) (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
           proof (rule integral_le [OF integrable_on_const [OF meas_t]])
             show "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on T k"
               using absolutely_integrable_on_def aint_T by blast
           next
             fix x assume "x \<in> T k"
             show "k * e \<le> \<bar>det (matrix (f' x))\<bar>"
               using \<open>x \<in> T k\<close> T_def by blast
           qed
         qed
         also have "\<dots> = sum (\<lambda>T. integral T (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)) (T ` {..n})"
           by (auto intro: sum_eq_Tim)
         also have "\<dots> = integral (\<Union>k\<le>n. T k) (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
         proof (rule integral_unique [OF has_integral_Union, symmetric])
           fix S  assume "S \<in> T ` {..n}"
           then show "((\<lambda>x. \<bar>det (matrix (f' x))\<bar>) has_integral integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)) S"
           using absolutely_integrable_on_def aint_T by blast
         next
           show "pairwise (\<lambda>S S'. negligible (S \<inter> S')) (T ` {..n})"
             using disT unfolding disjnt_iff by (auto simp: pairwise_def intro!: empty_imp_negligible)
         qed auto
         also have "\<dots> \<le> m"
           unfolding m_def
         proof (rule integral_subset_le)
           have "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on (\<Union>k\<le>n. T k)"
             apply (rule set_integrable_subset [OF aint_S])
              apply (intro measurable meas_t fmeasurableD)
             apply (force simp: Seq)
             done
           then show "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on (\<Union>k\<le>n. T k)"
             using absolutely_integrable_on_def by blast
         qed (use Seq int in auto)
         finally show "(\<Sum>k\<le>n. real k * e * ?\<mu> (T k)) \<le> m" .
       next
         have "(\<Sum>k\<le>n. ?\<mu> (T k)) = sum ?\<mu> (T ` {..n})"
           by (auto intro: sum_eq_Tim)
         also have "\<dots> = ?\<mu> (\<Union>k\<le>n. T k)"
           using S disT by (auto simp: pairwise_def meas_t intro: measure_Union' [symmetric])
         also have "\<dots> \<le> ?\<mu> S"
           using S by (auto simp: Seq intro: meas_t fmeasurableD measure_mono_fmeasurable)
         finally have "(\<Sum>k\<le>n. ?\<mu> (T k)) \<le> ?\<mu> S" .
         then show "(\<Sum>k\<le>n. e * ?\<mu> (T k)) \<le> e * ?\<mu> S"
           by (metis less_eq_real_def ordered_comm_semiring_class.comm_mult_left_mono sum_distrib_left that)
       qed
       finally show "(\<Sum>k\<le>n. ?\<mu> (f ` T k)) \<le> ?B" .
     qed
     moreover have "measure lebesgue (\<Union>k\<le>n. f ` T k) \<le> (\<Sum>k\<le>n. ?\<mu> (f ` T k))" for n
       by (simp add: fmeasurableD meas_ft measure_UNION_le)
     ultimately have B_ge_m: "?\<mu> (\<Union>k\<le>n. (f ` T k)) \<le> ?B" for n
       by (meson order_trans)
     have "(\<Union>n. f ` T n) \<in> lmeasurable"
       by (rule fmeasurable_countable_Union [OF meas_ft B_ge_m])
     moreover have "?\<mu> (\<Union>n. f ` T n) \<le> m + e * ?\<mu> S"
       by (rule measure_countable_Union_le [OF meas_ft B_ge_m])
     ultimately show "f ` S \<in> lmeasurable" "?\<mu> (f ` S) \<le> m + e * ?\<mu> S"
       by (auto simp: Seq image_Union)
   qed
   show ?thesis
   proof
     show "f ` S \<in> lmeasurable"
       using * linordered_field_no_ub by blast
     let ?x = "m - ?\<mu> (f ` S)"
     have False if "?\<mu> (f ` S) > integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
     proof -
       have ml: "m < ?\<mu> (f ` S)"
         using m_def that by blast
       then have "?\<mu> S \<noteq> 0"
         using "*"(2) bgauge_existence_lemma by fastforce
       with ml have 0: "0 < - (m - ?\<mu> (f ` S))/2 / ?\<mu> S"
         using that zero_less_measure_iff by force
       then show ?thesis
         using * [OF 0] that by (auto simp: field_split_simps m_def split: if_split_asm)
     qed
     then show "?\<mu> (f ` S) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
       by fastforce
   qed
 qed
 
 
 theorem
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> sets lebesgue"
     and deriv: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and int: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   shows measurable_differentiable_image: "f ` S \<in> lmeasurable"
     and measure_differentiable_image:
        "measure lebesgue (f ` S) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)" (is "?M")
 proof -
   let ?I = "\<lambda>n::nat. cbox (vec (-n)) (vec n) \<inter> S"
   let ?\<mu> = "measure lebesgue"
   have "x \<in> cbox (vec (- real (nat \<lceil>norm x\<rceil>))) (vec (real (nat \<lceil>norm x\<rceil>)))" for x :: "real^'n::_"
     apply (auto simp: mem_box_cart)
     apply (metis abs_le_iff component_le_norm_cart minus_le_iff of_nat_ceiling order.trans)
     by (meson abs_le_D1 norm_bound_component_le_cart real_nat_ceiling_ge)
   then have Seq: "S = (\<Union>n. ?I n)"
     by auto
   have fIn: "f ` ?I n \<in> lmeasurable"
        and mfIn: "?\<mu> (f ` ?I n) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)" (is ?MN) for n
   proof -
     have In: "?I n \<in> lmeasurable"
       by (simp add: S bounded_Int bounded_set_imp_lmeasurable sets.Int)
     moreover have "\<And>x. x \<in> ?I n \<Longrightarrow> (f has_derivative f' x) (at x within ?I n)"
       by (meson Int_iff deriv has_derivative_within_subset subsetI)
     moreover have int_In: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on ?I n"
     proof -
       have "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on S"
         using int absolutely_integrable_integrable_bound by force
       then have "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on ?I n"
         by (metis (no_types) Int_lower1 In fmeasurableD inf_commute set_integrable_subset)
       then show ?thesis
         using absolutely_integrable_on_def by blast
     qed
     ultimately have "f ` ?I n \<in> lmeasurable" "?\<mu> (f ` ?I n) \<le> integral (?I n) (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
       using m_diff_image_weak by metis+
     moreover have "integral (?I n) (\<lambda>x. \<bar>det (matrix (f' x))\<bar>) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
       by (simp add: int_In int integral_subset_le)
     ultimately show "f ` ?I n \<in> lmeasurable" ?MN
       by auto
   qed
   have "?I k \<subseteq> ?I n" if "k \<le> n" for k n
     by (rule Int_mono) (use that in \<open>auto simp: subset_interval_imp_cart\<close>)
   then have "(\<Union>k\<le>n. f ` ?I k) = f ` ?I n" for n
     by (fastforce simp add:)
   with mfIn have "?\<mu> (\<Union>k\<le>n. f ` ?I k) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)" for n
     by simp
   then have "(\<Union>n. f ` ?I n) \<in> lmeasurable" "?\<mu> (\<Union>n. f ` ?I n) \<le> integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
     by (rule fmeasurable_countable_Union [OF fIn] measure_countable_Union_le [OF fIn])+
   then show "f ` S \<in> lmeasurable" ?M
     by (metis Seq image_UN)+
 qed
 
 
 lemma borel_measurable_simple_function_limit_increasing:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   shows "(f \<in> borel_measurable lebesgue \<and> (\<forall>x. 0 \<le> f x)) \<longleftrightarrow>
          (\<exists>g. (\<forall>n x. 0 \<le> g n x \<and> g n x \<le> f x) \<and> (\<forall>n x. g n x \<le> (g(Suc n) x)) \<and>
               (\<forall>n. g n \<in> borel_measurable lebesgue) \<and> (\<forall>n. finite(range (g n))) \<and>
               (\<forall>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x))"
          (is "?lhs = ?rhs")
 proof
   assume f: ?lhs
   have leb_f: "{x. a \<le> f x \<and> f x < b} \<in> sets lebesgue" for a b
   proof -
     have "{x. a \<le> f x \<and> f x < b} = {x. f x < b} - {x. f x < a}"
       by auto
     also have "\<dots> \<in> sets lebesgue"
       using borel_measurable_vimage_halfspace_component_lt [of f UNIV] f by auto
     finally show ?thesis .
   qed
   have "g n x \<le> f x"
         if inc_g: "\<And>n x. 0 \<le> g n x \<and> g n x \<le> g (Suc n) x"
            and meas_g: "\<And>n. g n \<in> borel_measurable lebesgue"
            and fin: "\<And>n. finite(range (g n))" and lim: "\<And>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x" for g n x
   proof -
     have "\<exists>r>0. \<forall>N. \<exists>n\<ge>N. dist (g n x) (f x) \<ge> r" if "g n x > f x"
     proof -
       have g: "g n x \<le> g (N + n) x" for N
         by (rule transitive_stepwise_le) (use inc_g in auto)
       have "\<exists>na\<ge>N. g n x - f x \<le> dist (g na x) (f x)" for N
         apply (rule_tac x="N+n" in exI)
         using g [of N] by (auto simp: dist_norm)
       with that show ?thesis
         using diff_gt_0_iff_gt by blast
     qed
     with lim show ?thesis
       apply (auto simp: lim_sequentially)
       by (meson less_le_not_le not_le_imp_less)
   qed
   moreover
   let ?\<Omega> = "\<lambda>n k. indicator {y. k/2^n \<le> f y \<and> f y < (k+1)/2^n}"
   let ?g = "\<lambda>n x. (\<Sum>k::real | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x)"
   have "\<exists>g. (\<forall>n x. 0 \<le> g n x \<and> g n x \<le> (g(Suc n) x)) \<and>
              (\<forall>n. g n \<in> borel_measurable lebesgue) \<and> (\<forall>n. finite(range (g n))) \<and>(\<forall>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x)"
   proof (intro exI allI conjI)
     show "0 \<le> ?g n x" for n x
     proof (clarify intro!: ordered_comm_monoid_add_class.sum_nonneg)
       fix k::real
       assume "k \<in> \<int>" and k: "\<bar>k\<bar> \<le> 2 ^ (2*n)"
       show "0 \<le> k/2^n * ?\<Omega> n k x"
         using f \<open>k \<in> \<int>\<close> apply (auto simp: indicator_def field_split_simps Ints_def)
         apply (drule spec [where x=x])
         using zero_le_power [of "2::real" n] mult_nonneg_nonneg [of "f x" "2^n"]
         by linarith
     qed
     show "?g n x \<le> ?g (Suc n) x" for n x
     proof -
       have "?g n x =
             (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n).
               k/2^n * (indicator {y. k/2^n \<le> f y \<and> f y < (k+1/2)/2^n} x +
               indicator {y. (k+1/2)/2^n \<le> f y \<and> f y < (k+1)/2^n} x))"
         by (rule sum.cong [OF refl]) (simp add: indicator_def field_split_simps)
       also have "\<dots> = (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * indicator {y. k/2^n \<le> f y \<and> f y < (k+1/2)/2^n} x) +
                        (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * indicator {y. (k+1/2)/2^n \<le> f y \<and> f y < (k+1)/2^n} x)"
         by (simp add:  comm_monoid_add_class.sum.distrib algebra_simps)
       also have "\<dots> = (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). (2 * k)/2 ^ Suc n * indicator {y. (2 * k)/2 ^ Suc n \<le> f y \<and> f y < (2 * k+1)/2 ^ Suc n} x) +
                        (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). (2 * k)/2 ^ Suc n * indicator {y. (2 * k+1)/2 ^ Suc n \<le> f y \<and> f y < ((2 * k+1) + 1)/2 ^ Suc n} x)"
         by (force simp: field_simps indicator_def intro: sum.cong)
       also have "\<dots> \<le> (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2 * Suc n). k/2 ^ Suc n * (indicator {y. k/2 ^ Suc n \<le> f y \<and> f y < (k+1)/2 ^ Suc n} x))"
                 (is "?a + _ \<le> ?b")
       proof -
         have *: "\<lbrakk>sum f I \<le> sum h I; a + sum h I \<le> b\<rbrakk> \<Longrightarrow> a + sum f I \<le> b" for I a b f and h :: "real\<Rightarrow>real"
           by linarith
         let ?h = "\<lambda>k. (2*k+1)/2 ^ Suc n *
                       (indicator {y. (2 * k+1)/2 ^ Suc n \<le> f y \<and> f y < ((2*k+1) + 1)/2 ^ Suc n} x)"
         show ?thesis
         proof (rule *)
           show "(\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n).
                   2 * k/2 ^ Suc n * indicator {y. (2 * k+1)/2 ^ Suc n \<le> f y \<and> f y < (2 * k+1 + 1)/2 ^ Suc n} x)
                 \<le> sum ?h {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}"
             by (rule sum_mono) (simp add: indicator_def field_split_simps)
         next
           have \<alpha>: "?a = (\<Sum>k \<in> (*)2 ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}.
                          k/2 ^ Suc n * indicator {y. k/2 ^ Suc n \<le> f y \<and> f y < (k+1)/2 ^ Suc n} x)"
             by (auto simp: inj_on_def field_simps comm_monoid_add_class.sum.reindex)
           have \<beta>: "sum ?h {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}
                    = (\<Sum>k \<in> (\<lambda>x. 2*x + 1) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}.
                       k/2 ^ Suc n * indicator {y. k/2 ^ Suc n \<le> f y \<and> f y < (k+1)/2 ^ Suc n} x)"
             by (auto simp: inj_on_def field_simps comm_monoid_add_class.sum.reindex)
           have 0: "(*) 2 ` {k \<in> \<int>. P k} \<inter> (\<lambda>x. 2 * x + 1) ` {k \<in> \<int>. P k} = {}" for P :: "real \<Rightarrow> bool"
           proof -
             have "2 * i \<noteq> 2 * j + 1" for i j :: int by arith
             thus ?thesis
               unfolding Ints_def by auto (use of_int_eq_iff in fastforce)
           qed
           have "?a + sum ?h {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}
                 = (\<Sum>k \<in> (*)2 ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)} \<union> (\<lambda>x. 2*x + 1) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}.
                   k/2 ^ Suc n * indicator {y. k/2 ^ Suc n \<le> f y \<and> f y < (k+1)/2 ^ Suc n} x)"
             unfolding \<alpha> \<beta>
             using finite_abs_int_segment [of "2 ^ (2*n)"]
             by (subst sum_Un) (auto simp: 0)
           also have "\<dots> \<le> ?b"
           proof (rule sum_mono2)
             show "finite {k::real. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2 * Suc n)}"
               by (rule finite_abs_int_segment)
             show "(*) 2 ` {k::real. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2^(2*n)} \<union> (\<lambda>x. 2*x + 1) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2^(2*n)} \<subseteq> {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2 * Suc n)}"
               apply auto
               using one_le_power [of "2::real" "2*n"]  by linarith
             have *: "\<lbrakk>x \<in> (S \<union> T) - U; \<And>x. x \<in> S \<Longrightarrow> x \<in> U; \<And>x. x \<in> T \<Longrightarrow> x \<in> U\<rbrakk> \<Longrightarrow> P x" for S T U P
               by blast
             have "0 \<le> b" if "b \<in> \<int>" "f x * (2 * 2^n) < b + 1" for b
             proof -
               have "0 \<le> f x * (2 * 2^n)"
                 by (simp add: f)
               also have "\<dots> < b+1"
                 by (simp add: that)
               finally show "0 \<le> b"
                 using \<open>b \<in> \<int>\<close> by (auto simp: elim!: Ints_cases)
             qed
             then show "0 \<le> b/2 ^ Suc n * indicator {y. b/2 ^ Suc n \<le> f y \<and> f y < (b + 1)/2 ^ Suc n} x"
                   if "b \<in> {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2 * Suc n)} -
                           ((*) 2 ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)} \<union> (\<lambda>x. 2*x + 1) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)})" for b
               using that by (simp add: indicator_def divide_simps)
           qed
           finally show "?a + sum ?h {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)} \<le> ?b" .
         qed
       qed
       finally show ?thesis .
     qed
     show "?g n \<in> borel_measurable lebesgue" for n
       apply (intro borel_measurable_indicator borel_measurable_times borel_measurable_sum)
       using leb_f sets_restrict_UNIV by auto
     show "finite (range (?g n))" for n
     proof -
       have "(\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x)
               \<in> (\<lambda>k. k/2^n) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}" for x
       proof (cases "\<exists>k. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n) \<and> k/2^n \<le> f x \<and> f x < (k+1)/2^n")
         case True
         then show ?thesis
           by (blast intro: indicator_sum_eq)
       next
         case False
         then have "(\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x) = 0"
           by auto
         then show ?thesis by force
       qed
       then have "range (?g n) \<subseteq> ((\<lambda>k. (k/2^n)) ` {k. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n)})"
         by auto
       moreover have "finite ((\<lambda>k::real. (k/2^n)) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)})"
         by (intro finite_imageI finite_abs_int_segment)
       ultimately show ?thesis
         by (rule finite_subset)
     qed
     show "(\<lambda>n. ?g n x) \<longlonglongrightarrow> f x" for x
     proof (clarsimp simp add: lim_sequentially)
       fix e::real
       assume "e > 0"
       obtain N1 where N1: "2 ^ N1 > abs(f x)"
         using real_arch_pow by fastforce
       obtain N2 where N2: "(1/2) ^ N2 < e"
         using real_arch_pow_inv \<open>e > 0\<close> by fastforce
       have "dist (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x) (f x) < e" if "N1 + N2 \<le> n" for n
       proof -
         let ?m = "real_of_int \<lfloor>2^n * f x\<rfloor>"
         have "\<bar>?m\<bar> \<le> 2^n * 2^N1"
           using N1 apply (simp add: f)
           by (meson floor_mono le_floor_iff less_le_not_le mult_le_cancel_left_pos zero_less_numeral zero_less_power)
         also have "\<dots> \<le> 2 ^ (2*n)"
           by (metis that add_leD1 add_le_cancel_left mult.commute mult_2_right one_less_numeral_iff
                     power_add power_increasing_iff semiring_norm(76))
         finally have m_le: "\<bar>?m\<bar> \<le> 2 ^ (2*n)" .
         have "?m/2^n \<le> f x" "f x < (?m + 1)/2^n"
           by (auto simp: mult.commute pos_divide_le_eq mult_imp_less_div_pos)
         then have eq: "dist (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k/2^n * ?\<Omega> n k x) (f x)
                      = dist (?m/2^n) (f x)"
           by (subst indicator_sum_eq [of ?m]) (auto simp: m_le)
         have "\<bar>2^n\<bar> * \<bar>?m/2^n - f x\<bar> = \<bar>2^n * (?m/2^n - f x)\<bar>"
           by (simp add: abs_mult)
         also have "\<dots> < 2 ^ N2 * e"
           using N2 by (simp add: divide_simps mult.commute) linarith
         also have "\<dots> \<le> \<bar>2^n\<bar> * e"
           using that \<open>e > 0\<close> by auto
         finally have "dist (?m/2^n) (f x) < e"
           by (simp add: dist_norm)
         then show ?thesis
           using eq by linarith
       qed
       then show "\<exists>no. \<forall>n\<ge>no. dist (\<Sum>k | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n). k * ?\<Omega> n k x/2^n) (f x) < e"
         by force
     qed
   qed
   ultimately show ?rhs
     by metis
 next
   assume RHS: ?rhs
   with borel_measurable_simple_function_limit [of f UNIV, unfolded lebesgue_on_UNIV_eq]
   show ?lhs
     by (blast intro: order_trans)
 qed
 
 subsection\<open>Borel measurable Jacobian determinant\<close>
 
 lemma lemma_partial_derivatives0:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "linear f" and lim0: "((\<lambda>x. f x /\<^sub>R norm x) \<longlongrightarrow> 0) (at 0 within S)"
     and lb: "\<And>v. v \<noteq> 0 \<Longrightarrow> (\<exists>k>0. \<forall>e>0. \<exists>x. x \<in> S - {0} \<and> norm x < e \<and> k * norm x \<le> \<bar>v \<bullet> x\<bar>)"
   shows "f x = 0"
 proof -
   interpret linear f by fact
   have "dim {x. f x = 0} \<le> DIM('a)"
     by (rule dim_subset_UNIV)
   moreover have False if less: "dim {x. f x = 0} < DIM('a)"
   proof -
     obtain d where "d \<noteq> 0" and d: "\<And>y. f y = 0 \<Longrightarrow> d \<bullet> y = 0"
       using orthogonal_to_subspace_exists [OF less] orthogonal_def
       by (metis (mono_tags, lifting) mem_Collect_eq span_base)
     then obtain k where "k > 0"
       and k: "\<And>e. e > 0 \<Longrightarrow> \<exists>y. y \<in> S - {0} \<and> norm y < e \<and> k * norm y \<le> \<bar>d \<bullet> y\<bar>"
       using lb by blast
     have "\<exists>h. \<forall>n. ((h n \<in> S \<and> h n \<noteq> 0 \<and> k * norm (h n) \<le> \<bar>d \<bullet> h n\<bar>) \<and> norm (h n) < 1 / real (Suc n)) \<and>
                norm (h (Suc n)) < norm (h n)"
     proof (rule dependent_nat_choice)
       show "\<exists>y. (y \<in> S \<and> y \<noteq> 0 \<and> k * norm y \<le> \<bar>d \<bullet> y\<bar>) \<and> norm y < 1 / real (Suc 0)"
         by simp (metis DiffE insertCI k not_less not_one_le_zero)
     qed (use k [of "min (norm x) (1/(Suc n + 1))" for x n] in auto)
     then obtain \<alpha> where \<alpha>: "\<And>n. \<alpha> n \<in> S - {0}" and kd: "\<And>n. k * norm(\<alpha> n) \<le> \<bar>d \<bullet> \<alpha> n\<bar>"
          and norm_lt: "\<And>n. norm(\<alpha> n) < 1/(Suc n)"
       by force
     let ?\<beta> = "\<lambda>n. \<alpha> n /\<^sub>R norm (\<alpha> n)"
     have com: "\<And>g. (\<forall>n. g n \<in> sphere (0::'a) 1)
               \<Longrightarrow> \<exists>l \<in> sphere 0 1. \<exists>\<rho>::nat\<Rightarrow>nat. strict_mono \<rho> \<and> (g \<circ> \<rho>) \<longlonglongrightarrow> l"
       using compact_sphere compact_def by metis
     moreover have "\<forall>n. ?\<beta> n \<in> sphere 0 1"
       using \<alpha> by auto
     ultimately obtain l::'a and \<rho>::"nat\<Rightarrow>nat"
        where l: "l \<in> sphere 0 1" and "strict_mono \<rho>" and to_l: "(?\<beta> \<circ> \<rho>) \<longlonglongrightarrow> l"
       by meson
     moreover have "continuous (at l) (\<lambda>x. (\<bar>d \<bullet> x\<bar> - k))"
       by (intro continuous_intros)
     ultimately have lim_dl: "((\<lambda>x. (\<bar>d \<bullet> x\<bar> - k)) \<circ> (?\<beta> \<circ> \<rho>)) \<longlonglongrightarrow> (\<bar>d \<bullet> l\<bar> - k)"
       by (meson continuous_imp_tendsto)
     have "\<forall>\<^sub>F i in sequentially. 0 \<le> ((\<lambda>x. \<bar>d \<bullet> x\<bar> - k) \<circ> ((\<lambda>n. \<alpha> n /\<^sub>R norm (\<alpha> n)) \<circ> \<rho>)) i"
       using \<alpha> kd by (auto simp: field_split_simps)
     then have "k \<le> \<bar>d \<bullet> l\<bar>"
       using tendsto_lowerbound [OF lim_dl, of 0] by auto
     moreover have "d \<bullet> l = 0"
     proof (rule d)
       show "f l = 0"
       proof (rule LIMSEQ_unique [of "f \<circ> ?\<beta> \<circ> \<rho>"])
         have "isCont f l"
           using \<open>linear f\<close> linear_continuous_at linear_conv_bounded_linear by blast
         then show "(f \<circ> (\<lambda>n. \<alpha> n /\<^sub>R norm (\<alpha> n)) \<circ> \<rho>) \<longlonglongrightarrow> f l"
           unfolding comp_assoc
           using to_l continuous_imp_tendsto by blast
         have "\<alpha> \<longlonglongrightarrow> 0"
           using norm_lt LIMSEQ_norm_0 by metis
         with \<open>strict_mono \<rho>\<close> have "(\<alpha> \<circ> \<rho>) \<longlonglongrightarrow> 0"
           by (metis LIMSEQ_subseq_LIMSEQ)
         with lim0 \<alpha> have "((\<lambda>x. f x /\<^sub>R norm x) \<circ> (\<alpha> \<circ> \<rho>)) \<longlonglongrightarrow> 0"
           by (force simp: tendsto_at_iff_sequentially)
         then show "(f \<circ> (\<lambda>n. \<alpha> n /\<^sub>R norm (\<alpha> n)) \<circ> \<rho>) \<longlonglongrightarrow> 0"
           by (simp add: o_def scale)
       qed
     qed
     ultimately show False
       using \<open>k > 0\<close> by auto
   qed
   ultimately have dim: "dim {x. f x = 0} = DIM('a)"
     by force
   then show ?thesis
     using dim_eq_full
     by (metis (mono_tags, lifting) eq_0_on_span eucl.span_Basis linear_axioms linear_eq_stdbasis
         mem_Collect_eq module_hom_zero span_base span_raw_def)
 qed
 
 lemma lemma_partial_derivatives:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "linear f" and lim: "((\<lambda>x. f (x - a) /\<^sub>R norm (x - a)) \<longlongrightarrow> 0) (at a within S)"
     and lb: "\<And>v. v \<noteq> 0 \<Longrightarrow> (\<exists>k>0.  \<forall>e>0. \<exists>x \<in> S - {a}. norm(a - x) < e \<and> k * norm(a - x) \<le> \<bar>v \<bullet> (x - a)\<bar>)"
   shows "f x = 0"
 proof -
   have "((\<lambda>x. f x /\<^sub>R norm x) \<longlongrightarrow> 0) (at 0 within (\<lambda>x. x-a) ` S)"
     using lim by (simp add: Lim_within dist_norm)
   then show ?thesis
   proof (rule lemma_partial_derivatives0 [OF \<open>linear f\<close>])
     fix v :: "'a"
     assume v: "v \<noteq> 0"
     show "\<exists>k>0. \<forall>e>0. \<exists>x. x \<in> (\<lambda>x. x - a) ` S - {0} \<and> norm x < e \<and> k * norm x \<le> \<bar>v \<bullet> x\<bar>"
       using lb [OF v] by (force simp:  norm_minus_commute)
   qed
 qed
 
 
 proposition borel_measurable_partial_derivatives:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n"
   assumes S: "S \<in> sets lebesgue"
     and f: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   shows "(\<lambda>x. (matrix(f' x)$m$n)) \<in> borel_measurable (lebesgue_on S)"
 proof -
   have contf: "continuous_on S f"
     using continuous_on_eq_continuous_within f has_derivative_continuous by blast
   have "{x \<in> S.  (matrix (f' x)$m$n) \<le> b} \<in> sets lebesgue" for b
   proof (rule sets_negligible_symdiff)
     let ?T = "{x \<in> S. \<forall>e>0. \<exists>d>0. \<exists>A. A$m$n < b \<and> (\<forall>i j. A$i$j \<in> \<rat>) \<and>
                        (\<forall>y \<in> S. norm(y - x) < d \<longrightarrow> norm(f y - f x - A *v (y - x)) \<le> e * norm(y - x))}"
     let ?U = "S \<inter>
               (\<Inter>e \<in> {e \<in> \<rat>. e > 0}.
                 \<Union>A \<in> {A. A$m$n < b \<and> (\<forall>i j. A$i$j \<in> \<rat>)}.
                   \<Union>d \<in> {d \<in> \<rat>. 0 < d}.
                      S \<inter> (\<Inter>y \<in> S. {x \<in> S. norm(y - x) < d \<longrightarrow> norm(f y - f x - A *v (y - x)) \<le> e * norm(y - x)}))"
     have "?T = ?U"
     proof (intro set_eqI iffI)
       fix x
       assume xT: "x \<in> ?T"
       then show "x \<in> ?U"
       proof (clarsimp simp add:)
         fix q :: real
         assume "q \<in> \<rat>" "q > 0"
         then obtain d A where "d > 0" and A: "A $ m $ n < b" "\<And>i j. A $ i $ j \<in> \<rat>"
           "\<And>y. \<lbrakk>y\<in>S;  norm (y - x) < d\<rbrakk> \<Longrightarrow> norm (f y - f x - A *v (y - x)) \<le> q * norm (y - x)"
           using xT by auto
         then obtain \<delta> where "d > \<delta>" "\<delta> > 0" "\<delta> \<in> \<rat>"
           using Rats_dense_in_real by blast
         with A show "\<exists>A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>) \<and>
                          (\<exists>s. s \<in> \<rat> \<and> 0 < s \<and> (\<forall>y\<in>S. norm (y - x) < s \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> q * norm (y - x)))"
           by force
       qed
     next
       fix x
       assume xU: "x \<in> ?U"
       then show "x \<in> ?T"
       proof clarsimp
         fix e :: "real"
         assume "e > 0"
         then obtain \<epsilon> where \<epsilon>: "e > \<epsilon>" "\<epsilon> > 0" "\<epsilon> \<in> \<rat>"
           using Rats_dense_in_real by blast
         with xU obtain A r where "x \<in> S" and Ar: "A $ m $ n < b" "\<forall>i j. A $ i $ j \<in> \<rat>" "r \<in> \<rat>" "r > 0"
           and "\<forall>y\<in>S. norm (y - x) < r \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> \<epsilon> * norm (y - x)"
           by (auto simp: split: if_split_asm)
         then have "\<forall>y\<in>S. norm (y - x) < r \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x)"
           by (meson \<open>e > \<epsilon>\<close> less_eq_real_def mult_right_mono norm_ge_zero order_trans)
         then show "\<exists>d>0. \<exists>A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>) \<and> (\<forall>y\<in>S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x))"
           using \<open>x \<in> S\<close> Ar by blast
       qed
     qed
     moreover have "?U \<in> sets lebesgue"
     proof -
       have coQ: "countable {e \<in> \<rat>. 0 < e}"
         using countable_Collect countable_rat by blast
       have ne: "{e \<in> \<rat>. (0::real) < e} \<noteq> {}"
         using zero_less_one Rats_1 by blast
       have coA: "countable {A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>)}"
       proof (rule countable_subset)
         show "countable {A. \<forall>i j. A $ i $ j \<in> \<rat>}"
           using countable_vector [OF countable_vector, of "\<lambda>i j. \<rat>"] by (simp add: countable_rat)
       qed blast
       have *: "\<lbrakk>U \<noteq> {} \<Longrightarrow> closedin (top_of_set S) (S \<inter> \<Inter> U)\<rbrakk>
                \<Longrightarrow> closedin (top_of_set S) (S \<inter> \<Inter> U)" for U
         by fastforce
       have eq: "{x::(real,'m)vec. P x \<and> (Q x \<longrightarrow> R x)} = {x. P x \<and> \<not> Q x} \<union> {x. P x \<and> R x}" for P Q R
         by auto
       have sets: "S \<inter> (\<Inter>y\<in>S. {x \<in> S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x)})
                   \<in> sets lebesgue" for e A d
       proof -
         have clo: "closedin (top_of_set S)
                      {x \<in> S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x)}"
           for y
         proof -
           have cont1: "continuous_on S (\<lambda>x. norm (y - x))"
           and  cont2: "continuous_on S (\<lambda>x. e * norm (y - x) - norm (f y - f x - (A *v y - A *v x)))"
             by (force intro: contf continuous_intros)+
           have clo1: "closedin (top_of_set S) {x \<in> S. d \<le> norm (y - x)}"
             using continuous_closedin_preimage [OF cont1, of "{d..}"] by (simp add: vimage_def Int_def)
           have clo2: "closedin (top_of_set S)
                        {x \<in> S. norm (f y - f x - (A *v y - A *v x)) \<le> e * norm (y - x)}"
             using continuous_closedin_preimage [OF cont2, of "{0..}"] by (simp add: vimage_def Int_def)
           show ?thesis
             by (auto simp: eq not_less matrix_vector_mult_diff_distrib intro: clo1 clo2)
         qed
         show ?thesis
           by (rule lebesgue_closedin [of S]) (force intro: * S clo)+
       qed
       show ?thesis
         by (intro sets sets.Int S sets.countable_UN'' sets.countable_INT'' coQ coA) auto
     qed
     ultimately show "?T \<in> sets lebesgue"
       by simp
     let ?M = "(?T - {x \<in> S. matrix (f' x) $ m $ n \<le> b} \<union> ({x \<in> S. matrix (f' x) $ m $ n \<le> b} - ?T))"
     let ?\<Theta> = "\<lambda>x v. \<forall>\<xi>>0. \<exists>e>0. \<forall>y \<in> S-{x}. norm (x - y) < e \<longrightarrow> \<bar>v \<bullet> (y - x)\<bar> < \<xi> * norm (x - y)"
     have nN: "negligible {x \<in> S. \<exists>v\<noteq>0. ?\<Theta> x v}"
       unfolding negligible_eq_zero_density
     proof clarsimp
       fix x v and r e :: "real"
       assume "x \<in> S" "v \<noteq> 0" "r > 0" "e > 0"
       and Theta [rule_format]: "?\<Theta> x v"
       moreover have "(norm v * e / 2) / CARD('m) ^ CARD('m) > 0"
         by (simp add: \<open>v \<noteq> 0\<close> \<open>e > 0\<close>)
       ultimately obtain d where "d > 0"
          and dless: "\<And>y. \<lbrakk>y \<in> S - {x}; norm (x - y) < d\<rbrakk> \<Longrightarrow>
                         \<bar>v \<bullet> (y - x)\<bar> < ((norm v * e / 2) / CARD('m) ^ CARD('m)) * norm (x - y)"
         by metis
       let ?W = "ball x (min d r) \<inter> {y. \<bar>v \<bullet> (y - x)\<bar> < (norm v * e/2 * min d r) / CARD('m) ^ CARD('m)}"
       have "open {x. \<bar>v \<bullet> (x - a)\<bar> < b}" for a b
         by (intro open_Collect_less continuous_intros)
       show "\<exists>d>0. d \<le> r \<and>
             (\<exists>U. {x' \<in> S. \<exists>v\<noteq>0. ?\<Theta> x' v} \<inter> ball x d \<subseteq> U \<and>
                  U \<in> lmeasurable \<and> measure lebesgue U < e * content (ball x d))"
       proof (intro exI conjI)
         show "0 < min d r" "min d r \<le> r"
           using \<open>r > 0\<close> \<open>d > 0\<close> by auto
         show "{x' \<in> S. \<exists>v. v \<noteq> 0 \<and> (\<forall>\<xi>>0. \<exists>e>0. \<forall>z\<in>S - {x'}. norm (x' - z) < e \<longrightarrow> \<bar>v \<bullet> (z - x')\<bar> < \<xi> * norm (x' - z))} \<inter> ball x (min d r) \<subseteq> ?W"
           proof (clarsimp simp: dist_norm norm_minus_commute)
             fix y w
             assume "y \<in> S" "w \<noteq> 0"
               and less [rule_format]:
                     "\<forall>\<xi>>0. \<exists>e>0. \<forall>z\<in>S - {y}. norm (y - z) < e \<longrightarrow> \<bar>w \<bullet> (z - y)\<bar> < \<xi> * norm (y - z)"
               and d: "norm (y - x) < d" and r: "norm (y - x) < r"
             show "\<bar>v \<bullet> (y - x)\<bar> < norm v * e * min d r / (2 * real CARD('m) ^ CARD('m))"
             proof (cases "y = x")
               case True
               with \<open>r > 0\<close> \<open>d > 0\<close> \<open>e > 0\<close> \<open>v \<noteq> 0\<close> show ?thesis
                 by simp
             next
               case False
               have "\<bar>v \<bullet> (y - x)\<bar> < norm v * e / 2 / real (CARD('m) ^ CARD('m)) * norm (x - y)"
                 apply (rule dless)
                 using False \<open>y \<in> S\<close> d by (auto simp: norm_minus_commute)
               also have "\<dots> \<le> norm v * e * min d r / (2 * real CARD('m) ^ CARD('m))"
                 using d r \<open>e > 0\<close> by (simp add: field_simps norm_minus_commute mult_left_mono)
               finally show ?thesis .
             qed
           qed
           show "?W \<in> lmeasurable"
             by (simp add: fmeasurable_Int_fmeasurable borel_open)
           obtain k::'m where True
             by metis
           obtain T where T: "orthogonal_transformation T" and v: "v = T(norm v *\<^sub>R axis k (1::real))"
             using rotation_rightward_line by metis
           define b where "b \<equiv> norm v"
           have "b > 0"
             using \<open>v \<noteq> 0\<close> by (auto simp: b_def)
           obtain eqb: "inv T v = b *\<^sub>R axis k (1::real)" and "inj T" "bij T" and invT: "orthogonal_transformation (inv T)"
             by (metis UNIV_I b_def  T v bij_betw_inv_into_left orthogonal_transformation_inj orthogonal_transformation_bij orthogonal_transformation_inv)
           let ?v = "\<chi> i. min d r / CARD('m)"
           let ?v' = "\<chi> i. if i = k then (e/2 * min d r) / CARD('m) ^ CARD('m) else min d r"
           let ?x' = "inv T x"
           let ?W' = "(ball ?x' (min d r) \<inter> {y. \<bar>(y - ?x')$k\<bar> < e * min d r / (2 * CARD('m) ^ CARD('m))})"
           have abs: "x - e \<le> y \<and> y \<le> x + e \<longleftrightarrow> abs(y - x) \<le> e" for x y e::real
             by auto
           have "?W = T ` ?W'"
           proof -
             have 1: "T ` (ball (inv T x) (min d r)) = ball x (min d r)"
               by (simp add: T image_orthogonal_transformation_ball orthogonal_transformation_surj surj_f_inv_f)
             have 2: "{y. \<bar>v \<bullet> (y - x)\<bar> < b * e * min d r / (2 * real CARD('m) ^ CARD('m))} =
                       T ` {y. \<bar>y $ k - ?x' $ k\<bar> < e * min d r / (2 * real CARD('m) ^ CARD('m))}"
             proof -
               have *: "\<bar>T (b *\<^sub>R axis k 1) \<bullet> (y - x)\<bar> = b * \<bar>inv T y $ k - ?x' $ k\<bar>" for y
               proof -
                 have "\<bar>T (b *\<^sub>R axis k 1) \<bullet> (y - x)\<bar> = \<bar>(b *\<^sub>R axis k 1) \<bullet> inv T (y - x)\<bar>"
                   by (metis (no_types, hide_lams) b_def eqb invT orthogonal_transformation_def v)
                 also have "\<dots> = b * \<bar>(axis k 1) \<bullet> inv T (y - x)\<bar>"
                   using \<open>b > 0\<close> by (simp add: abs_mult)
                 also have "\<dots> = b * \<bar>inv T y $ k - ?x' $ k\<bar>"
                   using orthogonal_transformation_linear [OF invT]
                   by (simp add: inner_axis' linear_diff)
                 finally show ?thesis
                   by simp
               qed
               show ?thesis
                 using v b_def [symmetric]
                 using \<open>b > 0\<close> by (simp add: * bij_image_Collect_eq [OF \<open>bij T\<close>] mult_less_cancel_left_pos times_divide_eq_right [symmetric] del: times_divide_eq_right)
             qed
             show ?thesis
               using \<open>b > 0\<close> by (simp add: image_Int \<open>inj T\<close> 1 2 b_def [symmetric])
           qed
           moreover have "?W' \<in> lmeasurable"
             by (auto intro: fmeasurable_Int_fmeasurable)
           ultimately have "measure lebesgue ?W = measure lebesgue ?W'"
             by (metis measure_orthogonal_image T)
           also have "\<dots> \<le> measure lebesgue (cbox (?x' - ?v') (?x' + ?v'))"
           proof (rule measure_mono_fmeasurable)
             show "?W' \<subseteq> cbox (?x' - ?v') (?x' + ?v')"
               apply (clarsimp simp add: mem_box_cart abs dist_norm norm_minus_commute simp del: min_less_iff_conj min.bounded_iff)
               by (metis component_le_norm_cart less_eq_real_def le_less_trans vector_minus_component)
           qed auto
           also have "\<dots> \<le> e/2 * measure lebesgue (cbox (?x' - ?v) (?x' + ?v))"
           proof -
             have "cbox (?x' - ?v) (?x' + ?v) \<noteq> {}"
               using \<open>r > 0\<close> \<open>d > 0\<close> by (auto simp: interval_eq_empty_cart divide_less_0_iff)
             with \<open>r > 0\<close> \<open>d > 0\<close> \<open>e > 0\<close> show ?thesis
               apply (simp add: content_cbox_if_cart mem_box_cart)
               apply (auto simp: prod_nonneg)
               apply (simp add: abs if_distrib prod.delta_remove field_simps power_diff split: if_split_asm)
               done
           qed
           also have "\<dots> \<le> e/2 * measure lebesgue (cball ?x' (min d r))"
           proof (rule mult_left_mono [OF measure_mono_fmeasurable])
             have *: "norm (?x' - y) \<le> min d r"
               if y: "\<And>i. \<bar>?x' $ i - y $ i\<bar> \<le> min d r / real CARD('m)" for y
             proof -
               have "norm (?x' - y) \<le> (\<Sum>i\<in>UNIV. \<bar>(?x' - y) $ i\<bar>)"
                 by (rule norm_le_l1_cart)
               also have "\<dots> \<le> real CARD('m) * (min d r / real CARD('m))"
                 by (rule sum_bounded_above) (use y in auto)
               finally show ?thesis
                 by simp
             qed
             show "cbox (?x' - ?v) (?x' + ?v) \<subseteq> cball ?x' (min d r)"
               apply (clarsimp simp only: mem_box_cart dist_norm mem_cball intro!: *)
               by (simp add: abs_diff_le_iff abs_minus_commute)
           qed (use \<open>e > 0\<close> in auto)
           also have "\<dots> < e * content (cball ?x' (min d r))"
-            using \<open>r > 0\<close> \<open>d > 0\<close> \<open>e > 0\<close> by auto
+            using \<open>r > 0\<close> \<open>d > 0\<close> \<open>e > 0\<close> by (auto intro: content_cball_pos)
           also have "\<dots> = e * content (ball x (min d r))"
-            using \<open>r > 0\<close> \<open>d > 0\<close> by (simp add: content_cball content_ball)
+            using \<open>r > 0\<close> \<open>d > 0\<close> content_ball_conv_unit_ball[of "min d r" "inv T x"]
+                  content_ball_conv_unit_ball[of "min d r" x]
+            by (simp add: content_cball_conv_ball)
           finally show "measure lebesgue ?W < e * content (ball x (min d r))" .
       qed
     qed
     have *: "(\<And>x. (x \<notin> S) \<Longrightarrow> (x \<in> T \<longleftrightarrow> x \<in> U)) \<Longrightarrow> (T - U) \<union> (U - T) \<subseteq> S" for S T U :: "(real,'m) vec set"
       by blast
     have MN: "?M \<subseteq> {x \<in> S. \<exists>v\<noteq>0. ?\<Theta> x v}"
     proof (rule *)
       fix x
       assume x: "x \<notin> {x \<in> S. \<exists>v\<noteq>0. ?\<Theta> x v}"
       show "(x \<in> ?T) \<longleftrightarrow> (x \<in> {x \<in> S. matrix (f' x) $ m $ n \<le> b})"
       proof (cases "x \<in> S")
         case True
         then have x: "\<not> ?\<Theta> x v" if "v \<noteq> 0" for v
           using x that by force
         show ?thesis
         proof (rule iffI; clarsimp)
           assume b: "\<forall>e>0. \<exists>d>0. \<exists>A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>) \<and>
                                     (\<forall>y\<in>S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x))"
                      (is "\<forall>e>0. \<exists>d>0. \<exists>A. ?\<Phi> e d A")
           then have "\<forall>k. \<exists>d>0. \<exists>A. ?\<Phi> (1 / Suc k) d A"
             by (metis (no_types, hide_lams) less_Suc_eq_0_disj of_nat_0_less_iff zero_less_divide_1_iff)
           then obtain \<delta> A where \<delta>: "\<And>k. \<delta> k > 0"
                            and Ab: "\<And>k. A k $ m $ n < b"
                            and A: "\<And>k y. \<lbrakk>y \<in> S; norm (y - x) < \<delta> k\<rbrakk> \<Longrightarrow>
                                           norm (f y - f x - A k *v (y - x)) \<le> 1/(Suc k) * norm (y - x)"
             by metis
           have "\<forall>i j. \<exists>a. (\<lambda>n. A n $ i $ j) \<longlonglongrightarrow> a"
           proof (intro allI)
             fix i j
             have vax: "(A n *v axis j 1) $ i = A n $ i $ j" for n
               by (metis cart_eq_inner_axis matrix_vector_mul_component)
             let ?CA = "{x. Cauchy (\<lambda>n. (A n) *v x)}"
             have "subspace ?CA"
               unfolding subspace_def convergent_eq_Cauchy [symmetric]
                 by (force simp: algebra_simps intro: tendsto_intros)
             then have CA_eq: "?CA = span ?CA"
               by (metis span_eq_iff)
             also have "\<dots> = UNIV"
             proof -
               have "dim ?CA \<le> CARD('m)"
                 using dim_subset_UNIV[of ?CA]
                 by auto
               moreover have "False" if less: "dim ?CA < CARD('m)"
               proof -
                 obtain d where "d \<noteq> 0" and d: "\<And>y. y \<in> span ?CA \<Longrightarrow> orthogonal d y"
                   using less by (force intro: orthogonal_to_subspace_exists [of ?CA])
                 with x [OF \<open>d \<noteq> 0\<close>] obtain \<xi> where "\<xi> > 0"
                   and \<xi>: "\<And>e. e > 0 \<Longrightarrow> \<exists>y \<in> S - {x}. norm (x - y) < e \<and> \<xi> * norm (x - y) \<le> \<bar>d \<bullet> (y - x)\<bar>"
                   by (fastforce simp: not_le Bex_def)
                 obtain \<gamma> z where \<gamma>Sx: "\<And>i. \<gamma> i \<in> S - {x}"
                            and \<gamma>le:   "\<And>i. \<xi> * norm(\<gamma> i - x) \<le> \<bar>d \<bullet> (\<gamma> i - x)\<bar>"
                            and \<gamma>x:    "\<gamma> \<longlonglongrightarrow> x"
                            and z:     "(\<lambda>n. (\<gamma> n - x) /\<^sub>R norm (\<gamma> n - x)) \<longlonglongrightarrow> z"
                 proof -
                   have "\<exists>\<gamma>. (\<forall>i. (\<gamma> i \<in> S - {x} \<and>
                                   \<xi> * norm(\<gamma> i - x) \<le> \<bar>d \<bullet> (\<gamma> i - x)\<bar> \<and> norm(\<gamma> i - x) < 1/Suc i) \<and>
                                  norm(\<gamma>(Suc i) - x) < norm(\<gamma> i - x))"
                   proof (rule dependent_nat_choice)
                     show "\<exists>y. y \<in> S - {x} \<and> \<xi> * norm (y - x) \<le> \<bar>d \<bullet> (y - x)\<bar> \<and> norm (y - x) < 1 / Suc 0"
                       using \<xi> [of 1] by (auto simp: dist_norm norm_minus_commute)
                   next
                     fix y i
                     assume "y \<in> S - {x} \<and> \<xi> * norm (y - x) \<le> \<bar>d \<bullet> (y - x)\<bar> \<and> norm (y - x) < 1/Suc i"
                     then have "min (norm(y - x)) (1/((Suc i) + 1)) > 0"
                       by auto
                     then obtain y' where "y' \<in> S - {x}" and y': "norm (x - y') < min (norm (y - x)) (1/((Suc i) + 1))"
                                          "\<xi> * norm (x - y') \<le> \<bar>d \<bullet> (y' - x)\<bar>"
                       using \<xi> by metis
                     with \<xi> show "\<exists>y'. (y' \<in> S - {x} \<and> \<xi> * norm (y' - x) \<le> \<bar>d \<bullet> (y' - x)\<bar> \<and>
                               norm (y' - x) < 1/(Suc (Suc i))) \<and> norm (y' - x) < norm (y - x)"
                       by (auto simp: dist_norm norm_minus_commute)
                   qed
                   then obtain \<gamma> where
                         \<gamma>Sx: "\<And>i. \<gamma> i \<in> S - {x}"
                         and \<gamma>le: "\<And>i. \<xi> * norm(\<gamma> i - x) \<le> \<bar>d \<bullet> (\<gamma> i - x)\<bar>"
                         and \<gamma>conv: "\<And>i. norm(\<gamma> i - x) < 1/(Suc i)"
                     by blast
                   let ?f = "\<lambda>i. (\<gamma> i - x) /\<^sub>R norm (\<gamma> i - x)"
                   have "?f i \<in> sphere 0 1" for i
                     using \<gamma>Sx by auto
                   then obtain l \<rho> where "l \<in> sphere 0 1" "strict_mono \<rho>" and l: "(?f \<circ> \<rho>) \<longlonglongrightarrow> l"
                     using compact_sphere [of "0::(real,'m) vec" 1]  unfolding compact_def by meson
                   show thesis
                   proof
                     show "(\<gamma> \<circ> \<rho>) i \<in> S - {x}" "\<xi> * norm ((\<gamma> \<circ> \<rho>) i - x) \<le> \<bar>d \<bullet> ((\<gamma> \<circ> \<rho>) i - x)\<bar>" for i
                       using \<gamma>Sx \<gamma>le by auto
                     have "\<gamma> \<longlonglongrightarrow> x"
                     proof (clarsimp simp add: LIMSEQ_def dist_norm)
                       fix r :: "real"
                       assume "r > 0"
                       with real_arch_invD obtain no where "no \<noteq> 0" "real no > 1/r"
                         by (metis divide_less_0_1_iff not_less_iff_gr_or_eq of_nat_0_eq_iff reals_Archimedean2)
                       with \<gamma>conv show "\<exists>no. \<forall>n\<ge>no. norm (\<gamma> n - x) < r"
                         by (metis \<open>r > 0\<close> add.commute divide_inverse inverse_inverse_eq inverse_less_imp_less less_trans mult.left_neutral nat_le_real_less of_nat_Suc)
                     qed
                     with \<open>strict_mono \<rho>\<close> show "(\<gamma> \<circ> \<rho>) \<longlonglongrightarrow> x"
                       by (metis LIMSEQ_subseq_LIMSEQ)
                     show "(\<lambda>n. ((\<gamma> \<circ> \<rho>) n - x) /\<^sub>R norm ((\<gamma> \<circ> \<rho>) n - x)) \<longlonglongrightarrow> l"
                       using l by (auto simp: o_def)
                   qed
                 qed
                 have "isCont (\<lambda>x. (\<bar>d \<bullet> x\<bar> - \<xi>)) z"
                   by (intro continuous_intros)
                 from isCont_tendsto_compose [OF this z]
                 have lim: "(\<lambda>y. \<bar>d \<bullet> ((\<gamma> y - x) /\<^sub>R norm (\<gamma> y - x))\<bar> - \<xi>) \<longlonglongrightarrow> \<bar>d \<bullet> z\<bar> - \<xi>"
                   by auto
                 moreover have "\<forall>\<^sub>F i in sequentially. 0 \<le> \<bar>d \<bullet> ((\<gamma> i - x) /\<^sub>R norm (\<gamma> i - x))\<bar> - \<xi>"
                 proof (rule eventuallyI)
                   fix n
                   show "0 \<le> \<bar>d \<bullet> ((\<gamma> n - x) /\<^sub>R norm (\<gamma> n - x))\<bar> - \<xi>"
                   using \<gamma>le [of n] \<gamma>Sx by (auto simp: abs_mult divide_simps)
                 qed
                 ultimately have "\<xi> \<le> \<bar>d \<bullet> z\<bar>"
                   using tendsto_lowerbound [where a=0] by fastforce
                 have "Cauchy (\<lambda>n. (A n) *v z)"
                 proof (clarsimp simp add: Cauchy_def)
                   fix \<epsilon> :: "real"
                   assume "0 < \<epsilon>"
                   then obtain N::nat where "N > 0" and N: "\<epsilon>/2 > 1/N"
                     by (metis half_gt_zero inverse_eq_divide neq0_conv real_arch_inverse)
                   show "\<exists>M. \<forall>m\<ge>M. \<forall>n\<ge>M. dist (A m *v z) (A n *v z) < \<epsilon>"
                   proof (intro exI allI impI)
                     fix i j
                     assume ij: "N \<le> i" "N \<le> j"
                     let ?V = "\<lambda>i k. A i *v ((\<gamma> k - x) /\<^sub>R norm (\<gamma> k - x))"
                     have "\<forall>\<^sub>F k in sequentially. dist (\<gamma> k) x < min (\<delta> i) (\<delta> j)"
                       using \<gamma>x [unfolded tendsto_iff] by (meson min_less_iff_conj \<delta>)
                     then have even: "\<forall>\<^sub>F k in sequentially. norm (?V i k - ?V j k) - 2 / N \<le> 0"
                     proof (rule eventually_mono, clarsimp)
                       fix p
                       assume p: "dist (\<gamma> p) x < \<delta> i" "dist (\<gamma> p) x < \<delta> j"
                       let ?C = "\<lambda>k. f (\<gamma> p) - f x - A k *v (\<gamma> p - x)"
                       have "norm ((A i - A j) *v (\<gamma> p - x)) = norm (?C j - ?C i)"
                         by (simp add: algebra_simps)
                       also have "\<dots> \<le> norm (?C j) + norm (?C i)"
                         using norm_triangle_ineq4 by blast
                       also have "\<dots> \<le> 1/(Suc j) * norm (\<gamma> p - x) + 1/(Suc i) * norm (\<gamma> p - x)"
                         by (metis A Diff_iff \<gamma>Sx dist_norm p add_mono)
                       also have "\<dots> \<le> 1/N * norm (\<gamma> p - x) + 1/N * norm (\<gamma> p - x)"
                         apply (intro add_mono mult_right_mono)
                         using ij \<open>N > 0\<close> by (auto simp: field_simps)
                       also have "\<dots> = 2 / N * norm (\<gamma> p - x)"
                         by simp
                       finally have no_le: "norm ((A i - A j) *v (\<gamma> p - x)) \<le> 2 / N * norm (\<gamma> p - x)" .
                       have "norm (?V i p - ?V j p) =
                             norm ((A i - A j) *v ((\<gamma> p - x) /\<^sub>R norm (\<gamma> p - x)))"
                         by (simp add: algebra_simps)
                       also have "\<dots> = norm ((A i - A j) *v (\<gamma> p - x)) / norm (\<gamma> p - x)"
                         by (simp add: divide_inverse matrix_vector_mult_scaleR)
                       also have "\<dots> \<le> 2 / N"
                         using no_le by (auto simp: field_split_simps)
                       finally show "norm (?V i p - ?V j p) \<le> 2 / N" .
                     qed
                     have "isCont (\<lambda>w. (norm(A i *v w - A j *v w) - 2 / N)) z"
                       by (intro continuous_intros)
                     from isCont_tendsto_compose [OF this z]
                     have lim: "(\<lambda>w. norm (A i *v ((\<gamma> w - x) /\<^sub>R norm (\<gamma> w - x)) -
                                     A j *v ((\<gamma> w - x) /\<^sub>R norm (\<gamma> w - x))) - 2 / N)
                                \<longlonglongrightarrow> norm (A i *v z - A j *v z) - 2 / N"
                       by auto
                     have "dist (A i *v z) (A j *v z) \<le> 2 / N"
                       using tendsto_upperbound [OF lim even] by (auto simp: dist_norm)
                     with N show "dist (A i *v z) (A j *v z) < \<epsilon>"
                       by linarith
                   qed
                 qed
                 then have "d \<bullet> z = 0"
                   using CA_eq d orthogonal_def by auto
                 then show False
                   using \<open>0 < \<xi>\<close> \<open>\<xi> \<le> \<bar>d \<bullet> z\<bar>\<close> by auto
               qed
               ultimately show ?thesis
                 using dim_eq_full by fastforce
             qed
             finally have "?CA = UNIV" .
             then have "Cauchy (\<lambda>n. (A n) *v axis j 1)"
               by auto
             then obtain L where "(\<lambda>n. A n *v axis j 1) \<longlonglongrightarrow> L"
               by (auto simp: Cauchy_convergent_iff convergent_def)
             then have "(\<lambda>x. (A x *v axis j 1) $ i) \<longlonglongrightarrow> L $ i"
               by (rule tendsto_vec_nth)
             then show "\<exists>a. (\<lambda>n. A n $ i $ j) \<longlonglongrightarrow> a"
               by (force simp: vax)
           qed
           then obtain B where B: "\<And>i j. (\<lambda>n. A n $ i $ j) \<longlonglongrightarrow> B $ i $ j"
             by (auto simp: lambda_skolem)
           have lin_df: "linear (f' x)"
                and lim_df: "((\<lambda>y. (1 / norm (y - x)) *\<^sub>R (f y - (f x + f' x (y - x)))) \<longlongrightarrow> 0) (at x within S)"
             using \<open>x \<in> S\<close> assms by (auto simp: has_derivative_within linear_linear)
           moreover
           interpret linear "f' x" by fact
           have "(matrix (f' x) - B) *v w = 0" for w
           proof (rule lemma_partial_derivatives [of "(*v) (matrix (f' x) - B)"])
             show "linear ((*v) (matrix (f' x) - B))"
               by (rule matrix_vector_mul_linear)
             have "((\<lambda>y. ((f x + f' x (y - x)) - f y) /\<^sub>R norm (y - x)) \<longlongrightarrow> 0) (at x within S)"
               using tendsto_minus [OF lim_df] by (simp add: algebra_simps field_split_simps)
             then show "((\<lambda>y. (matrix (f' x) - B) *v (y - x) /\<^sub>R norm (y - x)) \<longlongrightarrow> 0) (at x within S)"
             proof (rule Lim_transform)
               have "((\<lambda>y. ((f y + B *v x - (f x + B *v y)) /\<^sub>R norm (y - x))) \<longlongrightarrow> 0) (at x within S)"
               proof (clarsimp simp add: Lim_within dist_norm)
                 fix e :: "real"
                 assume "e > 0"
                 then obtain q::nat where "q \<noteq> 0" and qe2: "1/q < e/2"
                   by (metis divide_pos_pos inverse_eq_divide real_arch_inverse zero_less_numeral)
                 let ?g = "\<lambda>p. sum  (\<lambda>i. sum (\<lambda>j. abs((A p - B)$i$j)) UNIV) UNIV"
                 have "(\<lambda>k. onorm (\<lambda>y. (A k - B) *v y)) \<longlonglongrightarrow> 0"
                 proof (rule Lim_null_comparison)
                   show "\<forall>\<^sub>F k in sequentially. norm (onorm (\<lambda>y. (A k - B) *v y)) \<le> ?g k"
                   proof (rule eventually_sequentiallyI)
                     fix k :: "nat"
                     assume "0 \<le> k"
                     have "0 \<le> onorm ((*v) (A k - B))"
                       using matrix_vector_mul_bounded_linear
                       by (rule onorm_pos_le)
                     then show "norm (onorm ((*v) (A k - B))) \<le> (\<Sum>i\<in>UNIV. \<Sum>j\<in>UNIV. \<bar>(A k - B) $ i $ j\<bar>)"
                       by (simp add: onorm_le_matrix_component_sum del: vector_minus_component)
                   qed
                 next
                   show "?g \<longlonglongrightarrow> 0"
                     using B Lim_null tendsto_rabs_zero_iff by (fastforce intro!: tendsto_null_sum)
                 qed
                 with \<open>e > 0\<close> obtain p where "\<And>n. n \<ge> p \<Longrightarrow> \<bar>onorm ((*v) (A n - B))\<bar> < e/2"
                   unfolding lim_sequentially by (metis diff_zero dist_real_def divide_pos_pos zero_less_numeral)
                 then have pqe2: "\<bar>onorm ((*v) (A (p + q) - B))\<bar> < e/2" (*17 [`abs (onorm (\y. A (p + q) ** y - B ** y)) < e / &2`]*)
                   using le_add1 by blast
                 show "\<exists>d>0. \<forall>y\<in>S. y \<noteq> x \<and> norm (y - x) < d \<longrightarrow>
                            inverse (norm (y - x)) * norm (f y + B *v x - (f x + B *v y)) < e"
                 proof (intro exI, safe)
                   show "0 < \<delta>(p + q)"
                     by (simp add: \<delta>)
                 next
                   fix y
                   assume y: "y \<in> S" "norm (y - x) < \<delta>(p + q)" and "y \<noteq> x"
                   have *: "\<lbrakk>norm(b - c) < e - d; norm(y - x - b) \<le> d\<rbrakk> \<Longrightarrow> norm(y - x - c) < e"
                     for b c d e x and y:: "real^'n"
                     using norm_triangle_ineq2 [of "y - x - c" "y - x - b"] by simp
                   have "norm (f y - f x - B *v (y - x)) < e * norm (y - x)"
                   proof (rule *)
                     show "norm (f y - f x - A (p + q) *v (y - x)) \<le> norm (y - x) / (Suc (p + q))"
                       using A [OF y] by simp
                     have "norm (A (p + q) *v (y - x) - B *v (y - x)) \<le> onorm(\<lambda>x. (A(p + q) - B) *v x) * norm(y - x)"
                       by (metis linear_linear matrix_vector_mul_linear matrix_vector_mult_diff_rdistrib onorm)
                     also have "\<dots> < (e/2) * norm (y - x)"
                       using \<open>y \<noteq> x\<close> pqe2 by auto
                     also have "\<dots> \<le> (e - 1 / (Suc (p + q))) * norm (y - x)"
                     proof (rule mult_right_mono)
                       have "1 / Suc (p + q) \<le> 1 / q"
                         using \<open>q \<noteq> 0\<close> by (auto simp: field_split_simps)
                       also have "\<dots> < e/2"
                         using qe2 by auto
                       finally show "e / 2 \<le> e - 1 / real (Suc (p + q))"
                         by linarith
                     qed auto
                     finally show "norm (A (p + q) *v (y - x) - B *v (y - x)) < e * norm (y - x) - norm (y - x) / real (Suc (p + q))"
                       by (simp add: algebra_simps)
                   qed
                   then show "inverse (norm (y - x)) * norm (f y + B *v x - (f x + B *v y)) < e"
                     using \<open>y \<noteq> x\<close> by (simp add: field_split_simps algebra_simps)
                 qed
               qed
               then show "((\<lambda>y. (matrix (f' x) - B) *v (y - x) /\<^sub>R
                            norm (y - x) - (f x + f' x (y - x) - f y) /\<^sub>R norm (y - x)) \<longlongrightarrow> 0)
                           (at x within S)"
                 by (simp add: algebra_simps diff lin_df matrix_vector_mul_linear scalar_mult_eq_scaleR)
             qed
           qed (use x in \<open>simp; auto simp: not_less\<close>)
           ultimately have "f' x = (*v) B"
             by (force simp: algebra_simps scalar_mult_eq_scaleR)
           show "matrix (f' x) $ m $ n \<le> b"
           proof (rule tendsto_upperbound [of "\<lambda>i. (A i $ m $ n)" _ sequentially])
             show "(\<lambda>i. A i $ m $ n) \<longlonglongrightarrow> matrix (f' x) $ m $ n"
               by (simp add: B \<open>f' x = (*v) B\<close>)
             show "\<forall>\<^sub>F i in sequentially. A i $ m $ n \<le> b"
               by (simp add: Ab less_eq_real_def)
           qed auto
         next
           fix e :: "real"
           assume "x \<in> S" and b: "matrix (f' x) $ m $ n \<le> b" and "e > 0"
           then obtain d where "d>0"
             and d: "\<And>y. y\<in>S \<Longrightarrow> 0 < dist y x \<and> dist y x < d \<longrightarrow> norm (f y - f x - f' x (y - x)) / (norm (y - x))
                   < e/2"
             using f [OF \<open>x \<in> S\<close>]
             by (simp add: Deriv.has_derivative_at_within Lim_within)
               (auto simp add: field_simps dest: spec [of _ "e/2"])
           let ?A = "matrix(f' x) - (\<chi> i j. if i = m \<and> j = n then e / 4 else 0)"
           obtain B where BRats: "\<And>i j. B$i$j \<in> \<rat>" and Bo_e6: "onorm((*v) (?A - B)) < e/6"
             using matrix_rational_approximation \<open>e > 0\<close>
             by (metis zero_less_divide_iff zero_less_numeral)
           show "\<exists>d>0. \<exists>A. A $ m $ n < b \<and> (\<forall>i j. A $ i $ j \<in> \<rat>) \<and>
                 (\<forall>y\<in>S. norm (y - x) < d \<longrightarrow> norm (f y - f x - A *v (y - x)) \<le> e * norm (y - x))"
           proof (intro exI conjI ballI allI impI)
             show "d>0"
               by (rule \<open>d>0\<close>)
             show "B $ m $ n < b"
             proof -
               have "\<bar>matrix ((*v) (?A - B)) $ m $ n\<bar> \<le> onorm ((*v) (?A - B))"
                 using component_le_onorm [OF matrix_vector_mul_linear, of _ m n] by metis
               then show ?thesis
                 using b Bo_e6 by simp
             qed
             show "B $ i $ j \<in> \<rat>" for i j
               using BRats by auto
             show "norm (f y - f x - B *v (y - x)) \<le> e * norm (y - x)"
               if "y \<in> S" and y: "norm (y - x) < d" for y
             proof (cases "y = x")
               case True then show ?thesis
                 by simp
             next
               case False
               have *: "norm(d' - d) \<le> e/2 \<Longrightarrow> norm(y - (x + d')) < e/2 \<Longrightarrow> norm(y - x - d) \<le> e" for d d' e and x y::"real^'n"
                 using norm_triangle_le [of "d' - d" "y - (x + d')"] by simp
               show ?thesis
               proof (rule *)
                 have split246: "\<lbrakk>norm y \<le> e / 6; norm(x - y) \<le> e / 4\<rbrakk> \<Longrightarrow> norm x \<le> e/2" if "e > 0" for e and x y :: "real^'n"
                   using norm_triangle_le [of y "x-y" "e/2"] \<open>e > 0\<close> by simp
                 have "linear (f' x)"
                   using True f has_derivative_linear by blast
                 then have "norm (f' x (y - x) - B *v (y - x)) = norm ((matrix (f' x) - B) *v (y - x))"
                   by (simp add: matrix_vector_mult_diff_rdistrib)
                 also have "\<dots> \<le> (e * norm (y - x)) / 2"
                 proof (rule split246)
                   have "norm ((?A - B) *v (y - x)) / norm (y - x) \<le> onorm(\<lambda>x. (?A - B) *v x)"
                     by (rule le_onorm) auto
                   also have  "\<dots> < e/6"
                     by (rule Bo_e6)
                   finally have "norm ((?A - B) *v (y - x)) / norm (y - x) < e / 6" .
                   then show "norm ((?A - B) *v (y - x)) \<le> e * norm (y - x) / 6"
                     by (simp add: field_split_simps False)
                   have "norm ((matrix (f' x) - B) *v (y - x) - ((?A - B) *v (y - x))) = norm ((\<chi> i j. if i = m \<and> j = n then e / 4 else 0) *v (y - x))"
                     by (simp add: algebra_simps)
                   also have "\<dots> = norm((e/4) *\<^sub>R (y - x)$n *\<^sub>R axis m (1::real))"
                   proof -
                     have "(\<Sum>j\<in>UNIV. (if i = m \<and> j = n then e / 4 else 0) * (y $ j - x $ j)) * 4 = e * (y $ n - x $ n) * axis m 1 $ i" for i
                     proof (cases "i=m")
                       case True then show ?thesis
                         by (auto simp: if_distrib [of "\<lambda>z. z * _"] cong: if_cong)
                     next
                       case False then show ?thesis
                         by (simp add: axis_def)
                     qed
                     then have "(\<chi> i j. if i = m \<and> j = n then e / 4 else 0) *v (y - x) = (e/4) *\<^sub>R (y - x)$n *\<^sub>R axis m (1::real)"
                       by (auto simp: vec_eq_iff matrix_vector_mult_def)
                     then show ?thesis
                       by metis
                   qed
                   also have "\<dots> \<le> e * norm (y - x) / 4"
                     using \<open>e > 0\<close> apply (simp add: norm_mult abs_mult)
                     by (metis component_le_norm_cart vector_minus_component)
                   finally show "norm ((matrix (f' x) - B) *v (y - x) - ((?A - B) *v (y - x))) \<le> e * norm (y - x) / 4" .
                   show "0 < e * norm (y - x)"
                     by (simp add: False \<open>e > 0\<close>)
                 qed
                 finally show "norm (f' x (y - x) - B *v (y - x)) \<le> (e * norm (y - x)) / 2" .
                 show "norm (f y - (f x + f' x (y - x))) < (e * norm (y - x)) / 2"
                   using False d [OF \<open>y \<in> S\<close>] y by (simp add: dist_norm field_simps)
               qed
             qed
           qed
         qed
       qed auto
     qed
     show "negligible ?M"
       using negligible_subset [OF nN MN] .
   qed
   then show ?thesis
     by (simp add: borel_measurable_vimage_halfspace_component_le sets_restrict_space_iff assms)
 qed
 
 
 theorem borel_measurable_det_Jacobian:
  fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> sets lebesgue" and f: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   shows "(\<lambda>x. det(matrix(f' x))) \<in> borel_measurable (lebesgue_on S)"
   unfolding det_def
   by (intro measurable) (auto intro: f borel_measurable_partial_derivatives [OF S])
 
 text\<open>The localisation wrt S uses the same argument for many similar results.\<close>
 (*See HOL Light's MEASURABLE_ON_LEBESGUE_MEASURABLE_PREIMAGE_BOREL, etc.*)
 theorem borel_measurable_lebesgue_on_preimage_borel:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue"
   shows "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<forall>T. T \<in> sets borel \<longrightarrow> {x \<in> S. f x \<in> T} \<in> sets lebesgue)"
 proof -
   have "{x. (if x \<in> S then f x else 0) \<in> T} \<in> sets lebesgue \<longleftrightarrow> {x \<in> S. f x \<in> T} \<in> sets lebesgue"
          if "T \<in> sets borel" for T
     proof (cases "0 \<in> T")
       case True
       then have "{x \<in> S. f x \<in> T} = {x. (if x \<in> S then f x else 0) \<in> T} \<inter> S"
                 "{x. (if x \<in> S then f x else 0) \<in> T} = {x \<in> S. f x \<in> T} \<union> -S"
         by auto
       then show ?thesis
         by (metis (no_types, lifting) Compl_in_sets_lebesgue assms sets.Int sets.Un)
     next
       case False
       then have "{x. (if x \<in> S then f x else 0) \<in> T} = {x \<in> S. f x \<in> T}"
         by auto
       then show ?thesis
         by auto
     qed
     then show ?thesis
       unfolding borel_measurable_lebesgue_preimage_borel borel_measurable_if [OF assms, symmetric]
       by blast
 qed
 
 lemma sets_lebesgue_almost_borel:
   assumes "S \<in> sets lebesgue"
   obtains B N where "B \<in> sets borel" "negligible N" "B \<union> N = S"
 proof -
   obtain T N N' where "S = T \<union> N" "N \<subseteq> N'" "N' \<in> null_sets lborel" "T \<in> sets borel"
     using sets_completionE [OF assms] by auto
   then show thesis
     by (metis negligible_iff_null_sets negligible_subset null_sets_completionI that)
 qed
 
 lemma double_lebesgue_sets:
  assumes S: "S \<in> sets lebesgue" and T: "T \<in> sets lebesgue" and fim: "f ` S \<subseteq> T"
  shows "(\<forall>U. U \<in> sets lebesgue \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue) \<longleftrightarrow>
           f \<in> borel_measurable (lebesgue_on S) \<and>
           (\<forall>U. negligible U \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue)"
          (is "?lhs \<longleftrightarrow> _ \<and> ?rhs")
   unfolding borel_measurable_lebesgue_on_preimage_borel [OF S]
 proof (intro iffI allI conjI impI, safe)
   fix V :: "'b set"
   assume *: "\<forall>U. U \<in> sets lebesgue \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue"
     and "V \<in> sets borel"
   then have V: "V \<in> sets lebesgue"
     by simp
   have "{x \<in> S. f x \<in> V} = {x \<in> S. f x \<in> T \<inter> V}"
     using fim by blast
   also have "{x \<in> S. f x \<in> T \<inter> V} \<in> sets lebesgue"
     using T V * le_inf_iff by blast
   finally show "{x \<in> S. f x \<in> V} \<in> sets lebesgue" .
 next
   fix U :: "'b set"
   assume "\<forall>U. U \<in> sets lebesgue \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue"
          "negligible U" "U \<subseteq> T"
   then show "{x \<in> S. f x \<in> U} \<in> sets lebesgue"
     using negligible_imp_sets by blast
 next
   fix U :: "'b set"
   assume 1 [rule_format]: "(\<forall>T. T \<in> sets borel \<longrightarrow> {x \<in> S. f x \<in> T} \<in> sets lebesgue)"
      and 2 [rule_format]: "\<forall>U. negligible U \<and> U \<subseteq> T \<longrightarrow> {x \<in> S. f x \<in> U} \<in> sets lebesgue"
      and "U \<in> sets lebesgue" "U \<subseteq> T"
   then obtain C N where C: "C \<in> sets borel \<and> negligible N \<and> C \<union> N = U"
     using sets_lebesgue_almost_borel
     by metis
   then have "{x \<in> S. f x \<in> C} \<in> sets lebesgue"
     by (blast intro: 1)
   moreover have "{x \<in> S. f x \<in> N} \<in> sets lebesgue"
     using C \<open>U \<subseteq> T\<close> by (blast intro: 2)
   moreover have "{x \<in> S. f x \<in> C \<union> N} = {x \<in> S. f x \<in> C} \<union> {x \<in> S. f x \<in> N}"
     by auto
   ultimately show "{x \<in> S. f x \<in> U} \<in> sets lebesgue"
     using C by auto
 qed
 
 
 subsection\<open>Simplest case of Sard's theorem (we don't need continuity of derivative)\<close>
 
 lemma Sard_lemma00:
   fixes P :: "'b::euclidean_space set"
   assumes "a \<ge> 0" and a: "a *\<^sub>R i \<noteq> 0" and i: "i \<in> Basis"
     and P: "P \<subseteq> {x. a *\<^sub>R i \<bullet> x = 0}"
     and "0 \<le> m" "0 \<le> e"
  obtains S where "S \<in> lmeasurable"
             and "{z. norm z \<le> m \<and> (\<exists>t \<in> P. norm(z - t) \<le> e)} \<subseteq> S"
             and "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (DIM('b) - 1)"
 proof -
   have "a > 0"
     using assms by simp
   let ?v = "(\<Sum>j\<in>Basis. (if j = i then e else m) *\<^sub>R j)"
   show thesis
   proof
     have "- e \<le> x \<bullet> i" "x \<bullet> i \<le> e"
       if "t \<in> P" "norm (x - t) \<le> e" for x t
       using \<open>a > 0\<close> that Basis_le_norm [of i "x-t"] P i
       by (auto simp: inner_commute algebra_simps)
     moreover have "- m \<le> x \<bullet> j" "x \<bullet> j \<le> m"
       if "norm x \<le> m" "t \<in> P" "norm (x - t) \<le> e" "j \<in> Basis" and "j \<noteq> i"
       for x t j
       using that Basis_le_norm [of j x] by auto
     ultimately
     show "{z. norm z \<le> m \<and> (\<exists>t\<in>P. norm (z - t) \<le> e)} \<subseteq> cbox (-?v) ?v"
       by (auto simp: mem_box)
     have *: "\<forall>k\<in>Basis. - ?v \<bullet> k \<le> ?v \<bullet> k"
       using \<open>0 \<le> m\<close> \<open>0 \<le> e\<close> by (auto simp: inner_Basis)
     have 2: "2 ^ DIM('b) = 2 * 2 ^ (DIM('b) - Suc 0)"
       by (metis DIM_positive Suc_pred power_Suc)
     show "measure lebesgue (cbox (-?v) ?v) \<le> 2 * e * (2 * m) ^ (DIM('b) - 1)"
       using \<open>i \<in> Basis\<close>
       by (simp add: content_cbox [OF *] prod.distrib prod.If_cases Diff_eq [symmetric] 2)
   qed blast
 qed
 
 text\<open>As above, but reorienting the vector (HOL Light's @text{GEOM\_BASIS\_MULTIPLE\_TAC})\<close>
 lemma Sard_lemma0:
   fixes P :: "(real^'n::{finite,wellorder}) set"
   assumes "a \<noteq> 0"
     and P: "P \<subseteq> {x. a \<bullet> x = 0}" and "0 \<le> m" "0 \<le> e"
   obtains S where "S \<in> lmeasurable"
     and "{z. norm z \<le> m \<and> (\<exists>t \<in> P. norm(z - t) \<le> e)} \<subseteq> S"
     and "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (CARD('n) - 1)"
 proof -
   obtain T and k::'n where T: "orthogonal_transformation T" and a: "a = T (norm a *\<^sub>R axis k (1::real))"
     using rotation_rightward_line by metis
   have Tinv [simp]: "T (inv T x) = x" for x
     by (simp add: T orthogonal_transformation_surj surj_f_inv_f)
   obtain S where S: "S \<in> lmeasurable"
     and subS: "{z. norm z \<le> m \<and> (\<exists>t \<in> T-`P. norm(z - t) \<le> e)} \<subseteq> S"
     and mS: "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (CARD('n) - 1)"
   proof (rule Sard_lemma00 [of "norm a" "axis k (1::real)" "T-`P" m e])
     have "norm a *\<^sub>R axis k 1 \<bullet> x = 0" if "T x \<in> P" for x
     proof -
       have "a \<bullet> T x = 0"
         using P that by blast
       then show ?thesis
         by (metis (no_types, lifting) T a orthogonal_orthogonal_transformation orthogonal_def)
     qed
     then show "T -` P \<subseteq> {x. norm a *\<^sub>R axis k 1 \<bullet> x = 0}"
       by auto
   qed (use assms T in auto)
   show thesis
   proof
     show "T ` S \<in> lmeasurable"
       using S measurable_orthogonal_image T by blast
     have "{z. norm z \<le> m \<and> (\<exists>t\<in>P. norm (z - t) \<le> e)} \<subseteq> T ` {z. norm z \<le> m \<and> (\<exists>t\<in>T -` P. norm (z - t) \<le> e)}"
     proof clarsimp
       fix x t
       assume "norm x \<le> m" "t \<in> P" "norm (x - t) \<le> e"
       then have "norm (inv T x) \<le> m"
         using orthogonal_transformation_inv [OF T] by (simp add: orthogonal_transformation_norm)
       moreover have "\<exists>t\<in>T -` P. norm (inv T x - t) \<le> e"
       proof
         have "T (inv T x - inv T t) = x - t"
           using T linear_diff orthogonal_transformation_def
           by (metis (no_types, hide_lams) Tinv)
         then have "norm (inv T x - inv T t) = norm (x - t)"
           by (metis T orthogonal_transformation_norm)
         then show "norm (inv T x - inv T t) \<le> e"
           using \<open>norm (x - t) \<le> e\<close> by linarith
        next
          show "inv T t \<in> T -` P"
            using \<open>t \<in> P\<close> by force
       qed
       ultimately show "x \<in> T ` {z. norm z \<le> m \<and> (\<exists>t\<in>T -` P. norm (z - t) \<le> e)}"
         by force
     qed
     then show "{z. norm z \<le> m \<and> (\<exists>t\<in>P. norm (z - t) \<le> e)} \<subseteq> T ` S"
       using image_mono [OF subS] by (rule order_trans)
     show "measure lebesgue (T ` S) \<le> 2 * e * (2 * m) ^ (CARD('n) - 1)"
       using mS T by (simp add: S measure_orthogonal_image)
   qed
 qed
 
 text\<open>As above, but translating the sets (HOL Light's @text{GEN\_GEOM\_ORIGIN\_TAC})\<close>
 lemma Sard_lemma1:
   fixes P :: "(real^'n::{finite,wellorder}) set"
    assumes P: "dim P < CARD('n)" and "0 \<le> m" "0 \<le> e"
  obtains S where "S \<in> lmeasurable"
             and "{z. norm(z - w) \<le> m \<and> (\<exists>t \<in> P. norm(z - w - t) \<le> e)} \<subseteq> S"
             and "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (CARD('n) - 1)"
 proof -
   obtain a where "a \<noteq> 0" "P \<subseteq> {x. a \<bullet> x = 0}"
     using lowdim_subset_hyperplane [of P] P span_base by auto
   then obtain S where S: "S \<in> lmeasurable"
     and subS: "{z. norm z \<le> m \<and> (\<exists>t \<in> P. norm(z - t) \<le> e)} \<subseteq> S"
     and mS: "measure lebesgue S \<le> (2 * e) * (2 * m) ^ (CARD('n) - 1)"
     by (rule Sard_lemma0 [OF _ _ \<open>0 \<le> m\<close> \<open>0 \<le> e\<close>])
   show thesis
   proof
     show "(+)w ` S \<in> lmeasurable"
       by (metis measurable_translation S)
     show "{z. norm (z - w) \<le> m \<and> (\<exists>t\<in>P. norm (z - w - t) \<le> e)} \<subseteq> (+)w ` S"
       using subS by force
     show "measure lebesgue ((+)w ` S) \<le> 2 * e * (2 * m) ^ (CARD('n) - 1)"
       by (metis measure_translation mS)
   qed
 qed
 
 lemma Sard_lemma2:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n::{finite,wellorder}"
   assumes mlen: "CARD('m) \<le> CARD('n)" (is "?m \<le> ?n")
     and "B > 0" "bounded S"
     and derS: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and rank: "\<And>x. x \<in> S \<Longrightarrow> rank(matrix(f' x)) < CARD('n)"
     and B: "\<And>x. x \<in> S \<Longrightarrow> onorm(f' x) \<le> B"
   shows "negligible(f ` S)"
 proof -
   have lin_f': "\<And>x. x \<in> S \<Longrightarrow> linear(f' x)"
     using derS has_derivative_linear by blast
   show ?thesis
   proof (clarsimp simp add: negligible_outer_le)
     fix e :: "real"
     assume "e > 0"
     obtain c where csub: "S \<subseteq> cbox (- (vec c)) (vec c)" and "c > 0"
     proof -
       obtain b where b: "\<And>x. x \<in> S \<Longrightarrow> norm x \<le> b"
         using \<open>bounded S\<close> by (auto simp: bounded_iff)
       show thesis
       proof
         have "- \<bar>b\<bar> - 1 \<le> x $ i \<and> x $ i \<le> \<bar>b\<bar> + 1" if "x \<in> S" for x i
           using component_le_norm_cart [of x i] b [OF that] by auto
         then show "S \<subseteq> cbox (- vec (\<bar>b\<bar> + 1)) (vec (\<bar>b\<bar> + 1))"
           by (auto simp: mem_box_cart)
       qed auto
     qed
     then have box_cc: "box (- (vec c)) (vec c) \<noteq> {}" and cbox_cc: "cbox (- (vec c)) (vec c) \<noteq> {}"
       by (auto simp: interval_eq_empty_cart)
     obtain d where "d > 0" "d \<le> B"
              and d: "(d * 2) * (4 * B) ^ (?n - 1) \<le> e / (2*c) ^ ?m / ?m ^ ?m"
       apply (rule that [of "min B (e / (2*c) ^ ?m / ?m ^ ?m / (4 * B) ^ (?n - 1) / 2)"])
       using \<open>B > 0\<close> \<open>c > 0\<close> \<open>e > 0\<close>
       by (simp_all add: divide_simps min_mult_distrib_right)
     have "\<exists>r. 0 < r \<and> r \<le> 1/2 \<and>
               (x \<in> S
                \<longrightarrow> (\<forall>y. y \<in> S \<and> norm(y - x) < r
                        \<longrightarrow> norm(f y - f x - f' x (y - x)) \<le> d * norm(y - x)))" for x
     proof (cases "x \<in> S")
       case True
       then obtain r where "r > 0"
               and "\<And>y. \<lbrakk>y \<in> S; norm (y - x) < r\<rbrakk>
                        \<Longrightarrow> norm (f y - f x - f' x (y - x)) \<le> d * norm (y - x)"
         using derS \<open>d > 0\<close> by (force simp: has_derivative_within_alt)
       then show ?thesis
         by (rule_tac x="min r (1/2)" in exI) simp
     next
       case False
       then show ?thesis
         by (rule_tac x="1/2" in exI) simp
     qed
     then obtain r where r12: "\<And>x. 0 < r x \<and> r x \<le> 1/2"
             and r: "\<And>x y. \<lbrakk>x \<in> S; y \<in> S; norm(y - x) < r x\<rbrakk>
                           \<Longrightarrow> norm(f y - f x - f' x (y - x)) \<le> d * norm(y - x)"
       by metis
     then have ga: "gauge (\<lambda>x. ball x (r x))"
       by (auto simp: gauge_def)
     obtain \<D> where \<D>: "countable \<D>" and sub_cc: "\<Union>\<D> \<subseteq> cbox (- vec c) (vec c)"
       and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> interior K \<noteq> {} \<and> (\<exists>u v. K = cbox u v)"
       and djointish: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
       and covered: "\<And>K. K \<in> \<D> \<Longrightarrow> \<exists>x \<in> S \<inter> K. K \<subseteq> ball x (r x)"
       and close: "\<And>u v. cbox u v \<in> \<D> \<Longrightarrow> \<exists>n. \<forall>i::'m. v $ i - u $ i = 2*c / 2^n"
       and covers: "S \<subseteq> \<Union>\<D>"
       apply (rule covering_lemma [OF csub box_cc ga])
       apply (auto simp: Basis_vec_def cart_eq_inner_axis [symmetric])
       done
     let ?\<mu> = "measure lebesgue"
     have "\<exists>T. T \<in> lmeasurable \<and> f ` (K \<inter> S) \<subseteq> T \<and> ?\<mu> T \<le> e / (2*c) ^ ?m * ?\<mu> K"
       if "K \<in> \<D>" for K
     proof -
       obtain u v where uv: "K = cbox u v"
         using cbox \<open>K \<in> \<D>\<close> by blast
       then have uv_ne: "cbox u v \<noteq> {}"
         using cbox that by fastforce
       obtain x where x: "x \<in> S \<inter> cbox u v" "cbox u v \<subseteq> ball x (r x)"
         using \<open>K \<in> \<D>\<close> covered uv by blast
       then have "dim (range (f' x)) < ?n"
         using rank_dim_range [of "matrix (f' x)"] x rank[of x]
         by (auto simp: matrix_works scalar_mult_eq_scaleR lin_f')
       then obtain T where T: "T \<in> lmeasurable"
             and subT: "{z. norm(z - f x) \<le> (2 * B) * norm(v - u) \<and> (\<exists>t \<in> range (f' x). norm(z - f x - t) \<le> d * norm(v - u))} \<subseteq> T"
             and measT: "?\<mu> T \<le> (2 * (d * norm(v - u))) * (2 * ((2 * B) * norm(v - u))) ^ (?n - 1)"
                         (is "_ \<le> ?DVU")
         apply (rule Sard_lemma1 [of "range (f' x)" "(2 * B) * norm(v - u)" "d * norm(v - u)" "f x"])
         using \<open>B > 0\<close> \<open>d > 0\<close> by simp_all
       show ?thesis
       proof (intro exI conjI)
         have "f ` (K \<inter> S) \<subseteq> {z. norm(z - f x) \<le> (2 * B) * norm(v - u) \<and> (\<exists>t \<in> range (f' x). norm(z - f x - t) \<le> d * norm(v - u))}"
           unfolding uv
         proof (clarsimp simp: mult.assoc, intro conjI)
           fix y
           assume y: "y \<in> cbox u v" and "y \<in> S"
           then have "norm (y - x) < r x"
             by (metis dist_norm mem_ball norm_minus_commute subsetCE x(2))
           then have le_dyx: "norm (f y - f x - f' x (y - x)) \<le> d * norm (y - x)"
             using r [of x y] x \<open>y \<in> S\<close> by blast
           have yx_le: "norm (y - x) \<le> norm (v - u)"
           proof (rule norm_le_componentwise_cart)
             show "norm ((y - x) $ i) \<le> norm ((v - u) $ i)" for i
               using x y by (force simp: mem_box_cart dest!: spec [where x=i])
           qed
           have *: "\<lbrakk>norm(y - x - z) \<le> d; norm z \<le> B; d \<le> B\<rbrakk> \<Longrightarrow> norm(y - x) \<le> 2 * B"
             for x y z :: "real^'n::_" and d B
             using norm_triangle_ineq2 [of "y - x" z] by auto
           show "norm (f y - f x) \<le> 2 * (B * norm (v - u))"
           proof (rule * [OF le_dyx])
             have "norm (f' x (y - x)) \<le> onorm (f' x) * norm (y - x)"
               using onorm [of "f' x" "y-x"] by (meson IntE lin_f' linear_linear x(1))
             also have "\<dots> \<le> B * norm (v - u)"
             proof (rule mult_mono)
               show "onorm (f' x) \<le> B"
                 using B x by blast
             qed (use \<open>B > 0\<close> yx_le in auto)
             finally show "norm (f' x (y - x)) \<le> B * norm (v - u)" .
             show "d * norm (y - x) \<le> B * norm (v - u)"
               using \<open>B > 0\<close> by (auto intro: mult_mono [OF \<open>d \<le> B\<close> yx_le])
           qed
           show "\<exists>t. norm (f y - f x - f' x t) \<le> d * norm (v - u)"
             apply (rule_tac x="y-x" in exI)
             using \<open>d > 0\<close> yx_le le_dyx mult_left_mono [where c=d]
             by (meson order_trans real_mult_le_cancel_iff2)
         qed
         with subT show "f ` (K \<inter> S) \<subseteq> T" by blast
         show "?\<mu> T \<le> e / (2*c) ^ ?m * ?\<mu> K"
         proof (rule order_trans [OF measT])
           have "?DVU = (d * 2 * (4 * B) ^ (?n - 1)) * norm (v - u)^?n"
             using \<open>c > 0\<close>
             apply (simp add: algebra_simps power_mult_distrib)
             by (metis Suc_pred power_Suc zero_less_card_finite)
           also have "\<dots> \<le> (e / (2*c) ^ ?m / (?m ^ ?m)) * norm(v - u) ^ ?n"
             by (rule mult_right_mono [OF d]) auto
           also have "\<dots> \<le> e / (2*c) ^ ?m * ?\<mu> K"
           proof -
             have "u \<in> ball (x) (r x)" "v \<in> ball x (r x)"
               using box_ne_empty(1) contra_subsetD [OF x(2)] mem_box(2) uv_ne by fastforce+
             moreover have "r x \<le> 1/2"
               using r12 by auto
             ultimately have "norm (v - u) \<le> 1"
               using norm_triangle_half_r [of x u 1 v]
               by (metis (no_types, hide_lams) dist_commute dist_norm less_eq_real_def less_le_trans mem_ball)
             then have "norm (v - u) ^ ?n \<le> norm (v - u) ^ ?m"
               by (simp add: power_decreasing [OF mlen])
             also have "\<dots> \<le> ?\<mu> K * real (?m ^ ?m)"
             proof -
               obtain n where n: "\<And>i. v$i - u$i = 2 * c / 2^n"
                 using close [of u v] \<open>K \<in> \<D>\<close> uv by blast
               have "norm (v - u) ^ ?m \<le> (\<Sum>i\<in>UNIV. \<bar>(v - u) $ i\<bar>) ^ ?m"
                 by (intro norm_le_l1_cart power_mono) auto
               also have "\<dots> \<le> (\<Prod>i\<in>UNIV. v $ i - u $ i) * real CARD('m) ^ CARD('m)"
                 by (simp add: n field_simps \<open>c > 0\<close> less_eq_real_def)
               also have "\<dots> = ?\<mu> K * real (?m ^ ?m)"
                 by (simp add: uv uv_ne content_cbox_cart)
               finally show ?thesis .
             qed
             finally have *: "1 / real (?m ^ ?m) * norm (v - u) ^ ?n \<le> ?\<mu> K"
               by (simp add: field_split_simps)
             show ?thesis
               using mult_left_mono [OF *, of "e / (2*c) ^ ?m"] \<open>c > 0\<close> \<open>e > 0\<close> by auto
           qed
           finally show "?DVU \<le> e / (2*c) ^ ?m * ?\<mu> K" .
         qed
       qed (use T in auto)
     qed
     then obtain g where meas_g: "\<And>K. K \<in> \<D> \<Longrightarrow> g K \<in> lmeasurable"
                     and sub_g: "\<And>K. K \<in> \<D> \<Longrightarrow> f ` (K \<inter> S) \<subseteq> g K"
                     and le_g: "\<And>K. K \<in> \<D> \<Longrightarrow> ?\<mu> (g K) \<le> e / (2*c)^?m * ?\<mu> K"
       by metis
     have le_e: "?\<mu> (\<Union>i\<in>\<F>. g i) \<le> e"
       if "\<F> \<subseteq> \<D>" "finite \<F>" for \<F>
     proof -
       have "?\<mu> (\<Union>i\<in>\<F>. g i) \<le> (\<Sum>i\<in>\<F>. ?\<mu> (g i))"
         using meas_g \<open>\<F> \<subseteq> \<D>\<close> by (auto intro: measure_UNION_le [OF \<open>finite \<F>\<close>])
       also have "\<dots> \<le> (\<Sum>K\<in>\<F>. e / (2*c) ^ ?m * ?\<mu> K)"
         using \<open>\<F> \<subseteq> \<D>\<close> sum_mono [OF le_g] by (meson le_g subsetCE sum_mono)
       also have "\<dots> = e / (2*c) ^ ?m * (\<Sum>K\<in>\<F>. ?\<mu> K)"
         by (simp add: sum_distrib_left)
       also have "\<dots> \<le> e"
       proof -
         have "\<F> division_of \<Union>\<F>"
         proof (rule division_ofI)
           show "K \<subseteq> \<Union>\<F>"  "K \<noteq> {}" "\<exists>a b. K = cbox a b" if "K \<in> \<F>" for K
             using \<open>K \<in> \<F>\<close> covered cbox \<open>\<F> \<subseteq> \<D>\<close> by (auto simp: Union_upper)
           show "interior K \<inter> interior L = {}" if "K \<in> \<F>" and "L \<in> \<F>" and "K \<noteq> L" for K L
             by (metis (mono_tags, lifting) \<open>\<F> \<subseteq> \<D>\<close> pairwiseD djointish pairwise_subset that)
         qed (use that in auto)
         then have "sum ?\<mu> \<F> \<le> ?\<mu> (\<Union>\<F>)"
           by (simp add: content_division)
         also have "\<dots> \<le> ?\<mu> (cbox (- vec c) (vec c) :: (real, 'm) vec set)"
         proof (rule measure_mono_fmeasurable)
           show "\<Union>\<F> \<subseteq> cbox (- vec c) (vec c)"
             by (meson Sup_subset_mono sub_cc order_trans \<open>\<F> \<subseteq> \<D>\<close>)
         qed (use \<open>\<F> division_of \<Union>\<F>\<close> lmeasurable_division in auto)
         also have "\<dots> = content (cbox (- vec c) (vec c) :: (real, 'm) vec set)"
           by simp
         also have "\<dots> \<le> (2 ^ ?m * c ^ ?m)"
           using \<open>c > 0\<close> by (simp add: content_cbox_if_cart)
         finally have "sum ?\<mu> \<F> \<le> (2 ^ ?m * c ^ ?m)" .
         then show ?thesis
           using \<open>e > 0\<close> \<open>c > 0\<close> by (auto simp: field_split_simps mult_less_0_iff)
       qed
       finally show ?thesis .
     qed
     show "\<exists>T. f ` S \<subseteq> T \<and> T \<in> lmeasurable \<and> ?\<mu> T \<le> e"
     proof (intro exI conjI)
       show "f ` S \<subseteq> \<Union> (g ` \<D>)"
         using covers sub_g by force
       show "\<Union> (g ` \<D>) \<in> lmeasurable"
         by (rule fmeasurable_UN_bound [OF \<open>countable \<D>\<close> meas_g le_e])
       show "?\<mu> (\<Union> (g ` \<D>)) \<le> e"
         by (rule measure_UN_bound [OF \<open>countable \<D>\<close> meas_g le_e])
     qed
   qed
 qed
 
 
 theorem baby_Sard:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n::{finite,wellorder}"
   assumes mlen: "CARD('m) \<le> CARD('n)"
     and der: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and rank: "\<And>x. x \<in> S \<Longrightarrow> rank(matrix(f' x)) < CARD('n)"
   shows "negligible(f ` S)"
 proof -
   let ?U = "\<lambda>n. {x \<in> S. norm(x) \<le> n \<and> onorm(f' x) \<le> real n}"
   have "\<And>x. x \<in> S \<Longrightarrow> \<exists>n. norm x \<le> real n \<and> onorm (f' x) \<le> real n"
     by (meson linear order_trans real_arch_simple)
   then have eq: "S = (\<Union>n. ?U n)"
     by auto
   have "negligible (f ` ?U n)" for n
   proof (rule Sard_lemma2 [OF mlen])
     show "0 < real n + 1"
       by auto
     show "bounded (?U n)"
       using bounded_iff by blast
     show "(f has_derivative f' x) (at x within ?U n)" if "x \<in> ?U n" for x
       using der that by (force intro: has_derivative_subset)
   qed (use rank in auto)
   then show ?thesis
     by (subst eq) (simp add: image_Union negligible_Union_nat)
 qed
 
 
 subsection\<open>A one-way version of change-of-variables not assuming injectivity. \<close>
 
 lemma integral_on_image_ubound_weak:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real"
   assumes S: "S \<in> sets lebesgue"
       and f: "f \<in> borel_measurable (lebesgue_on (g ` S))"
       and nonneg_fg:  "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f(g x)"
       and der_g:   "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and det_int_fg: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) integrable_on S"
       and meas_gim: "\<And>T. \<lbrakk>T \<subseteq> g ` S; T \<in> sets lebesgue\<rbrakk> \<Longrightarrow> {x \<in> S. g x \<in> T} \<in> sets lebesgue"
     shows "f integrable_on (g ` S) \<and>
            integral (g ` S) f \<le> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x))"
          (is "_ \<and> _ \<le> ?b")
 proof -
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar>"
   have cont_g: "continuous_on S g"
     using der_g has_derivative_continuous_on by blast
   have [simp]: "space (lebesgue_on S) = S"
     by (simp add: S)
   have gS_in_sets_leb: "g ` S \<in> sets lebesgue"
     apply (rule differentiable_image_in_sets_lebesgue)
     using der_g by (auto simp: S differentiable_def differentiable_on_def)
   obtain h where nonneg_h: "\<And>n x. 0 \<le> h n x"
     and h_le_f: "\<And>n x. x \<in> S \<Longrightarrow> h n (g x) \<le> f (g x)"
     and h_inc: "\<And>n x. h n x \<le> h (Suc n) x"
     and h_meas: "\<And>n. h n \<in> borel_measurable lebesgue"
     and fin_R: "\<And>n. finite(range (h n))"
     and lim: "\<And>x. x \<in> g ` S \<Longrightarrow> (\<lambda>n. h n x) \<longlonglongrightarrow> f x"
   proof -
     let ?f = "\<lambda>x. if x \<in> g ` S then f x else 0"
     have "?f \<in> borel_measurable lebesgue \<and> (\<forall>x. 0 \<le> ?f x)"
       by (auto simp: gS_in_sets_leb f nonneg_fg measurable_restrict_space_iff [symmetric])
     then show ?thesis
       apply (clarsimp simp add: borel_measurable_simple_function_limit_increasing)
       apply (rename_tac h)
       by (rule_tac h=h in that) (auto split: if_split_asm)
   qed
   have h_lmeas: "{t. h n (g t) = y} \<inter> S \<in> sets lebesgue" for y n
   proof -
     have "space (lebesgue_on (UNIV::(real,'n) vec set)) = UNIV"
       by simp
     then have "((h n) -`{y} \<inter> g ` S) \<in> sets (lebesgue_on (g ` S))"
       by (metis Int_commute borel_measurable_vimage h_meas image_eqI inf_top.right_neutral sets_restrict_space space_borel space_completion space_lborel)
     then have "({u. h n u = y} \<inter> g ` S) \<in> sets lebesgue"
       using gS_in_sets_leb
       by (simp add: integral_indicator fmeasurableI2 sets_restrict_space_iff vimage_def)
     then have "{x \<in> S. g x \<in> ({u. h n u = y} \<inter> g ` S)} \<in> sets lebesgue"
       using meas_gim[of "({u. h n u = y} \<inter> g ` S)"] by force
     moreover have "{t. h n (g t) = y} \<inter> S = {x \<in> S. g x \<in> ({u. h n u = y} \<inter> g ` S)}"
       by blast
     ultimately show ?thesis
       by auto
   qed
   have hint: "h n integrable_on g ` S \<and> integral (g ` S) (h n) \<le> integral S (\<lambda>x. ?D x * h n (g x))"
           (is "?INT \<and> ?lhs \<le> ?rhs")  for n
   proof -
     let ?R = "range (h n)"
     have hn_eq: "h n = (\<lambda>x. \<Sum>y\<in>?R. y * indicat_real {x. h n x = y} x)"
       by (simp add: indicator_def if_distrib fin_R cong: if_cong)
     have yind: "(\<lambda>t. y * indicator{x. h n x = y} t) integrable_on (g ` S) \<and>
                 (integral (g ` S) (\<lambda>t. y * indicator {x. h n x = y} t))
                  \<le> integral S (\<lambda>t. \<bar>det (matrix (g' t))\<bar> * y * indicator {x. h n x = y} (g t))"
        if y: "y \<in> ?R" for y::real
     proof (cases "y=0")
       case True
       then show ?thesis using gS_in_sets_leb integrable_0 by force
     next
       case False
       with that have "y > 0"
         using less_eq_real_def nonneg_h by fastforce
       have "(\<lambda>x. if x \<in> {t. h n (g t) = y} then ?D x else 0) integrable_on S"
       proof (rule measurable_bounded_by_integrable_imp_integrable)
         have "(\<lambda>x. ?D x) \<in> borel_measurable (lebesgue_on ({t. h n (g t) = y} \<inter> S))"
           apply (intro borel_measurable_abs borel_measurable_det_Jacobian [OF h_lmeas, where f=g])
           by (meson der_g IntD2 has_derivative_within_subset inf_le2)
         then have "(\<lambda>x. if x \<in> {t. h n (g t) = y} \<inter> S then ?D x else 0) \<in> borel_measurable lebesgue"
           by (rule borel_measurable_if_I [OF _ h_lmeas])
         then show "(\<lambda>x. if x \<in> {t. h n (g t) = y} then ?D x else 0) \<in> borel_measurable (lebesgue_on S)"
           by (simp add: if_if_eq_conj Int_commute borel_measurable_if [OF S, symmetric])
         show "(\<lambda>x. ?D x *\<^sub>R f (g x) /\<^sub>R y) integrable_on S"
           by (rule integrable_cmul) (use det_int_fg in auto)
         show "norm (if x \<in> {t. h n (g t) = y} then ?D x else 0) \<le> ?D x *\<^sub>R f (g x) /\<^sub>R y"
           if "x \<in> S" for x
           using nonneg_h [of n x] \<open>y > 0\<close> nonneg_fg [of x] h_le_f [of x n] that
           by (auto simp: divide_simps mult_left_mono)
       qed (use S in auto)
       then have int_det: "(\<lambda>t. \<bar>det (matrix (g' t))\<bar>) integrable_on ({t. h n (g t) = y} \<inter> S)"
         using integrable_restrict_Int by force
       have "(g ` ({t. h n (g t) = y} \<inter> S)) \<in> lmeasurable"
         apply (rule measurable_differentiable_image [OF h_lmeas])
          apply (blast intro: has_derivative_within_subset [OF der_g])
         apply (rule int_det)
         done
       moreover have "g ` ({t. h n (g t) = y} \<inter> S) = {x. h n x = y} \<inter> g ` S"
         by blast
       moreover have "measure lebesgue (g ` ({t. h n (g t) = y} \<inter> S))
                      \<le> integral ({t. h n (g t) = y} \<inter> S) (\<lambda>t. \<bar>det (matrix (g' t))\<bar>)"
         apply (rule measure_differentiable_image [OF h_lmeas _ int_det])
         apply (blast intro: has_derivative_within_subset [OF der_g])
         done
       ultimately show ?thesis
         using \<open>y > 0\<close> integral_restrict_Int [of S "{t. h n (g t) = y}" "\<lambda>t. \<bar>det (matrix (g' t))\<bar> * y"]
         apply (simp add: integrable_on_indicator integrable_on_cmult_iff integral_indicator)
         apply (simp add: indicator_def if_distrib cong: if_cong)
         done
     qed
     have hn_int: "h n integrable_on g ` S"
       apply (subst hn_eq)
       using yind by (force intro: integrable_sum [OF fin_R])
     then show ?thesis
     proof
       have "?lhs = integral (g ` S) (\<lambda>x. \<Sum>y\<in>range (h n). y * indicat_real {x. h n x = y} x)"
         by (metis hn_eq)
       also have "\<dots> = (\<Sum>y\<in>range (h n). integral (g ` S) (\<lambda>x. y * indicat_real {x. h n x = y} x))"
         by (rule integral_sum [OF fin_R]) (use yind in blast)
       also have "\<dots> \<le> (\<Sum>y\<in>range (h n). integral S (\<lambda>u. \<bar>det (matrix (g' u))\<bar> * y * indicat_real {x. h n x = y} (g u)))"
         using yind by (force intro: sum_mono)
       also have "\<dots> = integral S (\<lambda>u. \<Sum>y\<in>range (h n). \<bar>det (matrix (g' u))\<bar> * y * indicat_real {x. h n x = y} (g u))"
       proof (rule integral_sum [OF fin_R, symmetric])
         fix y assume y: "y \<in> ?R"
         with nonneg_h have "y \<ge> 0"
           by auto
         show "(\<lambda>u. \<bar>det (matrix (g' u))\<bar> * y * indicat_real {x. h n x = y} (g u)) integrable_on S"
         proof (rule measurable_bounded_by_integrable_imp_integrable)
           have "(\<lambda>x. indicat_real {x. h n x = y} (g x)) \<in> borel_measurable (lebesgue_on S)"
             using h_lmeas S
             by (auto simp: indicator_vimage [symmetric] borel_measurable_indicator_iff sets_restrict_space_iff)
           then show "(\<lambda>u. \<bar>det (matrix (g' u))\<bar> * y * indicat_real {x. h n x = y} (g u)) \<in> borel_measurable (lebesgue_on S)"
             by (intro borel_measurable_times borel_measurable_abs borel_measurable_const borel_measurable_det_Jacobian [OF S der_g])
         next
           fix x
           assume "x \<in> S"
           have "y * indicat_real {x. h n x = y} (g x) \<le> f (g x)"
             by (metis (full_types) \<open>x \<in> S\<close> h_le_f indicator_def mem_Collect_eq mult.right_neutral mult_zero_right nonneg_fg)
           with \<open>y \<ge> 0\<close> show "norm (?D x * y * indicat_real {x. h n x = y} (g x)) \<le> ?D x * f(g x)"
             by (simp add: abs_mult mult.assoc mult_left_mono)
         qed (use S det_int_fg in auto)
       qed
       also have "\<dots> = integral S (\<lambda>T. \<bar>det (matrix (g' T))\<bar> *
                                         (\<Sum>y\<in>range (h n). y * indicat_real {x. h n x = y} (g T)))"
         by (simp add: sum_distrib_left mult.assoc)
       also have "\<dots> = ?rhs"
         by (metis hn_eq)
       finally show "integral (g ` S) (h n) \<le> ?rhs" .
     qed
   qed
   have le: "integral S (\<lambda>T. \<bar>det (matrix (g' T))\<bar> * h n (g T)) \<le> ?b" for n
   proof (rule integral_le)
     show "(\<lambda>T. \<bar>det (matrix (g' T))\<bar> * h n (g T)) integrable_on S"
     proof (rule measurable_bounded_by_integrable_imp_integrable)
       have "(\<lambda>T. \<bar>det (matrix (g' T))\<bar> *\<^sub>R h n (g T)) \<in> borel_measurable (lebesgue_on S)"
       proof (intro borel_measurable_scaleR borel_measurable_abs borel_measurable_det_Jacobian \<open>S \<in> sets lebesgue\<close>)
         have eq: "{x \<in> S. f x \<le> a} = (\<Union>b \<in> (f ` S) \<inter> atMost a. {x. f x = b} \<inter> S)" for f and a::real
           by auto
         have "finite ((\<lambda>x. h n (g x)) ` S \<inter> {..a})" for a
           by (force intro: finite_subset [OF _ fin_R])
         with h_lmeas [of n] show "(\<lambda>x. h n (g x)) \<in> borel_measurable (lebesgue_on S)"
           apply (simp add: borel_measurable_vimage_halfspace_component_le \<open>S \<in> sets lebesgue\<close> sets_restrict_space_iff eq)
           by (metis (mono_tags) SUP_inf sets.finite_UN)
       qed (use der_g in blast)
       then show "(\<lambda>T. \<bar>det (matrix (g' T))\<bar> * h n (g T)) \<in> borel_measurable (lebesgue_on S)"
         by simp
       show "norm (?D x * h n (g x)) \<le> ?D x *\<^sub>R f (g x)"
         if "x \<in> S" for x
         by (simp add: h_le_f mult_left_mono nonneg_h that)
     qed (use S det_int_fg in auto)
     show "?D x * h n (g x) \<le> ?D x * f (g x)" if "x \<in> S" for x
       by (simp add: \<open>x \<in> S\<close> h_le_f mult_left_mono)
     show "(\<lambda>x. ?D x * f (g x)) integrable_on S"
       using det_int_fg by blast
   qed
   have "f integrable_on g ` S \<and> (\<lambda>k. integral (g ` S) (h k)) \<longlonglongrightarrow> integral (g ` S) f"
   proof (rule monotone_convergence_increasing)
     have "\<bar>integral (g ` S) (h n)\<bar> \<le> integral S (\<lambda>x. ?D x * f (g x))" for n
     proof -
       have "\<bar>integral (g ` S) (h n)\<bar> = integral (g ` S) (h n)"
         using hint by (simp add: integral_nonneg nonneg_h)
       also have "\<dots> \<le> integral S (\<lambda>x. ?D x * f (g x))"
         using hint le by (meson order_trans)
       finally show ?thesis .
     qed
     then show "bounded (range (\<lambda>k. integral (g ` S) (h k)))"
       by (force simp: bounded_iff)
   qed (use h_inc lim hint in auto)
   moreover have "integral (g ` S) (h n) \<le> integral S (\<lambda>x. ?D x * f (g x))" for n
     using hint by (blast intro: le order_trans)
   ultimately show ?thesis
     by (auto intro: Lim_bounded)
 qed
 
 
 lemma integral_on_image_ubound_nonneg:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real"
   assumes nonneg_fg: "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f(g x)"
       and der_g:   "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and intS: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) integrable_on S"
   shows "f integrable_on (g ` S) \<and> integral (g ` S) f \<le> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x))"
          (is "_ \<and> _ \<le> ?b")
 proof -
   let ?D = "\<lambda>x. det (matrix (g' x))"
   define S' where "S' \<equiv> {x \<in> S. ?D x * f(g x) \<noteq> 0}"
   then have der_gS': "\<And>x. x \<in> S' \<Longrightarrow> (g has_derivative g' x) (at x within S')"
     by (metis (mono_tags, lifting) der_g has_derivative_within_subset mem_Collect_eq subset_iff)
   have "(\<lambda>x. if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0) integrable_on UNIV"
     by (simp add: integrable_restrict_UNIV intS)
   then have Df_borel: "(\<lambda>x. if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0) \<in> borel_measurable lebesgue"
     using integrable_imp_measurable lebesgue_on_UNIV_eq by force
   have S': "S' \<in> sets lebesgue"
   proof -
     from Df_borel borel_measurable_vimage_open [of _ UNIV]
     have "{x. (if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0) \<in> T} \<in> sets lebesgue"
       if "open T" for T
       using that unfolding lebesgue_on_UNIV_eq
       by (fastforce simp add: dest!: spec)
     then have "{x. (if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0) \<in> -{0}} \<in> sets lebesgue"
       using open_Compl by blast
     then show ?thesis
       by (simp add: S'_def conj_ac split: if_split_asm cong: conj_cong)
   qed
   then have gS': "g ` S' \<in> sets lebesgue"
   proof (rule differentiable_image_in_sets_lebesgue)
     show "g differentiable_on S'"
       using der_g unfolding S'_def differentiable_def differentiable_on_def
       by (blast intro: has_derivative_within_subset)
   qed auto
   have f: "f \<in> borel_measurable (lebesgue_on (g ` S'))"
   proof (clarsimp simp add: borel_measurable_vimage_open)
     fix T :: "real set"
     assume "open T"
     have "{x \<in> g ` S'. f x \<in> T} = g ` {x \<in> S'. f(g x) \<in> T}"
       by blast
     moreover have "g ` {x \<in> S'. f(g x) \<in> T} \<in> sets lebesgue"
     proof (rule differentiable_image_in_sets_lebesgue)
       let ?h = "\<lambda>x. \<bar>?D x\<bar> * f (g x) /\<^sub>R \<bar>?D x\<bar>"
       have "(\<lambda>x. if x \<in> S' then \<bar>?D x\<bar> * f (g x) else 0) = (\<lambda>x. if x \<in> S then \<bar>?D x\<bar> * f (g x) else 0)"
         by (auto simp: S'_def)
       also have "\<dots> \<in> borel_measurable lebesgue"
         by (rule Df_borel)
       finally have *: "(\<lambda>x. \<bar>?D x\<bar> * f (g x)) \<in> borel_measurable (lebesgue_on S')"
         by (simp add: borel_measurable_if_D)
       have "?h \<in> borel_measurable (lebesgue_on S')"
         by (intro * S' der_gS' borel_measurable_det_Jacobian measurable) (blast intro: der_gS')
       moreover have "?h x = f(g x)" if "x \<in> S'" for x
         using that by (auto simp: S'_def)
       ultimately have "(\<lambda>x. f(g x)) \<in> borel_measurable (lebesgue_on S')"
         by (metis (no_types, lifting) measurable_lebesgue_cong)
       then show "{x \<in> S'. f (g x) \<in> T} \<in> sets lebesgue"
         by (simp add: \<open>S' \<in> sets lebesgue\<close> \<open>open T\<close> borel_measurable_vimage_open sets_restrict_space_iff)
       show "g differentiable_on {x \<in> S'. f (g x) \<in> T}"
         using der_g unfolding S'_def differentiable_def differentiable_on_def
         by (blast intro: has_derivative_within_subset)
     qed auto
     ultimately have "{x \<in> g ` S'. f x \<in> T} \<in> sets lebesgue"
       by metis
     then show "{x \<in> g ` S'. f x \<in> T} \<in> sets (lebesgue_on (g ` S'))"
       by (simp add: \<open>g ` S' \<in> sets lebesgue\<close> sets_restrict_space_iff)
   qed
   have intS': "(\<lambda>x. \<bar>?D x\<bar> * f (g x)) integrable_on S'"
     using intS
     by (rule integrable_spike_set) (auto simp: S'_def intro: empty_imp_negligible)
   have lebS': "{x \<in> S'. g x \<in> T} \<in> sets lebesgue" if "T \<subseteq> g ` S'" "T \<in> sets lebesgue" for T
   proof -
     have "g \<in> borel_measurable (lebesgue_on S')"
       using der_gS' has_derivative_continuous_on S'
       by (blast intro: continuous_imp_measurable_on_sets_lebesgue)
     moreover have "{x \<in> S'. g x \<in> U} \<in> sets lebesgue" if "negligible U" "U \<subseteq> g ` S'" for U
     proof (intro negligible_imp_sets negligible_differentiable_vimage that)
       fix x
       assume x: "x \<in> S'"
       then have "linear (g' x)"
         using der_gS' has_derivative_linear by blast
       with x show "inj (g' x)"
         by (auto simp: S'_def det_nz_iff_inj)
     qed (use der_gS' in auto)
     ultimately show ?thesis
       using double_lebesgue_sets [OF S' gS' order_refl] that by blast
   qed
   have int_gS': "f integrable_on g ` S' \<and> integral (g ` S') f \<le> integral S' (\<lambda>x. \<bar>?D x\<bar> * f(g x))"
     using integral_on_image_ubound_weak [OF S' f nonneg_fg der_gS' intS' lebS'] S'_def by blast
   have "negligible (g ` {x \<in> S. det(matrix(g' x)) = 0})"
   proof (rule baby_Sard, simp_all)
     fix x
     assume x: "x \<in> S \<and> det (matrix (g' x)) = 0"
     then show "(g has_derivative g' x) (at x within {x \<in> S. det (matrix (g' x)) = 0})"
       by (metis (no_types, lifting) der_g has_derivative_within_subset mem_Collect_eq subsetI)
     then show "rank (matrix (g' x)) < CARD('n)"
       using det_nz_iff_inj matrix_vector_mul_linear x
       by (fastforce simp add: less_rank_noninjective)
   qed
   then have negg: "negligible (g ` S - g ` {x \<in> S. ?D x \<noteq> 0})"
     by (rule negligible_subset) (auto simp: S'_def)
   have null: "g ` {x \<in> S. ?D x \<noteq> 0} - g ` S = {}"
     by (auto simp: S'_def)
   let ?F = "{x \<in> S. f (g x) \<noteq> 0}"
   have eq: "g ` S' = g ` ?F \<inter> g ` {x \<in> S. ?D x \<noteq> 0}"
     by (auto simp: S'_def image_iff)
   show ?thesis
   proof
     have "((\<lambda>x. if x \<in> g ` ?F then f x else 0) integrable_on g ` {x \<in> S. ?D x \<noteq> 0})"
       using int_gS' eq integrable_restrict_Int [where f=f]
       by simp
     then have "f integrable_on g ` {x \<in> S. ?D x \<noteq> 0}"
       by (auto simp: image_iff elim!: integrable_eq)
     then show "f integrable_on g ` S"
       apply (rule integrable_spike_set [OF _ empty_imp_negligible negligible_subset])
       using negg null by auto
     have "integral (g ` S) f = integral (g ` {x \<in> S. ?D x \<noteq> 0}) f"
       using negg by (auto intro: negligible_subset integral_spike_set)
     also have "\<dots> = integral (g ` {x \<in> S. ?D x \<noteq> 0}) (\<lambda>x. if x \<in> g ` ?F then f x else 0)"
       by (auto simp: image_iff intro!: integral_cong)
     also have "\<dots> = integral (g ` S') f"
       using  eq integral_restrict_Int by simp
     also have "\<dots> \<le> integral S' (\<lambda>x. \<bar>?D x\<bar> * f(g x))"
       by (metis int_gS')
     also have "\<dots> \<le> ?b"
       by (rule integral_subset_le [OF _ intS' intS]) (use nonneg_fg S'_def in auto)
     finally show "integral (g ` S) f \<le> ?b" .
   qed
 qed
 
 
 lemma absolutely_integrable_on_image_real:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and intS: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) absolutely_integrable_on S"
   shows "f absolutely_integrable_on (g ` S)"
 proof -
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f (g x)"
   let ?N = "{x \<in> S. f (g x) < 0}" and ?P = "{x \<in> S. f (g x) > 0}"
   have eq: "{x. (if x \<in> S then ?D x else 0) > 0} = {x \<in> S. ?D x > 0}"
            "{x. (if x \<in> S then ?D x else 0) < 0} = {x \<in> S. ?D x < 0}"
     by auto
   have "?D integrable_on S"
     using intS absolutely_integrable_on_def by blast
   then have "(\<lambda>x. if x \<in> S then ?D x else 0) integrable_on UNIV"
     by (simp add: integrable_restrict_UNIV)
   then have D_borel: "(\<lambda>x. if x \<in> S then ?D x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
     using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
   then have Dlt: "{x \<in> S. ?D x < 0} \<in> sets lebesgue"
     unfolding borel_measurable_vimage_halfspace_component_lt
     by (drule_tac x=0 in spec) (auto simp: eq)
   from D_borel have Dgt: "{x \<in> S. ?D x > 0} \<in> sets lebesgue"
     unfolding borel_measurable_vimage_halfspace_component_gt
     by (drule_tac x=0 in spec) (auto simp: eq)
 
   have dfgbm: "?D \<in> borel_measurable (lebesgue_on S)"
     using intS absolutely_integrable_on_def integrable_imp_measurable by blast
   have der_gN: "(g has_derivative g' x) (at x within ?N)" if "x \<in> ?N" for x
       using der_g has_derivative_within_subset that by force
   have "(\<lambda>x. - f x) integrable_on g ` ?N \<and>
          integral (g ` ?N) (\<lambda>x. - f x) \<le> integral ?N (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * - f (g x))"
   proof (rule integral_on_image_ubound_nonneg [OF _ der_gN])
     have 1: "?D integrable_on {x \<in> S. ?D x < 0}"
       using Dlt
       by (auto intro: set_lebesgue_integral_eq_integral [OF set_integrable_subset] intS)
     have "uminus \<circ> (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * - f (g x)) integrable_on ?N"
       by (simp add: o_def mult_less_0_iff empty_imp_negligible integrable_spike_set [OF 1])
     then show "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * - f (g x)) integrable_on ?N"
       by (simp add: integrable_neg_iff o_def)
   qed auto
   then have "f integrable_on g ` ?N"
     by (simp add: integrable_neg_iff)
   moreover have "g ` ?N = {y \<in> g ` S. f y < 0}"
     by auto
   ultimately have "f integrable_on {y \<in> g ` S. f y < 0}"
     by simp
   then have N: "f absolutely_integrable_on {y \<in> g ` S. f y < 0}"
     by (rule absolutely_integrable_absolutely_integrable_ubound) auto
 
   have der_gP: "(g has_derivative g' x) (at x within ?P)" if "x \<in> ?P" for x
       using der_g has_derivative_within_subset that by force
   have "f integrable_on g ` ?P \<and> integral (g ` ?P) f \<le> integral ?P ?D"
   proof (rule integral_on_image_ubound_nonneg [OF _ der_gP])
     have "?D integrable_on {x \<in> S. 0 < ?D x}"
       using Dgt
       by (auto intro: set_lebesgue_integral_eq_integral [OF set_integrable_subset] intS)
     then show "?D integrable_on ?P"
       apply (rule integrable_spike_set)
       by (auto simp: zero_less_mult_iff empty_imp_negligible)
   qed auto
   then have "f integrable_on g ` ?P"
     by metis
   moreover have "g ` ?P = {y \<in> g ` S. f y > 0}"
     by auto
   ultimately have "f integrable_on {y \<in> g ` S. f y > 0}"
     by simp
   then have P: "f absolutely_integrable_on {y \<in> g ` S. f y > 0}"
     by (rule absolutely_integrable_absolutely_integrable_lbound) auto
   have "(\<lambda>x. if x \<in> g ` S \<and> f x < 0 \<or> x \<in> g ` S \<and> 0 < f x then f x else 0) = (\<lambda>x. if x \<in> g ` S then f x else 0)"
     by auto
   then show ?thesis
     using absolutely_integrable_Un [OF N P] absolutely_integrable_restrict_UNIV [symmetric, where f=f]
     by simp
 qed
 
 
 proposition absolutely_integrable_on_image:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and intS: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S"
   shows "f absolutely_integrable_on (g ` S)"
   apply (rule absolutely_integrable_componentwise [OF absolutely_integrable_on_image_real [OF der_g]])
   using absolutely_integrable_component [OF intS]  by auto
 
 proposition integral_on_image_ubound:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes"\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f(g x)"
     and "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) integrable_on S"
   shows "integral (g ` S) f \<le> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x))"
   using integral_on_image_ubound_nonneg [OF assms] by simp
 
 
 subsection\<open>Change-of-variables theorem\<close>
 
 text\<open>The classic change-of-variables theorem. We have two versions with quite general hypotheses,
 the first that the transforming function has a continuous inverse, the second that the base set is
 Lebesgue measurable.\<close>
 lemma cov_invertible_nonneg_le:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and der_h: "\<And>y. y \<in> T \<Longrightarrow> (h has_derivative h' y) (at y within T)"
     and f0: "\<And>y. y \<in> T \<Longrightarrow> 0 \<le> f y"
     and hg: "\<And>x. x \<in> S \<Longrightarrow> g x \<in> T \<and> h(g x) = x"
     and gh: "\<And>y. y \<in> T \<Longrightarrow> h y \<in> S \<and> g(h y) = y"
     and id: "\<And>y. y \<in> T \<Longrightarrow> h' y \<circ> g'(h y) = id"
   shows "f integrable_on T \<and> (integral T f) \<le> b \<longleftrightarrow>
              (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) integrable_on S \<and>
              integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) \<le> b"
         (is "?lhs = ?rhs")
 proof -
   have Teq: "T = g`S" and Seq: "S = h`T"
     using hg gh image_iff by fastforce+
   have gS: "g differentiable_on S"
     by (meson der_g differentiable_def differentiable_on_def)
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f (g x)"
   show ?thesis
   proof
     assume ?lhs
     then have fT: "f integrable_on T" and intf: "integral T f \<le> b"
       by blast+
     show ?rhs
     proof
       let ?fgh = "\<lambda>x. \<bar>det (matrix (h' x))\<bar> * (\<bar>det (matrix (g' (h x)))\<bar> * f (g (h x)))"
       have ddf: "?fgh x = f x"
         if "x \<in> T" for x
       proof -
         have "matrix (h' x) ** matrix (g' (h x)) = mat 1"
           using that id[OF that] der_g[of "h x"] gh[OF that] left_inverse_linear has_derivative_linear
           by (subst matrix_compose[symmetric]) (force simp: matrix_id_mat_1 has_derivative_linear)+
         then have "\<bar>det (matrix (h' x))\<bar> * \<bar>det (matrix (g' (h x)))\<bar> = 1"
           by (metis abs_1 abs_mult det_I det_mul)
         then show ?thesis
           by (simp add: gh that)
       qed
       have "?D integrable_on (h ` T)"
       proof (intro set_lebesgue_integral_eq_integral absolutely_integrable_on_image_real)
         show "(\<lambda>x. ?fgh x) absolutely_integrable_on T"
         proof (subst absolutely_integrable_on_iff_nonneg)
           show "(\<lambda>x. ?fgh x) integrable_on T"
             using ddf fT integrable_eq by force
         qed (simp add: zero_le_mult_iff f0 gh)
       qed (use der_h in auto)
       with Seq show "(\<lambda>x. ?D x) integrable_on S"
         by simp
       have "integral S (\<lambda>x. ?D x) \<le> integral T (\<lambda>x. ?fgh x)"
         unfolding Seq
       proof (rule integral_on_image_ubound)
         show "(\<lambda>x. ?fgh x) integrable_on T"
         using ddf fT integrable_eq by force
       qed (use f0 gh der_h in auto)
       also have "\<dots> = integral T f"
         by (force simp: ddf intro: integral_cong)
       also have "\<dots> \<le> b"
         by (rule intf)
       finally show "integral S (\<lambda>x. ?D x) \<le> b" .
     qed
   next
     assume R: ?rhs
     then have "f integrable_on g ` S"
       using der_g f0 hg integral_on_image_ubound_nonneg by blast
     moreover have "integral (g ` S) f \<le> integral S (\<lambda>x. ?D x)"
       by (rule integral_on_image_ubound [OF f0 der_g]) (use R Teq in auto)
     ultimately show ?lhs
       using R by (simp add: Teq)
   qed
 qed
 
 
 lemma cov_invertible_nonneg_eq:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and "\<And>y. y \<in> T \<Longrightarrow> (h has_derivative h' y) (at y within T)"
       and "\<And>y. y \<in> T \<Longrightarrow> 0 \<le> f y"
       and "\<And>x. x \<in> S \<Longrightarrow> g x \<in> T \<and> h(g x) = x"
       and "\<And>y. y \<in> T \<Longrightarrow> h y \<in> S \<and> g(h y) = y"
       and "\<And>y. y \<in> T \<Longrightarrow> h' y \<circ> g'(h y) = id"
   shows "((\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) has_integral b) S \<longleftrightarrow> (f has_integral b) T"
   using cov_invertible_nonneg_le [OF assms]
   by (simp add: has_integral_iff) (meson eq_iff)
 
 
 lemma cov_invertible_real:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real" and g :: "real^'n::_ \<Rightarrow> real^'n::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and der_h: "\<And>y. y \<in> T \<Longrightarrow> (h has_derivative h' y) (at y within T)"
       and hg: "\<And>x. x \<in> S \<Longrightarrow> g x \<in> T \<and> h(g x) = x"
       and gh: "\<And>y. y \<in> T \<Longrightarrow> h y \<in> S \<and> g(h y) = y"
       and id: "\<And>y. y \<in> T \<Longrightarrow> h' y \<circ> g'(h y) = id"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)) = b \<longleftrightarrow>
          f absolutely_integrable_on T \<and> integral T f = b"
          (is "?lhs = ?rhs")
 proof -
   have Teq: "T = g`S" and Seq: "S = h`T"
     using hg gh image_iff by fastforce+
   let ?DP = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x)" and ?DN = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> * -f(g x)"
   have "+": "(?DP has_integral b) {x \<in> S. f (g x) > 0} \<longleftrightarrow> (f has_integral b) {y \<in> T. f y > 0}" for b
   proof (rule cov_invertible_nonneg_eq)
     have *: "(\<lambda>x. f (g x)) -` Y \<inter> {x \<in> S. f (g x) > 0}
           = ((\<lambda>x. f (g x)) -` Y \<inter> S) \<inter> {x \<in> S. f (g x) > 0}" for Y
       by auto
     show "(g has_derivative g' x) (at x within {x \<in> S. f (g x) > 0})" if "x \<in> {x \<in> S. f (g x) > 0}" for x
       using that der_g has_derivative_within_subset by fastforce
     show "(h has_derivative h' y) (at y within {y \<in> T. f y > 0})" if "y \<in> {y \<in> T. f y > 0}" for y
       using that der_h has_derivative_within_subset by fastforce
   qed (use gh hg id in auto)
   have "-": "(?DN has_integral b) {x \<in> S. f (g x) < 0} \<longleftrightarrow> ((\<lambda>x. - f x) has_integral b) {y \<in> T. f y < 0}" for b
   proof (rule cov_invertible_nonneg_eq)
     have *: "(\<lambda>x. - f (g x)) -` y \<inter> {x \<in> S. f (g x) < 0}
           = ((\<lambda>x. f (g x)) -` uminus ` y \<inter> S) \<inter> {x \<in> S. f (g x) < 0}" for y
       using image_iff by fastforce
     show "(g has_derivative g' x) (at x within {x \<in> S. f (g x) < 0})" if "x \<in> {x \<in> S. f (g x) < 0}" for x
       using that der_g has_derivative_within_subset by fastforce
     show "(h has_derivative h' y) (at y within {y \<in> T. f y < 0})" if "y \<in> {y \<in> T. f y < 0}" for y
       using that der_h has_derivative_within_subset by fastforce
   qed (use gh hg id in auto)
   show ?thesis
   proof
     assume LHS: ?lhs
     have eq: "{x. (if x \<in> S then ?DP x else 0) > 0} = {x \<in> S. ?DP x > 0}"
       "{x. (if x \<in> S then ?DP x else 0) < 0} = {x \<in> S. ?DP x < 0}"
       by auto
     have "?DP integrable_on S"
       using LHS absolutely_integrable_on_def by blast
     then have "(\<lambda>x. if x \<in> S then ?DP x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have D_borel: "(\<lambda>x. if x \<in> S then ?DP x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
       using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
     then have SN: "{x \<in> S. ?DP x < 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_halfspace_component_lt
       by (drule_tac x=0 in spec) (auto simp: eq)
     from D_borel have SP: "{x \<in> S. ?DP x > 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_halfspace_component_gt
       by (drule_tac x=0 in spec) (auto simp: eq)
     have "?DP absolutely_integrable_on {x \<in> S. ?DP x > 0}"
       using LHS by (fast intro!: set_integrable_subset [OF _, of _ S] SP)
     then have aP: "?DP absolutely_integrable_on {x \<in> S. f (g x) > 0}"
       by (rule absolutely_integrable_spike_set) (auto simp: zero_less_mult_iff empty_imp_negligible)
     have "?DP absolutely_integrable_on {x \<in> S. ?DP x < 0}"
       using LHS by (fast intro!: set_integrable_subset [OF _, of _ S] SN)
     then have aN: "?DP absolutely_integrable_on {x \<in> S. f (g x) < 0}"
       by (rule absolutely_integrable_spike_set) (auto simp: mult_less_0_iff empty_imp_negligible)
     have fN: "f integrable_on {y \<in> T. f y < 0}"
              "integral {y \<in> T. f y < 0} f = integral {x \<in> S. f (g x) < 0} ?DP"
       using "-" [of "integral {x \<in> S. f(g x) < 0} ?DN"] aN
       by (auto simp: set_lebesgue_integral_eq_integral has_integral_iff integrable_neg_iff)
     have faN: "f absolutely_integrable_on {y \<in> T. f y < 0}"
       apply (rule absolutely_integrable_integrable_bound [where g = "\<lambda>x. - f x"])
       using fN by (auto simp: integrable_neg_iff)
     have fP: "f integrable_on {y \<in> T. f y > 0}"
              "integral {y \<in> T. f y > 0} f = integral {x \<in> S. f (g x) > 0} ?DP"
       using "+" [of "integral {x \<in> S. f(g x) > 0} ?DP"] aP
       by (auto simp: set_lebesgue_integral_eq_integral has_integral_iff integrable_neg_iff)
     have faP: "f absolutely_integrable_on {y \<in> T. f y > 0}"
       apply (rule absolutely_integrable_integrable_bound [where g = f])
       using fP by auto
     have fa: "f absolutely_integrable_on ({y \<in> T. f y < 0} \<union> {y \<in> T. f y > 0})"
       by (rule absolutely_integrable_Un [OF faN faP])
     show ?rhs
     proof
       have eq: "((if x \<in> T \<and> f x < 0 \<or> x \<in> T \<and> 0 < f x then 1 else 0) * f x)
               = (if x \<in> T then 1 else 0) * f x" for x
         by auto
       show "f absolutely_integrable_on T"
         using fa by (simp add: indicator_def set_integrable_def eq)
       have [simp]: "{y \<in> T. f y < 0} \<inter> {y \<in> T. 0 < f y} = {}" for T and f :: "(real^'n::_) \<Rightarrow> real"
         by auto
       have "integral T f = integral ({y \<in> T. f y < 0} \<union> {y \<in> T. f y > 0}) f"
         by (intro empty_imp_negligible integral_spike_set) (auto simp: eq)
       also have "\<dots> = integral {y \<in> T. f y < 0} f + integral {y \<in> T. f y > 0} f"
         using fN fP by simp
       also have "\<dots> = integral {x \<in> S. f (g x) < 0} ?DP + integral {x \<in> S. 0 < f (g x)} ?DP"
         by (simp add: fN fP)
       also have "\<dots> = integral ({x \<in> S. f (g x) < 0} \<union> {x \<in> S. 0 < f (g x)}) ?DP"
         using aP aN by (simp add: set_lebesgue_integral_eq_integral)
       also have "\<dots> = integral S ?DP"
         by (intro empty_imp_negligible integral_spike_set) auto
       also have "\<dots> = b"
         using LHS by simp
       finally show "integral T f = b" .
     qed
   next
     assume RHS: ?rhs
     have eq: "{x. (if x \<in> T then f x else 0) > 0} = {x \<in> T. f x > 0}"
              "{x. (if x \<in> T then f x else 0) < 0} = {x \<in> T. f x < 0}"
       by auto
     have "f integrable_on T"
       using RHS absolutely_integrable_on_def by blast
     then have "(\<lambda>x. if x \<in> T then f x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have D_borel: "(\<lambda>x. if x \<in> T then f x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
       using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
     then have TN: "{x \<in> T. f x < 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_halfspace_component_lt
       by (drule_tac x=0 in spec) (auto simp: eq)
     from D_borel have TP: "{x \<in> T. f x > 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_halfspace_component_gt
       by (drule_tac x=0 in spec) (auto simp: eq)
     have aint: "f absolutely_integrable_on {y. y \<in> T \<and> 0 < (f y)}"
                "f absolutely_integrable_on {y. y \<in> T \<and> (f y) < 0}"
          and intT: "integral T f = b"
       using set_integrable_subset [of _ T] TP TN RHS
       by blast+
     show ?lhs
     proof
       have fN: "f integrable_on {v \<in> T. f v < 0}"
         using absolutely_integrable_on_def aint by blast
       then have DN: "(?DN has_integral integral {y \<in> T. f y < 0} (\<lambda>x. - f x)) {x \<in> S. f (g x) < 0}"
         using "-" [of "integral {y \<in> T. f y < 0} (\<lambda>x. - f x)"]
         by (simp add: has_integral_neg_iff integrable_integral)
       have aDN: "?DP absolutely_integrable_on {x \<in> S. f (g x) < 0}"
         apply (rule absolutely_integrable_integrable_bound [where g = ?DN])
         using DN hg by (fastforce simp: abs_mult integrable_neg_iff)+
       have fP: "f integrable_on {v \<in> T. f v > 0}"
         using absolutely_integrable_on_def aint by blast
       then have DP: "(?DP has_integral integral {y \<in> T. f y > 0} f) {x \<in> S. f (g x) > 0}"
         using "+" [of "integral {y \<in> T. f y > 0} f"]
         by (simp add: has_integral_neg_iff integrable_integral)
       have aDP: "?DP absolutely_integrable_on {x \<in> S. f (g x) > 0}"
         apply (rule absolutely_integrable_integrable_bound [where g = ?DP])
         using DP hg by (fastforce simp: integrable_neg_iff)+
       have eq: "(if x \<in> S then 1 else 0) * ?DP x = (if x \<in> S \<and> f (g x) < 0 \<or> x \<in> S \<and> f (g x) > 0 then 1 else 0) * ?DP x" for x
         by force
       have "?DP absolutely_integrable_on ({x \<in> S. f (g x) < 0} \<union> {x \<in> S. f (g x) > 0})"
         by (rule absolutely_integrable_Un [OF aDN aDP])
       then show I: "?DP absolutely_integrable_on S"
         by (simp add: indicator_def eq set_integrable_def)
       have [simp]: "{y \<in> S. f y < 0} \<inter> {y \<in> S. 0 < f y} = {}" for S and f :: "(real^'n::_) \<Rightarrow> real"
         by auto
       have "integral S ?DP = integral ({x \<in> S. f (g x) < 0} \<union> {x \<in> S. f (g x) > 0}) ?DP"
         by (intro empty_imp_negligible integral_spike_set) auto
       also have "\<dots> = integral {x \<in> S. f (g x) < 0} ?DP + integral {x \<in> S. 0 < f (g x)} ?DP"
         using aDN aDP by (simp add: set_lebesgue_integral_eq_integral)
       also have "\<dots> = - integral {y \<in> T. f y < 0} (\<lambda>x. - f x) + integral {y \<in> T. f y > 0} f"
         using DN DP by (auto simp: has_integral_iff)
       also have "\<dots> = integral ({x \<in> T. f x < 0} \<union> {x \<in> T. 0 < f x}) f"
         by (simp add: fN fP)
       also have "\<dots> = integral T f"
         by (intro empty_imp_negligible integral_spike_set) auto
       also have "\<dots> = b"
         using intT by simp
       finally show "integral S ?DP = b" .
     qed
   qed
 qed
 
 
 lemma cv_inv_version3:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and der_h: "\<And>y. y \<in> T \<Longrightarrow> (h has_derivative h' y) (at y within T)"
     and hg: "\<And>x. x \<in> S \<Longrightarrow> g x \<in> T \<and> h(g x) = x"
     and gh: "\<And>y. y \<in> T \<Longrightarrow> h y \<in> S \<and> g(h y) = y"
     and id: "\<And>y. y \<in> T \<Longrightarrow> h' y \<circ> g'(h y) = id"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
              integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
          \<longleftrightarrow> f absolutely_integrable_on T \<and> integral T f = b"
 proof -
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)"
   have "((\<lambda>x. \<bar>det (matrix (g' x))\<bar> * f(g x) $ i) absolutely_integrable_on S \<and> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> * (f(g x) $ i)) = b $ i) \<longleftrightarrow>
         ((\<lambda>x. f x $ i) absolutely_integrable_on T \<and> integral T (\<lambda>x. f x $ i) = b $ i)" for i
     by (rule cov_invertible_real [OF der_g der_h hg gh id])
   then have "?D absolutely_integrable_on S \<and> (?D has_integral b) S \<longleftrightarrow>
         f absolutely_integrable_on T \<and> (f has_integral b) T"
     unfolding absolutely_integrable_componentwise_iff [where f=f] has_integral_componentwise_iff [of f]
               absolutely_integrable_componentwise_iff [where f="?D"] has_integral_componentwise_iff [of ?D]
     by (auto simp: all_conj_distrib Basis_vec_def cart_eq_inner_axis [symmetric]
            has_integral_iff set_lebesgue_integral_eq_integral)
   then show ?thesis
     using absolutely_integrable_on_def by blast
 qed
 
 
 lemma cv_inv_version4:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S) \<and> invertible(matrix(g' x))"
     and hg: "\<And>x. x \<in> S \<Longrightarrow> continuous_on (g ` S) h \<and> h(g x) = x"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
              integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
          \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
 proof -
   have "\<forall>x. \<exists>h'. x \<in> S
            \<longrightarrow> (g has_derivative g' x) (at x within S) \<and> linear h' \<and> g' x \<circ> h' = id \<and> h' \<circ> g' x = id"
     using der_g matrix_invertible has_derivative_linear by blast
   then obtain h' where h':
     "\<And>x. x \<in> S
            \<Longrightarrow> (g has_derivative g' x) (at x within S) \<and>
                linear (h' x) \<and> g' x \<circ> (h' x) = id \<and> (h' x) \<circ> g' x = id"
     by metis
   show ?thesis
   proof (rule cv_inv_version3)
     show "\<And>y. y \<in> g ` S \<Longrightarrow> (h has_derivative h' (h y)) (at y within g ` S)"
       using h' hg
       by (force simp: continuous_on_eq_continuous_within intro!: has_derivative_inverse_within)
   qed (use h' hg in auto)
 qed
 
 
 theorem has_absolute_integral_change_of_variables_invertible:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and hg: "\<And>x. x \<in> S \<Longrightarrow> h(g x) = x"
       and conth: "continuous_on (g ` S) h"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and> integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b \<longleftrightarrow>
          f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
     (is "?lhs = ?rhs")
 proof -
   let ?S = "{x \<in> S. invertible (matrix (g' x))}" and ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)"
   have *: "?D absolutely_integrable_on ?S \<and> integral ?S ?D = b
            \<longleftrightarrow> f absolutely_integrable_on (g ` ?S) \<and> integral (g ` ?S) f = b"
   proof (rule cv_inv_version4)
     show "(g has_derivative g' x) (at x within ?S) \<and> invertible (matrix (g' x))"
       if "x \<in> ?S" for x
       using der_g that has_derivative_within_subset that by fastforce
     show "continuous_on (g ` ?S) h \<and> h (g x) = x"
       if "x \<in> ?S" for x
       using that continuous_on_subset [OF conth]  by (simp add: hg image_mono)
   qed
   have "(g has_derivative g' x) (at x within {x \<in> S. rank (matrix (g' x)) < CARD('m)})" if "x \<in> S" for x
     by (metis (no_types, lifting) der_g has_derivative_within_subset mem_Collect_eq subsetI that)
   then have "negligible (g ` {x \<in> S. \<not> invertible (matrix (g' x))})"
     by (auto simp: invertible_det_nz det_eq_0_rank intro: baby_Sard)
   then have neg: "negligible {x \<in> g ` S. x \<notin> g ` ?S \<and> f x \<noteq> 0}"
     by (auto intro: negligible_subset)
   have [simp]: "{x \<in> g ` ?S. x \<notin> g ` S \<and> f x \<noteq> 0} = {}"
     by auto
   have "?D absolutely_integrable_on ?S \<and> integral ?S ?D = b
     \<longleftrightarrow> ?D absolutely_integrable_on S \<and> integral S ?D = b"
     apply (intro conj_cong absolutely_integrable_spike_set_eq)
       apply(auto simp: integral_spike_set invertible_det_nz empty_imp_negligible neg)
     done
   moreover
   have "f absolutely_integrable_on (g ` ?S) \<and> integral (g ` ?S) f = b
     \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
     by (auto intro!: conj_cong absolutely_integrable_spike_set_eq integral_spike_set neg)
   ultimately
   show ?thesis
     using "*" by blast
 qed
 
 
 
 theorem has_absolute_integral_change_of_variables_compact:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "compact S"
       and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
       and inj: "inj_on g S"
   shows "((\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
              integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
       \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b)"
 proof -
   obtain h where hg: "\<And>x. x \<in> S \<Longrightarrow> h(g x) = x"
     using inj by (metis the_inv_into_f_f)
   have conth: "continuous_on (g ` S) h"
     by (metis \<open>compact S\<close> continuous_on_inv der_g has_derivative_continuous_on hg)
   show ?thesis
     by (rule has_absolute_integral_change_of_variables_invertible [OF der_g hg conth])
 qed
 
 
 lemma has_absolute_integral_change_of_variables_compact_family:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes compact: "\<And>n::nat. compact (F n)"
       and der_g: "\<And>x. x \<in> (\<Union>n. F n) \<Longrightarrow> (g has_derivative g' x) (at x within (\<Union>n. F n))"
       and inj: "inj_on g (\<Union>n. F n)"
   shows "((\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on (\<Union>n. F n) \<and>
              integral (\<Union>n. F n) (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
       \<longleftrightarrow> f absolutely_integrable_on (g ` (\<Union>n. F n)) \<and> integral (g ` (\<Union>n. F n)) f = b)"
 proof -
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f (g x)"
   let ?U = "\<lambda>n. \<Union>m\<le>n. F m"
   let ?lift = "vec::real\<Rightarrow>real^1"
   have F_leb: "F m \<in> sets lebesgue" for m
     by (simp add: compact borel_compact)
   have iff: "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f (g x)) absolutely_integrable_on (?U n) \<and>
              integral (?U n) (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f (g x)) = b
          \<longleftrightarrow> f absolutely_integrable_on (g ` (?U n)) \<and> integral (g ` (?U n)) f = b" for n b and f :: "real^'m::_ \<Rightarrow> real^'k"
   proof (rule has_absolute_integral_change_of_variables_compact)
     show "compact (?U n)"
       by (simp add: compact compact_UN)
     show "(g has_derivative g' x) (at x within (?U n))"
       if "x \<in> ?U n" for x
       using that by (blast intro!: has_derivative_within_subset [OF der_g])
     show "inj_on g (?U n)"
       using inj by (auto simp: inj_on_def)
   qed
   show ?thesis
     unfolding image_UN
   proof safe
     assume DS: "?D absolutely_integrable_on (\<Union>n. F n)"
       and b: "b = integral (\<Union>n. F n) ?D"
     have DU: "\<And>n. ?D absolutely_integrable_on (?U n)"
              "(\<lambda>n. integral (?U n) ?D) \<longlonglongrightarrow> integral (\<Union>n. F n) ?D"
       using integral_countable_UN [OF DS F_leb] by auto
     with iff have fag: "f absolutely_integrable_on g ` (?U n)"
       and fg_int: "integral (\<Union>m\<le>n. g ` F m) f = integral (?U n) ?D" for n
       by (auto simp: image_UN)
     let ?h = "\<lambda>x. if x \<in> (\<Union>m. g ` F m) then norm(f x) else 0"
     have "(\<lambda>x. if x \<in> (\<Union>m. g ` F m) then f x else 0) absolutely_integrable_on UNIV"
     proof (rule dominated_convergence_absolutely_integrable)
       show "(\<lambda>x. if x \<in> (\<Union>m\<le>k. g ` F m) then f x else 0) absolutely_integrable_on UNIV" for k
         unfolding absolutely_integrable_restrict_UNIV
         using fag by (simp add: image_UN)
       let ?nf = "\<lambda>n x. if x \<in> (\<Union>m\<le>n. g ` F m) then norm(f x) else 0"
       show "?h integrable_on UNIV"
       proof (rule monotone_convergence_increasing [THEN conjunct1])
         show "?nf k integrable_on UNIV" for k
           using fag
           unfolding integrable_restrict_UNIV absolutely_integrable_on_def by (simp add: image_UN)
         { fix n
           have "(norm \<circ> ?D) absolutely_integrable_on ?U n"
             by (intro absolutely_integrable_norm DU)
           then have "integral (g ` ?U n) (norm \<circ> f) = integral (?U n) (norm \<circ> ?D)"
             using iff [of n "vec \<circ> norm \<circ> f" "integral (?U n) (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R (?lift \<circ> norm \<circ> f) (g x))"]
             unfolding absolutely_integrable_on_1_iff integral_on_1_eq by (auto simp: o_def)
         }
         moreover have "bounded (range (\<lambda>k. integral (?U k) (norm \<circ> ?D)))"
           unfolding bounded_iff
         proof (rule exI, clarify)
           fix k
           show "norm (integral (?U k) (norm \<circ> ?D)) \<le> integral (\<Union>n. F n) (norm \<circ> ?D)"
             unfolding integral_restrict_UNIV [of _ "norm \<circ> ?D", symmetric]
           proof (rule integral_norm_bound_integral)
             show "(\<lambda>x. if x \<in> \<Union> (F ` {..k}) then (norm \<circ> ?D) x else 0) integrable_on UNIV"
               "(\<lambda>x. if x \<in> (\<Union>n. F n) then (norm \<circ> ?D) x else 0) integrable_on UNIV"
               using DU(1) DS
               unfolding absolutely_integrable_on_def o_def integrable_restrict_UNIV by auto
           qed auto
         qed
         ultimately show "bounded (range (\<lambda>k. integral UNIV (?nf k)))"
           by (simp add: integral_restrict_UNIV image_UN [symmetric] o_def)
       next
         show "(\<lambda>k. if x \<in> (\<Union>m\<le>k. g ` F m) then norm (f x) else 0)
               \<longlonglongrightarrow> (if x \<in> (\<Union>m. g ` F m) then norm (f x) else 0)" for x
           by (force intro: tendsto_eventually eventually_sequentiallyI)
       qed auto
     next
       show "(\<lambda>k. if x \<in> (\<Union>m\<le>k. g ` F m) then f x else 0)
             \<longlonglongrightarrow> (if x \<in> (\<Union>m. g ` F m) then f x else 0)" for x
       proof clarsimp
         fix m y
         assume "y \<in> F m"
         show "(\<lambda>k. if \<exists>x\<in>{..k}. g y \<in> g ` F x then f (g y) else 0) \<longlonglongrightarrow> f (g y)"
           using \<open>y \<in> F m\<close> by (force intro: tendsto_eventually eventually_sequentiallyI [of m])
       qed
     qed auto
     then show fai: "f absolutely_integrable_on (\<Union>m. g ` F m)"
       using absolutely_integrable_restrict_UNIV by blast
     show "integral ((\<Union>x. g ` F x)) f = integral (\<Union>n. F n) ?D"
     proof (rule LIMSEQ_unique)
       show "(\<lambda>n. integral (?U n) ?D) \<longlonglongrightarrow> integral (\<Union>x. g ` F x) f"
         unfolding fg_int [symmetric]
       proof (rule integral_countable_UN [OF fai])
         show "g ` F m \<in> sets lebesgue" for m
         proof (rule differentiable_image_in_sets_lebesgue [OF F_leb])
           show "g differentiable_on F m"
             by (meson der_g differentiableI UnionI differentiable_on_def differentiable_on_subset rangeI subsetI)
         qed auto
       qed
     next
       show "(\<lambda>n. integral (?U n) ?D) \<longlonglongrightarrow> integral (\<Union>n. F n) ?D"
         by (rule DU)
     qed
   next
     assume fs: "f absolutely_integrable_on (\<Union>x. g ` F x)"
       and b: "b = integral ((\<Union>x. g ` F x)) f"
     have gF_leb: "g ` F m \<in> sets lebesgue" for m
     proof (rule differentiable_image_in_sets_lebesgue [OF F_leb])
       show "g differentiable_on F m"
         using der_g unfolding differentiable_def differentiable_on_def
         by (meson Sup_upper UNIV_I UnionI has_derivative_within_subset image_eqI)
     qed auto
     have fgU: "\<And>n. f absolutely_integrable_on (\<Union>m\<le>n. g ` F m)"
       "(\<lambda>n. integral (\<Union>m\<le>n. g ` F m) f) \<longlonglongrightarrow> integral (\<Union>m. g ` F m) f"
       using integral_countable_UN [OF fs gF_leb] by auto
     with iff have DUn: "?D absolutely_integrable_on ?U n"
       and D_int: "integral (?U n) ?D = integral (\<Union>m\<le>n. g ` F m) f" for n
       by (auto simp: image_UN)
     let ?h = "\<lambda>x. if x \<in> (\<Union>n. F n) then norm(?D x) else 0"
     have "(\<lambda>x. if x \<in> (\<Union>n. F n) then ?D x else 0) absolutely_integrable_on UNIV"
     proof (rule dominated_convergence_absolutely_integrable)
       show "(\<lambda>x. if x \<in> ?U k then ?D x else 0) absolutely_integrable_on UNIV" for k
         unfolding absolutely_integrable_restrict_UNIV using DUn by simp
       let ?nD = "\<lambda>n x. if x \<in> ?U n then norm(?D x) else 0"
       show "?h integrable_on UNIV"
       proof (rule monotone_convergence_increasing [THEN conjunct1])
         show "?nD k integrable_on UNIV" for k
           using DUn
           unfolding integrable_restrict_UNIV absolutely_integrable_on_def by (simp add: image_UN)
         { fix n::nat
           have "(norm \<circ> f) absolutely_integrable_on (\<Union>m\<le>n. g ` F m)"
             apply (rule absolutely_integrable_norm)
             using fgU by blast
           then have "integral (?U n) (norm \<circ> ?D) = integral (g ` ?U n) (norm \<circ> f)"
             using iff [of n "?lift \<circ> norm \<circ> f" "integral (g ` ?U n) (?lift \<circ> norm \<circ> f)"]
             unfolding absolutely_integrable_on_1_iff integral_on_1_eq image_UN by (auto simp: o_def)
         }
         moreover have "bounded (range (\<lambda>k. integral (g ` ?U k) (norm \<circ> f)))"
           unfolding bounded_iff
         proof (rule exI, clarify)
           fix k
           show "norm (integral (g ` ?U k) (norm \<circ> f)) \<le> integral (g ` (\<Union>n. F n)) (norm \<circ> f)"
             unfolding integral_restrict_UNIV [of _ "norm \<circ> f", symmetric]
           proof (rule integral_norm_bound_integral)
             show "(\<lambda>x. if x \<in> g ` ?U k then (norm \<circ> f) x else 0) integrable_on UNIV"
                  "(\<lambda>x. if x \<in> g ` (\<Union>n. F n) then (norm \<circ> f) x else 0) integrable_on UNIV"
               using fgU fs
               unfolding absolutely_integrable_on_def o_def integrable_restrict_UNIV
               by (auto simp: image_UN)
           qed auto
         qed
         ultimately show "bounded (range (\<lambda>k. integral UNIV (?nD k)))"
           unfolding integral_restrict_UNIV image_UN [symmetric] o_def by simp
       next
         show "(\<lambda>k. if x \<in> ?U k then norm (?D x) else 0) \<longlonglongrightarrow> (if x \<in> (\<Union>n. F n) then norm (?D x) else 0)" for x
           by (force intro: tendsto_eventually eventually_sequentiallyI)
       qed auto
     next
       show "(\<lambda>k. if x \<in> ?U k then ?D x else 0) \<longlonglongrightarrow> (if x \<in> (\<Union>n. F n) then ?D x else 0)" for x
       proof clarsimp
         fix n
         assume "x \<in> F n"
         show "(\<lambda>m. if \<exists>j\<in>{..m}. x \<in> F j then ?D x else 0) \<longlonglongrightarrow> ?D x"
           using \<open>x \<in> F n\<close> by (auto intro!: tendsto_eventually eventually_sequentiallyI [of n])
       qed
     qed auto
     then show Dai: "?D absolutely_integrable_on (\<Union>n. F n)"
       unfolding absolutely_integrable_restrict_UNIV by simp
     show "integral (\<Union>n. F n) ?D = integral ((\<Union>x. g ` F x)) f"
     proof (rule LIMSEQ_unique)
       show "(\<lambda>n. integral (\<Union>m\<le>n. g ` F m) f) \<longlonglongrightarrow> integral (\<Union>x. g ` F x) f"
         by (rule fgU)
       show "(\<lambda>n. integral (\<Union>m\<le>n. g ` F m) f) \<longlonglongrightarrow> integral (\<Union>n. F n) ?D"
         unfolding D_int [symmetric] by (rule integral_countable_UN [OF Dai F_leb])
     qed
   qed
 qed
 
 
 theorem has_absolute_integral_change_of_variables:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes S: "S \<in> sets lebesgue"
     and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and inj: "inj_on g S"
   shows "(\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) = b
      \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
 proof -
   obtain C N where "fsigma C" and N: "N \<in> null_sets lebesgue" and CNS: "C \<union> N = S" and "disjnt C N"
     using lebesgue_set_almost_fsigma [OF S] .
   then obtain F :: "nat \<Rightarrow> (real^'m::_) set"
     where F: "range F \<subseteq> Collect compact" and Ceq: "C = Union(range F)"
     using fsigma_Union_compact by metis
   have "negligible N"
     using N by (simp add: negligible_iff_null_sets)
   let ?D = "\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f (g x)"
   have "?D absolutely_integrable_on C \<and> integral C ?D = b
     \<longleftrightarrow> f absolutely_integrable_on (g ` C) \<and> integral (g ` C) f = b"
     unfolding Ceq
   proof (rule has_absolute_integral_change_of_variables_compact_family)
     fix n x
     assume "x \<in> \<Union>(F ` UNIV)"
     then show "(g has_derivative g' x) (at x within \<Union>(F ` UNIV))"
       using Ceq \<open>C \<union> N = S\<close> der_g has_derivative_within_subset by blast
   next
     have "\<Union>(F ` UNIV) \<subseteq> S"
       using Ceq \<open>C \<union> N = S\<close> by blast
     then show "inj_on g (\<Union>(F ` UNIV))"
       using inj by (meson inj_on_subset)
   qed (use F in auto)
   moreover
   have "?D absolutely_integrable_on C \<and> integral C ?D = b
     \<longleftrightarrow> ?D absolutely_integrable_on S \<and> integral S ?D = b"
   proof (rule conj_cong)
     have neg: "negligible {x \<in> C - S. ?D x \<noteq> 0}" "negligible {x \<in> S - C. ?D x \<noteq> 0}"
       using CNS by (blast intro: negligible_subset [OF \<open>negligible N\<close>])+
     then show "(?D absolutely_integrable_on C) = (?D absolutely_integrable_on S)"
       by (rule absolutely_integrable_spike_set_eq)
     show "(integral C ?D = b) \<longleftrightarrow> (integral S ?D = b)"
       using integral_spike_set [OF neg] by simp
   qed
   moreover
   have "f absolutely_integrable_on (g ` C) \<and> integral (g ` C) f = b
     \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
   proof (rule conj_cong)
     have "g differentiable_on N"
       by (metis CNS der_g differentiable_def differentiable_on_def differentiable_on_subset sup.cobounded2)
     with \<open>negligible N\<close>
     have neg_gN: "negligible (g ` N)"
       by (blast intro: negligible_differentiable_image_negligible)
     have neg: "negligible {x \<in> g ` C - g ` S. f x \<noteq> 0}"
               "negligible {x \<in> g ` S - g ` C. f x \<noteq> 0}"
       using CNS by (blast intro: negligible_subset [OF neg_gN])+
     then show "(f absolutely_integrable_on g ` C) = (f absolutely_integrable_on g ` S)"
       by (rule absolutely_integrable_spike_set_eq)
     show "(integral (g ` C) f = b) \<longleftrightarrow> (integral (g ` S) f = b)"
       using integral_spike_set [OF neg] by simp
   qed
   ultimately show ?thesis
     by simp
 qed
 
 
 corollary absolutely_integrable_change_of_variables:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "S \<in> sets lebesgue"
     and "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and "inj_on g S"
   shows "f absolutely_integrable_on (g ` S)
      \<longleftrightarrow> (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S"
   using assms has_absolute_integral_change_of_variables by blast
 
 corollary integral_change_of_variables:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes S: "S \<in> sets lebesgue"
     and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_derivative g' x) (at x within S)"
     and inj: "inj_on g S"
     and disj: "(f absolutely_integrable_on (g ` S) \<or>
         (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S)"
   shows "integral (g ` S) f = integral S (\<lambda>x. \<bar>det (matrix (g' x))\<bar> *\<^sub>R f(g x))"
   using has_absolute_integral_change_of_variables [OF S der_g inj] disj
   by blast
 
 lemma has_absolute_integral_change_of_variables_1:
   fixes f :: "real \<Rightarrow> real^'n::{finite,wellorder}" and g :: "real \<Rightarrow> real"
   assumes S: "S \<in> sets lebesgue"
     and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_vector_derivative g' x) (at x within S)"
     and inj: "inj_on g S"
   shows "(\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)) = b
      \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
 proof -
   let ?lift = "vec :: real \<Rightarrow> real^1"
   let ?drop = "(\<lambda>x::real^1. x $ 1)"
   have S': "?lift ` S \<in> sets lebesgue"
     by (auto intro: differentiable_image_in_sets_lebesgue [OF S] differentiable_vec)
   have "((\<lambda>x. vec (g (x $ 1))) has_derivative (*\<^sub>R) (g' z)) (at (vec z) within ?lift ` S)"
     if "z \<in> S" for z
     using der_g [OF that]
     by (simp add: has_vector_derivative_def has_derivative_vector_1)
   then have der': "\<And>x. x \<in> ?lift ` S \<Longrightarrow>
         (?lift \<circ> g \<circ> ?drop has_derivative (*\<^sub>R) (g' (?drop x))) (at x within ?lift ` S)"
     by (auto simp: o_def)
   have inj': "inj_on (vec \<circ> g \<circ> ?drop) (vec ` S)"
     using inj by (simp add: inj_on_def)
   let ?fg = "\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)"
   have "((\<lambda>x. ?fg x $ i) absolutely_integrable_on S \<and> ((\<lambda>x. ?fg x $ i) has_integral b $ i) S
     \<longleftrightarrow> (\<lambda>x. f x $ i) absolutely_integrable_on g ` S \<and> ((\<lambda>x. f x $ i) has_integral b $ i) (g ` S))" for i
     using has_absolute_integral_change_of_variables [OF S' der' inj', of "\<lambda>x. ?lift(f (?drop x) $ i)" "?lift (b$i)"]
     unfolding integrable_on_1_iff integral_on_1_eq absolutely_integrable_on_1_iff absolutely_integrable_drop absolutely_integrable_on_def
     by (auto simp: image_comp o_def integral_vec1_eq has_integral_iff)
   then have "?fg absolutely_integrable_on S \<and> (?fg has_integral b) S
          \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> (f has_integral b) (g ` S)"
     unfolding has_integral_componentwise_iff [where y=b]
            absolutely_integrable_componentwise_iff [where f=f]
            absolutely_integrable_componentwise_iff [where f = ?fg]
     by (force simp: Basis_vec_def cart_eq_inner_axis)
   then show ?thesis
     using absolutely_integrable_on_def by blast
 qed
 
 
 corollary absolutely_integrable_change_of_variables_1:
   fixes f :: "real \<Rightarrow> real^'n::{finite,wellorder}" and g :: "real \<Rightarrow> real"
   assumes S: "S \<in> sets lebesgue"
     and der_g: "\<And>x. x \<in> S \<Longrightarrow> (g has_vector_derivative g' x) (at x within S)"
     and inj: "inj_on g S"
   shows "(f absolutely_integrable_on g ` S \<longleftrightarrow>
              (\<lambda>x. \<bar>g' x\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S)"
   using has_absolute_integral_change_of_variables_1 [OF assms] by auto
 
 
 subsection\<open>Change of variables for integrals: special case of linear function\<close>
 
 lemma has_absolute_integral_change_of_variables_linear:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "linear g"
   shows "(\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S \<and>
            integral S (\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f(g x)) = b
      \<longleftrightarrow> f absolutely_integrable_on (g ` S) \<and> integral (g ` S) f = b"
 proof (cases "det(matrix g) = 0")
   case True
   then have "negligible(g ` S)"
     using assms det_nz_iff_inj negligible_linear_singular_image by blast
   with True show ?thesis
     by (auto simp: absolutely_integrable_on_def integrable_negligible integral_negligible)
 next
   case False
   then obtain h where h: "\<And>x. x \<in> S \<Longrightarrow> h (g x) = x" "linear h"
     using assms det_nz_iff_inj linear_injective_isomorphism by metis
   show ?thesis
   proof (rule has_absolute_integral_change_of_variables_invertible)
     show "(g has_derivative g) (at x within S)" for x
       by (simp add: assms linear_imp_has_derivative)
     show "continuous_on (g ` S) h"
       using continuous_on_eq_continuous_within has_derivative_continuous linear_imp_has_derivative h by blast
   qed (use h in auto)
 qed
 
 lemma absolutely_integrable_change_of_variables_linear:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "linear g"
   shows "(\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f(g x)) absolutely_integrable_on S
      \<longleftrightarrow> f absolutely_integrable_on (g ` S)"
   using assms has_absolute_integral_change_of_variables_linear by blast
 
 lemma absolutely_integrable_on_linear_image:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "linear g"
   shows "f absolutely_integrable_on (g ` S)
      \<longleftrightarrow> (f \<circ> g) absolutely_integrable_on S \<or> det(matrix g) = 0"
   unfolding assms absolutely_integrable_change_of_variables_linear [OF assms, symmetric] absolutely_integrable_on_scaleR_iff
   by (auto simp: set_integrable_def)
 
 lemma integral_change_of_variables_linear:
   fixes f :: "real^'m::{finite,wellorder} \<Rightarrow> real^'n" and g :: "real^'m::_ \<Rightarrow> real^'m::_"
   assumes "linear g"
       and "f absolutely_integrable_on (g ` S) \<or> (f \<circ> g) absolutely_integrable_on S"
     shows "integral (g ` S) f = \<bar>det (matrix g)\<bar> *\<^sub>R integral S (f \<circ> g)"
 proof -
   have "((\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f (g x)) absolutely_integrable_on S) \<or> (f absolutely_integrable_on g ` S)"
     using absolutely_integrable_on_linear_image assms by blast
   moreover
   have ?thesis if "((\<lambda>x. \<bar>det (matrix g)\<bar> *\<^sub>R f (g x)) absolutely_integrable_on S)" "(f absolutely_integrable_on g ` S)"
     using has_absolute_integral_change_of_variables_linear [OF \<open>linear g\<close>] that
     by (auto simp: o_def)
   ultimately show ?thesis
     using absolutely_integrable_change_of_variables_linear [OF \<open>linear g\<close>]
     by blast
 qed
 
 subsection\<open>Change of variable for measure\<close>
 
 lemma has_measure_differentiable_image:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes "S \<in> sets lebesgue"
       and "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
       and "inj_on f S"
   shows "f ` S \<in> lmeasurable \<and> measure lebesgue (f ` S) = m
      \<longleftrightarrow> ((\<lambda>x. \<bar>det (matrix (f' x))\<bar>) has_integral m) S"
   using has_absolute_integral_change_of_variables [OF assms, of "\<lambda>x. (1::real^1)" "vec m"]
   unfolding absolutely_integrable_on_1_iff integral_on_1_eq integrable_on_1_iff absolutely_integrable_on_def
   by (auto simp: has_integral_iff lmeasurable_iff_integrable_on lmeasure_integral)
 
 lemma measurable_differentiable_image_eq:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes "S \<in> sets lebesgue"
       and "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
       and "inj_on f S"
   shows "f ` S \<in> lmeasurable \<longleftrightarrow> (\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   using has_measure_differentiable_image [OF assms]
   by blast
 
 lemma measurable_differentiable_image_alt:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes "S \<in> sets lebesgue"
     and "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and "inj_on f S"
   shows "f ` S \<in> lmeasurable \<longleftrightarrow> (\<lambda>x. \<bar>det (matrix (f' x))\<bar>) absolutely_integrable_on S"
   using measurable_differentiable_image_eq [OF assms]
   by (simp only: absolutely_integrable_on_iff_nonneg)
 
 lemma measure_differentiable_image_eq:
   fixes f :: "real^'n::{finite,wellorder} \<Rightarrow> real^'n::_"
   assumes S: "S \<in> sets lebesgue"
     and der_f: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
     and inj: "inj_on f S"
     and intS: "(\<lambda>x. \<bar>det (matrix (f' x))\<bar>) integrable_on S"
   shows "measure lebesgue (f ` S) = integral S (\<lambda>x. \<bar>det (matrix (f' x))\<bar>)"
   using measurable_differentiable_image_eq [OF S der_f inj]
         assms has_measure_differentiable_image by blast
 
 end
diff --git a/src/HOL/Analysis/Elementary_Metric_Spaces.thy b/src/HOL/Analysis/Elementary_Metric_Spaces.thy
--- a/src/HOL/Analysis/Elementary_Metric_Spaces.thy
+++ b/src/HOL/Analysis/Elementary_Metric_Spaces.thy
@@ -1,3258 +1,3313 @@
 (*  Author:     L C Paulson, University of Cambridge
     Author:     Amine Chaieb, University of Cambridge
     Author:     Robert Himmelmann, TU Muenchen
     Author:     Brian Huffman, Portland State University
 *)
 
 chapter \<open>Functional Analysis\<close>
 
 theory Elementary_Metric_Spaces
   imports
     Abstract_Topology_2
     Metric_Arith
 begin
 
 section \<open>Elementary Metric Spaces\<close>
 
 subsection \<open>Open and closed balls\<close>
 
 definition\<^marker>\<open>tag important\<close> ball :: "'a::metric_space \<Rightarrow> real \<Rightarrow> 'a set"
   where "ball x e = {y. dist x y < e}"
 
 definition\<^marker>\<open>tag important\<close> cball :: "'a::metric_space \<Rightarrow> real \<Rightarrow> 'a set"
   where "cball x e = {y. dist x y \<le> e}"
 
 definition\<^marker>\<open>tag important\<close> sphere :: "'a::metric_space \<Rightarrow> real \<Rightarrow> 'a set"
   where "sphere x e = {y. dist x y = e}"
 
 lemma mem_ball [simp, metric_unfold]: "y \<in> ball x e \<longleftrightarrow> dist x y < e"
   by (simp add: ball_def)
 
 lemma mem_cball [simp, metric_unfold]: "y \<in> cball x e \<longleftrightarrow> dist x y \<le> e"
   by (simp add: cball_def)
 
 lemma mem_sphere [simp]: "y \<in> sphere x e \<longleftrightarrow> dist x y = e"
   by (simp add: sphere_def)
 
 lemma ball_trivial [simp]: "ball x 0 = {}"
   by (simp add: ball_def)
 
 lemma cball_trivial [simp]: "cball x 0 = {x}"
   by (simp add: cball_def)
 
 lemma sphere_trivial [simp]: "sphere x 0 = {x}"
   by (simp add: sphere_def)
 
 lemma disjoint_ballI: "dist x y \<ge> r+s \<Longrightarrow> ball x r \<inter> ball y s = {}"
   using dist_triangle_less_add not_le by fastforce
 
 lemma disjoint_cballI: "dist x y > r + s \<Longrightarrow> cball x r \<inter> cball y s = {}"
   by (metis add_mono disjoint_iff_not_equal dist_triangle2 dual_order.trans leD mem_cball)
 
 lemma sphere_empty [simp]: "r < 0 \<Longrightarrow> sphere a r = {}"
   for a :: "'a::metric_space"
   by auto
 
 lemma centre_in_ball [simp]: "x \<in> ball x e \<longleftrightarrow> 0 < e"
   by simp
 
 lemma centre_in_cball [simp]: "x \<in> cball x e \<longleftrightarrow> 0 \<le> e"
   by simp
 
 lemma ball_subset_cball [simp, intro]: "ball x e \<subseteq> cball x e"
   by (simp add: subset_eq)
 
 lemma mem_ball_imp_mem_cball: "x \<in> ball y e \<Longrightarrow> x \<in> cball y e"
   by (auto)
 
 lemma sphere_cball [simp,intro]: "sphere z r \<subseteq> cball z r"
   by force
 
 lemma cball_diff_sphere: "cball a r - sphere a r = ball a r"
   by auto
 
 lemma subset_ball[intro]: "d \<le> e \<Longrightarrow> ball x d \<subseteq> ball x e"
   by (simp add: subset_eq)
 
 lemma subset_cball[intro]: "d \<le> e \<Longrightarrow> cball x d \<subseteq> cball x e"
   by (simp add: subset_eq)
 
 lemma mem_ball_leI: "x \<in> ball y e \<Longrightarrow> e \<le> f \<Longrightarrow> x \<in> ball y f"
   by (auto)
 
 lemma mem_cball_leI: "x \<in> cball y e \<Longrightarrow> e \<le> f \<Longrightarrow> x \<in> cball y f"
   by (auto)
 
 lemma cball_trans: "y \<in> cball z b \<Longrightarrow> x \<in> cball y a \<Longrightarrow> x \<in> cball z (b + a)"
   by metric
 
 lemma ball_max_Un: "ball a (max r s) = ball a r \<union> ball a s"
   by (simp add: set_eq_iff) arith
 
 lemma ball_min_Int: "ball a (min r s) = ball a r \<inter> ball a s"
   by (simp add: set_eq_iff)
 
 lemma cball_max_Un: "cball a (max r s) = cball a r \<union> cball a s"
   by (simp add: set_eq_iff) arith
 
 lemma cball_min_Int: "cball a (min r s) = cball a r \<inter> cball a s"
   by (simp add: set_eq_iff)
 
 lemma cball_diff_eq_sphere: "cball a r - ball a r =  sphere a r"
   by (auto simp: cball_def ball_def dist_commute)
 
 lemma open_ball [intro, simp]: "open (ball x e)"
 proof -
   have "open (dist x -` {..<e})"
     by (intro open_vimage open_lessThan continuous_intros)
   also have "dist x -` {..<e} = ball x e"
     by auto
   finally show ?thesis .
 qed
 
 lemma open_contains_ball: "open S \<longleftrightarrow> (\<forall>x\<in>S. \<exists>e>0. ball x e \<subseteq> S)"
   by (simp add: open_dist subset_eq mem_ball Ball_def dist_commute)
 
 lemma openI [intro?]: "(\<And>x. x\<in>S \<Longrightarrow> \<exists>e>0. ball x e \<subseteq> S) \<Longrightarrow> open S"
   by (auto simp: open_contains_ball)
 
 lemma openE[elim?]:
   assumes "open S" "x\<in>S"
   obtains e where "e>0" "ball x e \<subseteq> S"
   using assms unfolding open_contains_ball by auto
 
 lemma open_contains_ball_eq: "open S \<Longrightarrow> x\<in>S \<longleftrightarrow> (\<exists>e>0. ball x e \<subseteq> S)"
   by (metis open_contains_ball subset_eq centre_in_ball)
 
 lemma ball_eq_empty[simp]: "ball x e = {} \<longleftrightarrow> e \<le> 0"
   unfolding mem_ball set_eq_iff
   by (simp add: not_less) metric
 
 lemma ball_empty: "e \<le> 0 \<Longrightarrow> ball x e = {}" by simp
 
 lemma closed_cball [iff]: "closed (cball x e)"
 proof -
   have "closed (dist x -` {..e})"
     by (intro closed_vimage closed_atMost continuous_intros)
   also have "dist x -` {..e} = cball x e"
     by auto
   finally show ?thesis .
 qed
 
 lemma open_contains_cball: "open S \<longleftrightarrow> (\<forall>x\<in>S. \<exists>e>0.  cball x e \<subseteq> S)"
 proof -
   {
     fix x and e::real
     assume "x\<in>S" "e>0" "ball x e \<subseteq> S"
     then have "\<exists>d>0. cball x d \<subseteq> S" unfolding subset_eq by (rule_tac x="e/2" in exI, auto)
   }
   moreover
   {
     fix x and e::real
     assume "x\<in>S" "e>0" "cball x e \<subseteq> S"
     then have "\<exists>d>0. ball x d \<subseteq> S"
       unfolding subset_eq
       apply (rule_tac x="e/2" in exI, auto)
       done
   }
   ultimately show ?thesis
     unfolding open_contains_ball by auto
 qed
 
 lemma open_contains_cball_eq: "open S \<Longrightarrow> (\<forall>x. x \<in> S \<longleftrightarrow> (\<exists>e>0. cball x e \<subseteq> S))"
   by (metis open_contains_cball subset_eq order_less_imp_le centre_in_cball)
 
 lemma eventually_nhds_ball: "d > 0 \<Longrightarrow> eventually (\<lambda>x. x \<in> ball z d) (nhds z)"
   by (rule eventually_nhds_in_open) simp_all
 
 lemma eventually_at_ball: "d > 0 \<Longrightarrow> eventually (\<lambda>t. t \<in> ball z d \<and> t \<in> A) (at z within A)"
   unfolding eventually_at by (intro exI[of _ d]) (simp_all add: dist_commute)
 
 lemma eventually_at_ball': "d > 0 \<Longrightarrow> eventually (\<lambda>t. t \<in> ball z d \<and> t \<noteq> z \<and> t \<in> A) (at z within A)"
   unfolding eventually_at by (intro exI[of _ d]) (simp_all add: dist_commute)
 
 lemma at_within_ball: "e > 0 \<Longrightarrow> dist x y < e \<Longrightarrow> at y within ball x e = at y"
   by (subst at_within_open) auto
 
 lemma atLeastAtMost_eq_cball:
   fixes a b::real
   shows "{a .. b} = cball ((a + b)/2) ((b - a)/2)"
   by (auto simp: dist_real_def field_simps)
 
 lemma cball_eq_atLeastAtMost:
   fixes a b::real
   shows "cball a b = {a - b .. a + b}"
   by (auto simp: dist_real_def)
 
 lemma greaterThanLessThan_eq_ball:
   fixes a b::real
   shows "{a <..< b} = ball ((a + b)/2) ((b - a)/2)"
   by (auto simp: dist_real_def field_simps)
 
 lemma ball_eq_greaterThanLessThan:
   fixes a b::real
   shows "ball a b = {a - b <..< a + b}"
   by (auto simp: dist_real_def)
 
 lemma interior_ball [simp]: "interior (ball x e) = ball x e"
   by (simp add: interior_open)
 
 lemma cball_eq_empty [simp]: "cball x e = {} \<longleftrightarrow> e < 0"
   apply (simp add: set_eq_iff not_le)
   apply (metis zero_le_dist dist_self order_less_le_trans)
   done
 
 lemma cball_empty [simp]: "e < 0 \<Longrightarrow> cball x e = {}"
   by simp
 
 lemma cball_sing:
   fixes x :: "'a::metric_space"
   shows "e = 0 \<Longrightarrow> cball x e = {x}"
   by (auto simp: set_eq_iff)
 
 lemma ball_divide_subset: "d \<ge> 1 \<Longrightarrow> ball x (e/d) \<subseteq> ball x e"
   apply (cases "e \<le> 0")
   apply (simp add: ball_empty field_split_simps)
   apply (rule subset_ball)
   apply (simp add: field_split_simps)
   done
 
 lemma ball_divide_subset_numeral: "ball x (e / numeral w) \<subseteq> ball x e"
   using ball_divide_subset one_le_numeral by blast
 
 lemma cball_divide_subset: "d \<ge> 1 \<Longrightarrow> cball x (e/d) \<subseteq> cball x e"
   apply (cases "e < 0")
   apply (simp add: field_split_simps)
   apply (rule subset_cball)
   apply (metis div_by_1 frac_le not_le order_refl zero_less_one)
   done
 
 lemma cball_divide_subset_numeral: "cball x (e / numeral w) \<subseteq> cball x e"
   using cball_divide_subset one_le_numeral by blast
 
+lemma cball_scale:
+  assumes "a \<noteq> 0"
+  shows   "(\<lambda>x. a *\<^sub>R x) ` cball c r = cball (a *\<^sub>R c :: 'a :: real_normed_vector) (\<bar>a\<bar> * r)"
+proof -
+  have 1: "(\<lambda>x. a *\<^sub>R x) ` cball c r \<subseteq> cball (a *\<^sub>R c) (\<bar>a\<bar> * r)" if "a \<noteq> 0" for a r and c :: 'a
+  proof safe
+    fix x
+    assume x: "x \<in> cball c r"
+    have "dist (a *\<^sub>R c) (a *\<^sub>R x) = norm (a *\<^sub>R c - a *\<^sub>R x)"
+      by (auto simp: dist_norm)
+    also have "a *\<^sub>R c - a *\<^sub>R x = a *\<^sub>R (c - x)"
+      by (simp add: algebra_simps)
+    finally show "a *\<^sub>R x \<in> cball (a *\<^sub>R c) (\<bar>a\<bar> * r)"
+      using that x by (auto simp: dist_norm)
+  qed
+
+  have "cball (a *\<^sub>R c) (\<bar>a\<bar> * r) = (\<lambda>x. a *\<^sub>R x) ` (\<lambda>x. inverse a *\<^sub>R x) ` cball (a *\<^sub>R c) (\<bar>a\<bar> * r)"
+    unfolding image_image using assms by simp
+  also have "\<dots> \<subseteq> (\<lambda>x. a *\<^sub>R x) ` cball (inverse a *\<^sub>R (a *\<^sub>R c)) (\<bar>inverse a\<bar> * (\<bar>a\<bar> * r))"
+    using assms by (intro image_mono 1) auto
+  also have "\<dots> = (\<lambda>x. a *\<^sub>R x) ` cball c r"
+    using assms by (simp add: algebra_simps)
+  finally have "cball (a *\<^sub>R c) (\<bar>a\<bar> * r) \<subseteq> (\<lambda>x. a *\<^sub>R x) ` cball c r" .
+  moreover from assms have "(\<lambda>x. a *\<^sub>R x) ` cball c r \<subseteq> cball (a *\<^sub>R c) (\<bar>a\<bar> * r)"
+    by (intro 1) auto
+  ultimately show ?thesis by blast
+qed
+
+lemma ball_scale:
+  assumes "a \<noteq> 0"
+  shows   "(\<lambda>x. a *\<^sub>R x) ` ball c r = ball (a *\<^sub>R c :: 'a :: real_normed_vector) (\<bar>a\<bar> * r)"
+proof -
+  have 1: "(\<lambda>x. a *\<^sub>R x) ` ball c r \<subseteq> ball (a *\<^sub>R c) (\<bar>a\<bar> * r)" if "a \<noteq> 0" for a r and c :: 'a
+  proof safe
+    fix x
+    assume x: "x \<in> ball c r"
+    have "dist (a *\<^sub>R c) (a *\<^sub>R x) = norm (a *\<^sub>R c - a *\<^sub>R x)"
+      by (auto simp: dist_norm)
+    also have "a *\<^sub>R c - a *\<^sub>R x = a *\<^sub>R (c - x)"
+      by (simp add: algebra_simps)
+    finally show "a *\<^sub>R x \<in> ball (a *\<^sub>R c) (\<bar>a\<bar> * r)"
+      using that x by (auto simp: dist_norm)
+  qed
+
+  have "ball (a *\<^sub>R c) (\<bar>a\<bar> * r) = (\<lambda>x. a *\<^sub>R x) ` (\<lambda>x. inverse a *\<^sub>R x) ` ball (a *\<^sub>R c) (\<bar>a\<bar> * r)"
+    unfolding image_image using assms by simp
+  also have "\<dots> \<subseteq> (\<lambda>x. a *\<^sub>R x) ` ball (inverse a *\<^sub>R (a *\<^sub>R c)) (\<bar>inverse a\<bar> * (\<bar>a\<bar> * r))"
+    using assms by (intro image_mono 1) auto
+  also have "\<dots> = (\<lambda>x. a *\<^sub>R x) ` ball c r"
+    using assms by (simp add: algebra_simps)
+  finally have "ball (a *\<^sub>R c) (\<bar>a\<bar> * r) \<subseteq> (\<lambda>x. a *\<^sub>R x) ` ball c r" .
+  moreover from assms have "(\<lambda>x. a *\<^sub>R x) ` ball c r \<subseteq> ball (a *\<^sub>R c) (\<bar>a\<bar> * r)"
+    by (intro 1) auto
+  ultimately show ?thesis by blast
+qed
 
 subsection \<open>Limit Points\<close>
 
 lemma islimpt_approachable:
   fixes x :: "'a::metric_space"
   shows "x islimpt S \<longleftrightarrow> (\<forall>e>0. \<exists>x'\<in>S. x' \<noteq> x \<and> dist x' x < e)"
   unfolding islimpt_iff_eventually eventually_at by fast
 
 lemma islimpt_approachable_le: "x islimpt S \<longleftrightarrow> (\<forall>e>0. \<exists>x'\<in> S. x' \<noteq> x \<and> dist x' x \<le> e)"
   for x :: "'a::metric_space"
   unfolding islimpt_approachable
   using approachable_lt_le [where f="\<lambda>y. dist y x" and P="\<lambda>y. y \<notin> S \<or> y = x",
     THEN arg_cong [where f=Not]]
   by (simp add: Bex_def conj_commute conj_left_commute)
 
 lemma limpt_of_limpts: "x islimpt {y. y islimpt S} \<Longrightarrow> x islimpt S"
   for x :: "'a::metric_space"
   apply (clarsimp simp add: islimpt_approachable)
   apply (drule_tac x="e/2" in spec)
   apply (auto simp: simp del: less_divide_eq_numeral1)
   apply (drule_tac x="dist x' x" in spec)
   apply (auto simp del: less_divide_eq_numeral1)
   apply metric
   done
 
 lemma closed_limpts:  "closed {x::'a::metric_space. x islimpt S}"
   using closed_limpt limpt_of_limpts by blast
 
 lemma limpt_of_closure: "x islimpt closure S \<longleftrightarrow> x islimpt S"
   for x :: "'a::metric_space"
   by (auto simp: closure_def islimpt_Un dest: limpt_of_limpts)
 
 lemma islimpt_eq_infinite_ball: "x islimpt S \<longleftrightarrow> (\<forall>e>0. infinite(S \<inter> ball x e))"
   apply (simp add: islimpt_eq_acc_point, safe)
    apply (metis Int_commute open_ball centre_in_ball)
   by (metis open_contains_ball Int_mono finite_subset inf_commute subset_refl)
 
 lemma islimpt_eq_infinite_cball: "x islimpt S \<longleftrightarrow> (\<forall>e>0. infinite(S \<inter> cball x e))"
   apply (simp add: islimpt_eq_infinite_ball, safe)
    apply (meson Int_mono ball_subset_cball finite_subset order_refl)
   by (metis open_ball centre_in_ball finite_Int inf.absorb_iff2 inf_assoc open_contains_cball_eq)
 
 
 subsection \<open>Perfect Metric Spaces\<close>
 
 lemma perfect_choose_dist: "0 < r \<Longrightarrow> \<exists>a. a \<noteq> x \<and> dist a x < r"
   for x :: "'a::{perfect_space,metric_space}"
   using islimpt_UNIV [of x] by (simp add: islimpt_approachable)
 
 lemma cball_eq_sing:
   fixes x :: "'a::{metric_space,perfect_space}"
   shows "cball x e = {x} \<longleftrightarrow> e = 0"
 proof (rule linorder_cases)
   assume e: "0 < e"
   obtain a where "a \<noteq> x" "dist a x < e"
     using perfect_choose_dist [OF e] by auto
   then have "a \<noteq> x" "dist x a \<le> e"
     by (auto simp: dist_commute)
   with e show ?thesis by (auto simp: set_eq_iff)
 qed auto
 
 
 subsection \<open>?\<close>
 
 lemma finite_ball_include:
   fixes a :: "'a::metric_space"
   assumes "finite S" 
   shows "\<exists>e>0. S \<subseteq> ball a e"
   using assms
 proof induction
   case (insert x S)
   then obtain e0 where "e0>0" and e0:"S \<subseteq> ball a e0" by auto
   define e where "e = max e0 (2 * dist a x)"
   have "e>0" unfolding e_def using \<open>e0>0\<close> by auto
   moreover have "insert x S \<subseteq> ball a e"
     using e0 \<open>e>0\<close> unfolding e_def by auto
   ultimately show ?case by auto
 qed (auto intro: zero_less_one)
 
 lemma finite_set_avoid:
   fixes a :: "'a::metric_space"
   assumes "finite S"
   shows "\<exists>d>0. \<forall>x\<in>S. x \<noteq> a \<longrightarrow> d \<le> dist a x"
   using assms
 proof induction
   case (insert x S)
   then obtain d where "d > 0" and d: "\<forall>x\<in>S. x \<noteq> a \<longrightarrow> d \<le> dist a x"
     by blast
   show ?case
   proof (cases "x = a")
     case True
     with \<open>d > 0 \<close>d show ?thesis by auto
   next
     case False
     let ?d = "min d (dist a x)"
     from False \<open>d > 0\<close> have dp: "?d > 0"
       by auto
     from d have d': "\<forall>x\<in>S. x \<noteq> a \<longrightarrow> ?d \<le> dist a x"
       by auto
     with dp False show ?thesis
       by (metis insert_iff le_less min_less_iff_conj not_less)
   qed
 qed (auto intro: zero_less_one)
 
 lemma discrete_imp_closed:
   fixes S :: "'a::metric_space set"
   assumes e: "0 < e"
     and d: "\<forall>x \<in> S. \<forall>y \<in> S. dist y x < e \<longrightarrow> y = x"
   shows "closed S"
 proof -
   have False if C: "\<And>e. e>0 \<Longrightarrow> \<exists>x'\<in>S. x' \<noteq> x \<and> dist x' x < e" for x
   proof -
     from e have e2: "e/2 > 0" by arith
     from C[rule_format, OF e2] obtain y where y: "y \<in> S" "y \<noteq> x" "dist y x < e/2"
       by blast
     from e2 y(2) have mp: "min (e/2) (dist x y) > 0"
       by simp
     from d y C[OF mp] show ?thesis
       by metric
   qed
   then show ?thesis
     by (metis islimpt_approachable closed_limpt [where 'a='a])
 qed
 
 
 subsection \<open>Interior\<close>
 
 lemma mem_interior: "x \<in> interior S \<longleftrightarrow> (\<exists>e>0. ball x e \<subseteq> S)"
   using open_contains_ball_eq [where S="interior S"]
   by (simp add: open_subset_interior)
 
 lemma mem_interior_cball: "x \<in> interior S \<longleftrightarrow> (\<exists>e>0. cball x e \<subseteq> S)"
   by (meson ball_subset_cball interior_subset mem_interior open_contains_cball open_interior
       subset_trans)
 
 
 subsection \<open>Frontier\<close>
 
 lemma frontier_straddle:
   fixes a :: "'a::metric_space"
   shows "a \<in> frontier S \<longleftrightarrow> (\<forall>e>0. (\<exists>x\<in>S. dist a x < e) \<and> (\<exists>x. x \<notin> S \<and> dist a x < e))"
   unfolding frontier_def closure_interior
   by (auto simp: mem_interior subset_eq ball_def)
 
 
 subsection \<open>Limits\<close>
 
 proposition Lim: "(f \<longlongrightarrow> l) net \<longleftrightarrow> trivial_limit net \<or> (\<forall>e>0. eventually (\<lambda>x. dist (f x) l < e) net)"
   by (auto simp: tendsto_iff trivial_limit_eq)
 
 text \<open>Show that they yield usual definitions in the various cases.\<close>
 
 proposition Lim_within_le: "(f \<longlongrightarrow> l)(at a within S) \<longleftrightarrow>
     (\<forall>e>0. \<exists>d>0. \<forall>x\<in>S. 0 < dist x a \<and> dist x a \<le> d \<longrightarrow> dist (f x) l < e)"
   by (auto simp: tendsto_iff eventually_at_le)
 
 proposition Lim_within: "(f \<longlongrightarrow> l) (at a within S) \<longleftrightarrow>
     (\<forall>e >0. \<exists>d>0. \<forall>x \<in> S. 0 < dist x a \<and> dist x a  < d \<longrightarrow> dist (f x) l < e)"
   by (auto simp: tendsto_iff eventually_at)
 
 corollary Lim_withinI [intro?]:
   assumes "\<And>e. e > 0 \<Longrightarrow> \<exists>d>0. \<forall>x \<in> S. 0 < dist x a \<and> dist x a < d \<longrightarrow> dist (f x) l \<le> e"
   shows "(f \<longlongrightarrow> l) (at a within S)"
   apply (simp add: Lim_within, clarify)
   apply (rule ex_forward [OF assms [OF half_gt_zero]], auto)
   done
 
 proposition Lim_at: "(f \<longlongrightarrow> l) (at a) \<longleftrightarrow>
     (\<forall>e >0. \<exists>d>0. \<forall>x. 0 < dist x a \<and> dist x a < d  \<longrightarrow> dist (f x) l < e)"
   by (auto simp: tendsto_iff eventually_at)
 
 lemma Lim_transform_within_set:
   fixes a :: "'a::metric_space" and l :: "'b::metric_space"
   shows "\<lbrakk>(f \<longlongrightarrow> l) (at a within S); eventually (\<lambda>x. x \<in> S \<longleftrightarrow> x \<in> T) (at a)\<rbrakk>
          \<Longrightarrow> (f \<longlongrightarrow> l) (at a within T)"
 apply (clarsimp simp: eventually_at Lim_within)
 apply (drule_tac x=e in spec, clarify)
 apply (rename_tac k)
 apply (rule_tac x="min d k" in exI, simp)
 done
 
 text \<open>Another limit point characterization.\<close>
 
 lemma limpt_sequential_inj:
   fixes x :: "'a::metric_space"
   shows "x islimpt S \<longleftrightarrow>
          (\<exists>f. (\<forall>n::nat. f n \<in> S - {x}) \<and> inj f \<and> (f \<longlongrightarrow> x) sequentially)"
          (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then have "\<forall>e>0. \<exists>x'\<in>S. x' \<noteq> x \<and> dist x' x < e"
     by (force simp: islimpt_approachable)
   then obtain y where y: "\<And>e. e>0 \<Longrightarrow> y e \<in> S \<and> y e \<noteq> x \<and> dist (y e) x < e"
     by metis
   define f where "f \<equiv> rec_nat (y 1) (\<lambda>n fn. y (min (inverse(2 ^ (Suc n))) (dist fn x)))"
   have [simp]: "f 0 = y 1"
                "f(Suc n) = y (min (inverse(2 ^ (Suc n))) (dist (f n) x))" for n
     by (simp_all add: f_def)
   have f: "f n \<in> S \<and> (f n \<noteq> x) \<and> dist (f n) x < inverse(2 ^ n)" for n
   proof (induction n)
     case 0 show ?case
       by (simp add: y)
   next
     case (Suc n) then show ?case
       apply (auto simp: y)
       by (metis half_gt_zero_iff inverse_positive_iff_positive less_divide_eq_numeral1(1) min_less_iff_conj y zero_less_dist_iff zero_less_numeral zero_less_power)
   qed
   show ?rhs
   proof (rule_tac x=f in exI, intro conjI allI)
     show "\<And>n. f n \<in> S - {x}"
       using f by blast
     have "dist (f n) x < dist (f m) x" if "m < n" for m n
     using that
     proof (induction n)
       case 0 then show ?case by simp
     next
       case (Suc n)
       then consider "m < n" | "m = n" using less_Suc_eq by blast
       then show ?case
       proof cases
         assume "m < n"
         have "dist (f(Suc n)) x = dist (y (min (inverse(2 ^ (Suc n))) (dist (f n) x))) x"
           by simp
         also have "\<dots> < dist (f n) x"
           by (metis dist_pos_lt f min.strict_order_iff min_less_iff_conj y)
         also have "\<dots> < dist (f m) x"
           using Suc.IH \<open>m < n\<close> by blast
         finally show ?thesis .
       next
         assume "m = n" then show ?case
           by simp (metis dist_pos_lt f half_gt_zero_iff inverse_positive_iff_positive min_less_iff_conj y zero_less_numeral zero_less_power)
       qed
     qed
     then show "inj f"
       by (metis less_irrefl linorder_injI)
     show "f \<longlonglongrightarrow> x"
       apply (rule tendstoI)
       apply (rule_tac c="nat (ceiling(1/e))" in eventually_sequentiallyI)
       apply (rule less_trans [OF f [THEN conjunct2, THEN conjunct2]])
       apply (simp add: field_simps)
       by (meson le_less_trans mult_less_cancel_left not_le of_nat_less_two_power)
   qed
 next
   assume ?rhs
   then show ?lhs
     by (fastforce simp add: islimpt_approachable lim_sequentially)
 qed
 
 lemma Lim_dist_ubound:
   assumes "\<not>(trivial_limit net)"
     and "(f \<longlongrightarrow> l) net"
     and "eventually (\<lambda>x. dist a (f x) \<le> e) net"
   shows "dist a l \<le> e"
   using assms by (fast intro: tendsto_le tendsto_intros)
 
 
 subsection \<open>Continuity\<close>
 
 text\<open>Derive the epsilon-delta forms, which we often use as "definitions"\<close>
 
 proposition continuous_within_eps_delta:
   "continuous (at x within s) f \<longleftrightarrow> (\<forall>e>0. \<exists>d>0. \<forall>x'\<in> s.  dist x' x < d --> dist (f x') (f x) < e)"
   unfolding continuous_within and Lim_within  by fastforce
 
 corollary continuous_at_eps_delta:
   "continuous (at x) f \<longleftrightarrow> (\<forall>e > 0. \<exists>d > 0. \<forall>x'. dist x' x < d \<longrightarrow> dist (f x') (f x) < e)"
   using continuous_within_eps_delta [of x UNIV f] by simp
 
 lemma continuous_at_right_real_increasing:
   fixes f :: "real \<Rightarrow> real"
   assumes nondecF: "\<And>x y. x \<le> y \<Longrightarrow> f x \<le> f y"
   shows "continuous (at_right a) f \<longleftrightarrow> (\<forall>e>0. \<exists>d>0. f (a + d) - f a < e)"
   apply (simp add: greaterThan_def dist_real_def continuous_within Lim_within_le)
   apply (intro all_cong ex_cong, safe)
   apply (erule_tac x="a + d" in allE, simp)
   apply (simp add: nondecF field_simps)
   apply (drule nondecF, simp)
   done
 
 lemma continuous_at_left_real_increasing:
   assumes nondecF: "\<And> x y. x \<le> y \<Longrightarrow> f x \<le> ((f y) :: real)"
   shows "(continuous (at_left (a :: real)) f) = (\<forall>e > 0. \<exists>delta > 0. f a - f (a - delta) < e)"
   apply (simp add: lessThan_def dist_real_def continuous_within Lim_within_le)
   apply (intro all_cong ex_cong, safe)
   apply (erule_tac x="a - d" in allE, simp)
   apply (simp add: nondecF field_simps)
   apply (cut_tac x="a - d" and y=x in nondecF, simp_all)
   done
 
 text\<open>Versions in terms of open balls.\<close>
 
 lemma continuous_within_ball:
   "continuous (at x within s) f \<longleftrightarrow>
     (\<forall>e > 0. \<exists>d > 0. f ` (ball x d \<inter> s) \<subseteq> ball (f x) e)"
   (is "?lhs = ?rhs")
 proof
   assume ?lhs
   {
     fix e :: real
     assume "e > 0"
     then obtain d where d: "d>0" "\<forall>xa\<in>s. 0 < dist xa x \<and> dist xa x < d \<longrightarrow> dist (f xa) (f x) < e"
       using \<open>?lhs\<close>[unfolded continuous_within Lim_within] by auto
     {
       fix y
       assume "y \<in> f ` (ball x d \<inter> s)"
       then have "y \<in> ball (f x) e"
         using d(2)
         using \<open>e > 0\<close>
         by (auto simp: dist_commute)
     }
     then have "\<exists>d>0. f ` (ball x d \<inter> s) \<subseteq> ball (f x) e"
       using \<open>d > 0\<close>
       unfolding subset_eq ball_def by (auto simp: dist_commute)
   }
   then show ?rhs by auto
 next
   assume ?rhs
   then show ?lhs
     unfolding continuous_within Lim_within ball_def subset_eq
     apply (auto simp: dist_commute)
     apply (erule_tac x=e in allE, auto)
     done
 qed
 
 lemma continuous_at_ball:
   "continuous (at x) f \<longleftrightarrow> (\<forall>e>0. \<exists>d>0. f ` (ball x d) \<subseteq> ball (f x) e)" (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then show ?rhs
     unfolding continuous_at Lim_at subset_eq Ball_def Bex_def image_iff mem_ball
     apply auto
     apply (erule_tac x=e in allE, auto)
     apply (rule_tac x=d in exI, auto)
     apply (erule_tac x=xa in allE)
     apply (auto simp: dist_commute)
     done
 next
   assume ?rhs
   then show ?lhs
     unfolding continuous_at Lim_at subset_eq Ball_def Bex_def image_iff mem_ball
     apply auto
     apply (erule_tac x=e in allE, auto)
     apply (rule_tac x=d in exI, auto)
     apply (erule_tac x="f xa" in allE)
     apply (auto simp: dist_commute)
     done
 qed
 
 text\<open>Define setwise continuity in terms of limits within the set.\<close>
 
 lemma continuous_on_iff:
   "continuous_on s f \<longleftrightarrow>
     (\<forall>x\<in>s. \<forall>e>0. \<exists>d>0. \<forall>x'\<in>s. dist x' x < d \<longrightarrow> dist (f x') (f x) < e)"
   unfolding continuous_on_def Lim_within
   by (metis dist_pos_lt dist_self)
 
 lemma continuous_within_E:
   assumes "continuous (at x within s) f" "e>0"
   obtains d where "d>0"  "\<And>x'. \<lbrakk>x'\<in> s; dist x' x \<le> d\<rbrakk> \<Longrightarrow> dist (f x') (f x) < e"
   using assms apply (simp add: continuous_within_eps_delta)
   apply (drule spec [of _ e], clarify)
   apply (rule_tac d="d/2" in that, auto)
   done
 
 lemma continuous_onI [intro?]:
   assumes "\<And>x e. \<lbrakk>e > 0; x \<in> s\<rbrakk> \<Longrightarrow> \<exists>d>0. \<forall>x'\<in>s. dist x' x < d \<longrightarrow> dist (f x') (f x) \<le> e"
   shows "continuous_on s f"
 apply (simp add: continuous_on_iff, clarify)
 apply (rule ex_forward [OF assms [OF half_gt_zero]], auto)
 done
 
 text\<open>Some simple consequential lemmas.\<close>
 
 lemma continuous_onE:
     assumes "continuous_on s f" "x\<in>s" "e>0"
     obtains d where "d>0"  "\<And>x'. \<lbrakk>x' \<in> s; dist x' x \<le> d\<rbrakk> \<Longrightarrow> dist (f x') (f x) < e"
   using assms
   apply (simp add: continuous_on_iff)
   apply (elim ballE allE)
   apply (auto intro: that [where d="d/2" for d])
   done
 
 text\<open>The usual transformation theorems.\<close>
 
 lemma continuous_transform_within:
   fixes f g :: "'a::metric_space \<Rightarrow> 'b::topological_space"
   assumes "continuous (at x within s) f"
     and "0 < d"
     and "x \<in> s"
     and "\<And>x'. \<lbrakk>x' \<in> s; dist x' x < d\<rbrakk> \<Longrightarrow> f x' = g x'"
   shows "continuous (at x within s) g"
   using assms
   unfolding continuous_within
   by (force intro: Lim_transform_within)
 
 
 subsection \<open>Closure and Limit Characterization\<close>
 
 lemma closure_approachable:
   fixes S :: "'a::metric_space set"
   shows "x \<in> closure S \<longleftrightarrow> (\<forall>e>0. \<exists>y\<in>S. dist y x < e)"
   apply (auto simp: closure_def islimpt_approachable)
   apply (metis dist_self)
   done
 
 lemma closure_approachable_le:
   fixes S :: "'a::metric_space set"
   shows "x \<in> closure S \<longleftrightarrow> (\<forall>e>0. \<exists>y\<in>S. dist y x \<le> e)"
   unfolding closure_approachable
   using dense by force
 
 lemma closure_approachableD:
   assumes "x \<in> closure S" "e>0"
   shows "\<exists>y\<in>S. dist x y < e"
   using assms unfolding closure_approachable by (auto simp: dist_commute)
 
 lemma closed_approachable:
   fixes S :: "'a::metric_space set"
   shows "closed S \<Longrightarrow> (\<forall>e>0. \<exists>y\<in>S. dist y x < e) \<longleftrightarrow> x \<in> S"
   by (metis closure_closed closure_approachable)
 
 lemma closure_contains_Inf:
   fixes S :: "real set"
   assumes "S \<noteq> {}" "bdd_below S"
   shows "Inf S \<in> closure S"
 proof -
   have *: "\<forall>x\<in>S. Inf S \<le> x"
     using cInf_lower[of _ S] assms by metis
   {
     fix e :: real
     assume "e > 0"
     then have "Inf S < Inf S + e" by simp
     with assms obtain x where "x \<in> S" "x < Inf S + e"
       by (subst (asm) cInf_less_iff) auto
     with * have "\<exists>x\<in>S. dist x (Inf S) < e"
       by (intro bexI[of _ x]) (auto simp: dist_real_def)
   }
   then show ?thesis unfolding closure_approachable by auto
 qed
 
 lemma closure_contains_Sup:
   fixes S :: "real set"
   assumes "S \<noteq> {}" "bdd_above S"
   shows "Sup S \<in> closure S"
 proof -
   have *: "\<forall>x\<in>S. x \<le> Sup S"
     using cSup_upper[of _ S] assms by metis
   {
     fix e :: real
     assume "e > 0"
     then have "Sup S - e < Sup S" by simp
     with assms obtain x where "x \<in> S" "Sup S - e < x"
       by (subst (asm) less_cSup_iff) auto
     with * have "\<exists>x\<in>S. dist x (Sup S) < e"
       by (intro bexI[of _ x]) (auto simp: dist_real_def)
   }
   then show ?thesis unfolding closure_approachable by auto
 qed
 
 lemma not_trivial_limit_within_ball:
   "\<not> trivial_limit (at x within S) \<longleftrightarrow> (\<forall>e>0. S \<inter> ball x e - {x} \<noteq> {})"
   (is "?lhs \<longleftrightarrow> ?rhs")
 proof
   show ?rhs if ?lhs
   proof -
     {
       fix e :: real
       assume "e > 0"
       then obtain y where "y \<in> S - {x}" and "dist y x < e"
         using \<open>?lhs\<close> not_trivial_limit_within[of x S] closure_approachable[of x "S - {x}"]
         by auto
       then have "y \<in> S \<inter> ball x e - {x}"
         unfolding ball_def by (simp add: dist_commute)
       then have "S \<inter> ball x e - {x} \<noteq> {}" by blast
     }
     then show ?thesis by auto
   qed
   show ?lhs if ?rhs
   proof -
     {
       fix e :: real
       assume "e > 0"
       then obtain y where "y \<in> S \<inter> ball x e - {x}"
         using \<open>?rhs\<close> by blast
       then have "y \<in> S - {x}" and "dist y x < e"
         unfolding ball_def by (simp_all add: dist_commute)
       then have "\<exists>y \<in> S - {x}. dist y x < e"
         by auto
     }
     then show ?thesis
       using not_trivial_limit_within[of x S] closure_approachable[of x "S - {x}"]
       by auto
   qed
 qed
 
 
 subsection \<open>Boundedness\<close>
 
   (* FIXME: This has to be unified with BSEQ!! *)
 definition\<^marker>\<open>tag important\<close> (in metric_space) bounded :: "'a set \<Rightarrow> bool"
   where "bounded S \<longleftrightarrow> (\<exists>x e. \<forall>y\<in>S. dist x y \<le> e)"
 
 lemma bounded_subset_cball: "bounded S \<longleftrightarrow> (\<exists>e x. S \<subseteq> cball x e \<and> 0 \<le> e)"
   unfolding bounded_def subset_eq  by auto (meson order_trans zero_le_dist)
 
 lemma bounded_any_center: "bounded S \<longleftrightarrow> (\<exists>e. \<forall>y\<in>S. dist a y \<le> e)"
   unfolding bounded_def
   by auto (metis add.commute add_le_cancel_right dist_commute dist_triangle_le)
 
 lemma bounded_iff: "bounded S \<longleftrightarrow> (\<exists>a. \<forall>x\<in>S. norm x \<le> a)"
   unfolding bounded_any_center [where a=0]
   by (simp add: dist_norm)
 
 lemma bdd_above_norm: "bdd_above (norm ` X) \<longleftrightarrow> bounded X"
   by (simp add: bounded_iff bdd_above_def)
 
 lemma bounded_norm_comp: "bounded ((\<lambda>x. norm (f x)) ` S) = bounded (f ` S)"
   by (simp add: bounded_iff)
 
 lemma boundedI:
   assumes "\<And>x. x \<in> S \<Longrightarrow> norm x \<le> B"
   shows "bounded S"
   using assms bounded_iff by blast
 
 lemma bounded_empty [simp]: "bounded {}"
   by (simp add: bounded_def)
 
 lemma bounded_subset: "bounded T \<Longrightarrow> S \<subseteq> T \<Longrightarrow> bounded S"
   by (metis bounded_def subset_eq)
 
 lemma bounded_interior[intro]: "bounded S \<Longrightarrow> bounded(interior S)"
   by (metis bounded_subset interior_subset)
 
 lemma bounded_closure[intro]:
   assumes "bounded S"
   shows "bounded (closure S)"
 proof -
   from assms obtain x and a where a: "\<forall>y\<in>S. dist x y \<le> a"
     unfolding bounded_def by auto
   {
     fix y
     assume "y \<in> closure S"
     then obtain f where f: "\<forall>n. f n \<in> S"  "(f \<longlongrightarrow> y) sequentially"
       unfolding closure_sequential by auto
     have "\<forall>n. f n \<in> S \<longrightarrow> dist x (f n) \<le> a" using a by simp
     then have "eventually (\<lambda>n. dist x (f n) \<le> a) sequentially"
       by (simp add: f(1))
     have "dist x y \<le> a"
       apply (rule Lim_dist_ubound [of sequentially f])
       apply (rule trivial_limit_sequentially)
       apply (rule f(2))
       apply fact
       done
   }
   then show ?thesis
     unfolding bounded_def by auto
 qed
 
 lemma bounded_closure_image: "bounded (f ` closure S) \<Longrightarrow> bounded (f ` S)"
   by (simp add: bounded_subset closure_subset image_mono)
 
 lemma bounded_cball[simp,intro]: "bounded (cball x e)"
   apply (simp add: bounded_def)
   apply (rule_tac x=x in exI)
   apply (rule_tac x=e in exI, auto)
   done
 
 lemma bounded_ball[simp,intro]: "bounded (ball x e)"
   by (metis ball_subset_cball bounded_cball bounded_subset)
 
 lemma bounded_Un[simp]: "bounded (S \<union> T) \<longleftrightarrow> bounded S \<and> bounded T"
   by (auto simp: bounded_def) (metis Un_iff bounded_any_center le_max_iff_disj)
 
 lemma bounded_Union[intro]: "finite F \<Longrightarrow> \<forall>S\<in>F. bounded S \<Longrightarrow> bounded (\<Union>F)"
   by (induct rule: finite_induct[of F]) auto
 
 lemma bounded_UN [intro]: "finite A \<Longrightarrow> \<forall>x\<in>A. bounded (B x) \<Longrightarrow> bounded (\<Union>x\<in>A. B x)"
   by (induct set: finite) auto
 
 lemma bounded_insert [simp]: "bounded (insert x S) \<longleftrightarrow> bounded S"
 proof -
   have "\<forall>y\<in>{x}. dist x y \<le> 0"
     by simp
   then have "bounded {x}"
     unfolding bounded_def by fast
   then show ?thesis
     by (metis insert_is_Un bounded_Un)
 qed
 
 lemma bounded_subset_ballI: "S \<subseteq> ball x r \<Longrightarrow> bounded S"
   by (meson bounded_ball bounded_subset)
 
 lemma bounded_subset_ballD:
   assumes "bounded S" shows "\<exists>r. 0 < r \<and> S \<subseteq> ball x r"
 proof -
   obtain e::real and y where "S \<subseteq> cball y e" "0 \<le> e"
     using assms by (auto simp: bounded_subset_cball)
   then show ?thesis
     by (intro exI[where x="dist x y + e + 1"]) metric
 qed
 
 lemma finite_imp_bounded [intro]: "finite S \<Longrightarrow> bounded S"
   by (induct set: finite) simp_all
 
 lemma bounded_Int[intro]: "bounded S \<or> bounded T \<Longrightarrow> bounded (S \<inter> T)"
   by (metis Int_lower1 Int_lower2 bounded_subset)
 
 lemma bounded_diff[intro]: "bounded S \<Longrightarrow> bounded (S - T)"
   by (metis Diff_subset bounded_subset)
 
 lemma bounded_dist_comp:
   assumes "bounded (f ` S)" "bounded (g ` S)"
   shows "bounded ((\<lambda>x. dist (f x) (g x)) ` S)"
 proof -
   from assms obtain M1 M2 where *: "dist (f x) undefined \<le> M1" "dist undefined (g x) \<le> M2" if "x \<in> S" for x
     by (auto simp: bounded_any_center[of _ undefined] dist_commute)
   have "dist (f x) (g x) \<le> M1 + M2" if "x \<in> S" for x
     using *[OF that]
     by metric
   then show ?thesis
     by (auto intro!: boundedI)
 qed
 
 lemma bounded_Times:
   assumes "bounded s" "bounded t"
   shows "bounded (s \<times> t)"
 proof -
   obtain x y a b where "\<forall>z\<in>s. dist x z \<le> a" "\<forall>z\<in>t. dist y z \<le> b"
     using assms [unfolded bounded_def] by auto
   then have "\<forall>z\<in>s \<times> t. dist (x, y) z \<le> sqrt (a\<^sup>2 + b\<^sup>2)"
     by (auto simp: dist_Pair_Pair real_sqrt_le_mono add_mono power_mono)
   then show ?thesis unfolding bounded_any_center [where a="(x, y)"] by auto
 qed
 
 
 subsection \<open>Compactness\<close>
 
 lemma compact_imp_bounded:
   assumes "compact U"
   shows "bounded U"
 proof -
   have "compact U" "\<forall>x\<in>U. open (ball x 1)" "U \<subseteq> (\<Union>x\<in>U. ball x 1)"
     using assms by auto
   then obtain D where D: "D \<subseteq> U" "finite D" "U \<subseteq> (\<Union>x\<in>D. ball x 1)"
     by (metis compactE_image)
   from \<open>finite D\<close> have "bounded (\<Union>x\<in>D. ball x 1)"
     by (simp add: bounded_UN)
   then show "bounded U" using \<open>U \<subseteq> (\<Union>x\<in>D. ball x 1)\<close>
     by (rule bounded_subset)
 qed
 
 lemma closure_Int_ball_not_empty:
   assumes "S \<subseteq> closure T" "x \<in> S" "r > 0"
   shows "T \<inter> ball x r \<noteq> {}"
   using assms centre_in_ball closure_iff_nhds_not_empty by blast
 
 lemma compact_sup_maxdistance:
   fixes s :: "'a::metric_space set"
   assumes "compact s"
     and "s \<noteq> {}"
   shows "\<exists>x\<in>s. \<exists>y\<in>s. \<forall>u\<in>s. \<forall>v\<in>s. dist u v \<le> dist x y"
 proof -
   have "compact (s \<times> s)"
     using \<open>compact s\<close> by (intro compact_Times)
   moreover have "s \<times> s \<noteq> {}"
     using \<open>s \<noteq> {}\<close> by auto
   moreover have "continuous_on (s \<times> s) (\<lambda>x. dist (fst x) (snd x))"
     by (intro continuous_at_imp_continuous_on ballI continuous_intros)
   ultimately show ?thesis
     using continuous_attains_sup[of "s \<times> s" "\<lambda>x. dist (fst x) (snd x)"] by auto
 qed
 
 
 subsubsection\<open>Totally bounded\<close>
 
 lemma cauchy_def: "Cauchy s \<longleftrightarrow> (\<forall>e>0. \<exists>N. \<forall>m n. m \<ge> N \<and> n \<ge> N \<longrightarrow> dist (s m) (s n) < e)"
   unfolding Cauchy_def by metis
 
 proposition seq_compact_imp_totally_bounded:
   assumes "seq_compact s"
   shows "\<forall>e>0. \<exists>k. finite k \<and> k \<subseteq> s \<and> s \<subseteq> (\<Union>x\<in>k. ball x e)"
 proof -
   { fix e::real assume "e > 0" assume *: "\<And>k. finite k \<Longrightarrow> k \<subseteq> s \<Longrightarrow> \<not> s \<subseteq> (\<Union>x\<in>k. ball x e)"
     let ?Q = "\<lambda>x n r. r \<in> s \<and> (\<forall>m < (n::nat). \<not> (dist (x m) r < e))"
     have "\<exists>x. \<forall>n::nat. ?Q x n (x n)"
     proof (rule dependent_wellorder_choice)
       fix n x assume "\<And>y. y < n \<Longrightarrow> ?Q x y (x y)"
       then have "\<not> s \<subseteq> (\<Union>x\<in>x ` {0..<n}. ball x e)"
         using *[of "x ` {0 ..< n}"] by (auto simp: subset_eq)
       then obtain z where z:"z\<in>s" "z \<notin> (\<Union>x\<in>x ` {0..<n}. ball x e)"
         unfolding subset_eq by auto
       show "\<exists>r. ?Q x n r"
         using z by auto
     qed simp
     then obtain x where "\<forall>n::nat. x n \<in> s" and x:"\<And>n m. m < n \<Longrightarrow> \<not> (dist (x m) (x n) < e)"
       by blast
     then obtain l r where "l \<in> s" and r:"strict_mono  r" and "((x \<circ> r) \<longlongrightarrow> l) sequentially"
       using assms by (metis seq_compact_def)
     from this(3) have "Cauchy (x \<circ> r)"
       using LIMSEQ_imp_Cauchy by auto
     then obtain N::nat where "\<And>m n. N \<le> m \<Longrightarrow> N \<le> n \<Longrightarrow> dist ((x \<circ> r) m) ((x \<circ> r) n) < e"
       unfolding cauchy_def using \<open>e > 0\<close> by blast
     then have False
       using x[of "r N" "r (N+1)"] r by (auto simp: strict_mono_def) }
   then show ?thesis
     by metis
 qed
 
 subsubsection\<open>Heine-Borel theorem\<close>
 
 proposition seq_compact_imp_Heine_Borel:
   fixes s :: "'a :: metric_space set"
   assumes "seq_compact s"
   shows "compact s"
 proof -
   from seq_compact_imp_totally_bounded[OF \<open>seq_compact s\<close>]
   obtain f where f: "\<forall>e>0. finite (f e) \<and> f e \<subseteq> s \<and> s \<subseteq> (\<Union>x\<in>f e. ball x e)"
     unfolding choice_iff' ..
   define K where "K = (\<lambda>(x, r). ball x r) ` ((\<Union>e \<in> \<rat> \<inter> {0 <..}. f e) \<times> \<rat>)"
   have "countably_compact s"
     using \<open>seq_compact s\<close> by (rule seq_compact_imp_countably_compact)
   then show "compact s"
   proof (rule countably_compact_imp_compact)
     show "countable K"
       unfolding K_def using f
       by (auto intro: countable_finite countable_subset countable_rat
                intro!: countable_image countable_SIGMA countable_UN)
     show "\<forall>b\<in>K. open b" by (auto simp: K_def)
   next
     fix T x
     assume T: "open T" "x \<in> T" and x: "x \<in> s"
     from openE[OF T] obtain e where "0 < e" "ball x e \<subseteq> T"
       by auto
     then have "0 < e / 2" "ball x (e / 2) \<subseteq> T"
       by auto
     from Rats_dense_in_real[OF \<open>0 < e / 2\<close>] obtain r where "r \<in> \<rat>" "0 < r" "r < e / 2"
       by auto
     from f[rule_format, of r] \<open>0 < r\<close> \<open>x \<in> s\<close> obtain k where "k \<in> f r" "x \<in> ball k r"
       by auto
     from \<open>r \<in> \<rat>\<close> \<open>0 < r\<close> \<open>k \<in> f r\<close> have "ball k r \<in> K"
       by (auto simp: K_def)
     then show "\<exists>b\<in>K. x \<in> b \<and> b \<inter> s \<subseteq> T"
     proof (rule bexI[rotated], safe)
       fix y
       assume "y \<in> ball k r"
       with \<open>r < e / 2\<close> \<open>x \<in> ball k r\<close> have "dist x y < e"
         by (intro dist_triangle_half_r [of k _ e]) (auto simp: dist_commute)
       with \<open>ball x e \<subseteq> T\<close> show "y \<in> T"
         by auto
     next
       show "x \<in> ball k r" by fact
     qed
   qed
 qed
 
 proposition compact_eq_seq_compact_metric:
   "compact (s :: 'a::metric_space set) \<longleftrightarrow> seq_compact s"
   using compact_imp_seq_compact seq_compact_imp_Heine_Borel by blast
 
 proposition compact_def: \<comment> \<open>this is the definition of compactness in HOL Light\<close>
   "compact (S :: 'a::metric_space set) \<longleftrightarrow>
    (\<forall>f. (\<forall>n. f n \<in> S) \<longrightarrow> (\<exists>l\<in>S. \<exists>r::nat\<Rightarrow>nat. strict_mono r \<and> (f \<circ> r) \<longlonglongrightarrow> l))"
   unfolding compact_eq_seq_compact_metric seq_compact_def by auto
 
 subsubsection \<open>Complete the chain of compactness variants\<close>
 
 proposition compact_eq_Bolzano_Weierstrass:
   fixes s :: "'a::metric_space set"
   shows "compact s \<longleftrightarrow> (\<forall>t. infinite t \<and> t \<subseteq> s --> (\<exists>x \<in> s. x islimpt t))"
   (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then show ?rhs
     using Heine_Borel_imp_Bolzano_Weierstrass[of s] by auto
 next
   assume ?rhs
   then show ?lhs
     unfolding compact_eq_seq_compact_metric by (rule Bolzano_Weierstrass_imp_seq_compact)
 qed
 
 proposition Bolzano_Weierstrass_imp_bounded:
   "\<forall>t. infinite t \<and> t \<subseteq> s \<longrightarrow> (\<exists>x \<in> s. x islimpt t) \<Longrightarrow> bounded s"
   using compact_imp_bounded unfolding compact_eq_Bolzano_Weierstrass .
 
 
 subsection \<open>Banach fixed point theorem\<close>
   
 theorem banach_fix:\<comment> \<open>TODO: rename to \<open>Banach_fix\<close>\<close>
   assumes s: "complete s" "s \<noteq> {}"
     and c: "0 \<le> c" "c < 1"
     and f: "f ` s \<subseteq> s"
     and lipschitz: "\<forall>x\<in>s. \<forall>y\<in>s. dist (f x) (f y) \<le> c * dist x y"
   shows "\<exists>!x\<in>s. f x = x"
 proof -
   from c have "1 - c > 0" by simp
 
   from s(2) obtain z0 where z0: "z0 \<in> s" by blast
   define z where "z n = (f ^^ n) z0" for n
   with f z0 have z_in_s: "z n \<in> s" for n :: nat
     by (induct n) auto
   define d where "d = dist (z 0) (z 1)"
 
   have fzn: "f (z n) = z (Suc n)" for n
     by (simp add: z_def)
   have cf_z: "dist (z n) (z (Suc n)) \<le> (c ^ n) * d" for n :: nat
   proof (induct n)
     case 0
     then show ?case
       by (simp add: d_def)
   next
     case (Suc m)
     with \<open>0 \<le> c\<close> have "c * dist (z m) (z (Suc m)) \<le> c ^ Suc m * d"
       using mult_left_mono[of "dist (z m) (z (Suc m))" "c ^ m * d" c] by simp
     then show ?case
       using lipschitz[THEN bspec[where x="z m"], OF z_in_s, THEN bspec[where x="z (Suc m)"], OF z_in_s]
       by (simp add: fzn mult_le_cancel_left)
   qed
 
   have cf_z2: "(1 - c) * dist (z m) (z (m + n)) \<le> (c ^ m) * d * (1 - c ^ n)" for n m :: nat
   proof (induct n)
     case 0
     show ?case by simp
   next
     case (Suc k)
     from c have "(1 - c) * dist (z m) (z (m + Suc k)) \<le>
         (1 - c) * (dist (z m) (z (m + k)) + dist (z (m + k)) (z (Suc (m + k))))"
       by (simp add: dist_triangle)
     also from c cf_z[of "m + k"] have "\<dots> \<le> (1 - c) * (dist (z m) (z (m + k)) + c ^ (m + k) * d)"
       by simp
     also from Suc have "\<dots> \<le> c ^ m * d * (1 - c ^ k) + (1 - c) * c ^ (m + k) * d"
       by (simp add: field_simps)
     also have "\<dots> = (c ^ m) * (d * (1 - c ^ k) + (1 - c) * c ^ k * d)"
       by (simp add: power_add field_simps)
     also from c have "\<dots> \<le> (c ^ m) * d * (1 - c ^ Suc k)"
       by (simp add: field_simps)
     finally show ?case by simp
   qed
 
   have "\<exists>N. \<forall>m n. N \<le> m \<and> N \<le> n \<longrightarrow> dist (z m) (z n) < e" if "e > 0" for e
   proof (cases "d = 0")
     case True
     from \<open>1 - c > 0\<close> have "(1 - c) * x \<le> 0 \<longleftrightarrow> x \<le> 0" for x
       by (metis mult_zero_left mult.commute real_mult_le_cancel_iff1)
     with c cf_z2[of 0] True have "z n = z0" for n
       by (simp add: z_def)
     with \<open>e > 0\<close> show ?thesis by simp
   next
     case False
     with zero_le_dist[of "z 0" "z 1"] have "d > 0"
       by (metis d_def less_le)
     with \<open>1 - c > 0\<close> \<open>e > 0\<close> have "0 < e * (1 - c) / d"
       by simp
     with c obtain N where N: "c ^ N < e * (1 - c) / d"
       using real_arch_pow_inv[of "e * (1 - c) / d" c] by auto
     have *: "dist (z m) (z n) < e" if "m > n" and as: "m \<ge> N" "n \<ge> N" for m n :: nat
     proof -
       from c \<open>n \<ge> N\<close> have *: "c ^ n \<le> c ^ N"
         using power_decreasing[OF \<open>n\<ge>N\<close>, of c] by simp
       from c \<open>m > n\<close> have "1 - c ^ (m - n) > 0"
         using power_strict_mono[of c 1 "m - n"] by simp
       with \<open>d > 0\<close> \<open>0 < 1 - c\<close> have **: "d * (1 - c ^ (m - n)) / (1 - c) > 0"
         by simp
       from cf_z2[of n "m - n"] \<open>m > n\<close>
       have "dist (z m) (z n) \<le> c ^ n * d * (1 - c ^ (m - n)) / (1 - c)"
         by (simp add: pos_le_divide_eq[OF \<open>1 - c > 0\<close>] mult.commute dist_commute)
       also have "\<dots> \<le> c ^ N * d * (1 - c ^ (m - n)) / (1 - c)"
         using mult_right_mono[OF * order_less_imp_le[OF **]]
         by (simp add: mult.assoc)
       also have "\<dots> < (e * (1 - c) / d) * d * (1 - c ^ (m - n)) / (1 - c)"
         using mult_strict_right_mono[OF N **] by (auto simp: mult.assoc)
       also from c \<open>d > 0\<close> \<open>1 - c > 0\<close> have "\<dots> = e * (1 - c ^ (m - n))"
         by simp
       also from c \<open>1 - c ^ (m - n) > 0\<close> \<open>e > 0\<close> have "\<dots> \<le> e"
         using mult_right_le_one_le[of e "1 - c ^ (m - n)"] by auto
       finally show ?thesis by simp
     qed
     have "dist (z n) (z m) < e" if "N \<le> m" "N \<le> n" for m n :: nat
     proof (cases "n = m")
       case True
       with \<open>e > 0\<close> show ?thesis by simp
     next
       case False
       with *[of n m] *[of m n] and that show ?thesis
         by (auto simp: dist_commute nat_neq_iff)
     qed
     then show ?thesis by auto
   qed
   then have "Cauchy z"
     by (simp add: cauchy_def)
   then obtain x where "x\<in>s" and x:"(z \<longlongrightarrow> x) sequentially"
     using s(1)[unfolded compact_def complete_def, THEN spec[where x=z]] and z_in_s by auto
 
   define e where "e = dist (f x) x"
   have "e = 0"
   proof (rule ccontr)
     assume "e \<noteq> 0"
     then have "e > 0"
       unfolding e_def using zero_le_dist[of "f x" x]
       by (metis dist_eq_0_iff dist_nz e_def)
     then obtain N where N:"\<forall>n\<ge>N. dist (z n) x < e / 2"
       using x[unfolded lim_sequentially, THEN spec[where x="e/2"]] by auto
     then have N':"dist (z N) x < e / 2" by auto
     have *: "c * dist (z N) x \<le> dist (z N) x"
       unfolding mult_le_cancel_right2
       using zero_le_dist[of "z N" x] and c
       by (metis dist_eq_0_iff dist_nz order_less_asym less_le)
     have "dist (f (z N)) (f x) \<le> c * dist (z N) x"
       using lipschitz[THEN bspec[where x="z N"], THEN bspec[where x=x]]
       using z_in_s[of N] \<open>x\<in>s\<close>
       using c
       by auto
     also have "\<dots> < e / 2"
       using N' and c using * by auto
     finally show False
       unfolding fzn
       using N[THEN spec[where x="Suc N"]] and dist_triangle_half_r[of "z (Suc N)" "f x" e x]
       unfolding e_def
       by auto
   qed
   then have "f x = x" by (auto simp: e_def)
   moreover have "y = x" if "f y = y" "y \<in> s" for y
   proof -
     from \<open>x \<in> s\<close> \<open>f x = x\<close> that have "dist x y \<le> c * dist x y"
       using lipschitz[THEN bspec[where x=x], THEN bspec[where x=y]] by simp
     with c and zero_le_dist[of x y] have "dist x y = 0"
       by (simp add: mult_le_cancel_right1)
     then show ?thesis by simp
   qed
   ultimately show ?thesis
     using \<open>x\<in>s\<close> by blast
 qed
 
 
 subsection \<open>Edelstein fixed point theorem\<close>
 
 theorem edelstein_fix:\<comment> \<open>TODO: rename to \<open>Edelstein_fix\<close>\<close>
   fixes s :: "'a::metric_space set"
   assumes s: "compact s" "s \<noteq> {}"
     and gs: "(g ` s) \<subseteq> s"
     and dist: "\<forall>x\<in>s. \<forall>y\<in>s. x \<noteq> y \<longrightarrow> dist (g x) (g y) < dist x y"
   shows "\<exists>!x\<in>s. g x = x"
 proof -
   let ?D = "(\<lambda>x. (x, x)) ` s"
   have D: "compact ?D" "?D \<noteq> {}"
     by (rule compact_continuous_image)
        (auto intro!: s continuous_Pair continuous_ident simp: continuous_on_eq_continuous_within)
 
   have "\<And>x y e. x \<in> s \<Longrightarrow> y \<in> s \<Longrightarrow> 0 < e \<Longrightarrow> dist y x < e \<Longrightarrow> dist (g y) (g x) < e"
     using dist by fastforce
   then have "continuous_on s g"
     by (auto simp: continuous_on_iff)
   then have cont: "continuous_on ?D (\<lambda>x. dist ((g \<circ> fst) x) (snd x))"
     unfolding continuous_on_eq_continuous_within
     by (intro continuous_dist ballI continuous_within_compose)
        (auto intro!: continuous_fst continuous_snd continuous_ident simp: image_image)
 
   obtain a where "a \<in> s" and le: "\<And>x. x \<in> s \<Longrightarrow> dist (g a) a \<le> dist (g x) x"
     using continuous_attains_inf[OF D cont] by auto
 
   have "g a = a"
   proof (rule ccontr)
     assume "g a \<noteq> a"
     with \<open>a \<in> s\<close> gs have "dist (g (g a)) (g a) < dist (g a) a"
       by (intro dist[rule_format]) auto
     moreover have "dist (g a) a \<le> dist (g (g a)) (g a)"
       using \<open>a \<in> s\<close> gs by (intro le) auto
     ultimately show False by auto
   qed
   moreover have "\<And>x. x \<in> s \<Longrightarrow> g x = x \<Longrightarrow> x = a"
     using dist[THEN bspec[where x=a]] \<open>g a = a\<close> and \<open>a\<in>s\<close> by auto
   ultimately show "\<exists>!x\<in>s. g x = x"
     using \<open>a \<in> s\<close> by blast
 qed
 
 subsection \<open>The diameter of a set\<close>
 
 definition\<^marker>\<open>tag important\<close> diameter :: "'a::metric_space set \<Rightarrow> real" where
   "diameter S = (if S = {} then 0 else SUP (x,y)\<in>S\<times>S. dist x y)"
 
 lemma diameter_empty [simp]: "diameter{} = 0"
   by (auto simp: diameter_def)
 
 lemma diameter_singleton [simp]: "diameter{x} = 0"
   by (auto simp: diameter_def)
 
 lemma diameter_le:
   assumes "S \<noteq> {} \<or> 0 \<le> d"
       and no: "\<And>x y. \<lbrakk>x \<in> S; y \<in> S\<rbrakk> \<Longrightarrow> norm(x - y) \<le> d"
     shows "diameter S \<le> d"
 using assms
   by (auto simp: dist_norm diameter_def intro: cSUP_least)
 
 lemma diameter_bounded_bound:
   fixes s :: "'a :: metric_space set"
   assumes s: "bounded s" "x \<in> s" "y \<in> s"
   shows "dist x y \<le> diameter s"
 proof -
   from s obtain z d where z: "\<And>x. x \<in> s \<Longrightarrow> dist z x \<le> d"
     unfolding bounded_def by auto
   have "bdd_above (case_prod dist ` (s\<times>s))"
   proof (intro bdd_aboveI, safe)
     fix a b
     assume "a \<in> s" "b \<in> s"
     with z[of a] z[of b] dist_triangle[of a b z]
     show "dist a b \<le> 2 * d"
       by (simp add: dist_commute)
   qed
   moreover have "(x,y) \<in> s\<times>s" using s by auto
   ultimately have "dist x y \<le> (SUP (x,y)\<in>s\<times>s. dist x y)"
     by (rule cSUP_upper2) simp
   with \<open>x \<in> s\<close> show ?thesis
     by (auto simp: diameter_def)
 qed
 
 lemma diameter_lower_bounded:
   fixes s :: "'a :: metric_space set"
   assumes s: "bounded s"
     and d: "0 < d" "d < diameter s"
   shows "\<exists>x\<in>s. \<exists>y\<in>s. d < dist x y"
 proof (rule ccontr)
   assume contr: "\<not> ?thesis"
   moreover have "s \<noteq> {}"
     using d by (auto simp: diameter_def)
   ultimately have "diameter s \<le> d"
     by (auto simp: not_less diameter_def intro!: cSUP_least)
   with \<open>d < diameter s\<close> show False by auto
 qed
 
 lemma diameter_bounded:
   assumes "bounded s"
   shows "\<forall>x\<in>s. \<forall>y\<in>s. dist x y \<le> diameter s"
     and "\<forall>d>0. d < diameter s \<longrightarrow> (\<exists>x\<in>s. \<exists>y\<in>s. dist x y > d)"
   using diameter_bounded_bound[of s] diameter_lower_bounded[of s] assms
   by auto
 
 lemma bounded_two_points:
   "bounded S \<longleftrightarrow> (\<exists>e. \<forall>x\<in>S. \<forall>y\<in>S. dist x y \<le> e)"
   apply (rule iffI)
   subgoal using diameter_bounded(1) by auto
   subgoal using bounded_any_center[of S] by meson
   done
 
 lemma diameter_compact_attained:
   assumes "compact s"
     and "s \<noteq> {}"
   shows "\<exists>x\<in>s. \<exists>y\<in>s. dist x y = diameter s"
 proof -
   have b: "bounded s" using assms(1)
     by (rule compact_imp_bounded)
   then obtain x y where xys: "x\<in>s" "y\<in>s"
     and xy: "\<forall>u\<in>s. \<forall>v\<in>s. dist u v \<le> dist x y"
     using compact_sup_maxdistance[OF assms] by auto
   then have "diameter s \<le> dist x y"
     unfolding diameter_def
     apply clarsimp
     apply (rule cSUP_least, fast+)
     done
   then show ?thesis
     by (metis b diameter_bounded_bound order_antisym xys)
 qed
 
 lemma diameter_ge_0:
   assumes "bounded S"  shows "0 \<le> diameter S"
   by (metis all_not_in_conv assms diameter_bounded_bound diameter_empty dist_self order_refl)
 
 lemma diameter_subset:
   assumes "S \<subseteq> T" "bounded T"
   shows "diameter S \<le> diameter T"
 proof (cases "S = {} \<or> T = {}")
   case True
   with assms show ?thesis
     by (force simp: diameter_ge_0)
 next
   case False
   then have "bdd_above ((\<lambda>x. case x of (x, xa) \<Rightarrow> dist x xa) ` (T \<times> T))"
     using \<open>bounded T\<close> diameter_bounded_bound by (force simp: bdd_above_def)
   with False \<open>S \<subseteq> T\<close> show ?thesis
     apply (simp add: diameter_def)
     apply (rule cSUP_subset_mono, auto)
     done
 qed
 
 lemma diameter_closure:
   assumes "bounded S"
   shows "diameter(closure S) = diameter S"
 proof (rule order_antisym)
   have "False" if "diameter S < diameter (closure S)"
   proof -
     define d where "d = diameter(closure S) - diameter(S)"
     have "d > 0"
       using that by (simp add: d_def)
     then have "diameter(closure(S)) - d / 2 < diameter(closure(S))"
       by simp
     have dd: "diameter (closure S) - d / 2 = (diameter(closure(S)) + diameter(S)) / 2"
       by (simp add: d_def field_split_simps)
      have bocl: "bounded (closure S)"
       using assms by blast
     moreover have "0 \<le> diameter S"
       using assms diameter_ge_0 by blast
     ultimately obtain x y where "x \<in> closure S" "y \<in> closure S" and xy: "diameter(closure(S)) - d / 2 < dist x y"
       using diameter_bounded(2) [OF bocl, rule_format, of "diameter(closure(S)) - d / 2"] \<open>d > 0\<close> d_def by auto
     then obtain x' y' where x'y': "x' \<in> S" "dist x' x < d/4" "y' \<in> S" "dist y' y < d/4"
       using closure_approachable
       by (metis \<open>0 < d\<close> zero_less_divide_iff zero_less_numeral)
     then have "dist x' y' \<le> diameter S"
       using assms diameter_bounded_bound by blast
     with x'y' have "dist x y \<le> d / 4 + diameter S + d / 4"
       by (meson add_mono_thms_linordered_semiring(1) dist_triangle dist_triangle3 less_eq_real_def order_trans)
     then show ?thesis
       using xy d_def by linarith
   qed
   then show "diameter (closure S) \<le> diameter S"
     by fastforce
   next
     show "diameter S \<le> diameter (closure S)"
       by (simp add: assms bounded_closure closure_subset diameter_subset)
 qed
 
 proposition Lebesgue_number_lemma:
   assumes "compact S" "\<C> \<noteq> {}" "S \<subseteq> \<Union>\<C>" and ope: "\<And>B. B \<in> \<C> \<Longrightarrow> open B"
   obtains \<delta> where "0 < \<delta>" "\<And>T. \<lbrakk>T \<subseteq> S; diameter T < \<delta>\<rbrakk> \<Longrightarrow> \<exists>B \<in> \<C>. T \<subseteq> B"
 proof (cases "S = {}")
   case True
   then show ?thesis
     by (metis \<open>\<C> \<noteq> {}\<close> zero_less_one empty_subsetI equals0I subset_trans that)
 next
   case False
   { fix x assume "x \<in> S"
     then obtain C where C: "x \<in> C" "C \<in> \<C>"
       using \<open>S \<subseteq> \<Union>\<C>\<close> by blast
     then obtain r where r: "r>0" "ball x (2*r) \<subseteq> C"
       by (metis mult.commute mult_2_right not_le ope openE field_sum_of_halves zero_le_numeral zero_less_mult_iff)
     then have "\<exists>r C. r > 0 \<and> ball x (2*r) \<subseteq> C \<and> C \<in> \<C>"
       using C by blast
   }
   then obtain r where r: "\<And>x. x \<in> S \<Longrightarrow> r x > 0 \<and> (\<exists>C \<in> \<C>. ball x (2*r x) \<subseteq> C)"
     by metis
   then have "S \<subseteq> (\<Union>x \<in> S. ball x (r x))"
     by auto
   then obtain \<T> where "finite \<T>" "S \<subseteq> \<Union>\<T>" and \<T>: "\<T> \<subseteq> (\<lambda>x. ball x (r x)) ` S"
     by (rule compactE [OF \<open>compact S\<close>]) auto
   then obtain S0 where "S0 \<subseteq> S" "finite S0" and S0: "\<T> = (\<lambda>x. ball x (r x)) ` S0"
     by (meson finite_subset_image)
   then have "S0 \<noteq> {}"
     using False \<open>S \<subseteq> \<Union>\<T>\<close> by auto
   define \<delta> where "\<delta> = Inf (r ` S0)"
   have "\<delta> > 0"
     using \<open>finite S0\<close> \<open>S0 \<subseteq> S\<close> \<open>S0 \<noteq> {}\<close> r by (auto simp: \<delta>_def finite_less_Inf_iff)
   show ?thesis
   proof
     show "0 < \<delta>"
       by (simp add: \<open>0 < \<delta>\<close>)
     show "\<exists>B \<in> \<C>. T \<subseteq> B" if "T \<subseteq> S" and dia: "diameter T < \<delta>" for T
     proof (cases "T = {}")
       case True
       then show ?thesis
         using \<open>\<C> \<noteq> {}\<close> by blast
     next
       case False
       then obtain y where "y \<in> T" by blast
       then have "y \<in> S"
         using \<open>T \<subseteq> S\<close> by auto
       then obtain x where "x \<in> S0" and x: "y \<in> ball x (r x)"
         using \<open>S \<subseteq> \<Union>\<T>\<close> S0 that by blast
       have "ball y \<delta> \<subseteq> ball y (r x)"
         by (metis \<delta>_def \<open>S0 \<noteq> {}\<close> \<open>finite S0\<close> \<open>x \<in> S0\<close> empty_is_image finite_imageI finite_less_Inf_iff imageI less_irrefl not_le subset_ball)
       also have "... \<subseteq> ball x (2*r x)"
         using x by metric
       finally obtain C where "C \<in> \<C>" "ball y \<delta> \<subseteq> C"
         by (meson r \<open>S0 \<subseteq> S\<close> \<open>x \<in> S0\<close> dual_order.trans subsetCE)
       have "bounded T"
         using \<open>compact S\<close> bounded_subset compact_imp_bounded \<open>T \<subseteq> S\<close> by blast
       then have "T \<subseteq> ball y \<delta>"
         using \<open>y \<in> T\<close> dia diameter_bounded_bound by fastforce
       then show ?thesis
         apply (rule_tac x=C in bexI)
         using \<open>ball y \<delta> \<subseteq> C\<close> \<open>C \<in> \<C>\<close> by auto
     qed
   qed
 qed
 
 
 subsection \<open>Metric spaces with the Heine-Borel property\<close>
 
 text \<open>
   A metric space (or topological vector space) is said to have the
   Heine-Borel property if every closed and bounded subset is compact.
 \<close>
 
 class heine_borel = metric_space +
   assumes bounded_imp_convergent_subsequence:
     "bounded (range f) \<Longrightarrow> \<exists>l r. strict_mono (r::nat\<Rightarrow>nat) \<and> ((f \<circ> r) \<longlongrightarrow> l) sequentially"
 
 proposition bounded_closed_imp_seq_compact:
   fixes s::"'a::heine_borel set"
   assumes "bounded s"
     and "closed s"
   shows "seq_compact s"
 proof (unfold seq_compact_def, clarify)
   fix f :: "nat \<Rightarrow> 'a"
   assume f: "\<forall>n. f n \<in> s"
   with \<open>bounded s\<close> have "bounded (range f)"
     by (auto intro: bounded_subset)
   obtain l r where r: "strict_mono (r :: nat \<Rightarrow> nat)" and l: "((f \<circ> r) \<longlongrightarrow> l) sequentially"
     using bounded_imp_convergent_subsequence [OF \<open>bounded (range f)\<close>] by auto
   from f have fr: "\<forall>n. (f \<circ> r) n \<in> s"
     by simp
   have "l \<in> s" using \<open>closed s\<close> fr l
     by (rule closed_sequentially)
   show "\<exists>l\<in>s. \<exists>r. strict_mono r \<and> ((f \<circ> r) \<longlongrightarrow> l) sequentially"
     using \<open>l \<in> s\<close> r l by blast
 qed
 
 lemma compact_eq_bounded_closed:
   fixes s :: "'a::heine_borel set"
   shows "compact s \<longleftrightarrow> bounded s \<and> closed s"
   (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then show ?rhs
     using compact_imp_closed compact_imp_bounded
     by blast
 next
   assume ?rhs
   then show ?lhs
     using bounded_closed_imp_seq_compact[of s]
     unfolding compact_eq_seq_compact_metric
     by auto
 qed
 
 lemma compact_Inter:
   fixes \<F> :: "'a :: heine_borel set set"
   assumes com: "\<And>S. S \<in> \<F> \<Longrightarrow> compact S" and "\<F> \<noteq> {}"
   shows "compact(\<Inter> \<F>)"
   using assms
   by (meson Inf_lower all_not_in_conv bounded_subset closed_Inter compact_eq_bounded_closed)
 
 lemma compact_closure [simp]:
   fixes S :: "'a::heine_borel set"
   shows "compact(closure S) \<longleftrightarrow> bounded S"
 by (meson bounded_closure bounded_subset closed_closure closure_subset compact_eq_bounded_closed)
 
 instance\<^marker>\<open>tag important\<close> real :: heine_borel
 proof
   fix f :: "nat \<Rightarrow> real"
   assume f: "bounded (range f)"
   obtain r :: "nat \<Rightarrow> nat" where r: "strict_mono r" "monoseq (f \<circ> r)"
     unfolding comp_def by (metis seq_monosub)
   then have "Bseq (f \<circ> r)"
     unfolding Bseq_eq_bounded using f
     by (metis BseqI' bounded_iff comp_apply rangeI)
   with r show "\<exists>l r. strict_mono r \<and> (f \<circ> r) \<longlonglongrightarrow> l"
     using Bseq_monoseq_convergent[of "f \<circ> r"] by (auto simp: convergent_def)
 qed
 
 lemma compact_lemma_general:
   fixes f :: "nat \<Rightarrow> 'a"
   fixes proj::"'a \<Rightarrow> 'b \<Rightarrow> 'c::heine_borel" (infixl "proj" 60)
   fixes unproj:: "('b \<Rightarrow> 'c) \<Rightarrow> 'a"
   assumes finite_basis: "finite basis"
   assumes bounded_proj: "\<And>k. k \<in> basis \<Longrightarrow> bounded ((\<lambda>x. x proj k) ` range f)"
   assumes proj_unproj: "\<And>e k. k \<in> basis \<Longrightarrow> (unproj e) proj k = e k"
   assumes unproj_proj: "\<And>x. unproj (\<lambda>k. x proj k) = x"
   shows "\<forall>d\<subseteq>basis. \<exists>l::'a. \<exists> r::nat\<Rightarrow>nat.
     strict_mono r \<and> (\<forall>e>0. eventually (\<lambda>n. \<forall>i\<in>d. dist (f (r n) proj i) (l proj i) < e) sequentially)"
 proof safe
   fix d :: "'b set"
   assume d: "d \<subseteq> basis"
   with finite_basis have "finite d"
     by (blast intro: finite_subset)
   from this d show "\<exists>l::'a. \<exists>r::nat\<Rightarrow>nat. strict_mono r \<and>
     (\<forall>e>0. eventually (\<lambda>n. \<forall>i\<in>d. dist (f (r n) proj i) (l proj i) < e) sequentially)"
   proof (induct d)
     case empty
     then show ?case
       unfolding strict_mono_def by auto
   next
     case (insert k d)
     have k[intro]: "k \<in> basis"
       using insert by auto
     have s': "bounded ((\<lambda>x. x proj k) ` range f)"
       using k
       by (rule bounded_proj)
     obtain l1::"'a" and r1 where r1: "strict_mono r1"
       and lr1: "\<forall>e > 0. eventually (\<lambda>n. \<forall>i\<in>d. dist (f (r1 n) proj i) (l1 proj i) < e) sequentially"
       using insert(3) using insert(4) by auto
     have f': "\<forall>n. f (r1 n) proj k \<in> (\<lambda>x. x proj k) ` range f"
       by simp
     have "bounded (range (\<lambda>i. f (r1 i) proj k))"
       by (metis (lifting) bounded_subset f' image_subsetI s')
     then obtain l2 r2 where r2:"strict_mono r2" and lr2:"((\<lambda>i. f (r1 (r2 i)) proj k) \<longlongrightarrow> l2) sequentially"
       using bounded_imp_convergent_subsequence[of "\<lambda>i. f (r1 i) proj k"]
       by (auto simp: o_def)
     define r where "r = r1 \<circ> r2"
     have r:"strict_mono r"
       using r1 and r2 unfolding r_def o_def strict_mono_def by auto
     moreover
     define l where "l = unproj (\<lambda>i. if i = k then l2 else l1 proj i)"
     {
       fix e::real
       assume "e > 0"
       from lr1 \<open>e > 0\<close> have N1: "eventually (\<lambda>n. \<forall>i\<in>d. dist (f (r1 n) proj i) (l1 proj i) < e) sequentially"
         by blast
       from lr2 \<open>e > 0\<close> have N2:"eventually (\<lambda>n. dist (f (r1 (r2 n)) proj k) l2 < e) sequentially"
         by (rule tendstoD)
       from r2 N1 have N1': "eventually (\<lambda>n. \<forall>i\<in>d. dist (f (r1 (r2 n)) proj i) (l1 proj i) < e) sequentially"
         by (rule eventually_subseq)
       have "eventually (\<lambda>n. \<forall>i\<in>(insert k d). dist (f (r n) proj i) (l proj i) < e) sequentially"
         using N1' N2
         by eventually_elim (insert insert.prems, auto simp: l_def r_def o_def proj_unproj)
     }
     ultimately show ?case by auto
   qed
 qed
 
 lemma bounded_fst: "bounded s \<Longrightarrow> bounded (fst ` s)"
   unfolding bounded_def
   by (metis (erased, hide_lams) dist_fst_le image_iff order_trans)
 
 lemma bounded_snd: "bounded s \<Longrightarrow> bounded (snd ` s)"
   unfolding bounded_def
   by (metis (no_types, hide_lams) dist_snd_le image_iff order.trans)
 
 instance\<^marker>\<open>tag important\<close> prod :: (heine_borel, heine_borel) heine_borel
 proof
   fix f :: "nat \<Rightarrow> 'a \<times> 'b"
   assume f: "bounded (range f)"
   then have "bounded (fst ` range f)"
     by (rule bounded_fst)
   then have s1: "bounded (range (fst \<circ> f))"
     by (simp add: image_comp)
   obtain l1 r1 where r1: "strict_mono r1" and l1: "(\<lambda>n. fst (f (r1 n))) \<longlonglongrightarrow> l1"
     using bounded_imp_convergent_subsequence [OF s1] unfolding o_def by fast
   from f have s2: "bounded (range (snd \<circ> f \<circ> r1))"
     by (auto simp: image_comp intro: bounded_snd bounded_subset)
   obtain l2 r2 where r2: "strict_mono r2" and l2: "((\<lambda>n. snd (f (r1 (r2 n)))) \<longlongrightarrow> l2) sequentially"
     using bounded_imp_convergent_subsequence [OF s2]
     unfolding o_def by fast
   have l1': "((\<lambda>n. fst (f (r1 (r2 n)))) \<longlongrightarrow> l1) sequentially"
     using LIMSEQ_subseq_LIMSEQ [OF l1 r2] unfolding o_def .
   have l: "((f \<circ> (r1 \<circ> r2)) \<longlongrightarrow> (l1, l2)) sequentially"
     using tendsto_Pair [OF l1' l2] unfolding o_def by simp
   have r: "strict_mono (r1 \<circ> r2)"
     using r1 r2 unfolding strict_mono_def by simp
   show "\<exists>l r. strict_mono r \<and> ((f \<circ> r) \<longlongrightarrow> l) sequentially"
     using l r by fast
 qed
 
 
 subsection \<open>Completeness\<close>
 
 proposition (in metric_space) completeI:
   assumes "\<And>f. \<forall>n. f n \<in> s \<Longrightarrow> Cauchy f \<Longrightarrow> \<exists>l\<in>s. f \<longlonglongrightarrow> l"
   shows "complete s"
   using assms unfolding complete_def by fast
 
 proposition (in metric_space) completeE:
   assumes "complete s" and "\<forall>n. f n \<in> s" and "Cauchy f"
   obtains l where "l \<in> s" and "f \<longlonglongrightarrow> l"
   using assms unfolding complete_def by fast
 
 (* TODO: generalize to uniform spaces *)
 lemma compact_imp_complete:
   fixes s :: "'a::metric_space set"
   assumes "compact s"
   shows "complete s"
 proof -
   {
     fix f
     assume as: "(\<forall>n::nat. f n \<in> s)" "Cauchy f"
     from as(1) obtain l r where lr: "l\<in>s" "strict_mono r" "(f \<circ> r) \<longlonglongrightarrow> l"
       using assms unfolding compact_def by blast
 
     note lr' = seq_suble [OF lr(2)]
     {
       fix e :: real
       assume "e > 0"
       from as(2) obtain N where N:"\<forall>m n. N \<le> m \<and> N \<le> n \<longrightarrow> dist (f m) (f n) < e/2"
         unfolding cauchy_def
         using \<open>e > 0\<close>
         apply (erule_tac x="e/2" in allE, auto)
         done
       from lr(3)[unfolded lim_sequentially, THEN spec[where x="e/2"]]
       obtain M where M:"\<forall>n\<ge>M. dist ((f \<circ> r) n) l < e/2"
         using \<open>e > 0\<close> by auto
       {
         fix n :: nat
         assume n: "n \<ge> max N M"
         have "dist ((f \<circ> r) n) l < e/2"
           using n M by auto
         moreover have "r n \<ge> N"
           using lr'[of n] n by auto
         then have "dist (f n) ((f \<circ> r) n) < e / 2"
           using N and n by auto
         ultimately have "dist (f n) l < e" using n M
           by metric
       }
       then have "\<exists>N. \<forall>n\<ge>N. dist (f n) l < e" by blast
     }
     then have "\<exists>l\<in>s. (f \<longlongrightarrow> l) sequentially" using \<open>l\<in>s\<close>
       unfolding lim_sequentially by auto
   }
   then show ?thesis unfolding complete_def by auto
 qed
 
 proposition compact_eq_totally_bounded:
   "compact s \<longleftrightarrow> complete s \<and> (\<forall>e>0. \<exists>k. finite k \<and> s \<subseteq> (\<Union>x\<in>k. ball x e))"
     (is "_ \<longleftrightarrow> ?rhs")
 proof
   assume assms: "?rhs"
   then obtain k where k: "\<And>e. 0 < e \<Longrightarrow> finite (k e)" "\<And>e. 0 < e \<Longrightarrow> s \<subseteq> (\<Union>x\<in>k e. ball x e)"
     by (auto simp: choice_iff')
 
   show "compact s"
   proof cases
     assume "s = {}"
     then show "compact s" by (simp add: compact_def)
   next
     assume "s \<noteq> {}"
     show ?thesis
       unfolding compact_def
     proof safe
       fix f :: "nat \<Rightarrow> 'a"
       assume f: "\<forall>n. f n \<in> s"
 
       define e where "e n = 1 / (2 * Suc n)" for n
       then have [simp]: "\<And>n. 0 < e n" by auto
       define B where "B n U = (SOME b. infinite {n. f n \<in> b} \<and> (\<exists>x. b \<subseteq> ball x (e n) \<inter> U))" for n U
       {
         fix n U
         assume "infinite {n. f n \<in> U}"
         then have "\<exists>b\<in>k (e n). infinite {i\<in>{n. f n \<in> U}. f i \<in> ball b (e n)}"
           using k f by (intro pigeonhole_infinite_rel) (auto simp: subset_eq)
         then obtain a where
           "a \<in> k (e n)"
           "infinite {i \<in> {n. f n \<in> U}. f i \<in> ball a (e n)}" ..
         then have "\<exists>b. infinite {i. f i \<in> b} \<and> (\<exists>x. b \<subseteq> ball x (e n) \<inter> U)"
           by (intro exI[of _ "ball a (e n) \<inter> U"] exI[of _ a]) (auto simp: ac_simps)
         from someI_ex[OF this]
         have "infinite {i. f i \<in> B n U}" "\<exists>x. B n U \<subseteq> ball x (e n) \<inter> U"
           unfolding B_def by auto
       }
       note B = this
 
       define F where "F = rec_nat (B 0 UNIV) B"
       {
         fix n
         have "infinite {i. f i \<in> F n}"
           by (induct n) (auto simp: F_def B)
       }
       then have F: "\<And>n. \<exists>x. F (Suc n) \<subseteq> ball x (e n) \<inter> F n"
         using B by (simp add: F_def)
       then have F_dec: "\<And>m n. m \<le> n \<Longrightarrow> F n \<subseteq> F m"
         using decseq_SucI[of F] by (auto simp: decseq_def)
 
       obtain sel where sel: "\<And>k i. i < sel k i" "\<And>k i. f (sel k i) \<in> F k"
       proof (atomize_elim, unfold all_conj_distrib[symmetric], intro choice allI)
         fix k i
         have "infinite ({n. f n \<in> F k} - {.. i})"
           using \<open>infinite {n. f n \<in> F k}\<close> by auto
         from infinite_imp_nonempty[OF this]
         show "\<exists>x>i. f x \<in> F k"
           by (simp add: set_eq_iff not_le conj_commute)
       qed
 
       define t where "t = rec_nat (sel 0 0) (\<lambda>n i. sel (Suc n) i)"
       have "strict_mono t"
         unfolding strict_mono_Suc_iff by (simp add: t_def sel)
       moreover have "\<forall>i. (f \<circ> t) i \<in> s"
         using f by auto
       moreover
       {
         fix n
         have "(f \<circ> t) n \<in> F n"
           by (cases n) (simp_all add: t_def sel)
       }
       note t = this
 
       have "Cauchy (f \<circ> t)"
       proof (safe intro!: metric_CauchyI exI elim!: nat_approx_posE)
         fix r :: real and N n m
         assume "1 / Suc N < r" "Suc N \<le> n" "Suc N \<le> m"
         then have "(f \<circ> t) n \<in> F (Suc N)" "(f \<circ> t) m \<in> F (Suc N)" "2 * e N < r"
           using F_dec t by (auto simp: e_def field_simps)
         with F[of N] obtain x where "dist x ((f \<circ> t) n) < e N" "dist x ((f \<circ> t) m) < e N"
           by (auto simp: subset_eq)
         with \<open>2 * e N < r\<close> show "dist ((f \<circ> t) m) ((f \<circ> t) n) < r"
           by metric
       qed
 
       ultimately show "\<exists>l\<in>s. \<exists>r. strict_mono r \<and> (f \<circ> r) \<longlonglongrightarrow> l"
         using assms unfolding complete_def by blast
     qed
   qed
 qed (metis compact_imp_complete compact_imp_seq_compact seq_compact_imp_totally_bounded)
 
 lemma cauchy_imp_bounded:
   assumes "Cauchy s"
   shows "bounded (range s)"
 proof -
   from assms obtain N :: nat where "\<forall>m n. N \<le> m \<and> N \<le> n \<longrightarrow> dist (s m) (s n) < 1"
     unfolding cauchy_def by force
   then have N:"\<forall>n. N \<le> n \<longrightarrow> dist (s N) (s n) < 1" by auto
   moreover
   have "bounded (s ` {0..N})"
     using finite_imp_bounded[of "s ` {1..N}"] by auto
   then obtain a where a:"\<forall>x\<in>s ` {0..N}. dist (s N) x \<le> a"
     unfolding bounded_any_center [where a="s N"] by auto
   ultimately show "?thesis"
     unfolding bounded_any_center [where a="s N"]
     apply (rule_tac x="max a 1" in exI, auto)
     apply (erule_tac x=y in allE)
     apply (erule_tac x=y in ballE, auto)
     done
 qed
 
 instance heine_borel < complete_space
 proof
   fix f :: "nat \<Rightarrow> 'a" assume "Cauchy f"
   then have "bounded (range f)"
     by (rule cauchy_imp_bounded)
   then have "compact (closure (range f))"
     unfolding compact_eq_bounded_closed by auto
   then have "complete (closure (range f))"
     by (rule compact_imp_complete)
   moreover have "\<forall>n. f n \<in> closure (range f)"
     using closure_subset [of "range f"] by auto
   ultimately have "\<exists>l\<in>closure (range f). (f \<longlongrightarrow> l) sequentially"
     using \<open>Cauchy f\<close> unfolding complete_def by auto
   then show "convergent f"
     unfolding convergent_def by auto
 qed
 
 lemma complete_UNIV: "complete (UNIV :: ('a::complete_space) set)"
 proof (rule completeI)
   fix f :: "nat \<Rightarrow> 'a" assume "Cauchy f"
   then have "convergent f" by (rule Cauchy_convergent)
   then show "\<exists>l\<in>UNIV. f \<longlonglongrightarrow> l" unfolding convergent_def by simp
 qed
 
 lemma complete_imp_closed:
   fixes S :: "'a::metric_space set"
   assumes "complete S"
   shows "closed S"
 proof (unfold closed_sequential_limits, clarify)
   fix f x assume "\<forall>n. f n \<in> S" and "f \<longlonglongrightarrow> x"
   from \<open>f \<longlonglongrightarrow> x\<close> have "Cauchy f"
     by (rule LIMSEQ_imp_Cauchy)
   with \<open>complete S\<close> and \<open>\<forall>n. f n \<in> S\<close> obtain l where "l \<in> S" and "f \<longlonglongrightarrow> l"
     by (rule completeE)
   from \<open>f \<longlonglongrightarrow> x\<close> and \<open>f \<longlonglongrightarrow> l\<close> have "x = l"
     by (rule LIMSEQ_unique)
   with \<open>l \<in> S\<close> show "x \<in> S"
     by simp
 qed
 
 lemma complete_Int_closed:
   fixes S :: "'a::metric_space set"
   assumes "complete S" and "closed t"
   shows "complete (S \<inter> t)"
 proof (rule completeI)
   fix f assume "\<forall>n. f n \<in> S \<inter> t" and "Cauchy f"
   then have "\<forall>n. f n \<in> S" and "\<forall>n. f n \<in> t"
     by simp_all
   from \<open>complete S\<close> obtain l where "l \<in> S" and "f \<longlonglongrightarrow> l"
     using \<open>\<forall>n. f n \<in> S\<close> and \<open>Cauchy f\<close> by (rule completeE)
   from \<open>closed t\<close> and \<open>\<forall>n. f n \<in> t\<close> and \<open>f \<longlonglongrightarrow> l\<close> have "l \<in> t"
     by (rule closed_sequentially)
   with \<open>l \<in> S\<close> and \<open>f \<longlonglongrightarrow> l\<close> show "\<exists>l\<in>S \<inter> t. f \<longlonglongrightarrow> l"
     by fast
 qed
 
 lemma complete_closed_subset:
   fixes S :: "'a::metric_space set"
   assumes "closed S" and "S \<subseteq> t" and "complete t"
   shows "complete S"
   using assms complete_Int_closed [of t S] by (simp add: Int_absorb1)
 
 lemma complete_eq_closed:
   fixes S :: "('a::complete_space) set"
   shows "complete S \<longleftrightarrow> closed S"
 proof
   assume "closed S" then show "complete S"
     using subset_UNIV complete_UNIV by (rule complete_closed_subset)
 next
   assume "complete S" then show "closed S"
     by (rule complete_imp_closed)
 qed
 
 lemma convergent_eq_Cauchy:
   fixes S :: "nat \<Rightarrow> 'a::complete_space"
   shows "(\<exists>l. (S \<longlongrightarrow> l) sequentially) \<longleftrightarrow> Cauchy S"
   unfolding Cauchy_convergent_iff convergent_def ..
 
 lemma convergent_imp_bounded:
   fixes S :: "nat \<Rightarrow> 'a::metric_space"
   shows "(S \<longlongrightarrow> l) sequentially \<Longrightarrow> bounded (range S)"
   by (intro cauchy_imp_bounded LIMSEQ_imp_Cauchy)
 
 lemma frontier_subset_compact:
   fixes S :: "'a::heine_borel set"
   shows "compact S \<Longrightarrow> frontier S \<subseteq> S"
   using frontier_subset_closed compact_eq_bounded_closed
   by blast
 
 lemma continuous_closed_imp_Cauchy_continuous:
   fixes S :: "('a::complete_space) set"
   shows "\<lbrakk>continuous_on S f; closed S; Cauchy \<sigma>; \<And>n. (\<sigma> n) \<in> S\<rbrakk> \<Longrightarrow> Cauchy(f \<circ> \<sigma>)"
   apply (simp add: complete_eq_closed [symmetric] continuous_on_sequentially)
   by (meson LIMSEQ_imp_Cauchy complete_def)
 
 lemma banach_fix_type:
   fixes f::"'a::complete_space\<Rightarrow>'a"
   assumes c:"0 \<le> c" "c < 1"
       and lipschitz:"\<forall>x. \<forall>y. dist (f x) (f y) \<le> c * dist x y"
   shows "\<exists>!x. (f x = x)"
   using assms banach_fix[OF complete_UNIV UNIV_not_empty assms(1,2) subset_UNIV, of f]
   by auto
 
 
 subsection\<^marker>\<open>tag unimportant\<close>\<open> Finite intersection property\<close>
 
 text\<open>Also developed in HOL's toplogical spaces theory, but the Heine-Borel type class isn't available there.\<close>
 
 lemma closed_imp_fip:
   fixes S :: "'a::heine_borel set"
   assumes "closed S"
       and T: "T \<in> \<F>" "bounded T"
       and clof: "\<And>T. T \<in> \<F> \<Longrightarrow> closed T"
       and none: "\<And>\<F>'. \<lbrakk>finite \<F>'; \<F>' \<subseteq> \<F>\<rbrakk> \<Longrightarrow> S \<inter> \<Inter>\<F>' \<noteq> {}"
     shows "S \<inter> \<Inter>\<F> \<noteq> {}"
 proof -
   have "compact (S \<inter> T)"
     using \<open>closed S\<close> clof compact_eq_bounded_closed T by blast
   then have "(S \<inter> T) \<inter> \<Inter>\<F> \<noteq> {}"
     apply (rule compact_imp_fip)
      apply (simp add: clof)
     by (metis Int_assoc complete_lattice_class.Inf_insert finite_insert insert_subset none \<open>T \<in> \<F>\<close>)
   then show ?thesis by blast
 qed
 
 lemma closed_imp_fip_compact:
   fixes S :: "'a::heine_borel set"
   shows
    "\<lbrakk>closed S; \<And>T. T \<in> \<F> \<Longrightarrow> compact T;
      \<And>\<F>'. \<lbrakk>finite \<F>'; \<F>' \<subseteq> \<F>\<rbrakk> \<Longrightarrow> S \<inter> \<Inter>\<F>' \<noteq> {}\<rbrakk>
         \<Longrightarrow> S \<inter> \<Inter>\<F> \<noteq> {}"
 by (metis Inf_greatest closed_imp_fip compact_eq_bounded_closed empty_subsetI finite.emptyI inf.orderE)
 
 lemma closed_fip_Heine_Borel:
   fixes \<F> :: "'a::heine_borel set set"
   assumes "closed S" "T \<in> \<F>" "bounded T"
       and "\<And>T. T \<in> \<F> \<Longrightarrow> closed T"
       and "\<And>\<F>'. \<lbrakk>finite \<F>'; \<F>' \<subseteq> \<F>\<rbrakk> \<Longrightarrow> \<Inter>\<F>' \<noteq> {}"
     shows "\<Inter>\<F> \<noteq> {}"
 proof -
   have "UNIV \<inter> \<Inter>\<F> \<noteq> {}"
     using assms closed_imp_fip [OF closed_UNIV] by auto
   then show ?thesis by simp
 qed
 
 lemma compact_fip_Heine_Borel:
   fixes \<F> :: "'a::heine_borel set set"
   assumes clof: "\<And>T. T \<in> \<F> \<Longrightarrow> compact T"
       and none: "\<And>\<F>'. \<lbrakk>finite \<F>'; \<F>' \<subseteq> \<F>\<rbrakk> \<Longrightarrow> \<Inter>\<F>' \<noteq> {}"
     shows "\<Inter>\<F> \<noteq> {}"
 by (metis InterI all_not_in_conv clof closed_fip_Heine_Borel compact_eq_bounded_closed none)
 
 lemma compact_sequence_with_limit:
   fixes f :: "nat \<Rightarrow> 'a::heine_borel"
   shows "(f \<longlongrightarrow> l) sequentially \<Longrightarrow> compact (insert l (range f))"
 apply (simp add: compact_eq_bounded_closed, auto)
 apply (simp add: convergent_imp_bounded)
 by (simp add: closed_limpt islimpt_insert sequence_unique_limpt)
 
 
 subsection \<open>Properties of Balls and Spheres\<close>
 
 lemma compact_cball[simp]:
   fixes x :: "'a::heine_borel"
   shows "compact (cball x e)"
   using compact_eq_bounded_closed bounded_cball closed_cball
   by blast
 
 lemma compact_frontier_bounded[intro]:
   fixes S :: "'a::heine_borel set"
   shows "bounded S \<Longrightarrow> compact (frontier S)"
   unfolding frontier_def
   using compact_eq_bounded_closed
   by blast
 
 lemma compact_frontier[intro]:
   fixes S :: "'a::heine_borel set"
   shows "compact S \<Longrightarrow> compact (frontier S)"
   using compact_eq_bounded_closed compact_frontier_bounded
   by blast
 
 
 subsection \<open>Distance from a Set\<close>
 
 lemma distance_attains_sup:
   assumes "compact s" "s \<noteq> {}"
   shows "\<exists>x\<in>s. \<forall>y\<in>s. dist a y \<le> dist a x"
 proof (rule continuous_attains_sup [OF assms])
   {
     fix x
     assume "x\<in>s"
     have "(dist a \<longlongrightarrow> dist a x) (at x within s)"
       by (intro tendsto_dist tendsto_const tendsto_ident_at)
   }
   then show "continuous_on s (dist a)"
     unfolding continuous_on ..
 qed
 
 text \<open>For \emph{minimal} distance, we only need closure, not compactness.\<close>
 
 lemma distance_attains_inf:
   fixes a :: "'a::heine_borel"
   assumes "closed s" and "s \<noteq> {}"
   obtains x where "x\<in>s" "\<And>y. y \<in> s \<Longrightarrow> dist a x \<le> dist a y"
 proof -
   from assms obtain b where "b \<in> s" by auto
   let ?B = "s \<inter> cball a (dist b a)"
   have "?B \<noteq> {}" using \<open>b \<in> s\<close>
     by (auto simp: dist_commute)
   moreover have "continuous_on ?B (dist a)"
     by (auto intro!: continuous_at_imp_continuous_on continuous_dist continuous_ident continuous_const)
   moreover have "compact ?B"
     by (intro closed_Int_compact \<open>closed s\<close> compact_cball)
   ultimately obtain x where "x \<in> ?B" "\<forall>y\<in>?B. dist a x \<le> dist a y"
     by (metis continuous_attains_inf)
   with that show ?thesis by fastforce
 qed
 
 
 subsection \<open>Infimum Distance\<close>
 
 definition\<^marker>\<open>tag important\<close> "infdist x A = (if A = {} then 0 else INF a\<in>A. dist x a)"
 
 lemma bdd_below_image_dist[intro, simp]: "bdd_below (dist x ` A)"
   by (auto intro!: zero_le_dist)
 
 lemma infdist_notempty: "A \<noteq> {} \<Longrightarrow> infdist x A = (INF a\<in>A. dist x a)"
   by (simp add: infdist_def)
 
 lemma infdist_nonneg: "0 \<le> infdist x A"
   by (auto simp: infdist_def intro: cINF_greatest)
 
 lemma infdist_le: "a \<in> A \<Longrightarrow> infdist x A \<le> dist x a"
   by (auto intro: cINF_lower simp add: infdist_def)
 
 lemma infdist_le2: "a \<in> A \<Longrightarrow> dist x a \<le> d \<Longrightarrow> infdist x A \<le> d"
   by (auto intro!: cINF_lower2 simp add: infdist_def)
 
 lemma infdist_zero[simp]: "a \<in> A \<Longrightarrow> infdist a A = 0"
   by (auto intro!: antisym infdist_nonneg infdist_le2)
 
 lemma infdist_Un_min:
   assumes "A \<noteq> {}" "B \<noteq> {}"
   shows "infdist x (A \<union> B) = min (infdist x A) (infdist x B)"
 using assms by (simp add: infdist_def cINF_union inf_real_def)
 
 lemma infdist_triangle: "infdist x A \<le> infdist y A + dist x y"
 proof (cases "A = {}")
   case True
   then show ?thesis by (simp add: infdist_def)
 next
   case False
   then obtain a where "a \<in> A" by auto
   have "infdist x A \<le> Inf {dist x y + dist y a |a. a \<in> A}"
   proof (rule cInf_greatest)
     from \<open>A \<noteq> {}\<close> show "{dist x y + dist y a |a. a \<in> A} \<noteq> {}"
       by simp
     fix d
     assume "d \<in> {dist x y + dist y a |a. a \<in> A}"
     then obtain a where d: "d = dist x y + dist y a" "a \<in> A"
       by auto
     show "infdist x A \<le> d"
       unfolding infdist_notempty[OF \<open>A \<noteq> {}\<close>]
     proof (rule cINF_lower2)
       show "a \<in> A" by fact
       show "dist x a \<le> d"
         unfolding d by (rule dist_triangle)
     qed simp
   qed
   also have "\<dots> = dist x y + infdist y A"
   proof (rule cInf_eq, safe)
     fix a
     assume "a \<in> A"
     then show "dist x y + infdist y A \<le> dist x y + dist y a"
       by (auto intro: infdist_le)
   next
     fix i
     assume inf: "\<And>d. d \<in> {dist x y + dist y a |a. a \<in> A} \<Longrightarrow> i \<le> d"
     then have "i - dist x y \<le> infdist y A"
       unfolding infdist_notempty[OF \<open>A \<noteq> {}\<close>] using \<open>a \<in> A\<close>
       by (intro cINF_greatest) (auto simp: field_simps)
     then show "i \<le> dist x y + infdist y A"
       by simp
   qed
   finally show ?thesis by simp
 qed
 
 lemma infdist_triangle_abs: "\<bar>infdist x A - infdist y A\<bar> \<le> dist x y"
   by (metis (full_types) abs_diff_le_iff diff_le_eq dist_commute infdist_triangle)
 
 lemma in_closure_iff_infdist_zero:
   assumes "A \<noteq> {}"
   shows "x \<in> closure A \<longleftrightarrow> infdist x A = 0"
 proof
   assume "x \<in> closure A"
   show "infdist x A = 0"
   proof (rule ccontr)
     assume "infdist x A \<noteq> 0"
     with infdist_nonneg[of x A] have "infdist x A > 0"
       by auto
     then have "ball x (infdist x A) \<inter> closure A = {}"
       apply auto
       apply (metis \<open>x \<in> closure A\<close> closure_approachable dist_commute infdist_le not_less)
       done
     then have "x \<notin> closure A"
       by (metis \<open>0 < infdist x A\<close> centre_in_ball disjoint_iff_not_equal)
     then show False using \<open>x \<in> closure A\<close> by simp
   qed
 next
   assume x: "infdist x A = 0"
   then obtain a where "a \<in> A"
     by atomize_elim (metis all_not_in_conv assms)
   show "x \<in> closure A"
     unfolding closure_approachable
     apply safe
   proof (rule ccontr)
     fix e :: real
     assume "e > 0"
     assume "\<not> (\<exists>y\<in>A. dist y x < e)"
     then have "infdist x A \<ge> e" using \<open>a \<in> A\<close>
       unfolding infdist_def
       by (force simp: dist_commute intro: cINF_greatest)
     with x \<open>e > 0\<close> show False by auto
   qed
 qed
 
 lemma in_closed_iff_infdist_zero:
   assumes "closed A" "A \<noteq> {}"
   shows "x \<in> A \<longleftrightarrow> infdist x A = 0"
 proof -
   have "x \<in> closure A \<longleftrightarrow> infdist x A = 0"
     by (rule in_closure_iff_infdist_zero) fact
   with assms show ?thesis by simp
 qed
 
 lemma infdist_pos_not_in_closed:
   assumes "closed S" "S \<noteq> {}" "x \<notin> S"
   shows "infdist x S > 0"
 using in_closed_iff_infdist_zero[OF assms(1) assms(2), of x] assms(3) infdist_nonneg le_less by fastforce
 
 lemma
   infdist_attains_inf:
   fixes X::"'a::heine_borel set"
   assumes "closed X"
   assumes "X \<noteq> {}"
   obtains x where "x \<in> X" "infdist y X = dist y x"
 proof -
   have "bdd_below (dist y ` X)"
     by auto
   from distance_attains_inf[OF assms, of y]
   obtain x where INF: "x \<in> X" "\<And>z. z \<in> X \<Longrightarrow> dist y x \<le> dist y z" by auto
   have "infdist y X = dist y x"
     by (auto simp: infdist_def assms
       intro!: antisym cINF_lower[OF _ \<open>x \<in> X\<close>] cINF_greatest[OF assms(2) INF(2)])
   with \<open>x \<in> X\<close> show ?thesis ..
 qed
 
 
 text \<open>Every metric space is a T4 space:\<close>
 
 instance metric_space \<subseteq> t4_space
 proof
   fix S T::"'a set" assume H: "closed S" "closed T" "S \<inter> T = {}"
   consider "S = {}" | "T = {}" | "S \<noteq> {} \<and> T \<noteq> {}" by auto
   then show "\<exists>U V. open U \<and> open V \<and> S \<subseteq> U \<and> T \<subseteq> V \<and> U \<inter> V = {}"
   proof (cases)
     case 1
     show ?thesis
       apply (rule exI[of _ "{}"], rule exI[of _ UNIV]) using 1 by auto
   next
     case 2
     show ?thesis
       apply (rule exI[of _ UNIV], rule exI[of _ "{}"]) using 2 by auto
   next
     case 3
     define U where "U = (\<Union>x\<in>S. ball x ((infdist x T)/2))"
     have A: "open U" unfolding U_def by auto
     have "infdist x T > 0" if "x \<in> S" for x
       using H that 3 by (auto intro!: infdist_pos_not_in_closed)
     then have B: "S \<subseteq> U" unfolding U_def by auto
     define V where "V = (\<Union>x\<in>T. ball x ((infdist x S)/2))"
     have C: "open V" unfolding V_def by auto
     have "infdist x S > 0" if "x \<in> T" for x
       using H that 3 by (auto intro!: infdist_pos_not_in_closed)
     then have D: "T \<subseteq> V" unfolding V_def by auto
 
     have "(ball x ((infdist x T)/2)) \<inter> (ball y ((infdist y S)/2)) = {}" if "x \<in> S" "y \<in> T" for x y
     proof (auto)
       fix z assume H: "dist x z * 2 < infdist x T" "dist y z * 2 < infdist y S"
       have "2 * dist x y \<le> 2 * dist x z + 2 * dist y z"
         by metric
       also have "... < infdist x T + infdist y S"
         using H by auto
       finally have "dist x y < infdist x T \<or> dist x y < infdist y S"
         by auto
       then show False
         using infdist_le[OF \<open>x \<in> S\<close>, of y] infdist_le[OF \<open>y \<in> T\<close>, of x] by (auto simp add: dist_commute)
     qed
     then have E: "U \<inter> V = {}"
       unfolding U_def V_def by auto
     show ?thesis
       apply (rule exI[of _ U], rule exI[of _ V]) using A B C D E by auto
   qed
 qed
 
 lemma tendsto_infdist [tendsto_intros]:
   assumes f: "(f \<longlongrightarrow> l) F"
   shows "((\<lambda>x. infdist (f x) A) \<longlongrightarrow> infdist l A) F"
 proof (rule tendstoI)
   fix e ::real
   assume "e > 0"
   from tendstoD[OF f this]
   show "eventually (\<lambda>x. dist (infdist (f x) A) (infdist l A) < e) F"
   proof (eventually_elim)
     fix x
     from infdist_triangle[of l A "f x"] infdist_triangle[of "f x" A l]
     have "dist (infdist (f x) A) (infdist l A) \<le> dist (f x) l"
       by (simp add: dist_commute dist_real_def)
     also assume "dist (f x) l < e"
     finally show "dist (infdist (f x) A) (infdist l A) < e" .
   qed
 qed
 
 lemma continuous_infdist[continuous_intros]:
   assumes "continuous F f"
   shows "continuous F (\<lambda>x. infdist (f x) A)"
   using assms unfolding continuous_def by (rule tendsto_infdist)
 
 lemma continuous_on_infdist [continuous_intros]:
   assumes "continuous_on S f"
   shows "continuous_on S (\<lambda>x. infdist (f x) A)"
 using assms unfolding continuous_on by (auto intro: tendsto_infdist)
 
 lemma compact_infdist_le:
   fixes A::"'a::heine_borel set"
   assumes "A \<noteq> {}"
   assumes "compact A"
   assumes "e > 0"
   shows "compact {x. infdist x A \<le> e}"
 proof -
   from continuous_closed_vimage[of "{0..e}" "\<lambda>x. infdist x A"]
     continuous_infdist[OF continuous_ident, of _ UNIV A]
   have "closed {x. infdist x A \<le> e}" by (auto simp: vimage_def infdist_nonneg)
   moreover
   from assms obtain x0 b where b: "\<And>x. x \<in> A \<Longrightarrow> dist x0 x \<le> b" "closed A"
     by (auto simp: compact_eq_bounded_closed bounded_def)
   {
     fix y
     assume "infdist y A \<le> e"
     moreover
     from infdist_attains_inf[OF \<open>closed A\<close> \<open>A \<noteq> {}\<close>, of y]
     obtain z where "z \<in> A" "infdist y A = dist y z" by blast
     ultimately
     have "dist x0 y \<le> b + e" using b by metric
   } then
   have "bounded {x. infdist x A \<le> e}"
     by (auto simp: bounded_any_center[where a=x0] intro!: exI[where x="b + e"])
   ultimately show "compact {x. infdist x A \<le> e}"
     by (simp add: compact_eq_bounded_closed)
 qed
 
 
 subsection \<open>Separation between Points and Sets\<close>
 
 proposition separate_point_closed:
   fixes s :: "'a::heine_borel set"
   assumes "closed s" and "a \<notin> s"
   shows "\<exists>d>0. \<forall>x\<in>s. d \<le> dist a x"
 proof (cases "s = {}")
   case True
   then show ?thesis by(auto intro!: exI[where x=1])
 next
   case False
   from assms obtain x where "x\<in>s" "\<forall>y\<in>s. dist a x \<le> dist a y"
     using \<open>s \<noteq> {}\<close> by (blast intro: distance_attains_inf [of s a])
   with \<open>x\<in>s\<close> show ?thesis using dist_pos_lt[of a x] and\<open>a \<notin> s\<close>
     by blast
 qed
 
 proposition separate_compact_closed:
   fixes s t :: "'a::heine_borel set"
   assumes "compact s"
     and t: "closed t" "s \<inter> t = {}"
   shows "\<exists>d>0. \<forall>x\<in>s. \<forall>y\<in>t. d \<le> dist x y"
 proof cases
   assume "s \<noteq> {} \<and> t \<noteq> {}"
   then have "s \<noteq> {}" "t \<noteq> {}" by auto
   let ?inf = "\<lambda>x. infdist x t"
   have "continuous_on s ?inf"
     by (auto intro!: continuous_at_imp_continuous_on continuous_infdist continuous_ident)
   then obtain x where x: "x \<in> s" "\<forall>y\<in>s. ?inf x \<le> ?inf y"
     using continuous_attains_inf[OF \<open>compact s\<close> \<open>s \<noteq> {}\<close>] by auto
   then have "0 < ?inf x"
     using t \<open>t \<noteq> {}\<close> in_closed_iff_infdist_zero by (auto simp: less_le infdist_nonneg)
   moreover have "\<forall>x'\<in>s. \<forall>y\<in>t. ?inf x \<le> dist x' y"
     using x by (auto intro: order_trans infdist_le)
   ultimately show ?thesis by auto
 qed (auto intro!: exI[of _ 1])
 
 proposition separate_closed_compact:
   fixes s t :: "'a::heine_borel set"
   assumes "closed s"
     and "compact t"
     and "s \<inter> t = {}"
   shows "\<exists>d>0. \<forall>x\<in>s. \<forall>y\<in>t. d \<le> dist x y"
 proof -
   have *: "t \<inter> s = {}"
     using assms(3) by auto
   show ?thesis
     using separate_compact_closed[OF assms(2,1) *] by (force simp: dist_commute)
 qed
 
 proposition compact_in_open_separated:
   fixes A::"'a::heine_borel set"
   assumes "A \<noteq> {}"
   assumes "compact A"
   assumes "open B"
   assumes "A \<subseteq> B"
   obtains e where "e > 0" "{x. infdist x A \<le> e} \<subseteq> B"
 proof atomize_elim
   have "closed (- B)" "compact A" "- B \<inter> A = {}"
     using assms by (auto simp: open_Diff compact_eq_bounded_closed)
   from separate_closed_compact[OF this]
   obtain d'::real where d': "d'>0" "\<And>x y. x \<notin> B \<Longrightarrow> y \<in> A \<Longrightarrow> d' \<le> dist x y"
     by auto
   define d where "d = d' / 2"
   hence "d>0" "d < d'" using d' by auto
   with d' have d: "\<And>x y. x \<notin> B \<Longrightarrow> y \<in> A \<Longrightarrow> d < dist x y"
     by force
   show "\<exists>e>0. {x. infdist x A \<le> e} \<subseteq> B"
   proof (rule ccontr)
     assume "\<nexists>e. 0 < e \<and> {x. infdist x A \<le> e} \<subseteq> B"
     with \<open>d > 0\<close> obtain x where x: "infdist x A \<le> d" "x \<notin> B"
       by auto
     from assms have "closed A" "A \<noteq> {}" by (auto simp: compact_eq_bounded_closed)
     from infdist_attains_inf[OF this]
     obtain y where y: "y \<in> A" "infdist x A = dist x y"
       by auto
     have "dist x y \<le> d" using x y by simp
     also have "\<dots> < dist x y" using y d x by auto
     finally show False by simp
   qed
 qed
 
 
 subsection \<open>Uniform Continuity\<close>
 
 lemma uniformly_continuous_onE:
   assumes "uniformly_continuous_on s f" "0 < e"
   obtains d where "d>0" "\<And>x x'. \<lbrakk>x\<in>s; x'\<in>s; dist x' x < d\<rbrakk> \<Longrightarrow> dist (f x') (f x) < e"
 using assms
 by (auto simp: uniformly_continuous_on_def)
 
 lemma uniformly_continuous_on_sequentially:
   "uniformly_continuous_on s f \<longleftrightarrow> (\<forall>x y. (\<forall>n. x n \<in> s) \<and> (\<forall>n. y n \<in> s) \<and>
     (\<lambda>n. dist (x n) (y n)) \<longlonglongrightarrow> 0 \<longrightarrow> (\<lambda>n. dist (f(x n)) (f(y n))) \<longlonglongrightarrow> 0)" (is "?lhs = ?rhs")
 proof
   assume ?lhs
   {
     fix x y
     assume x: "\<forall>n. x n \<in> s"
       and y: "\<forall>n. y n \<in> s"
       and xy: "((\<lambda>n. dist (x n) (y n)) \<longlongrightarrow> 0) sequentially"
     {
       fix e :: real
       assume "e > 0"
       then obtain d where "d > 0" and d: "\<forall>x\<in>s. \<forall>x'\<in>s. dist x' x < d \<longrightarrow> dist (f x') (f x) < e"
         using \<open>?lhs\<close>[unfolded uniformly_continuous_on_def, THEN spec[where x=e]] by auto
       obtain N where N: "\<forall>n\<ge>N. dist (x n) (y n) < d"
         using xy[unfolded lim_sequentially dist_norm] and \<open>d>0\<close> by auto
       {
         fix n
         assume "n\<ge>N"
         then have "dist (f (x n)) (f (y n)) < e"
           using N[THEN spec[where x=n]]
           using d[THEN bspec[where x="x n"], THEN bspec[where x="y n"]]
           using x and y
           by (simp add: dist_commute)
       }
       then have "\<exists>N. \<forall>n\<ge>N. dist (f (x n)) (f (y n)) < e"
         by auto
     }
     then have "((\<lambda>n. dist (f(x n)) (f(y n))) \<longlongrightarrow> 0) sequentially"
       unfolding lim_sequentially and dist_real_def by auto
   }
   then show ?rhs by auto
 next
   assume ?rhs
   {
     assume "\<not> ?lhs"
     then obtain e where "e > 0" "\<forall>d>0. \<exists>x\<in>s. \<exists>x'\<in>s. dist x' x < d \<and> \<not> dist (f x') (f x) < e"
       unfolding uniformly_continuous_on_def by auto
     then obtain fa where fa:
       "\<forall>x. 0 < x \<longrightarrow> fst (fa x) \<in> s \<and> snd (fa x) \<in> s \<and> dist (fst (fa x)) (snd (fa x)) < x \<and> \<not> dist (f (fst (fa x))) (f (snd (fa x))) < e"
       using choice[of "\<lambda>d x. d>0 \<longrightarrow> fst x \<in> s \<and> snd x \<in> s \<and> dist (snd x) (fst x) < d \<and> \<not> dist (f (snd x)) (f (fst x)) < e"]
       unfolding Bex_def
       by (auto simp: dist_commute)
     define x where "x n = fst (fa (inverse (real n + 1)))" for n
     define y where "y n = snd (fa (inverse (real n + 1)))" for n
     have xyn: "\<forall>n. x n \<in> s \<and> y n \<in> s"
       and xy0: "\<forall>n. dist (x n) (y n) < inverse (real n + 1)"
       and fxy:"\<forall>n. \<not> dist (f (x n)) (f (y n)) < e"
       unfolding x_def and y_def using fa
       by auto
     {
       fix e :: real
       assume "e > 0"
       then obtain N :: nat where "N \<noteq> 0" and N: "0 < inverse (real N) \<and> inverse (real N) < e"
         unfolding real_arch_inverse[of e] by auto
       {
         fix n :: nat
         assume "n \<ge> N"
         then have "inverse (real n + 1) < inverse (real N)"
           using of_nat_0_le_iff and \<open>N\<noteq>0\<close> by auto
         also have "\<dots> < e" using N by auto
         finally have "inverse (real n + 1) < e" by auto
         then have "dist (x n) (y n) < e"
           using xy0[THEN spec[where x=n]] by auto
       }
       then have "\<exists>N. \<forall>n\<ge>N. dist (x n) (y n) < e" by auto
     }
     then have "\<forall>e>0. \<exists>N. \<forall>n\<ge>N. dist (f (x n)) (f (y n)) < e"
       using \<open>?rhs\<close>[THEN spec[where x=x], THEN spec[where x=y]] and xyn
       unfolding lim_sequentially dist_real_def by auto
     then have False using fxy and \<open>e>0\<close> by auto
   }
   then show ?lhs
     unfolding uniformly_continuous_on_def by blast
 qed
 
 
 subsection \<open>Continuity on a Compact Domain Implies Uniform Continuity\<close>
 
 text\<open>From the proof of the Heine-Borel theorem: Lemma 2 in section 3.7, page 69 of
 J. C. Burkill and H. Burkill. A Second Course in Mathematical Analysis (CUP, 2002)\<close>
 
 lemma Heine_Borel_lemma:
   assumes "compact S" and Ssub: "S \<subseteq> \<Union>\<G>" and opn: "\<And>G. G \<in> \<G> \<Longrightarrow> open G"
   obtains e where "0 < e" "\<And>x. x \<in> S \<Longrightarrow> \<exists>G \<in> \<G>. ball x e \<subseteq> G"
 proof -
   have False if neg: "\<And>e. 0 < e \<Longrightarrow> \<exists>x \<in> S. \<forall>G \<in> \<G>. \<not> ball x e \<subseteq> G"
   proof -
     have "\<exists>x \<in> S. \<forall>G \<in> \<G>. \<not> ball x (1 / Suc n) \<subseteq> G" for n
       using neg by simp
     then obtain f where "\<And>n. f n \<in> S" and fG: "\<And>G n. G \<in> \<G> \<Longrightarrow> \<not> ball (f n) (1 / Suc n) \<subseteq> G"
       by metis
     then obtain l r where "l \<in> S" "strict_mono r" and to_l: "(f \<circ> r) \<longlonglongrightarrow> l"
       using \<open>compact S\<close> compact_def that by metis
     then obtain G where "l \<in> G" "G \<in> \<G>"
       using Ssub by auto
     then obtain e where "0 < e" and e: "\<And>z. dist z l < e \<Longrightarrow> z \<in> G"
       using opn open_dist by blast
     obtain N1 where N1: "\<And>n. n \<ge> N1 \<Longrightarrow> dist (f (r n)) l < e/2"
       using to_l apply (simp add: lim_sequentially)
       using \<open>0 < e\<close> half_gt_zero that by blast
     obtain N2 where N2: "of_nat N2 > 2/e"
       using reals_Archimedean2 by blast
     obtain x where "x \<in> ball (f (r (max N1 N2))) (1 / real (Suc (r (max N1 N2))))" and "x \<notin> G"
       using fG [OF \<open>G \<in> \<G>\<close>, of "r (max N1 N2)"] by blast
     then have "dist (f (r (max N1 N2))) x < 1 / real (Suc (r (max N1 N2)))"
       by simp
     also have "... \<le> 1 / real (Suc (max N1 N2))"
       apply (simp add: field_split_simps del: max.bounded_iff)
       using \<open>strict_mono r\<close> seq_suble by blast
     also have "... \<le> 1 / real (Suc N2)"
       by (simp add: field_simps)
     also have "... < e/2"
       using N2 \<open>0 < e\<close> by (simp add: field_simps)
     finally have "dist (f (r (max N1 N2))) x < e / 2" .
     moreover have "dist (f (r (max N1 N2))) l < e/2"
       using N1 max.cobounded1 by blast
     ultimately have "dist x l < e"
       by metric
     then show ?thesis
       using e \<open>x \<notin> G\<close> by blast
   qed
   then show ?thesis
     by (meson that)
 qed
 
 lemma compact_uniformly_equicontinuous:
   assumes "compact S"
       and cont: "\<And>x e. \<lbrakk>x \<in> S; 0 < e\<rbrakk>
                         \<Longrightarrow> \<exists>d. 0 < d \<and>
                                 (\<forall>f \<in> \<F>. \<forall>x' \<in> S. dist x' x < d \<longrightarrow> dist (f x') (f x) < e)"
       and "0 < e"
   obtains d where "0 < d"
                   "\<And>f x x'. \<lbrakk>f \<in> \<F>; x \<in> S; x' \<in> S; dist x' x < d\<rbrakk> \<Longrightarrow> dist (f x') (f x) < e"
 proof -
   obtain d where d_pos: "\<And>x e. \<lbrakk>x \<in> S; 0 < e\<rbrakk> \<Longrightarrow> 0 < d x e"
      and d_dist : "\<And>x x' e f. \<lbrakk>dist x' x < d x e; x \<in> S; x' \<in> S; 0 < e; f \<in> \<F>\<rbrakk> \<Longrightarrow> dist (f x') (f x) < e"
     using cont by metis
   let ?\<G> = "((\<lambda>x. ball x (d x (e / 2))) ` S)"
   have Ssub: "S \<subseteq> \<Union> ?\<G>"
     by clarsimp (metis d_pos \<open>0 < e\<close> dist_self half_gt_zero_iff)
   then obtain k where "0 < k" and k: "\<And>x. x \<in> S \<Longrightarrow> \<exists>G \<in> ?\<G>. ball x k \<subseteq> G"
     by (rule Heine_Borel_lemma [OF \<open>compact S\<close>]) auto
   moreover have "dist (f v) (f u) < e" if "f \<in> \<F>" "u \<in> S" "v \<in> S" "dist v u < k" for f u v
   proof -
     obtain G where "G \<in> ?\<G>" "u \<in> G" "v \<in> G"
       using k that
       by (metis \<open>dist v u < k\<close> \<open>u \<in> S\<close> \<open>0 < k\<close> centre_in_ball subsetD dist_commute mem_ball)
     then obtain w where w: "dist w u < d w (e / 2)" "dist w v < d w (e / 2)" "w \<in> S"
       by auto
     with that d_dist have "dist (f w) (f v) < e/2"
       by (metis \<open>0 < e\<close> dist_commute half_gt_zero)
     moreover
     have "dist (f w) (f u) < e/2"
       using that d_dist w by (metis \<open>0 < e\<close> dist_commute divide_pos_pos zero_less_numeral)
     ultimately show ?thesis
       using dist_triangle_half_r by blast
   qed
   ultimately show ?thesis using that by blast
 qed
 
 corollary compact_uniformly_continuous:
   fixes f :: "'a :: metric_space \<Rightarrow> 'b :: metric_space"
   assumes f: "continuous_on S f" and S: "compact S"
   shows "uniformly_continuous_on S f"
   using f
     unfolding continuous_on_iff uniformly_continuous_on_def
     by (force intro: compact_uniformly_equicontinuous [OF S, of "{f}"])
 
 
 subsection\<^marker>\<open>tag unimportant\<close>\<open> Theorems relating continuity and uniform continuity to closures\<close>
 
 lemma continuous_on_closure:
    "continuous_on (closure S) f \<longleftrightarrow>
     (\<forall>x e. x \<in> closure S \<and> 0 < e
            \<longrightarrow> (\<exists>d. 0 < d \<and> (\<forall>y. y \<in> S \<and> dist y x < d \<longrightarrow> dist (f y) (f x) < e)))"
    (is "?lhs = ?rhs")
 proof
   assume ?lhs then show ?rhs
     unfolding continuous_on_iff  by (metis Un_iff closure_def)
 next
   assume R [rule_format]: ?rhs
   show ?lhs
   proof
     fix x and e::real
     assume "0 < e" and x: "x \<in> closure S"
     obtain \<delta>::real where "\<delta> > 0"
                    and \<delta>: "\<And>y. \<lbrakk>y \<in> S; dist y x < \<delta>\<rbrakk> \<Longrightarrow> dist (f y) (f x) < e/2"
       using R [of x "e/2"] \<open>0 < e\<close> x by auto
     have "dist (f y) (f x) \<le> e" if y: "y \<in> closure S" and dyx: "dist y x < \<delta>/2" for y
     proof -
       obtain \<delta>'::real where "\<delta>' > 0"
                       and \<delta>': "\<And>z. \<lbrakk>z \<in> S; dist z y < \<delta>'\<rbrakk> \<Longrightarrow> dist (f z) (f y) < e/2"
         using R [of y "e/2"] \<open>0 < e\<close> y by auto
       obtain z where "z \<in> S" and z: "dist z y < min \<delta>' \<delta> / 2"
         using closure_approachable y
         by (metis \<open>0 < \<delta>'\<close> \<open>0 < \<delta>\<close> divide_pos_pos min_less_iff_conj zero_less_numeral)
       have "dist (f z) (f y) < e/2"
         using \<delta>' [OF \<open>z \<in> S\<close>] z \<open>0 < \<delta>'\<close> by metric
       moreover have "dist (f z) (f x) < e/2"
         using \<delta>[OF \<open>z \<in> S\<close>] z dyx by metric
       ultimately show ?thesis
         by metric
     qed
     then show "\<exists>d>0. \<forall>x'\<in>closure S. dist x' x < d \<longrightarrow> dist (f x') (f x) \<le> e"
       by (rule_tac x="\<delta>/2" in exI) (simp add: \<open>\<delta> > 0\<close>)
   qed
 qed
 
 lemma continuous_on_closure_sequentially:
   fixes f :: "'a::metric_space \<Rightarrow> 'b :: metric_space"
   shows
    "continuous_on (closure S) f \<longleftrightarrow>
     (\<forall>x a. a \<in> closure S \<and> (\<forall>n. x n \<in> S) \<and> x \<longlonglongrightarrow> a \<longrightarrow> (f \<circ> x) \<longlonglongrightarrow> f a)"
    (is "?lhs = ?rhs")
 proof -
   have "continuous_on (closure S) f \<longleftrightarrow>
            (\<forall>x \<in> closure S. continuous (at x within S) f)"
     by (force simp: continuous_on_closure continuous_within_eps_delta)
   also have "... = ?rhs"
     by (force simp: continuous_within_sequentially)
   finally show ?thesis .
 qed
 
 lemma uniformly_continuous_on_closure:
   fixes f :: "'a::metric_space \<Rightarrow> 'b::metric_space"
   assumes ucont: "uniformly_continuous_on S f"
       and cont: "continuous_on (closure S) f"
     shows "uniformly_continuous_on (closure S) f"
 unfolding uniformly_continuous_on_def
 proof (intro allI impI)
   fix e::real
   assume "0 < e"
   then obtain d::real
     where "d>0"
       and d: "\<And>x x'. \<lbrakk>x\<in>S; x'\<in>S; dist x' x < d\<rbrakk> \<Longrightarrow> dist (f x') (f x) < e/3"
     using ucont [unfolded uniformly_continuous_on_def, rule_format, of "e/3"] by auto
   show "\<exists>d>0. \<forall>x\<in>closure S. \<forall>x'\<in>closure S. dist x' x < d \<longrightarrow> dist (f x') (f x) < e"
   proof (rule exI [where x="d/3"], clarsimp simp: \<open>d > 0\<close>)
     fix x y
     assume x: "x \<in> closure S" and y: "y \<in> closure S" and dyx: "dist y x * 3 < d"
     obtain d1::real where "d1 > 0"
            and d1: "\<And>w. \<lbrakk>w \<in> closure S; dist w x < d1\<rbrakk> \<Longrightarrow> dist (f w) (f x) < e/3"
       using cont [unfolded continuous_on_iff, rule_format, of "x" "e/3"] \<open>0 < e\<close> x by auto
      obtain x' where "x' \<in> S" and x': "dist x' x < min d1 (d / 3)"
         using closure_approachable [of x S]
         by (metis \<open>0 < d1\<close> \<open>0 < d\<close> divide_pos_pos min_less_iff_conj x zero_less_numeral)
     obtain d2::real where "d2 > 0"
            and d2: "\<forall>w \<in> closure S. dist w y < d2 \<longrightarrow> dist (f w) (f y) < e/3"
       using cont [unfolded continuous_on_iff, rule_format, of "y" "e/3"] \<open>0 < e\<close> y by auto
     obtain y' where "y' \<in> S" and y': "dist y' y < min d2 (d / 3)"
       using closure_approachable [of y S]
       by (metis \<open>0 < d2\<close> \<open>0 < d\<close> divide_pos_pos min_less_iff_conj y zero_less_numeral)
     have "dist x' x < d/3" using x' by auto
     then have "dist x' y' < d"
       using dyx y' by metric
     then have "dist (f x') (f y') < e/3"
       by (rule d [OF \<open>y' \<in> S\<close> \<open>x' \<in> S\<close>])
     moreover have "dist (f x') (f x) < e/3" using \<open>x' \<in> S\<close> closure_subset x' d1
       by (simp add: closure_def)
     moreover have "dist (f y') (f y) < e/3" using \<open>y' \<in> S\<close> closure_subset y' d2
       by (simp add: closure_def)
     ultimately show "dist (f y) (f x) < e" by metric
   qed
 qed
 
 lemma uniformly_continuous_on_extension_at_closure:
   fixes f::"'a::metric_space \<Rightarrow> 'b::complete_space"
   assumes uc: "uniformly_continuous_on X f"
   assumes "x \<in> closure X"
   obtains l where "(f \<longlongrightarrow> l) (at x within X)"
 proof -
   from assms obtain xs where xs: "xs \<longlonglongrightarrow> x" "\<And>n. xs n \<in> X"
     by (auto simp: closure_sequential)
 
   from uniformly_continuous_on_Cauchy[OF uc LIMSEQ_imp_Cauchy, OF xs]
   obtain l where l: "(\<lambda>n. f (xs n)) \<longlonglongrightarrow> l"
     by atomize_elim (simp only: convergent_eq_Cauchy)
 
   have "(f \<longlongrightarrow> l) (at x within X)"
   proof (safe intro!: Lim_within_LIMSEQ)
     fix xs'
     assume "\<forall>n. xs' n \<noteq> x \<and> xs' n \<in> X"
       and xs': "xs' \<longlonglongrightarrow> x"
     then have "xs' n \<noteq> x" "xs' n \<in> X" for n by auto
 
     from uniformly_continuous_on_Cauchy[OF uc LIMSEQ_imp_Cauchy, OF \<open>xs' \<longlonglongrightarrow> x\<close> \<open>xs' _ \<in> X\<close>]
     obtain l' where l': "(\<lambda>n. f (xs' n)) \<longlonglongrightarrow> l'"
       by atomize_elim (simp only: convergent_eq_Cauchy)
 
     show "(\<lambda>n. f (xs' n)) \<longlonglongrightarrow> l"
     proof (rule tendstoI)
       fix e::real assume "e > 0"
       define e' where "e' \<equiv> e / 2"
       have "e' > 0" using \<open>e > 0\<close> by (simp add: e'_def)
 
       have "\<forall>\<^sub>F n in sequentially. dist (f (xs n)) l < e'"
         by (simp add: \<open>0 < e'\<close> l tendstoD)
       moreover
       from uc[unfolded uniformly_continuous_on_def, rule_format, OF \<open>e' > 0\<close>]
       obtain d where d: "d > 0" "\<And>x x'. x \<in> X \<Longrightarrow> x' \<in> X \<Longrightarrow> dist x x' < d \<Longrightarrow> dist (f x) (f x') < e'"
         by auto
       have "\<forall>\<^sub>F n in sequentially. dist (xs n) (xs' n) < d"
         by (auto intro!: \<open>0 < d\<close> order_tendstoD tendsto_eq_intros xs xs')
       ultimately
       show "\<forall>\<^sub>F n in sequentially. dist (f (xs' n)) l < e"
       proof eventually_elim
         case (elim n)
         have "dist (f (xs' n)) l \<le> dist (f (xs n)) (f (xs' n)) + dist (f (xs n)) l"
           by metric
         also have "dist (f (xs n)) (f (xs' n)) < e'"
           by (auto intro!: d xs \<open>xs' _ \<in> _\<close> elim)
         also note \<open>dist (f (xs n)) l < e'\<close>
         also have "e' + e' = e" by (simp add: e'_def)
         finally show ?case by simp
       qed
     qed
   qed
   thus ?thesis ..
 qed
 
 lemma uniformly_continuous_on_extension_on_closure:
   fixes f::"'a::metric_space \<Rightarrow> 'b::complete_space"
   assumes uc: "uniformly_continuous_on X f"
   obtains g where "uniformly_continuous_on (closure X) g" "\<And>x. x \<in> X \<Longrightarrow> f x = g x"
     "\<And>Y h x. X \<subseteq> Y \<Longrightarrow> Y \<subseteq> closure X \<Longrightarrow> continuous_on Y h \<Longrightarrow> (\<And>x. x \<in> X \<Longrightarrow> f x = h x) \<Longrightarrow> x \<in> Y \<Longrightarrow> h x = g x"
 proof -
   from uc have cont_f: "continuous_on X f"
     by (simp add: uniformly_continuous_imp_continuous)
   obtain y where y: "(f \<longlongrightarrow> y x) (at x within X)" if "x \<in> closure X" for x
     apply atomize_elim
     apply (rule choice)
     using uniformly_continuous_on_extension_at_closure[OF assms]
     by metis
   let ?g = "\<lambda>x. if x \<in> X then f x else y x"
 
   have "uniformly_continuous_on (closure X) ?g"
     unfolding uniformly_continuous_on_def
   proof safe
     fix e::real assume "e > 0"
     define e' where "e' \<equiv> e / 3"
     have "e' > 0" using \<open>e > 0\<close> by (simp add: e'_def)
     from uc[unfolded uniformly_continuous_on_def, rule_format, OF \<open>0 < e'\<close>]
     obtain d where "d > 0" and d: "\<And>x x'. x \<in> X \<Longrightarrow> x' \<in> X \<Longrightarrow> dist x' x < d \<Longrightarrow> dist (f x') (f x) < e'"
       by auto
     define d' where "d' = d / 3"
     have "d' > 0" using \<open>d > 0\<close> by (simp add: d'_def)
     show "\<exists>d>0. \<forall>x\<in>closure X. \<forall>x'\<in>closure X. dist x' x < d \<longrightarrow> dist (?g x') (?g x) < e"
     proof (safe intro!: exI[where x=d'] \<open>d' > 0\<close>)
       fix x x' assume x: "x \<in> closure X" and x': "x' \<in> closure X" and dist: "dist x' x < d'"
       then obtain xs xs' where xs: "xs \<longlonglongrightarrow> x" "\<And>n. xs n \<in> X"
         and xs': "xs' \<longlonglongrightarrow> x'" "\<And>n. xs' n \<in> X"
         by (auto simp: closure_sequential)
       have "\<forall>\<^sub>F n in sequentially. dist (xs' n) x' < d'"
         and "\<forall>\<^sub>F n in sequentially. dist (xs n) x < d'"
         by (auto intro!: \<open>0 < d'\<close> order_tendstoD tendsto_eq_intros xs xs')
       moreover
       have "(\<lambda>x. f (xs x)) \<longlonglongrightarrow> y x" if "x \<in> closure X" "x \<notin> X" "xs \<longlonglongrightarrow> x" "\<And>n. xs n \<in> X" for xs x
         using that not_eventuallyD
         by (force intro!: filterlim_compose[OF y[OF \<open>x \<in> closure X\<close>]] simp: filterlim_at)
       then have "(\<lambda>x. f (xs' x)) \<longlonglongrightarrow> ?g x'" "(\<lambda>x. f (xs x)) \<longlonglongrightarrow> ?g x"
         using x x'
         by (auto intro!: continuous_on_tendsto_compose[OF cont_f] simp: xs' xs)
       then have "\<forall>\<^sub>F n in sequentially. dist (f (xs' n)) (?g x') < e'"
         "\<forall>\<^sub>F n in sequentially. dist (f (xs n)) (?g x) < e'"
         by (auto intro!: \<open>0 < e'\<close> order_tendstoD tendsto_eq_intros)
       ultimately
       have "\<forall>\<^sub>F n in sequentially. dist (?g x') (?g x) < e"
       proof eventually_elim
         case (elim n)
         have "dist (?g x') (?g x) \<le>
           dist (f (xs' n)) (?g x') + dist (f (xs' n)) (f (xs n)) + dist (f (xs n)) (?g x)"
           by (metis add.commute add_le_cancel_left dist_commute dist_triangle dist_triangle_le)
         also
         from \<open>dist (xs' n) x' < d'\<close> \<open>dist x' x < d'\<close> \<open>dist (xs n) x < d'\<close>
         have "dist (xs' n) (xs n) < d" unfolding d'_def by metric
         with \<open>xs _ \<in> X\<close> \<open>xs' _ \<in> X\<close> have "dist (f (xs' n)) (f (xs n)) < e'"
           by (rule d)
         also note \<open>dist (f (xs' n)) (?g x') < e'\<close>
         also note \<open>dist (f (xs n)) (?g x) < e'\<close>
         finally show ?case by (simp add: e'_def)
       qed
       then show "dist (?g x') (?g x) < e" by simp
     qed
   qed
   moreover have "f x = ?g x" if "x \<in> X" for x using that by simp
   moreover
   {
     fix Y h x
     assume Y: "x \<in> Y" "X \<subseteq> Y" "Y \<subseteq> closure X" and cont_h: "continuous_on Y h"
       and extension: "(\<And>x. x \<in> X \<Longrightarrow> f x = h x)"
     {
       assume "x \<notin> X"
       have "x \<in> closure X" using Y by auto
       then obtain xs where xs: "xs \<longlonglongrightarrow> x" "\<And>n. xs n \<in> X"
         by (auto simp: closure_sequential)
       from continuous_on_tendsto_compose[OF cont_h xs(1)] xs(2) Y
       have hx: "(\<lambda>x. f (xs x)) \<longlonglongrightarrow> h x"
         by (auto simp: subsetD extension)
       then have "(\<lambda>x. f (xs x)) \<longlonglongrightarrow> y x"
         using \<open>x \<notin> X\<close> not_eventuallyD xs(2)
         by (force intro!: filterlim_compose[OF y[OF \<open>x \<in> closure X\<close>]] simp: filterlim_at xs)
       with hx have "h x = y x" by (rule LIMSEQ_unique)
     } then
     have "h x = ?g x"
       using extension by auto
   }
   ultimately show ?thesis ..
 qed
 
 lemma bounded_uniformly_continuous_image:
   fixes f :: "'a :: heine_borel \<Rightarrow> 'b :: heine_borel"
   assumes "uniformly_continuous_on S f" "bounded S"
   shows "bounded(f ` S)"
   by (metis (no_types, lifting) assms bounded_closure_image compact_closure compact_continuous_image compact_eq_bounded_closed image_cong uniformly_continuous_imp_continuous uniformly_continuous_on_extension_on_closure)
 
 
 subsection \<open>With Abstract Topology (TODO: move and remove dependency?)\<close>
 
 lemma openin_contains_ball:
     "openin (top_of_set t) s \<longleftrightarrow>
      s \<subseteq> t \<and> (\<forall>x \<in> s. \<exists>e. 0 < e \<and> ball x e \<inter> t \<subseteq> s)"
     (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then show ?rhs
     apply (simp add: openin_open)
     apply (metis Int_commute Int_mono inf.cobounded2 open_contains_ball order_refl subsetCE)
     done
 next
   assume ?rhs
   then show ?lhs
     apply (simp add: openin_euclidean_subtopology_iff)
     by (metis (no_types) Int_iff dist_commute inf.absorb_iff2 mem_ball)
 qed
 
 lemma openin_contains_cball:
    "openin (top_of_set t) s \<longleftrightarrow>
         s \<subseteq> t \<and>
         (\<forall>x \<in> s. \<exists>e. 0 < e \<and> cball x e \<inter> t \<subseteq> s)"
   apply (simp add: openin_contains_ball)
   apply (rule iffI)
    apply (auto dest!: bspec)
    apply (rule_tac x="e/2" in exI, force+)
   done
 
 
 subsection \<open>Closed Nest\<close>
 
 text \<open>Bounded closed nest property (proof does not use Heine-Borel)\<close>
 
 lemma bounded_closed_nest:
   fixes S :: "nat \<Rightarrow> ('a::heine_borel) set"
   assumes "\<And>n. closed (S n)"
       and "\<And>n. S n \<noteq> {}"
       and "\<And>m n. m \<le> n \<Longrightarrow> S n \<subseteq> S m"
       and "bounded (S 0)"
   obtains a where "\<And>n. a \<in> S n"
 proof -
   from assms(2) obtain x where x: "\<forall>n. x n \<in> S n"
     using choice[of "\<lambda>n x. x \<in> S n"] by auto
   from assms(4,1) have "seq_compact (S 0)"
     by (simp add: bounded_closed_imp_seq_compact)
   then obtain l r where lr: "l \<in> S 0" "strict_mono r" "(x \<circ> r) \<longlonglongrightarrow> l"
     using x and assms(3) unfolding seq_compact_def by blast
   have "\<forall>n. l \<in> S n"
   proof
     fix n :: nat
     have "closed (S n)"
       using assms(1) by simp
     moreover have "\<forall>i. (x \<circ> r) i \<in> S i"
       using x and assms(3) and lr(2) [THEN seq_suble] by auto
     then have "\<forall>i. (x \<circ> r) (i + n) \<in> S n"
       using assms(3) by (fast intro!: le_add2)
     moreover have "(\<lambda>i. (x \<circ> r) (i + n)) \<longlonglongrightarrow> l"
       using lr(3) by (rule LIMSEQ_ignore_initial_segment)
     ultimately show "l \<in> S n"
       by (rule closed_sequentially)
   qed
   then show ?thesis 
     using that by blast
 qed
 
 text \<open>Decreasing case does not even need compactness, just completeness.\<close>
 
 lemma decreasing_closed_nest:
   fixes S :: "nat \<Rightarrow> ('a::complete_space) set"
   assumes "\<And>n. closed (S n)"
           "\<And>n. S n \<noteq> {}"
           "\<And>m n. m \<le> n \<Longrightarrow> S n \<subseteq> S m"
           "\<And>e. e>0 \<Longrightarrow> \<exists>n. \<forall>x\<in>S n. \<forall>y\<in>S n. dist x y < e"
   obtains a where "\<And>n. a \<in> S n"
 proof -
   have "\<forall>n. \<exists>x. x \<in> S n"
     using assms(2) by auto
   then have "\<exists>t. \<forall>n. t n \<in> S n"
     using choice[of "\<lambda>n x. x \<in> S n"] by auto
   then obtain t where t: "\<forall>n. t n \<in> S n" by auto
   {
     fix e :: real
     assume "e > 0"
     then obtain N where N: "\<forall>x\<in>S N. \<forall>y\<in>S N. dist x y < e"
       using assms(4) by blast
     {
       fix m n :: nat
       assume "N \<le> m \<and> N \<le> n"
       then have "t m \<in> S N" "t n \<in> S N"
         using assms(3) t unfolding  subset_eq t by blast+
       then have "dist (t m) (t n) < e"
         using N by auto
     }
     then have "\<exists>N. \<forall>m n. N \<le> m \<and> N \<le> n \<longrightarrow> dist (t m) (t n) < e"
       by auto
   }
   then have "Cauchy t"
     unfolding cauchy_def by auto
   then obtain l where l:"(t \<longlongrightarrow> l) sequentially"
     using complete_UNIV unfolding complete_def by auto
   { fix n :: nat
     { fix e :: real
       assume "e > 0"
       then obtain N :: nat where N: "\<forall>n\<ge>N. dist (t n) l < e"
         using l[unfolded lim_sequentially] by auto
       have "t (max n N) \<in> S n"
         by (meson assms(3) contra_subsetD max.cobounded1 t)
       then have "\<exists>y\<in>S n. dist y l < e"
         using N max.cobounded2 by blast
     }
     then have "l \<in> S n"
       using closed_approachable[of "S n" l] assms(1) by auto
   }
   then show ?thesis
     using that by blast
 qed
 
 text \<open>Strengthen it to the intersection actually being a singleton.\<close>
 
 lemma decreasing_closed_nest_sing:
   fixes S :: "nat \<Rightarrow> 'a::complete_space set"
   assumes "\<And>n. closed(S n)"
           "\<And>n. S n \<noteq> {}"
           "\<And>m n. m \<le> n \<Longrightarrow> S n \<subseteq> S m"
           "\<And>e. e>0 \<Longrightarrow> \<exists>n. \<forall>x \<in> (S n). \<forall> y\<in>(S n). dist x y < e"
   shows "\<exists>a. \<Inter>(range S) = {a}"
 proof -
   obtain a where a: "\<forall>n. a \<in> S n"
     using decreasing_closed_nest[of S] using assms by auto
   { fix b
     assume b: "b \<in> \<Inter>(range S)"
     { fix e :: real
       assume "e > 0"
       then have "dist a b < e"
         using assms(4) and b and a by blast
     }
     then have "dist a b = 0"
       by (metis dist_eq_0_iff dist_nz less_le)
   }
   with a have "\<Inter>(range S) = {a}"
     unfolding image_def by auto
   then show ?thesis ..
 qed
 
 subsection\<^marker>\<open>tag unimportant\<close> \<open>Making a continuous function avoid some value in a neighbourhood\<close>
 
 lemma continuous_within_avoid:
   fixes f :: "'a::metric_space \<Rightarrow> 'b::t1_space"
   assumes "continuous (at x within s) f"
     and "f x \<noteq> a"
   shows "\<exists>e>0. \<forall>y \<in> s. dist x y < e --> f y \<noteq> a"
 proof -
   obtain U where "open U" and "f x \<in> U" and "a \<notin> U"
     using t1_space [OF \<open>f x \<noteq> a\<close>] by fast
   have "(f \<longlongrightarrow> f x) (at x within s)"
     using assms(1) by (simp add: continuous_within)
   then have "eventually (\<lambda>y. f y \<in> U) (at x within s)"
     using \<open>open U\<close> and \<open>f x \<in> U\<close>
     unfolding tendsto_def by fast
   then have "eventually (\<lambda>y. f y \<noteq> a) (at x within s)"
     using \<open>a \<notin> U\<close> by (fast elim: eventually_mono)
   then show ?thesis
     using \<open>f x \<noteq> a\<close> by (auto simp: dist_commute eventually_at)
 qed
 
 lemma continuous_at_avoid:
   fixes f :: "'a::metric_space \<Rightarrow> 'b::t1_space"
   assumes "continuous (at x) f"
     and "f x \<noteq> a"
   shows "\<exists>e>0. \<forall>y. dist x y < e \<longrightarrow> f y \<noteq> a"
   using assms continuous_within_avoid[of x UNIV f a] by simp
 
 lemma continuous_on_avoid:
   fixes f :: "'a::metric_space \<Rightarrow> 'b::t1_space"
   assumes "continuous_on s f"
     and "x \<in> s"
     and "f x \<noteq> a"
   shows "\<exists>e>0. \<forall>y \<in> s. dist x y < e \<longrightarrow> f y \<noteq> a"
   using assms(1)[unfolded continuous_on_eq_continuous_within, THEN bspec[where x=x],
     OF assms(2)] continuous_within_avoid[of x s f a]
   using assms(3)
   by auto
 
 lemma continuous_on_open_avoid:
   fixes f :: "'a::metric_space \<Rightarrow> 'b::t1_space"
   assumes "continuous_on s f"
     and "open s"
     and "x \<in> s"
     and "f x \<noteq> a"
   shows "\<exists>e>0. \<forall>y. dist x y < e \<longrightarrow> f y \<noteq> a"
   using assms(1)[unfolded continuous_on_eq_continuous_at[OF assms(2)], THEN bspec[where x=x], OF assms(3)]
   using continuous_at_avoid[of x f a] assms(4)
   by auto
 
 subsection \<open>Consequences for Real Numbers\<close>
 
 lemma closed_contains_Inf:
   fixes S :: "real set"
   shows "S \<noteq> {} \<Longrightarrow> bdd_below S \<Longrightarrow> closed S \<Longrightarrow> Inf S \<in> S"
   by (metis closure_contains_Inf closure_closed)
 
 lemma closed_subset_contains_Inf:
   fixes A C :: "real set"
   shows "closed C \<Longrightarrow> A \<subseteq> C \<Longrightarrow> A \<noteq> {} \<Longrightarrow> bdd_below A \<Longrightarrow> Inf A \<in> C"
   by (metis closure_contains_Inf closure_minimal subset_eq)
 
 lemma closed_contains_Sup:
   fixes S :: "real set"
   shows "S \<noteq> {} \<Longrightarrow> bdd_above S \<Longrightarrow> closed S \<Longrightarrow> Sup S \<in> S"
   by (subst closure_closed[symmetric], assumption, rule closure_contains_Sup)
 
 lemma closed_subset_contains_Sup:
   fixes A C :: "real set"
   shows "closed C \<Longrightarrow> A \<subseteq> C \<Longrightarrow> A \<noteq> {} \<Longrightarrow> bdd_above A \<Longrightarrow> Sup A \<in> C"
   by (metis closure_contains_Sup closure_minimal subset_eq)
 
 lemma atLeastAtMost_subset_contains_Inf:
   fixes A :: "real set" and a b :: real
   shows "A \<noteq> {} \<Longrightarrow> a \<le> b \<Longrightarrow> A \<subseteq> {a..b} \<Longrightarrow> Inf A \<in> {a..b}"
   by (rule closed_subset_contains_Inf)
      (auto intro: closed_real_atLeastAtMost intro!: bdd_belowI[of A a])
 
 lemma bounded_real: "bounded (S::real set) \<longleftrightarrow> (\<exists>a. \<forall>x\<in>S. \<bar>x\<bar> \<le> a)"
   by (simp add: bounded_iff)
 
 lemma bounded_imp_bdd_above: "bounded S \<Longrightarrow> bdd_above (S :: real set)"
   by (auto simp: bounded_def bdd_above_def dist_real_def)
      (metis abs_le_D1 abs_minus_commute diff_le_eq)
 
 lemma bounded_imp_bdd_below: "bounded S \<Longrightarrow> bdd_below (S :: real set)"
   by (auto simp: bounded_def bdd_below_def dist_real_def)
      (metis abs_le_D1 add.commute diff_le_eq)
 
 lemma bounded_has_Sup:
   fixes S :: "real set"
   assumes "bounded S"
     and "S \<noteq> {}"
   shows "\<forall>x\<in>S. x \<le> Sup S"
     and "\<forall>b. (\<forall>x\<in>S. x \<le> b) \<longrightarrow> Sup S \<le> b"
 proof
   show "\<forall>b. (\<forall>x\<in>S. x \<le> b) \<longrightarrow> Sup S \<le> b"
     using assms by (metis cSup_least)
 qed (metis cSup_upper assms(1) bounded_imp_bdd_above)
 
 lemma Sup_insert:
   fixes S :: "real set"
   shows "bounded S \<Longrightarrow> Sup (insert x S) = (if S = {} then x else max x (Sup S))"
   by (auto simp: bounded_imp_bdd_above sup_max cSup_insert_If)
 
 lemma bounded_has_Inf:
   fixes S :: "real set"
   assumes "bounded S"
     and "S \<noteq> {}"
   shows "\<forall>x\<in>S. x \<ge> Inf S"
     and "\<forall>b. (\<forall>x\<in>S. x \<ge> b) \<longrightarrow> Inf S \<ge> b"
 proof
   show "\<forall>b. (\<forall>x\<in>S. x \<ge> b) \<longrightarrow> Inf S \<ge> b"
     using assms by (metis cInf_greatest)
 qed (metis cInf_lower assms(1) bounded_imp_bdd_below)
 
 lemma Inf_insert:
   fixes S :: "real set"
   shows "bounded S \<Longrightarrow> Inf (insert x S) = (if S = {} then x else min x (Inf S))"
   by (auto simp: bounded_imp_bdd_below inf_min cInf_insert_If)
 
 lemma open_real:
   fixes s :: "real set"
   shows "open s \<longleftrightarrow> (\<forall>x \<in> s. \<exists>e>0. \<forall>x'. \<bar>x' - x\<bar> < e --> x' \<in> s)"
   unfolding open_dist dist_norm by simp
 
 lemma islimpt_approachable_real:
   fixes s :: "real set"
   shows "x islimpt s \<longleftrightarrow> (\<forall>e>0. \<exists>x'\<in> s. x' \<noteq> x \<and> \<bar>x' - x\<bar> < e)"
   unfolding islimpt_approachable dist_norm by simp
 
 lemma closed_real:
   fixes s :: "real set"
   shows "closed s \<longleftrightarrow> (\<forall>x. (\<forall>e>0.  \<exists>x' \<in> s. x' \<noteq> x \<and> \<bar>x' - x\<bar> < e) \<longrightarrow> x \<in> s)"
   unfolding closed_limpt islimpt_approachable dist_norm by simp
 
 lemma continuous_at_real_range:
   fixes f :: "'a::real_normed_vector \<Rightarrow> real"
   shows "continuous (at x) f \<longleftrightarrow> (\<forall>e>0. \<exists>d>0. \<forall>x'. norm(x' - x) < d --> \<bar>f x' - f x\<bar> < e)"
   unfolding continuous_at
   unfolding Lim_at
   unfolding dist_norm
   apply auto
   apply (erule_tac x=e in allE, auto)
   apply (rule_tac x=d in exI, auto)
   apply (erule_tac x=x' in allE, auto)
   apply (erule_tac x=e in allE, auto)
   done
 
 lemma continuous_on_real_range:
   fixes f :: "'a::real_normed_vector \<Rightarrow> real"
   shows "continuous_on s f \<longleftrightarrow>
     (\<forall>x \<in> s. \<forall>e>0. \<exists>d>0. (\<forall>x' \<in> s. norm(x' - x) < d \<longrightarrow> \<bar>f x' - f x\<bar> < e))"
   unfolding continuous_on_iff dist_norm by simp
 
 lemma continuous_on_closed_Collect_le:
   fixes f g :: "'a::topological_space \<Rightarrow> real"
   assumes f: "continuous_on s f" and g: "continuous_on s g" and s: "closed s"
   shows "closed {x \<in> s. f x \<le> g x}"
 proof -
   have "closed ((\<lambda>x. g x - f x) -` {0..} \<inter> s)"
     using closed_real_atLeast continuous_on_diff [OF g f]
     by (simp add: continuous_on_closed_vimage [OF s])
   also have "((\<lambda>x. g x - f x) -` {0..} \<inter> s) = {x\<in>s. f x \<le> g x}"
     by auto
   finally show ?thesis .
 qed
 
 lemma continuous_le_on_closure:
   fixes a::real
   assumes f: "continuous_on (closure s) f"
       and x: "x \<in> closure(s)"
       and xlo: "\<And>x. x \<in> s ==> f(x) \<le> a"
     shows "f(x) \<le> a"
   using image_closure_subset [OF f, where T=" {x. x \<le> a}" ] assms
     continuous_on_closed_Collect_le[of "UNIV" "\<lambda>x. x" "\<lambda>x. a"]
   by auto
 
 lemma continuous_ge_on_closure:
   fixes a::real
   assumes f: "continuous_on (closure s) f"
       and x: "x \<in> closure(s)"
       and xlo: "\<And>x. x \<in> s ==> f(x) \<ge> a"
     shows "f(x) \<ge> a"
   using image_closure_subset [OF f, where T=" {x. a \<le> x}"] assms
     continuous_on_closed_Collect_le[of "UNIV" "\<lambda>x. a" "\<lambda>x. x"]
   by auto
 
 
 subsection\<open>The infimum of the distance between two sets\<close>
 
 definition\<^marker>\<open>tag important\<close> setdist :: "'a::metric_space set \<Rightarrow> 'a set \<Rightarrow> real" where
   "setdist s t \<equiv>
        (if s = {} \<or> t = {} then 0
         else Inf {dist x y| x y. x \<in> s \<and> y \<in> t})"
 
 lemma setdist_empty1 [simp]: "setdist {} t = 0"
   by (simp add: setdist_def)
 
 lemma setdist_empty2 [simp]: "setdist t {} = 0"
   by (simp add: setdist_def)
 
 lemma setdist_pos_le [simp]: "0 \<le> setdist s t"
   by (auto simp: setdist_def ex_in_conv [symmetric] intro: cInf_greatest)
 
 lemma le_setdistI:
   assumes "s \<noteq> {}" "t \<noteq> {}" "\<And>x y. \<lbrakk>x \<in> s; y \<in> t\<rbrakk> \<Longrightarrow> d \<le> dist x y"
     shows "d \<le> setdist s t"
   using assms
   by (auto simp: setdist_def Set.ex_in_conv [symmetric] intro: cInf_greatest)
 
 lemma setdist_le_dist: "\<lbrakk>x \<in> s; y \<in> t\<rbrakk> \<Longrightarrow> setdist s t \<le> dist x y"
   unfolding setdist_def
   by (auto intro!: bdd_belowI [where m=0] cInf_lower)
 
 lemma le_setdist_iff:
         "d \<le> setdist s t \<longleftrightarrow>
         (\<forall>x \<in> s. \<forall>y \<in> t. d \<le> dist x y) \<and> (s = {} \<or> t = {} \<longrightarrow> d \<le> 0)"
   apply (cases "s = {} \<or> t = {}")
   apply (force simp add: setdist_def)
   apply (intro iffI conjI)
   using setdist_le_dist apply fastforce
   apply (auto simp: intro: le_setdistI)
   done
 
 lemma setdist_ltE:
   assumes "setdist s t < b" "s \<noteq> {}" "t \<noteq> {}"
     obtains x y where "x \<in> s" "y \<in> t" "dist x y < b"
 using assms
 by (auto simp: not_le [symmetric] le_setdist_iff)
 
 lemma setdist_refl: "setdist s s = 0"
   apply (cases "s = {}")
   apply (force simp add: setdist_def)
   apply (rule antisym [OF _ setdist_pos_le])
   apply (metis all_not_in_conv dist_self setdist_le_dist)
   done
 
 lemma setdist_sym: "setdist s t = setdist t s"
   by (force simp: setdist_def dist_commute intro!: arg_cong [where f=Inf])
 
 lemma setdist_triangle: "setdist s t \<le> setdist s {a} + setdist {a} t"
 proof (cases "s = {} \<or> t = {}")
   case True then show ?thesis
     using setdist_pos_le by fastforce
 next
   case False
   have "\<And>x. x \<in> s \<Longrightarrow> setdist s t - dist x a \<le> setdist {a} t"
     apply (rule le_setdistI, blast)
     using False apply (fastforce intro: le_setdistI)
     apply (simp add: algebra_simps)
     apply (metis dist_commute dist_triangle3 order_trans [OF setdist_le_dist])
     done
   then have "setdist s t - setdist {a} t \<le> setdist s {a}"
     using False by (fastforce intro: le_setdistI)
   then show ?thesis
     by (simp add: algebra_simps)
 qed
 
 lemma setdist_singletons [simp]: "setdist {x} {y} = dist x y"
   by (simp add: setdist_def)
 
 lemma setdist_Lipschitz: "\<bar>setdist {x} s - setdist {y} s\<bar> \<le> dist x y"
   apply (subst setdist_singletons [symmetric])
   by (metis abs_diff_le_iff diff_le_eq setdist_triangle setdist_sym)
 
 lemma continuous_at_setdist [continuous_intros]: "continuous (at x) (\<lambda>y. (setdist {y} s))"
   by (force simp: continuous_at_eps_delta dist_real_def intro: le_less_trans [OF setdist_Lipschitz])
 
 lemma continuous_on_setdist [continuous_intros]: "continuous_on t (\<lambda>y. (setdist {y} s))"
   by (metis continuous_at_setdist continuous_at_imp_continuous_on)
 
 lemma uniformly_continuous_on_setdist: "uniformly_continuous_on t (\<lambda>y. (setdist {y} s))"
   by (force simp: uniformly_continuous_on_def dist_real_def intro: le_less_trans [OF setdist_Lipschitz])
 
 lemma setdist_subset_right: "\<lbrakk>t \<noteq> {}; t \<subseteq> u\<rbrakk> \<Longrightarrow> setdist s u \<le> setdist s t"
   apply (cases "s = {} \<or> u = {}", force)
   apply (auto simp: setdist_def intro!: bdd_belowI [where m=0] cInf_superset_mono)
   done
 
 lemma setdist_subset_left: "\<lbrakk>s \<noteq> {}; s \<subseteq> t\<rbrakk> \<Longrightarrow> setdist t u \<le> setdist s u"
   by (metis setdist_subset_right setdist_sym)
 
 lemma setdist_closure_1 [simp]: "setdist (closure s) t = setdist s t"
 proof (cases "s = {} \<or> t = {}")
   case True then show ?thesis by force
 next
   case False
   { fix y
     assume "y \<in> t"
     have "continuous_on (closure s) (\<lambda>a. dist a y)"
       by (auto simp: continuous_intros dist_norm)
     then have *: "\<And>x. x \<in> closure s \<Longrightarrow> setdist s t \<le> dist x y"
       apply (rule continuous_ge_on_closure)
       apply assumption
       apply (blast intro: setdist_le_dist \<open>y \<in> t\<close> )
       done
   } note * = this
   show ?thesis
     apply (rule antisym)
      using False closure_subset apply (blast intro: setdist_subset_left)
     using False *
     apply (force intro!: le_setdistI)
     done
 qed
 
 lemma setdist_closure_2 [simp]: "setdist t (closure s) = setdist t s"
 by (metis setdist_closure_1 setdist_sym)
 
 lemma setdist_eq_0I: "\<lbrakk>x \<in> S; x \<in> T\<rbrakk> \<Longrightarrow> setdist S T = 0"
   by (metis antisym dist_self setdist_le_dist setdist_pos_le)
 
 lemma setdist_unique:
   "\<lbrakk>a \<in> S; b \<in> T; \<And>x y. x \<in> S \<and> y \<in> T ==> dist a b \<le> dist x y\<rbrakk>
    \<Longrightarrow> setdist S T = dist a b"
   by (force simp add: setdist_le_dist le_setdist_iff intro: antisym)
 
 lemma setdist_le_sing: "x \<in> S ==> setdist S T \<le> setdist {x} T"
   using setdist_subset_left by auto
 
 lemma infdist_eq_setdist: "infdist x A = setdist {x} A"
   by (simp add: infdist_def setdist_def Setcompr_eq_image)
 
 lemma setdist_eq_infdist: "setdist A B = (if A = {} then 0 else INF a\<in>A. infdist a B)"
 proof -
   have "Inf {dist x y |x y. x \<in> A \<and> y \<in> B} = (INF x\<in>A. Inf (dist x ` B))"
     if "b \<in> B" "a \<in> A" for a b
   proof (rule order_antisym)
     have "Inf {dist x y |x y. x \<in> A \<and> y \<in> B} \<le> Inf (dist x ` B)"
       if  "b \<in> B" "a \<in> A" "x \<in> A" for x 
     proof -
       have *: "\<And>b'. b' \<in> B \<Longrightarrow> Inf {dist x y |x y. x \<in> A \<and> y \<in> B} \<le> dist x b'"
         by (metis (mono_tags, lifting) ex_in_conv setdist_def setdist_le_dist that(3))
       show ?thesis
         using that by (subst conditionally_complete_lattice_class.le_cInf_iff) (auto simp: *)+
     qed
     then show "Inf {dist x y |x y. x \<in> A \<and> y \<in> B} \<le> (INF x\<in>A. Inf (dist x ` B))"
       using that
       by (subst conditionally_complete_lattice_class.le_cInf_iff) (auto simp: bdd_below_def)
   next
     have *: "\<And>x y. \<lbrakk>b \<in> B; a \<in> A; x \<in> A; y \<in> B\<rbrakk> \<Longrightarrow> \<exists>a\<in>A. Inf (dist a ` B) \<le> dist x y"
       by (meson bdd_below_image_dist cINF_lower)
     show "(INF x\<in>A. Inf (dist x ` B)) \<le> Inf {dist x y |x y. x \<in> A \<and> y \<in> B}"
     proof (rule conditionally_complete_lattice_class.cInf_mono)
       show "bdd_below ((\<lambda>x. Inf (dist x ` B)) ` A)"
         by (metis (no_types, lifting) bdd_belowI2 ex_in_conv infdist_def infdist_nonneg that(1))
     qed (use that in \<open>auto simp: *\<close>)
   qed
   then show ?thesis
     by (auto simp: setdist_def infdist_def)
 qed
 
 lemma infdist_mono:
   assumes "A \<subseteq> B" "A \<noteq> {}"
   shows "infdist x B \<le> infdist x A"
   by (simp add: assms infdist_eq_setdist setdist_subset_right)
 
 lemma infdist_singleton [simp]:
   "infdist x {y} = dist x y"
   by (simp add: infdist_eq_setdist)
 
 proposition setdist_attains_inf:
   assumes "compact B" "B \<noteq> {}"
   obtains y where "y \<in> B" "setdist A B = infdist y A"
 proof (cases "A = {}")
   case True
   then show thesis
     by (metis assms diameter_compact_attained infdist_def setdist_def that)
 next
   case False
   obtain y where "y \<in> B" and min: "\<And>y'. y' \<in> B \<Longrightarrow> infdist y A \<le> infdist y' A"
     by (metis continuous_attains_inf [OF assms continuous_on_infdist] continuous_on_id)
   show thesis
   proof
     have "setdist A B = (INF y\<in>B. infdist y A)"
       by (metis \<open>B \<noteq> {}\<close> setdist_eq_infdist setdist_sym)
     also have "\<dots> = infdist y A"
     proof (rule order_antisym)
       show "(INF y\<in>B. infdist y A) \<le> infdist y A"
       proof (rule cInf_lower)
         show "infdist y A \<in> (\<lambda>y. infdist y A) ` B"
           using \<open>y \<in> B\<close> by blast
         show "bdd_below ((\<lambda>y. infdist y A) ` B)"
           by (meson bdd_belowI2 infdist_nonneg)
       qed
     next
       show "infdist y A \<le> (INF y\<in>B. infdist y A)"
         by (simp add: \<open>B \<noteq> {}\<close> cINF_greatest min)
     qed
     finally show "setdist A B = infdist y A" .
   qed (fact \<open>y \<in> B\<close>)
 qed
 
 end
diff --git a/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy b/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy
--- a/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy
+++ b/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy
@@ -1,5036 +1,5080 @@
 (*  Title:      HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy
     Author:     Johannes Hölzl, TU München
     Author:     Robert Himmelmann, TU München
     Huge cleanup by LCP
 *)
 
 theory Equivalence_Lebesgue_Henstock_Integration
   imports
     Lebesgue_Measure
     Henstock_Kurzweil_Integration
     Complete_Measure
     Set_Integral
     Homeomorphism
     Cartesian_Euclidean_Space
 begin
 
 lemma le_left_mono: "x \<le> y \<Longrightarrow> y \<le> a \<longrightarrow> x \<le> (a::'a::preorder)"
   by (auto intro: order_trans)
 
 lemma ball_trans:
   assumes "y \<in> ball z q" "r + q \<le> s" shows "ball y r \<subseteq> ball z s"
   using assms by metric
 
 lemma has_integral_implies_lebesgue_measurable_cbox:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes f: "(f has_integral I) (cbox x y)"
   shows "f \<in> lebesgue_on (cbox x y) \<rightarrow>\<^sub>M borel"
 proof (rule cld_measure.borel_measurable_cld)
   let ?L = "lebesgue_on (cbox x y)"
   let ?\<mu> = "emeasure ?L"
   let ?\<mu>' = "outer_measure_of ?L"
   interpret L: finite_measure ?L
   proof
     show "?\<mu> (space ?L) \<noteq> \<infinity>"
       by (simp add: emeasure_restrict_space space_restrict_space emeasure_lborel_cbox_eq)
   qed
 
   show "cld_measure ?L"
   proof
     fix B A assume "B \<subseteq> A" "A \<in> null_sets ?L"
     then show "B \<in> sets ?L"
       using null_sets_completion_subset[OF \<open>B \<subseteq> A\<close>, of lborel]
       by (auto simp add: null_sets_restrict_space sets_restrict_space_iff intro: )
   next
     fix A assume "A \<subseteq> space ?L" "\<And>B. B \<in> sets ?L \<Longrightarrow> ?\<mu> B < \<infinity> \<Longrightarrow> A \<inter> B \<in> sets ?L"
     from this(1) this(2)[of "space ?L"] show "A \<in> sets ?L"
       by (auto simp: Int_absorb2 less_top[symmetric])
   qed auto
   then interpret cld_measure ?L
     .
 
   have content_eq_L: "A \<in> sets borel \<Longrightarrow> A \<subseteq> cbox x y \<Longrightarrow> content A = measure ?L A" for A
     by (subst measure_restrict_space) (auto simp: measure_def)
 
   fix E and a b :: real assume "E \<in> sets ?L" "a < b" "0 < ?\<mu> E" "?\<mu> E < \<infinity>"
   then obtain M :: real where "?\<mu> E = M" "0 < M"
     by (cases "?\<mu> E") auto
   define e where "e = M / (4 + 2 / (b - a))"
   from \<open>a < b\<close> \<open>0<M\<close> have "0 < e"
     by (auto intro!: divide_pos_pos simp: field_simps e_def)
 
   have "e < M / (3 + 2 / (b - a))"
     using \<open>a < b\<close> \<open>0 < M\<close>
     unfolding e_def by (intro divide_strict_left_mono add_strict_right_mono mult_pos_pos) (auto simp: field_simps)
   then have "2 * e < (b - a) * (M - e * 3)"
     using \<open>0<M\<close> \<open>0 < e\<close> \<open>a < b\<close> by (simp add: field_simps)
 
   have e_less_M: "e < M / 1"
     unfolding e_def using \<open>a < b\<close> \<open>0<M\<close> by (intro divide_strict_left_mono) (auto simp: field_simps)
 
   obtain d
     where "gauge d"
       and integral_f: "\<forall>p. p tagged_division_of cbox x y \<and> d fine p \<longrightarrow>
         norm ((\<Sum>(x,k) \<in> p. content k *\<^sub>R f x) - I) < e"
     using \<open>0<e\<close> f unfolding has_integral by auto
 
   define C where "C X m = X \<inter> {x. ball x (1/Suc m) \<subseteq> d x}" for X m
   have "incseq (C X)" for X
     unfolding C_def [abs_def]
     by (intro monoI Collect_mono conj_mono imp_refl le_left_mono subset_ball divide_left_mono Int_mono) auto
 
   { fix X assume "X \<subseteq> space ?L" and eq: "?\<mu>' X = ?\<mu> E"
     have "(SUP m. outer_measure_of ?L (C X m)) = outer_measure_of ?L (\<Union>m. C X m)"
       using \<open>X \<subseteq> space ?L\<close> by (intro SUP_outer_measure_of_incseq \<open>incseq (C X)\<close>) (auto simp: C_def)
     also have "(\<Union>m. C X m) = X"
     proof -
       { fix x
         obtain e where "0 < e" "ball x e \<subseteq> d x"
           using gaugeD[OF \<open>gauge d\<close>, of x] unfolding open_contains_ball by auto
         moreover
         obtain n where "1 / (1 + real n) < e"
           using reals_Archimedean[OF \<open>0<e\<close>] by (auto simp: inverse_eq_divide)
         then have "ball x (1 / (1 + real n)) \<subseteq> ball x e"
           by (intro subset_ball) auto
         ultimately have "\<exists>n. ball x (1 / (1 + real n)) \<subseteq> d x"
           by blast }
       then show ?thesis
         by (auto simp: C_def)
     qed
     finally have "(SUP m. outer_measure_of ?L (C X m)) = ?\<mu> E"
       using eq by auto
     also have "\<dots> > M - e"
       using \<open>0 < M\<close> \<open>?\<mu> E = M\<close> \<open>0<e\<close> by (auto intro!: ennreal_lessI)
     finally have "\<exists>m. M - e < outer_measure_of ?L (C X m)"
       unfolding less_SUP_iff by auto }
   note C = this
 
   let ?E = "{x\<in>E. f x \<le> a}" and ?F = "{x\<in>E. b \<le> f x}"
 
   have "\<not> (?\<mu>' ?E = ?\<mu> E \<and> ?\<mu>' ?F = ?\<mu> E)"
   proof
     assume eq: "?\<mu>' ?E = ?\<mu> E \<and> ?\<mu>' ?F = ?\<mu> E"
     with C[of ?E] C[of ?F] \<open>E \<in> sets ?L\<close>[THEN sets.sets_into_space] obtain ma mb
       where "M - e < outer_measure_of ?L (C ?E ma)" "M - e < outer_measure_of ?L (C ?F mb)"
       by auto
     moreover define m where "m = max ma mb"
     ultimately have M_minus_e: "M - e < outer_measure_of ?L (C ?E m)" "M - e < outer_measure_of ?L (C ?F m)"
       using
         incseqD[OF \<open>incseq (C ?E)\<close>, of ma m, THEN outer_measure_of_mono]
         incseqD[OF \<open>incseq (C ?F)\<close>, of mb m, THEN outer_measure_of_mono]
       by (auto intro: less_le_trans)
     define d' where "d' x = d x \<inter> ball x (1 / (3 * Suc m))" for x
     have "gauge d'"
       unfolding d'_def by (intro gauge_Int \<open>gauge d\<close> gauge_ball) auto
     then obtain p where p: "p tagged_division_of cbox x y" "d' fine p"
       by (rule fine_division_exists)
     then have "d fine p"
       unfolding d'_def[abs_def] fine_def by auto
 
     define s where "s = {(x::'a, k). k \<inter> (C ?E m) \<noteq> {} \<and> k \<inter> (C ?F m) \<noteq> {}}"
     define T where "T E k = (SOME x. x \<in> k \<inter> C E m)" for E k
     let ?A = "(\<lambda>(x, k). (T ?E k, k)) ` (p \<inter> s) \<union> (p - s)"
     let ?B = "(\<lambda>(x, k). (T ?F k, k)) ` (p \<inter> s) \<union> (p - s)"
 
     { fix X assume X_eq: "X = ?E \<or> X = ?F"
       let ?T = "(\<lambda>(x, k). (T X k, k))"
       let ?p = "?T ` (p \<inter> s) \<union> (p - s)"
 
       have in_s: "(x, k) \<in> s \<Longrightarrow> T X k \<in> k \<inter> C X m" for x k
         using someI_ex[of "\<lambda>x. x \<in> k \<inter> C X m"] X_eq unfolding ex_in_conv by (auto simp: T_def s_def)
 
       { fix x k assume "(x, k) \<in> p" "(x, k) \<in> s"
         have k: "k \<subseteq> ball x (1 / (3 * Suc m))"
           using \<open>d' fine p\<close>[THEN fineD, OF \<open>(x, k) \<in> p\<close>] by (auto simp: d'_def)
         then have "x \<in> ball (T X k) (1 / (3 * Suc m))"
           using in_s[OF \<open>(x, k) \<in> s\<close>] by (auto simp: C_def subset_eq dist_commute)
         then have "ball x (1 / (3 * Suc m)) \<subseteq> ball (T X k) (1 / Suc m)"
           by (rule ball_trans) (auto simp: field_split_simps)
         with k in_s[OF \<open>(x, k) \<in> s\<close>] have "k \<subseteq> d (T X k)"
           by (auto simp: C_def) }
       then have "d fine ?p"
         using \<open>d fine p\<close> by (auto intro!: fineI)
       moreover
       have "?p tagged_division_of cbox x y"
       proof (rule tagged_division_ofI)
         show "finite ?p"
           using p(1) by auto
       next
         fix z k assume *: "(z, k) \<in> ?p"
         then consider "(z, k) \<in> p" "(z, k) \<notin> s"
           | x' where "(x', k) \<in> p" "(x', k) \<in> s" "z = T X k"
           by (auto simp: T_def)
         then have "z \<in> k \<and> k \<subseteq> cbox x y \<and> (\<exists>a b. k = cbox a b)"
           using p(1) by cases (auto dest: in_s)
         then show "z \<in> k" "k \<subseteq> cbox x y" "\<exists>a b. k = cbox a b"
           by auto
       next
         fix z k z' k' assume "(z, k) \<in> ?p" "(z', k') \<in> ?p" "(z, k) \<noteq> (z', k')"
         with tagged_division_ofD(5)[OF p(1), of _ k _ k']
         show "interior k \<inter> interior k' = {}"
           by (auto simp: T_def dest: in_s)
       next
         have "{k. \<exists>x. (x, k) \<in> ?p} = {k. \<exists>x. (x, k) \<in> p}"
           by (auto simp: T_def image_iff Bex_def)
         then show "\<Union>{k. \<exists>x. (x, k) \<in> ?p} = cbox x y"
           using p(1) by auto
       qed
       ultimately have I: "norm ((\<Sum>(x,k) \<in> ?p. content k *\<^sub>R f x) - I) < e"
         using integral_f by auto
 
       have "(\<Sum>(x,k) \<in> ?p. content k *\<^sub>R f x) =
         (\<Sum>(x,k) \<in> ?T ` (p \<inter> s). content k *\<^sub>R f x) + (\<Sum>(x,k) \<in> p - s. content k *\<^sub>R f x)"
         using p(1)[THEN tagged_division_ofD(1)]
         by (safe intro!: sum.union_inter_neutral) (auto simp: s_def T_def)
       also have "(\<Sum>(x,k) \<in> ?T ` (p \<inter> s). content k *\<^sub>R f x) = (\<Sum>(x,k) \<in> p \<inter> s. content k *\<^sub>R f (T X k))"
       proof (subst sum.reindex_nontrivial, safe)
         fix x1 x2 k assume 1: "(x1, k) \<in> p" "(x1, k) \<in> s" and 2: "(x2, k) \<in> p" "(x2, k) \<in> s"
           and eq: "content k *\<^sub>R f (T X k) \<noteq> 0"
         with tagged_division_ofD(5)[OF p(1), of x1 k x2 k] tagged_division_ofD(4)[OF p(1), of x1 k]
         show "x1 = x2"
           by (auto simp: content_eq_0_interior)
       qed (use p in \<open>auto intro!: sum.cong\<close>)
       finally have eq: "(\<Sum>(x,k) \<in> ?p. content k *\<^sub>R f x) =
         (\<Sum>(x,k) \<in> p \<inter> s. content k *\<^sub>R f (T X k)) + (\<Sum>(x,k) \<in> p - s. content k *\<^sub>R f x)" .
 
       have in_T: "(x, k) \<in> s \<Longrightarrow> T X k \<in> X" for x k
         using in_s[of x k] by (auto simp: C_def)
 
       note I eq in_T }
     note parts = this
 
     have p_in_L: "(x, k) \<in> p \<Longrightarrow> k \<in> sets ?L" for x k
       using tagged_division_ofD(3, 4)[OF p(1), of x k] by (auto simp: sets_restrict_space)
 
     have [simp]: "finite p"
       using tagged_division_ofD(1)[OF p(1)] .
 
     have "(M - 3*e) * (b - a) \<le> (\<Sum>(x,k) \<in> p \<inter> s. content k) * (b - a)"
     proof (intro mult_right_mono)
       have fin: "?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}}) < \<infinity>" for X
         using \<open>?\<mu> E < \<infinity>\<close> by (rule le_less_trans[rotated]) (auto intro!: emeasure_mono \<open>E \<in> sets ?L\<close>)
       have sets: "(E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}}) \<in> sets ?L" for X
         using tagged_division_ofD(1)[OF p(1)] by (intro sets.Diff \<open>E \<in> sets ?L\<close> sets.finite_Union sets.Int) (auto intro: p_in_L)
       { fix X assume "X \<subseteq> E" "M - e < ?\<mu>' (C X m)"
         have "M - e \<le> ?\<mu>' (C X m)"
           by (rule less_imp_le) fact
         also have "\<dots> \<le> ?\<mu>' (E - (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}}))"
         proof (intro outer_measure_of_mono subsetI)
           fix v assume "v \<in> C X m"
           then have "v \<in> cbox x y" "v \<in> E"
             using \<open>E \<subseteq> space ?L\<close> \<open>X \<subseteq> E\<close> by (auto simp: space_restrict_space C_def)
           then obtain z k where "(z, k) \<in> p" "v \<in> k"
             using tagged_division_ofD(6)[OF p(1), symmetric] by auto
           then show "v \<in> E - E \<inter> (\<Union>{k\<in>snd`p. k \<inter> C X m = {}})"
             using \<open>v \<in> C X m\<close> \<open>v \<in> E\<close> by auto
         qed
         also have "\<dots> = ?\<mu> E - ?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}})"
           using \<open>E \<in> sets ?L\<close> fin[of X] sets[of X] by (auto intro!: emeasure_Diff)
         finally have "?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}}) \<le> e"
           using \<open>0 < e\<close> e_less_M apply (cases "?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C X m = {}})")
           by (auto simp add: \<open>?\<mu> E = M\<close> ennreal_minus ennreal_le_iff2)
         note this }
       note upper_bound = this
 
       have "?\<mu> (E \<inter> \<Union>(snd`(p - s))) =
         ?\<mu> ((E \<inter> \<Union>{k\<in>snd`p. k \<inter> C ?E m = {}}) \<union> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C ?F m = {}}))"
         by (intro arg_cong[where f="?\<mu>"]) (auto simp: s_def image_def Bex_def)
       also have "\<dots> \<le> ?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C ?E m = {}}) + ?\<mu> (E \<inter> \<Union>{k\<in>snd`p. k \<inter> C ?F m = {}})"
         using sets[of ?E] sets[of ?F] M_minus_e by (intro emeasure_subadditive) auto
       also have "\<dots> \<le> e + ennreal e"
         using upper_bound[of ?E] upper_bound[of ?F] M_minus_e by (intro add_mono) auto
       finally have "?\<mu> E - 2*e \<le> ?\<mu> (E - (E \<inter> \<Union>(snd`(p - s))))"
         using \<open>0 < e\<close> \<open>E \<in> sets ?L\<close> tagged_division_ofD(1)[OF p(1)]
         by (subst emeasure_Diff)
            (auto simp: top_unique simp flip: ennreal_plus
                  intro!: sets.Int sets.finite_UN ennreal_mono_minus intro: p_in_L)
       also have "\<dots> \<le> ?\<mu> (\<Union>x\<in>p \<inter> s. snd x)"
       proof (safe intro!: emeasure_mono subsetI)
         fix v assume "v \<in> E" and not: "v \<notin> (\<Union>x\<in>p \<inter> s. snd x)"
         then have "v \<in> cbox x y"
           using \<open>E \<subseteq> space ?L\<close> by (auto simp: space_restrict_space)
         then obtain z k where "(z, k) \<in> p" "v \<in> k"
           using tagged_division_ofD(6)[OF p(1), symmetric] by auto
         with not show "v \<in> \<Union>(snd ` (p - s))"
           by (auto intro!: bexI[of _ "(z, k)"] elim: ballE[of _ _ "(z, k)"])
       qed (auto intro!: sets.Int sets.finite_UN ennreal_mono_minus intro: p_in_L)
       also have "\<dots> = measure ?L (\<Union>x\<in>p \<inter> s. snd x)"
         by (auto intro!: emeasure_eq_ennreal_measure)
       finally have "M - 2 * e \<le> measure ?L (\<Union>x\<in>p \<inter> s. snd x)"
         unfolding \<open>?\<mu> E = M\<close> using \<open>0 < e\<close> by (simp add: ennreal_minus)
       also have "measure ?L (\<Union>x\<in>p \<inter> s. snd x) = content (\<Union>x\<in>p \<inter> s. snd x)"
         using tagged_division_ofD(1,3,4) [OF p(1)]
         by (intro content_eq_L[symmetric])
            (fastforce intro!: sets.finite_UN UN_least del: subsetI)+
       also have "content (\<Union>x\<in>p \<inter> s. snd x) \<le> (\<Sum>k\<in>p \<inter> s. content (snd k))"
         using p(1) by (auto simp: emeasure_lborel_cbox_eq intro!: measure_subadditive_finite
                             dest!: p(1)[THEN tagged_division_ofD(4)])
       finally show "M - 3 * e \<le> (\<Sum>(x, y)\<in>p \<inter> s. content y)"
         using \<open>0 < e\<close> by (simp add: split_beta)
     qed (use \<open>a < b\<close> in auto)
     also have "\<dots> = (\<Sum>(x,k) \<in> p \<inter> s. content k * (b - a))"
       by (simp add: sum_distrib_right split_beta')
     also have "\<dots> \<le> (\<Sum>(x,k) \<in> p \<inter> s. content k * (f (T ?F k) - f (T ?E k)))"
       using parts(3) by (auto intro!: sum_mono mult_left_mono diff_mono)
     also have "\<dots> = (\<Sum>(x,k) \<in> p \<inter> s. content k * f (T ?F k)) - (\<Sum>(x,k) \<in> p \<inter> s. content k * f (T ?E k))"
       by (auto intro!: sum.cong simp: field_simps sum_subtractf[symmetric])
     also have "\<dots> = (\<Sum>(x,k) \<in> ?B. content k *\<^sub>R f x) - (\<Sum>(x,k) \<in> ?A. content k *\<^sub>R f x)"
       by (subst (1 2) parts) auto
     also have "\<dots> \<le> norm ((\<Sum>(x,k) \<in> ?B. content k *\<^sub>R f x) - (\<Sum>(x,k) \<in> ?A. content k *\<^sub>R f x))"
       by auto
     also have "\<dots> \<le> e + e"
       using parts(1)[of ?E] parts(1)[of ?F] by (intro norm_diff_triangle_le[of _ I]) auto
     finally show False
       using \<open>2 * e < (b - a) * (M - e * 3)\<close> by (auto simp: field_simps)
   qed
   moreover have "?\<mu>' ?E \<le> ?\<mu> E" "?\<mu>' ?F \<le> ?\<mu> E"
     unfolding outer_measure_of_eq[OF \<open>E \<in> sets ?L\<close>, symmetric] by (auto intro!: outer_measure_of_mono)
   ultimately show "min (?\<mu>' ?E) (?\<mu>' ?F) < ?\<mu> E"
     unfolding min_less_iff_disj by (auto simp: less_le)
 qed
 
 lemma has_integral_implies_lebesgue_measurable_real:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes f: "(f has_integral I) \<Omega>"
   shows "(\<lambda>x. f x * indicator \<Omega> x) \<in> lebesgue \<rightarrow>\<^sub>M borel"
 proof -
   define B :: "nat \<Rightarrow> 'a set" where "B n = cbox (- real n *\<^sub>R One) (real n *\<^sub>R One)" for n
   show "(\<lambda>x. f x * indicator \<Omega> x) \<in> lebesgue \<rightarrow>\<^sub>M borel"
   proof (rule measurable_piecewise_restrict)
     have "(\<Union>n. box (- real n *\<^sub>R One) (real n *\<^sub>R One)) \<subseteq> \<Union>(B ` UNIV)"
       unfolding B_def by (intro UN_mono box_subset_cbox order_refl)
     then show "countable (range B)" "space lebesgue \<subseteq> \<Union>(B ` UNIV)"
       by (auto simp: B_def UN_box_eq_UNIV)
   next
     fix \<Omega>' assume "\<Omega>' \<in> range B"
     then obtain n where \<Omega>': "\<Omega>' = B n" by auto
     then show "\<Omega>' \<inter> space lebesgue \<in> sets lebesgue"
       by (auto simp: B_def)
 
     have "f integrable_on \<Omega>"
       using f by auto
     then have "(\<lambda>x. f x * indicator \<Omega> x) integrable_on \<Omega>"
       by (auto simp: integrable_on_def cong: has_integral_cong)
     then have "(\<lambda>x. f x * indicator \<Omega> x) integrable_on (\<Omega> \<union> B n)"
       by (rule integrable_on_superset) auto
     then have "(\<lambda>x. f x * indicator \<Omega> x) integrable_on B n"
       unfolding B_def by (rule integrable_on_subcbox) auto
     then show "(\<lambda>x. f x * indicator \<Omega> x) \<in> lebesgue_on \<Omega>' \<rightarrow>\<^sub>M borel"
       unfolding B_def \<Omega>' by (auto intro: has_integral_implies_lebesgue_measurable_cbox simp: integrable_on_def)
   qed
 qed
 
 lemma has_integral_implies_lebesgue_measurable:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes f: "(f has_integral I) \<Omega>"
   shows "(\<lambda>x. indicator \<Omega> x *\<^sub>R f x) \<in> lebesgue \<rightarrow>\<^sub>M borel"
 proof (intro borel_measurable_euclidean_space[where 'c='b, THEN iffD2] ballI)
   fix i :: "'b" assume "i \<in> Basis"
   have "(\<lambda>x. (f x \<bullet> i) * indicator \<Omega> x) \<in> borel_measurable (completion lborel)"
     using has_integral_linear[OF f bounded_linear_inner_left, of i]
     by (intro has_integral_implies_lebesgue_measurable_real) (auto simp: comp_def)
   then show "(\<lambda>x. indicator \<Omega> x *\<^sub>R f x \<bullet> i) \<in> borel_measurable (completion lborel)"
     by (simp add: ac_simps)
 qed
 
 subsection \<open>Equivalence Lebesgue integral on \<^const>\<open>lborel\<close> and HK-integral\<close>
 
 lemma has_integral_measure_lborel:
   fixes A :: "'a::euclidean_space set"
   assumes A[measurable]: "A \<in> sets borel" and finite: "emeasure lborel A < \<infinity>"
   shows "((\<lambda>x. 1) has_integral measure lborel A) A"
 proof -
   { fix l u :: 'a
     have "((\<lambda>x. 1) has_integral measure lborel (box l u)) (box l u)"
     proof cases
       assume "\<forall>b\<in>Basis. l \<bullet> b \<le> u \<bullet> b"
       then show ?thesis
         apply simp
         apply (subst has_integral_restrict[symmetric, OF box_subset_cbox])
         apply (subst has_integral_spike_interior_eq[where g="\<lambda>_. 1"])
         using has_integral_const[of "1::real" l u]
         apply (simp_all add: inner_diff_left[symmetric] content_cbox_cases)
         done
     next
       assume "\<not> (\<forall>b\<in>Basis. l \<bullet> b \<le> u \<bullet> b)"
       then have "box l u = {}"
         unfolding box_eq_empty by (auto simp: not_le intro: less_imp_le)
       then show ?thesis
         by simp
     qed }
   note has_integral_box = this
 
   { fix a b :: 'a let ?M = "\<lambda>A. measure lborel (A \<inter> box a b)"
     have "Int_stable  (range (\<lambda>(a, b). box a b))"
       by (auto simp: Int_stable_def box_Int_box)
     moreover have "(range (\<lambda>(a, b). box a b)) \<subseteq> Pow UNIV"
       by auto
     moreover have "A \<in> sigma_sets UNIV (range (\<lambda>(a, b). box a b))"
        using A unfolding borel_eq_box by simp
     ultimately have "((\<lambda>x. 1) has_integral ?M A) (A \<inter> box a b)"
     proof (induction rule: sigma_sets_induct_disjoint)
       case (basic A) then show ?case
         by (auto simp: box_Int_box has_integral_box)
     next
       case empty then show ?case
         by simp
     next
       case (compl A)
       then have [measurable]: "A \<in> sets borel"
         by (simp add: borel_eq_box)
 
       have "((\<lambda>x. 1) has_integral ?M (box a b)) (box a b)"
         by (simp add: has_integral_box)
       moreover have "((\<lambda>x. if x \<in> A \<inter> box a b then 1 else 0) has_integral ?M A) (box a b)"
         by (subst has_integral_restrict) (auto intro: compl)
       ultimately have "((\<lambda>x. 1 - (if x \<in> A \<inter> box a b then 1 else 0)) has_integral ?M (box a b) - ?M A) (box a b)"
         by (rule has_integral_diff)
       then have "((\<lambda>x. (if x \<in> (UNIV - A) \<inter> box a b then 1 else 0)) has_integral ?M (box a b) - ?M A) (box a b)"
         by (rule has_integral_cong[THEN iffD1, rotated 1]) auto
       then have "((\<lambda>x. 1) has_integral ?M (box a b) - ?M A) ((UNIV - A) \<inter> box a b)"
         by (subst (asm) has_integral_restrict) auto
       also have "?M (box a b) - ?M A = ?M (UNIV - A)"
         by (subst measure_Diff[symmetric]) (auto simp: emeasure_lborel_box_eq Diff_Int_distrib2)
       finally show ?case .
     next
       case (union F)
       then have [measurable]: "\<And>i. F i \<in> sets borel"
         by (simp add: borel_eq_box subset_eq)
       have "((\<lambda>x. if x \<in> \<Union>(F ` UNIV) \<inter> box a b then 1 else 0) has_integral ?M (\<Union>i. F i)) (box a b)"
       proof (rule has_integral_monotone_convergence_increasing)
         let ?f = "\<lambda>k x. \<Sum>i<k. if x \<in> F i \<inter> box a b then 1 else 0 :: real"
         show "\<And>k. (?f k has_integral (\<Sum>i<k. ?M (F i))) (box a b)"
           using union.IH by (auto intro!: has_integral_sum simp del: Int_iff)
         show "\<And>k x. ?f k x \<le> ?f (Suc k) x"
           by (intro sum_mono2) auto
         from union(1) have *: "\<And>x i j. x \<in> F i \<Longrightarrow> x \<in> F j \<longleftrightarrow> j = i"
           by (auto simp add: disjoint_family_on_def)
         show "\<And>x. (\<lambda>k. ?f k x) \<longlonglongrightarrow> (if x \<in> \<Union>(F ` UNIV) \<inter> box a b then 1 else 0)"
           apply (auto simp: * sum.If_cases Iio_Int_singleton)
           apply (rule_tac k="Suc xa" in LIMSEQ_offset)
           apply simp
           done
         have *: "emeasure lborel ((\<Union>x. F x) \<inter> box a b) \<le> emeasure lborel (box a b)"
           by (intro emeasure_mono) auto
 
         with union(1) show "(\<lambda>k. \<Sum>i<k. ?M (F i)) \<longlonglongrightarrow> ?M (\<Union>i. F i)"
           unfolding sums_def[symmetric] UN_extend_simps
           by (intro measure_UNION) (auto simp: disjoint_family_on_def emeasure_lborel_box_eq top_unique)
       qed
       then show ?case
         by (subst (asm) has_integral_restrict) auto
     qed }
   note * = this
 
   show ?thesis
   proof (rule has_integral_monotone_convergence_increasing)
     let ?B = "\<lambda>n::nat. box (- real n *\<^sub>R One) (real n *\<^sub>R One) :: 'a set"
     let ?f = "\<lambda>n::nat. \<lambda>x. if x \<in> A \<inter> ?B n then 1 else 0 :: real"
     let ?M = "\<lambda>n. measure lborel (A \<inter> ?B n)"
 
     show "\<And>n::nat. (?f n has_integral ?M n) A"
       using * by (subst has_integral_restrict) simp_all
     show "\<And>k x. ?f k x \<le> ?f (Suc k) x"
       by (auto simp: box_def)
     { fix x assume "x \<in> A"
       moreover have "(\<lambda>k. indicator (A \<inter> ?B k) x :: real) \<longlonglongrightarrow> indicator (\<Union>k::nat. A \<inter> ?B k) x"
         by (intro LIMSEQ_indicator_incseq) (auto simp: incseq_def box_def)
       ultimately show "(\<lambda>k. if x \<in> A \<inter> ?B k then 1 else 0::real) \<longlonglongrightarrow> 1"
         by (simp add: indicator_def UN_box_eq_UNIV) }
 
     have "(\<lambda>n. emeasure lborel (A \<inter> ?B n)) \<longlonglongrightarrow> emeasure lborel (\<Union>n::nat. A \<inter> ?B n)"
       by (intro Lim_emeasure_incseq) (auto simp: incseq_def box_def)
     also have "(\<lambda>n. emeasure lborel (A \<inter> ?B n)) = (\<lambda>n. measure lborel (A \<inter> ?B n))"
     proof (intro ext emeasure_eq_ennreal_measure)
       fix n have "emeasure lborel (A \<inter> ?B n) \<le> emeasure lborel (?B n)"
         by (intro emeasure_mono) auto
       then show "emeasure lborel (A \<inter> ?B n) \<noteq> top"
         by (auto simp: top_unique)
     qed
     finally show "(\<lambda>n. measure lborel (A \<inter> ?B n)) \<longlonglongrightarrow> measure lborel A"
       using emeasure_eq_ennreal_measure[of lborel A] finite
       by (simp add: UN_box_eq_UNIV less_top)
   qed
 qed
 
 lemma nn_integral_has_integral:
   fixes f::"'a::euclidean_space \<Rightarrow> real"
   assumes f: "f \<in> borel_measurable borel" "\<And>x. 0 \<le> f x" "(\<integral>\<^sup>+x. f x \<partial>lborel) = ennreal r" "0 \<le> r"
   shows "(f has_integral r) UNIV"
 using f proof (induct f arbitrary: r rule: borel_measurable_induct_real)
   case (set A)
   then have "((\<lambda>x. 1) has_integral measure lborel A) A"
     by (intro has_integral_measure_lborel) (auto simp: ennreal_indicator)
   with set show ?case
     by (simp add: ennreal_indicator measure_def) (simp add: indicator_def)
 next
   case (mult g c)
   then have "ennreal c * (\<integral>\<^sup>+ x. g x \<partial>lborel) = ennreal r"
     by (subst nn_integral_cmult[symmetric]) (auto simp: ennreal_mult)
   with \<open>0 \<le> r\<close> \<open>0 \<le> c\<close>
   obtain r' where "(c = 0 \<and> r = 0) \<or> (0 \<le> r' \<and> (\<integral>\<^sup>+ x. ennreal (g x) \<partial>lborel) = ennreal r' \<and> r = c * r')"
     by (cases "\<integral>\<^sup>+ x. ennreal (g x) \<partial>lborel" rule: ennreal_cases)
        (auto split: if_split_asm simp: ennreal_mult_top ennreal_mult[symmetric])
   with mult show ?case
     by (auto intro!: has_integral_cmult_real)
 next
   case (add g h)
   then have "(\<integral>\<^sup>+ x. h x + g x \<partial>lborel) = (\<integral>\<^sup>+ x. h x \<partial>lborel) + (\<integral>\<^sup>+ x. g x \<partial>lborel)"
     by (simp add: nn_integral_add)
   with add obtain a b where "0 \<le> a" "0 \<le> b" "(\<integral>\<^sup>+ x. h x \<partial>lborel) = ennreal a" "(\<integral>\<^sup>+ x. g x \<partial>lborel) = ennreal b" "r = a + b"
     by (cases "\<integral>\<^sup>+ x. h x \<partial>lborel" "\<integral>\<^sup>+ x. g x \<partial>lborel" rule: ennreal2_cases)
        (auto simp: add_top nn_integral_add top_add simp flip: ennreal_plus)
   with add show ?case
     by (auto intro!: has_integral_add)
 next
   case (seq U)
   note seq(1)[measurable] and f[measurable]
 
   { fix i x
     have "U i x \<le> f x"
       using seq(5)
       apply (rule LIMSEQ_le_const)
       using seq(4)
       apply (auto intro!: exI[of _ i] simp: incseq_def le_fun_def)
       done }
   note U_le_f = this
 
   { fix i
     have "(\<integral>\<^sup>+x. U i x \<partial>lborel) \<le> (\<integral>\<^sup>+x. f x \<partial>lborel)"
       using seq(2) f(2) U_le_f by (intro nn_integral_mono) simp
     then obtain p where "(\<integral>\<^sup>+x. U i x \<partial>lborel) = ennreal p" "p \<le> r" "0 \<le> p"
       using seq(6) \<open>0\<le>r\<close> by (cases "\<integral>\<^sup>+x. U i x \<partial>lborel" rule: ennreal_cases) (auto simp: top_unique)
     moreover note seq
     ultimately have "\<exists>p. (\<integral>\<^sup>+x. U i x \<partial>lborel) = ennreal p \<and> 0 \<le> p \<and> p \<le> r \<and> (U i has_integral p) UNIV"
       by auto }
   then obtain p where p: "\<And>i. (\<integral>\<^sup>+x. ennreal (U i x) \<partial>lborel) = ennreal (p i)"
     and bnd: "\<And>i. p i \<le> r" "\<And>i. 0 \<le> p i"
     and U_int: "\<And>i.(U i has_integral (p i)) UNIV" by metis
 
   have int_eq: "\<And>i. integral UNIV (U i) = p i" using U_int by (rule integral_unique)
 
   have *: "f integrable_on UNIV \<and> (\<lambda>k. integral UNIV (U k)) \<longlonglongrightarrow> integral UNIV f"
   proof (rule monotone_convergence_increasing)
     show "\<And>k. U k integrable_on UNIV" using U_int by auto
     show "\<And>k x. x\<in>UNIV \<Longrightarrow> U k x \<le> U (Suc k) x" using \<open>incseq U\<close> by (auto simp: incseq_def le_fun_def)
     then show "bounded (range (\<lambda>k. integral UNIV (U k)))"
       using bnd int_eq by (auto simp: bounded_real intro!: exI[of _ r])
     show "\<And>x. x\<in>UNIV \<Longrightarrow> (\<lambda>k. U k x) \<longlonglongrightarrow> f x"
       using seq by auto
   qed
   moreover have "(\<lambda>i. (\<integral>\<^sup>+x. U i x \<partial>lborel)) \<longlonglongrightarrow> (\<integral>\<^sup>+x. f x \<partial>lborel)"
     using seq f(2) U_le_f by (intro nn_integral_dominated_convergence[where w=f]) auto
   ultimately have "integral UNIV f = r"
     by (auto simp add: bnd int_eq p seq intro: LIMSEQ_unique)
   with * show ?case
     by (simp add: has_integral_integral)
 qed
 
 lemma nn_integral_lborel_eq_integral:
   fixes f::"'a::euclidean_space \<Rightarrow> real"
   assumes f: "f \<in> borel_measurable borel" "\<And>x. 0 \<le> f x" "(\<integral>\<^sup>+x. f x \<partial>lborel) < \<infinity>"
   shows "(\<integral>\<^sup>+x. f x \<partial>lborel) = integral UNIV f"
 proof -
   from f(3) obtain r where r: "(\<integral>\<^sup>+x. f x \<partial>lborel) = ennreal r" "0 \<le> r"
     by (cases "\<integral>\<^sup>+x. f x \<partial>lborel" rule: ennreal_cases) auto
   then show ?thesis
     using nn_integral_has_integral[OF f(1,2) r] by (simp add: integral_unique)
 qed
 
 lemma nn_integral_integrable_on:
   fixes f::"'a::euclidean_space \<Rightarrow> real"
   assumes f: "f \<in> borel_measurable borel" "\<And>x. 0 \<le> f x" "(\<integral>\<^sup>+x. f x \<partial>lborel) < \<infinity>"
   shows "f integrable_on UNIV"
 proof -
   from f(3) obtain r where r: "(\<integral>\<^sup>+x. f x \<partial>lborel) = ennreal r" "0 \<le> r"
     by (cases "\<integral>\<^sup>+x. f x \<partial>lborel" rule: ennreal_cases) auto
   then show ?thesis
     by (intro has_integral_integrable[where i=r] nn_integral_has_integral[where r=r] f)
 qed
 
 lemma nn_integral_has_integral_lborel:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f_borel: "f \<in> borel_measurable borel" and nonneg: "\<And>x. 0 \<le> f x"
   assumes I: "(f has_integral I) UNIV"
   shows "integral\<^sup>N lborel f = I"
 proof -
   from f_borel have "(\<lambda>x. ennreal (f x)) \<in> borel_measurable lborel" by auto
   from borel_measurable_implies_simple_function_sequence'[OF this]
   obtain F where F: "\<And>i. simple_function lborel (F i)" "incseq F"
                  "\<And>i x. F i x < top" "\<And>x. (SUP i. F i x) = ennreal (f x)"
     by blast
   then have [measurable]: "\<And>i. F i \<in> borel_measurable lborel"
     by (metis borel_measurable_simple_function)
   let ?B = "\<lambda>i::nat. box (- (real i *\<^sub>R One)) (real i *\<^sub>R One) :: 'a set"
 
   have "0 \<le> I"
     using I by (rule has_integral_nonneg) (simp add: nonneg)
 
   have F_le_f: "enn2real (F i x) \<le> f x" for i x
     using F(3,4)[where x=x] nonneg SUP_upper[of i UNIV "\<lambda>i. F i x"]
     by (cases "F i x" rule: ennreal_cases) auto
   let ?F = "\<lambda>i x. F i x * indicator (?B i) x"
   have "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>lborel) = (SUP i. integral\<^sup>N lborel (\<lambda>x. ?F i x))"
   proof (subst nn_integral_monotone_convergence_SUP[symmetric])
     { fix x
       obtain j where j: "x \<in> ?B j"
         using UN_box_eq_UNIV by auto
 
       have "ennreal (f x) = (SUP i. F i x)"
         using F(4)[of x] nonneg[of x] by (simp add: max_def)
       also have "\<dots> = (SUP i. ?F i x)"
       proof (rule SUP_eq)
         fix i show "\<exists>j\<in>UNIV. F i x \<le> ?F j x"
           using j F(2)
           by (intro bexI[of _ "max i j"])
              (auto split: split_max split_indicator simp: incseq_def le_fun_def box_def)
       qed (auto intro!: F split: split_indicator)
       finally have "ennreal (f x) =  (SUP i. ?F i x)" . }
     then show "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>lborel) = (\<integral>\<^sup>+ x. (SUP i. ?F i x) \<partial>lborel)"
       by simp
   qed (insert F, auto simp: incseq_def le_fun_def box_def split: split_indicator)
   also have "\<dots> \<le> ennreal I"
   proof (rule SUP_least)
     fix i :: nat
     have finite_F: "(\<integral>\<^sup>+ x. ennreal (enn2real (F i x) * indicator (?B i) x) \<partial>lborel) < \<infinity>"
     proof (rule nn_integral_bound_simple_function)
       have "emeasure lborel {x \<in> space lborel. ennreal (enn2real (F i x) * indicator (?B i) x) \<noteq> 0} \<le>
         emeasure lborel (?B i)"
         by (intro emeasure_mono)  (auto split: split_indicator)
       then show "emeasure lborel {x \<in> space lborel. ennreal (enn2real (F i x) * indicator (?B i) x) \<noteq> 0} < \<infinity>"
         by (auto simp: less_top[symmetric] top_unique)
     qed (auto split: split_indicator
               intro!: F simple_function_compose1[where g="enn2real"] simple_function_ennreal)
 
     have int_F: "(\<lambda>x. enn2real (F i x) * indicator (?B i) x) integrable_on UNIV"
       using F(4) finite_F
       by (intro nn_integral_integrable_on) (auto split: split_indicator simp: enn2real_nonneg)
 
     have "(\<integral>\<^sup>+ x. F i x * indicator (?B i) x \<partial>lborel) =
       (\<integral>\<^sup>+ x. ennreal (enn2real (F i x) * indicator (?B i) x) \<partial>lborel)"
       using F(3,4)
       by (intro nn_integral_cong) (auto simp: image_iff eq_commute split: split_indicator)
     also have "\<dots> = ennreal (integral UNIV (\<lambda>x. enn2real (F i x) * indicator (?B i) x))"
       using F
       by (intro nn_integral_lborel_eq_integral[OF _ _ finite_F])
          (auto split: split_indicator intro: enn2real_nonneg)
     also have "\<dots> \<le> ennreal I"
       by (auto intro!: has_integral_le[OF integrable_integral[OF int_F] I] nonneg F_le_f
                simp: \<open>0 \<le> I\<close> split: split_indicator )
     finally show "(\<integral>\<^sup>+ x. F i x * indicator (?B i) x \<partial>lborel) \<le> ennreal I" .
   qed
   finally have "(\<integral>\<^sup>+ x. ennreal (f x) \<partial>lborel) < \<infinity>"
     by (auto simp: less_top[symmetric] top_unique)
   from nn_integral_lborel_eq_integral[OF assms(1,2) this] I show ?thesis
     by (simp add: integral_unique)
 qed
 
 lemma has_integral_iff_emeasure_lborel:
   fixes A :: "'a::euclidean_space set"
   assumes A[measurable]: "A \<in> sets borel" and [simp]: "0 \<le> r"
   shows "((\<lambda>x. 1) has_integral r) A \<longleftrightarrow> emeasure lborel A = ennreal r"
 proof (cases "emeasure lborel A = \<infinity>")
   case emeasure_A: True
   have "\<not> (\<lambda>x. 1::real) integrable_on A"
   proof
     assume int: "(\<lambda>x. 1::real) integrable_on A"
     then have "(indicator A::'a \<Rightarrow> real) integrable_on UNIV"
       unfolding indicator_def[abs_def] integrable_restrict_UNIV .
     then obtain r where "((indicator A::'a\<Rightarrow>real) has_integral r) UNIV"
       by auto
     from nn_integral_has_integral_lborel[OF _ _ this] emeasure_A show False
       by (simp add: ennreal_indicator)
   qed
   with emeasure_A show ?thesis
     by auto
 next
   case False
   then have "((\<lambda>x. 1) has_integral measure lborel A) A"
     by (simp add: has_integral_measure_lborel less_top)
   with False show ?thesis
     by (auto simp: emeasure_eq_ennreal_measure has_integral_unique)
 qed
 
 lemma ennreal_max_0: "ennreal (max 0 x) = ennreal x"
   by (auto simp: max_def ennreal_neg)
 
 lemma has_integral_integral_real:
   fixes f::"'a::euclidean_space \<Rightarrow> real"
   assumes f: "integrable lborel f"
   shows "(f has_integral (integral\<^sup>L lborel f)) UNIV"
 proof -
   from integrableE[OF f] obtain r q
     where "0 \<le> r" "0 \<le> q"
       and r: "(\<integral>\<^sup>+ x. ennreal (max 0 (f x)) \<partial>lborel) = ennreal r"
       and q: "(\<integral>\<^sup>+ x. ennreal (max 0 (- f x)) \<partial>lborel) = ennreal q"
       and f: "f \<in> borel_measurable lborel" and eq: "integral\<^sup>L lborel f = r - q"
     unfolding ennreal_max_0 by auto
   then have "((\<lambda>x. max 0 (f x)) has_integral r) UNIV" "((\<lambda>x. max 0 (- f x)) has_integral q) UNIV"
     using nn_integral_has_integral[OF _ _ r] nn_integral_has_integral[OF _ _ q] by auto
   note has_integral_diff[OF this]
   moreover have "(\<lambda>x. max 0 (f x) - max 0 (- f x)) = f"
     by auto
   ultimately show ?thesis
     by (simp add: eq)
 qed
 
 lemma has_integral_AE:
   assumes ae: "AE x in lborel. x \<in> \<Omega> \<longrightarrow> f x = g x"
   shows "(f has_integral x) \<Omega> = (g has_integral x) \<Omega>"
 proof -
   from ae obtain N
     where N: "N \<in> sets borel" "emeasure lborel N = 0" "{x. \<not> (x \<in> \<Omega> \<longrightarrow> f x = g x)} \<subseteq> N"
     by (auto elim!: AE_E)
   then have not_N: "AE x in lborel. x \<notin> N"
     by (simp add: AE_iff_measurable)
   show ?thesis
   proof (rule has_integral_spike_eq[symmetric])
     show "\<And>x. x\<in>\<Omega> - N \<Longrightarrow> f x = g x" using N(3) by auto
     show "negligible N"
       unfolding negligible_def
     proof (intro allI)
       fix a b :: "'a"
       let ?F = "\<lambda>x::'a. if x \<in> cbox a b then indicator N x else 0 :: real"
       have "integrable lborel ?F = integrable lborel (\<lambda>x::'a. 0::real)"
         using not_N N(1) by (intro integrable_cong_AE) auto
       moreover have "(LINT x|lborel. ?F x) = (LINT x::'a|lborel. 0::real)"
         using not_N N(1) by (intro integral_cong_AE) auto
       ultimately have "(?F has_integral 0) UNIV"
         using has_integral_integral_real[of ?F] by simp
       then show "(indicator N has_integral (0::real)) (cbox a b)"
         unfolding has_integral_restrict_UNIV .
     qed
   qed
 qed
 
 lemma nn_integral_has_integral_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes nonneg: "\<And>x. 0 \<le> f x" and I: "(f has_integral I) \<Omega>"
   shows "integral\<^sup>N lborel (\<lambda>x. indicator \<Omega> x * f x) = I"
 proof -
   from I have "(\<lambda>x. indicator \<Omega> x *\<^sub>R f x) \<in> lebesgue \<rightarrow>\<^sub>M borel"
     by (rule has_integral_implies_lebesgue_measurable)
   then obtain f' :: "'a \<Rightarrow> real"
     where [measurable]: "f' \<in> borel \<rightarrow>\<^sub>M borel" and eq: "AE x in lborel. indicator \<Omega> x * f x = f' x"
     by (auto dest: completion_ex_borel_measurable_real)
 
   from I have "((\<lambda>x. abs (indicator \<Omega> x * f x)) has_integral I) UNIV"
     using nonneg by (simp add: indicator_def if_distrib[of "\<lambda>x. x * f y" for y] cong: if_cong)
   also have "((\<lambda>x. abs (indicator \<Omega> x * f x)) has_integral I) UNIV \<longleftrightarrow> ((\<lambda>x. abs (f' x)) has_integral I) UNIV"
     using eq by (intro has_integral_AE) auto
   finally have "integral\<^sup>N lborel (\<lambda>x. abs (f' x)) = I"
     by (rule nn_integral_has_integral_lborel[rotated 2]) auto
   also have "integral\<^sup>N lborel (\<lambda>x. abs (f' x)) = integral\<^sup>N lborel (\<lambda>x. abs (indicator \<Omega> x * f x))"
     using eq by (intro nn_integral_cong_AE) auto
   finally show ?thesis
     using nonneg by auto
 qed
 
 lemma has_integral_iff_nn_integral_lebesgue:
   assumes f: "\<And>x. 0 \<le> f x"
   shows "(f has_integral r) UNIV \<longleftrightarrow> (f \<in> lebesgue \<rightarrow>\<^sub>M borel \<and> integral\<^sup>N lebesgue f = r \<and> 0 \<le> r)" (is "?I = ?N")
 proof
   assume ?I
   have "0 \<le> r"
     using has_integral_nonneg[OF \<open>?I\<close>] f by auto
   then show ?N
     using nn_integral_has_integral_lebesgue[OF f \<open>?I\<close>]
       has_integral_implies_lebesgue_measurable[OF \<open>?I\<close>]
     by (auto simp: nn_integral_completion)
 next
   assume ?N
   then obtain f' where f': "f' \<in> borel \<rightarrow>\<^sub>M borel" "AE x in lborel. f x = f' x"
     by (auto dest: completion_ex_borel_measurable_real)
   moreover have "(\<integral>\<^sup>+ x. ennreal \<bar>f' x\<bar> \<partial>lborel) = (\<integral>\<^sup>+ x. ennreal \<bar>f x\<bar> \<partial>lborel)"
     using f' by (intro nn_integral_cong_AE) auto
   moreover have "((\<lambda>x. \<bar>f' x\<bar>) has_integral r) UNIV \<longleftrightarrow> ((\<lambda>x. \<bar>f x\<bar>) has_integral r) UNIV"
     using f' by (intro has_integral_AE) auto
   moreover note nn_integral_has_integral[of "\<lambda>x. \<bar>f' x\<bar>" r] \<open>?N\<close>
   ultimately show ?I
     using f by (auto simp: nn_integral_completion)
 qed
 
 context
   fixes f::"'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
 begin
 
 lemma has_integral_integral_lborel:
   assumes f: "integrable lborel f"
   shows "(f has_integral (integral\<^sup>L lborel f)) UNIV"
 proof -
   have "((\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) has_integral (\<Sum>b\<in>Basis. integral\<^sup>L lborel (\<lambda>x. f x \<bullet> b) *\<^sub>R b)) UNIV"
     using f by (intro has_integral_sum finite_Basis ballI has_integral_scaleR_left has_integral_integral_real) auto
   also have eq_f: "(\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) = f"
     by (simp add: fun_eq_iff euclidean_representation)
   also have "(\<Sum>b\<in>Basis. integral\<^sup>L lborel (\<lambda>x. f x \<bullet> b) *\<^sub>R b) = integral\<^sup>L lborel f"
     using f by (subst (2) eq_f[symmetric]) simp
   finally show ?thesis .
 qed
 
 lemma integrable_on_lborel: "integrable lborel f \<Longrightarrow> f integrable_on UNIV"
   using has_integral_integral_lborel by auto
 
 lemma integral_lborel: "integrable lborel f \<Longrightarrow> integral UNIV f = (\<integral>x. f x \<partial>lborel)"
   using has_integral_integral_lborel by auto
 
 end
 
 context
 begin
 
 private lemma has_integral_integral_lebesgue_real:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f: "integrable lebesgue f"
   shows "(f has_integral (integral\<^sup>L lebesgue f)) UNIV"
 proof -
   obtain f' where f': "f' \<in> borel \<rightarrow>\<^sub>M borel" "AE x in lborel. f x = f' x"
     using completion_ex_borel_measurable_real[OF borel_measurable_integrable[OF f]] by auto
   moreover have "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>lborel) = (\<integral>\<^sup>+ x. ennreal (norm (f' x)) \<partial>lborel)"
     using f' by (intro nn_integral_cong_AE) auto
   ultimately have "integrable lborel f'"
     using f by (auto simp: integrable_iff_bounded nn_integral_completion cong: nn_integral_cong_AE)
   note has_integral_integral_real[OF this]
   moreover have "integral\<^sup>L lebesgue f = integral\<^sup>L lebesgue f'"
     using f' f by (intro integral_cong_AE) (auto intro: AE_completion measurable_completion)
   moreover have "integral\<^sup>L lebesgue f' = integral\<^sup>L lborel f'"
     using f' by (simp add: integral_completion)
   moreover have "(f' has_integral integral\<^sup>L lborel f') UNIV \<longleftrightarrow> (f has_integral integral\<^sup>L lborel f') UNIV"
     using f' by (intro has_integral_AE) auto
   ultimately show ?thesis
     by auto
 qed
 
 lemma has_integral_integral_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "integrable lebesgue f"
   shows "(f has_integral (integral\<^sup>L lebesgue f)) UNIV"
 proof -
   have "((\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) has_integral (\<Sum>b\<in>Basis. integral\<^sup>L lebesgue (\<lambda>x. f x \<bullet> b) *\<^sub>R b)) UNIV"
     using f by (intro has_integral_sum finite_Basis ballI has_integral_scaleR_left has_integral_integral_lebesgue_real) auto
   also have eq_f: "(\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) = f"
     by (simp add: fun_eq_iff euclidean_representation)
   also have "(\<Sum>b\<in>Basis. integral\<^sup>L lebesgue (\<lambda>x. f x \<bullet> b) *\<^sub>R b) = integral\<^sup>L lebesgue f"
     using f by (subst (2) eq_f[symmetric]) simp
   finally show ?thesis .
 qed
 
 lemma has_integral_integral_lebesgue_on:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "integrable (lebesgue_on S) f" "S \<in> sets lebesgue"
   shows "(f has_integral (integral\<^sup>L (lebesgue_on S) f)) S"
 proof -
   let ?f = "\<lambda>x. if x \<in> S then f x else 0"
   have "integrable lebesgue (\<lambda>x. indicat_real S x *\<^sub>R f x)"
     using indicator_scaleR_eq_if [of S _ f] assms
   by (metis (full_types) integrable_restrict_space sets.Int_space_eq2)
   then have "integrable lebesgue ?f"
     using indicator_scaleR_eq_if [of S _ f] assms by auto
   then have "(?f has_integral (integral\<^sup>L lebesgue ?f)) UNIV"
     by (rule has_integral_integral_lebesgue)
   then have "(f has_integral (integral\<^sup>L lebesgue ?f)) S"
     using has_integral_restrict_UNIV by blast
   moreover
   have "S \<inter> space lebesgue \<in> sets lebesgue"
     by (simp add: assms)
   then have "(integral\<^sup>L lebesgue ?f) = (integral\<^sup>L (lebesgue_on S) f)"
     by (simp add: integral_restrict_space indicator_scaleR_eq_if)
   ultimately show ?thesis
     by auto
 qed
 
 lemma lebesgue_integral_eq_integral:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "integrable (lebesgue_on S) f" "S \<in> sets lebesgue"
   shows "integral\<^sup>L (lebesgue_on S) f = integral S f"
   by (metis has_integral_integral_lebesgue_on assms integral_unique)
 
 lemma integrable_on_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "integrable lebesgue f \<Longrightarrow> f integrable_on UNIV"
   using has_integral_integral_lebesgue by auto
 
 lemma integral_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "integrable lebesgue f \<Longrightarrow> integral UNIV f = (\<integral>x. f x \<partial>lebesgue)"
   using has_integral_integral_lebesgue by auto
 
 end
 
 subsection \<open>Absolute integrability (this is the same as Lebesgue integrability)\<close>
 
 translations
 "LBINT x. f" == "CONST lebesgue_integral CONST lborel (\<lambda>x. f)"
 
 translations
 "LBINT x:A. f" == "CONST set_lebesgue_integral CONST lborel A (\<lambda>x. f)"
 
 lemma set_integral_reflect:
   fixes S and f :: "real \<Rightarrow> 'a :: {banach, second_countable_topology}"
   shows "(LBINT x : S. f x) = (LBINT x : {x. - x \<in> S}. f (- x))"
   unfolding set_lebesgue_integral_def
   by (subst lborel_integral_real_affine[where c="-1" and t=0])
      (auto intro!: Bochner_Integration.integral_cong split: split_indicator)
 
 lemma borel_integrable_atLeastAtMost':
   fixes f :: "real \<Rightarrow> 'a::{banach, second_countable_topology}"
   assumes f: "continuous_on {a..b} f"
   shows "set_integrable lborel {a..b} f"
   unfolding set_integrable_def
   by (intro borel_integrable_compact compact_Icc f)
 
 lemma integral_FTC_atLeastAtMost:
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space"
   assumes "a \<le> b"
     and F: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> (F has_vector_derivative f x) (at x within {a .. b})"
     and f: "continuous_on {a .. b} f"
   shows "integral\<^sup>L lborel (\<lambda>x. indicator {a .. b} x *\<^sub>R f x) = F b - F a"
 proof -
   let ?f = "\<lambda>x. indicator {a .. b} x *\<^sub>R f x"
   have "(?f has_integral (\<integral>x. ?f x \<partial>lborel)) UNIV"
     using borel_integrable_atLeastAtMost'[OF f]
     unfolding set_integrable_def by (rule has_integral_integral_lborel)
   moreover
   have "(f has_integral F b - F a) {a .. b}"
     by (intro fundamental_theorem_of_calculus ballI assms) auto
   then have "(?f has_integral F b - F a) {a .. b}"
     by (subst has_integral_cong[where g=f]) auto
   then have "(?f has_integral F b - F a) UNIV"
     by (intro has_integral_on_superset[where T=UNIV and S="{a..b}"]) auto
   ultimately show "integral\<^sup>L lborel ?f = F b - F a"
     by (rule has_integral_unique)
 qed
 
 lemma set_borel_integral_eq_integral:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "set_integrable lborel S f"
   shows "f integrable_on S" "LINT x : S | lborel. f x = integral S f"
 proof -
   let ?f = "\<lambda>x. indicator S x *\<^sub>R f x"
   have "(?f has_integral LINT x : S | lborel. f x) UNIV"
     using assms has_integral_integral_lborel
     unfolding set_integrable_def set_lebesgue_integral_def by blast
   hence 1: "(f has_integral (set_lebesgue_integral lborel S f)) S"
     apply (subst has_integral_restrict_UNIV [symmetric])
     apply (rule has_integral_eq)
     by auto
   thus "f integrable_on S"
     by (auto simp add: integrable_on_def)
   with 1 have "(f has_integral (integral S f)) S"
     by (intro integrable_integral, auto simp add: integrable_on_def)
   thus "LINT x : S | lborel. f x = integral S f"
     by (intro has_integral_unique [OF 1])
 qed
 
 lemma has_integral_set_lebesgue:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "set_integrable lebesgue S f"
   shows "(f has_integral (LINT x:S|lebesgue. f x)) S"
   using has_integral_integral_lebesgue f
   by (fastforce simp add: set_integrable_def set_lebesgue_integral_def indicator_def if_distrib[of "\<lambda>x. x *\<^sub>R f _"] cong: if_cong)
 
 lemma set_lebesgue_integral_eq_integral:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "set_integrable lebesgue S f"
   shows "f integrable_on S" "LINT x:S | lebesgue. f x = integral S f"
   using has_integral_set_lebesgue[OF f] by (auto simp: integral_unique integrable_on_def)
 
 lemma lmeasurable_iff_has_integral:
   "S \<in> lmeasurable \<longleftrightarrow> ((indicator S) has_integral measure lebesgue S) UNIV"
   by (subst has_integral_iff_nn_integral_lebesgue)
      (auto simp: ennreal_indicator emeasure_eq_measure2 borel_measurable_indicator_iff intro!: fmeasurableI)
 
 abbreviation
   absolutely_integrable_on :: "('a::euclidean_space \<Rightarrow> 'b::{banach, second_countable_topology}) \<Rightarrow> 'a set \<Rightarrow> bool"
   (infixr "absolutely'_integrable'_on" 46)
   where "f absolutely_integrable_on s \<equiv> set_integrable lebesgue s f"
 
 
 lemma absolutely_integrable_zero [simp]: "(\<lambda>x. 0) absolutely_integrable_on S"
     by (simp add: set_integrable_def)
 
 lemma absolutely_integrable_on_def:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f absolutely_integrable_on S \<longleftrightarrow> f integrable_on S \<and> (\<lambda>x. norm (f x)) integrable_on S"
 proof safe
   assume f: "f absolutely_integrable_on S"
   then have nf: "integrable lebesgue (\<lambda>x. norm (indicator S x *\<^sub>R f x))"
     using integrable_norm set_integrable_def by blast
   show "f integrable_on S"
     by (rule set_lebesgue_integral_eq_integral[OF f])
   have "(\<lambda>x. norm (indicator S x *\<^sub>R f x)) = (\<lambda>x. if x \<in> S then norm (f x) else 0)"
     by auto
   with integrable_on_lebesgue[OF nf] show "(\<lambda>x. norm (f x)) integrable_on S"
     by (simp add: integrable_restrict_UNIV)
 next
   assume f: "f integrable_on S" and nf: "(\<lambda>x. norm (f x)) integrable_on S"
   show "f absolutely_integrable_on S"
     unfolding set_integrable_def
   proof (rule integrableI_bounded)
     show "(\<lambda>x. indicator S x *\<^sub>R f x) \<in> borel_measurable lebesgue"
       using f has_integral_implies_lebesgue_measurable[of f _ S] by (auto simp: integrable_on_def)
     show "(\<integral>\<^sup>+ x. ennreal (norm (indicator S x *\<^sub>R f x)) \<partial>lebesgue) < \<infinity>"
       using nf nn_integral_has_integral_lebesgue[of "\<lambda>x. norm (f x)" _ S]
       by (auto simp: integrable_on_def nn_integral_completion)
   qed
 qed
 
 lemma integrable_on_lebesgue_on:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "integrable (lebesgue_on S) f" and S: "S \<in> sets lebesgue"
   shows "f integrable_on S"
 proof -
   have "integrable lebesgue (\<lambda>x. indicator S x *\<^sub>R f x)"
     using S f inf_top.comm_neutral integrable_restrict_space by blast
   then show ?thesis
     using absolutely_integrable_on_def set_integrable_def by blast
 qed
 
 lemma absolutely_integrable_imp_integrable:
   assumes "f absolutely_integrable_on S" "S \<in> sets lebesgue"
   shows "integrable (lebesgue_on S) f"
   by (meson assms integrable_restrict_space set_integrable_def sets.Int sets.top)
 
 lemma absolutely_integrable_on_null [intro]:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "content (cbox a b) = 0 \<Longrightarrow> f absolutely_integrable_on (cbox a b)"
   by (auto simp: absolutely_integrable_on_def)
 
 lemma absolutely_integrable_on_open_interval:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "f absolutely_integrable_on box a b \<longleftrightarrow>
          f absolutely_integrable_on cbox a b"
   by (auto simp: integrable_on_open_interval absolutely_integrable_on_def)
 
 lemma absolutely_integrable_restrict_UNIV:
   "(\<lambda>x. if x \<in> S then f x else 0) absolutely_integrable_on UNIV \<longleftrightarrow> f absolutely_integrable_on S"
     unfolding set_integrable_def
   by (intro arg_cong2[where f=integrable]) auto
 
 lemma absolutely_integrable_onI:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f integrable_on S \<Longrightarrow> (\<lambda>x. norm (f x)) integrable_on S \<Longrightarrow> f absolutely_integrable_on S"
   unfolding absolutely_integrable_on_def by auto
 
 lemma nonnegative_absolutely_integrable_1:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes f: "f integrable_on A" and "\<And>x. x \<in> A \<Longrightarrow> 0 \<le> f x"
   shows "f absolutely_integrable_on A"
   by (rule absolutely_integrable_onI [OF f]) (use assms in \<open>simp add: integrable_eq\<close>)
 
 lemma absolutely_integrable_on_iff_nonneg:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f x" shows "f absolutely_integrable_on S \<longleftrightarrow> f integrable_on S"
 proof -
   { assume "f integrable_on S"
     then have "(\<lambda>x. if x \<in> S then f x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have "(\<lambda>x. if x \<in> S then f x else 0) absolutely_integrable_on UNIV"
       using \<open>f integrable_on S\<close> absolutely_integrable_restrict_UNIV assms nonnegative_absolutely_integrable_1 by blast
     then have "f absolutely_integrable_on S"
       using absolutely_integrable_restrict_UNIV by blast
   }
   then show ?thesis
     unfolding absolutely_integrable_on_def by auto
 qed
 
 lemma absolutely_integrable_on_scaleR_iff:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows
    "(\<lambda>x. c *\<^sub>R f x) absolutely_integrable_on S \<longleftrightarrow>
       c = 0 \<or> f absolutely_integrable_on S"
 proof (cases "c=0")
   case False
   then show ?thesis
   unfolding absolutely_integrable_on_def
   by (simp add: norm_mult)
 qed auto
 
 lemma absolutely_integrable_spike:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f absolutely_integrable_on T" and S: "negligible S" "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "g absolutely_integrable_on T"
   using assms integrable_spike
   unfolding absolutely_integrable_on_def by metis
 
 lemma absolutely_integrable_negligible:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "negligible S"
   shows "f absolutely_integrable_on S"
   using assms by (simp add: absolutely_integrable_on_def integrable_negligible)
 
 lemma absolutely_integrable_spike_eq:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "negligible S" "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "(f absolutely_integrable_on T \<longleftrightarrow> g absolutely_integrable_on T)"
   using assms by (blast intro: absolutely_integrable_spike sym)
 
 lemma absolutely_integrable_spike_set_eq:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "(f absolutely_integrable_on S \<longleftrightarrow> f absolutely_integrable_on T)"
 proof -
   have "(\<lambda>x. if x \<in> S then f x else 0) absolutely_integrable_on UNIV \<longleftrightarrow>
         (\<lambda>x. if x \<in> T then f x else 0) absolutely_integrable_on UNIV"
   proof (rule absolutely_integrable_spike_eq)
     show "negligible ({x \<in> S - T. f x \<noteq> 0} \<union> {x \<in> T - S. f x \<noteq> 0})"
       by (rule negligible_Un [OF assms])
   qed auto
   with absolutely_integrable_restrict_UNIV show ?thesis
     by blast
 qed
 
 lemma absolutely_integrable_spike_set:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f absolutely_integrable_on S" and neg: "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "f absolutely_integrable_on T"
   using absolutely_integrable_spike_set_eq f neg by blast
 
 lemma absolutely_integrable_reflect[simp]:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "(\<lambda>x. f(-x)) absolutely_integrable_on cbox (-b) (-a) \<longleftrightarrow> f absolutely_integrable_on cbox a b"
   apply (auto simp: absolutely_integrable_on_def dest: integrable_reflect [THEN iffD1])
   unfolding integrable_on_def by auto
 
 lemma absolutely_integrable_reflect_real[simp]:
   fixes f :: "real \<Rightarrow> 'b::euclidean_space"
   shows "(\<lambda>x. f(-x)) absolutely_integrable_on {-b .. -a} \<longleftrightarrow> f absolutely_integrable_on {a..b::real}"
   unfolding box_real[symmetric] by (rule absolutely_integrable_reflect)
 
 lemma absolutely_integrable_on_subcbox:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "\<lbrakk>f absolutely_integrable_on S; cbox a b \<subseteq> S\<rbrakk> \<Longrightarrow> f absolutely_integrable_on cbox a b"
   by (meson absolutely_integrable_on_def integrable_on_subcbox)
 
 lemma absolutely_integrable_on_subinterval:
   fixes f :: "real \<Rightarrow> 'b::euclidean_space"
   shows "\<lbrakk>f absolutely_integrable_on S; {a..b} \<subseteq> S\<rbrakk> \<Longrightarrow> f absolutely_integrable_on {a..b}"
   using absolutely_integrable_on_subcbox by fastforce
 
 lemma integrable_subinterval:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "integrable (lebesgue_on {a..b}) f"
     and "{c..d} \<subseteq> {a..b}"
   shows "integrable (lebesgue_on {c..d}) f"
 proof (rule absolutely_integrable_imp_integrable)
   show "f absolutely_integrable_on {c..d}"
   proof -
     have "f integrable_on {c..d}"
       using assms integrable_on_lebesgue_on integrable_on_subinterval by fastforce
     moreover have "(\<lambda>x. norm (f x)) integrable_on {c..d}"
     proof (rule integrable_on_subinterval)
       show "(\<lambda>x. norm (f x)) integrable_on {a..b}"
         by (simp add: assms integrable_on_lebesgue_on)
     qed (use assms in auto)
     ultimately show ?thesis
       by (auto simp: absolutely_integrable_on_def)
   qed
 qed auto
 
 lemma indefinite_integral_continuous_real:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "integrable (lebesgue_on {a..b}) f"
   shows "continuous_on {a..b} (\<lambda>x. integral\<^sup>L (lebesgue_on {a..x}) f)"
 proof -
   have "f integrable_on {a..b}"
     by (simp add: assms integrable_on_lebesgue_on)
   then have "continuous_on {a..b} (\<lambda>x. integral {a..x} f)"
     using indefinite_integral_continuous_1 by blast
   moreover have "integral\<^sup>L (lebesgue_on {a..x}) f = integral {a..x} f" if "a \<le> x" "x \<le> b" for x
   proof -
     have "{a..x} \<subseteq> {a..b}"
       using that by auto
     then have "integrable (lebesgue_on {a..x}) f"
       using integrable_subinterval assms by blast
     then show "integral\<^sup>L (lebesgue_on {a..x}) f = integral {a..x} f"
       by (simp add: lebesgue_integral_eq_integral)
   qed
   ultimately show ?thesis
     by (metis (no_types, lifting) atLeastAtMost_iff continuous_on_cong)
 qed
 
 lemma lmeasurable_iff_integrable_on: "S \<in> lmeasurable \<longleftrightarrow> (\<lambda>x. 1::real) integrable_on S"
   by (subst absolutely_integrable_on_iff_nonneg[symmetric])
      (simp_all add: lmeasurable_iff_integrable set_integrable_def)
 
 lemma lmeasure_integral_UNIV: "S \<in> lmeasurable \<Longrightarrow> measure lebesgue S = integral UNIV (indicator S)"
   by (simp add: lmeasurable_iff_has_integral integral_unique)
 
 lemma lmeasure_integral: "S \<in> lmeasurable \<Longrightarrow> measure lebesgue S = integral S (\<lambda>x. 1::real)"
   by (fastforce simp add: lmeasure_integral_UNIV indicator_def[abs_def] lmeasurable_iff_integrable_on)
 
 lemma integrable_on_const: "S \<in> lmeasurable \<Longrightarrow> (\<lambda>x. c) integrable_on S"
   unfolding lmeasurable_iff_integrable
   by (metis (mono_tags, lifting) integrable_eq integrable_on_scaleR_left lmeasurable_iff_integrable lmeasurable_iff_integrable_on scaleR_one)
 
 lemma integral_indicator:
   assumes "(S \<inter> T) \<in> lmeasurable"
   shows "integral T (indicator S) = measure lebesgue (S \<inter> T)"
 proof -
   have "integral UNIV (indicator (S \<inter> T)) = integral UNIV (\<lambda>a. if a \<in> S \<inter> T then 1::real else 0)"
     by (meson indicator_def)
   moreover
   have "(indicator (S \<inter> T) has_integral measure lebesgue (S \<inter> T)) UNIV"
     using assms by (simp add: lmeasurable_iff_has_integral)
   ultimately have "integral UNIV (\<lambda>x. if x \<in> S \<inter> T then 1 else 0) = measure lebesgue (S \<inter> T)"
     by (metis (no_types) integral_unique)
   then show ?thesis
     using integral_restrict_Int [of UNIV "S \<inter> T" "\<lambda>x. 1::real"]
     apply (simp add: integral_restrict_Int [symmetric])
     by (meson indicator_def)
 qed
 
 lemma measurable_integrable:
   fixes S :: "'a::euclidean_space set"
   shows "S \<in> lmeasurable \<longleftrightarrow> (indicat_real S) integrable_on UNIV"
   by (auto simp: lmeasurable_iff_integrable absolutely_integrable_on_iff_nonneg [symmetric] set_integrable_def)
 
 lemma integrable_on_indicator:
   fixes S :: "'a::euclidean_space set"
   shows "indicat_real S integrable_on T \<longleftrightarrow> (S \<inter> T) \<in> lmeasurable"
   unfolding measurable_integrable
   unfolding integrable_restrict_UNIV [of T, symmetric]
   by (fastforce simp add: indicator_def elim: integrable_eq)
 
 lemma
   assumes \<D>: "\<D> division_of S"
   shows lmeasurable_division: "S \<in> lmeasurable" (is ?l)
     and content_division: "(\<Sum>k\<in>\<D>. measure lebesgue k) = measure lebesgue S" (is ?m)
 proof -
   { fix d1 d2 assume *: "d1 \<in> \<D>" "d2 \<in> \<D>" "d1 \<noteq> d2"
     then obtain a b c d where "d1 = cbox a b" "d2 = cbox c d"
       using division_ofD(4)[OF \<D>] by blast
     with division_ofD(5)[OF \<D> *]
     have "d1 \<in> sets lborel" "d2 \<in> sets lborel" "d1 \<inter> d2 \<subseteq> (cbox a b - box a b) \<union> (cbox c d - box c d)"
       by auto
     moreover have "(cbox a b - box a b) \<union> (cbox c d - box c d) \<in> null_sets lborel"
       by (intro null_sets.Un null_sets_cbox_Diff_box)
     ultimately have "d1 \<inter> d2 \<in> null_sets lborel"
       by (blast intro: null_sets_subset) }
   then show ?l ?m
     unfolding division_ofD(6)[OF \<D>, symmetric]
     using division_ofD(1,4)[OF \<D>]
     by (auto intro!: measure_Union_AE[symmetric] simp: completion.AE_iff_null_sets Int_def[symmetric] pairwise_def null_sets_def)
 qed
 
 lemma has_measure_limit:
   assumes "S \<in> lmeasurable" "e > 0"
   obtains B where "B > 0"
     "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> \<bar>measure lebesgue (S \<inter> cbox a b) - measure lebesgue S\<bar> < e"
   using assms unfolding lmeasurable_iff_has_integral has_integral_alt'
   by (force simp: integral_indicator integrable_on_indicator)
 
 lemma lmeasurable_iff_indicator_has_integral:
   fixes S :: "'a::euclidean_space set"
   shows "S \<in> lmeasurable \<and> m = measure lebesgue S \<longleftrightarrow> (indicat_real S has_integral m) UNIV"
   by (metis has_integral_iff lmeasurable_iff_has_integral measurable_integrable)
 
 lemma has_measure_limit_iff:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "S \<in> lmeasurable \<and> m = measure lebesgue S \<longleftrightarrow>
           (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
             (S \<inter> cbox a b) \<in> lmeasurable \<and> \<bar>measure lebesgue (S \<inter> cbox a b) - m\<bar> < e)" (is "?lhs = ?rhs")
 proof
   assume ?lhs then show ?rhs
     by (meson has_measure_limit fmeasurable.Int lmeasurable_cbox)
 next
   assume RHS [rule_format]: ?rhs
   show ?lhs
     apply (simp add: lmeasurable_iff_indicator_has_integral has_integral' [where i=m])
     using RHS
     by (metis (full_types) integral_indicator integrable_integral integrable_on_indicator)
 qed
 
 subsection\<open>Applications to Negligibility\<close>
 
 lemma negligible_iff_null_sets: "negligible S \<longleftrightarrow> S \<in> null_sets lebesgue"
 proof
   assume "negligible S"
   then have "(indicator S has_integral (0::real)) UNIV"
     by (auto simp: negligible)
   then show "S \<in> null_sets lebesgue"
     by (subst (asm) has_integral_iff_nn_integral_lebesgue)
         (auto simp: borel_measurable_indicator_iff nn_integral_0_iff_AE AE_iff_null_sets indicator_eq_0_iff)
 next
   assume S: "S \<in> null_sets lebesgue"
   show "negligible S"
     unfolding negligible_def
   proof (safe intro!: has_integral_iff_nn_integral_lebesgue[THEN iffD2]
                       has_integral_restrict_UNIV[where s="cbox _ _", THEN iffD1])
     fix a b
     show "(\<lambda>x. if x \<in> cbox a b then indicator S x else 0) \<in> lebesgue \<rightarrow>\<^sub>M borel"
       using S by (auto intro!: measurable_If)
     then show "(\<integral>\<^sup>+ x. ennreal (if x \<in> cbox a b then indicator S x else 0) \<partial>lebesgue) = ennreal 0"
       using S[THEN AE_not_in] by (auto intro!: nn_integral_0_iff_AE[THEN iffD2])
   qed auto
 qed
 
 corollary eventually_ae_filter_negligible:
   "eventually P (ae_filter lebesgue) \<longleftrightarrow> (\<exists>N. negligible N \<and> {x. \<not> P x} \<subseteq> N)"
   by (auto simp: completion.AE_iff_null_sets negligible_iff_null_sets null_sets_completion_subset)
 
 lemma starlike_negligible:
   assumes "closed S"
       and eq1: "\<And>c x. (a + c *\<^sub>R x) \<in> S \<Longrightarrow> 0 \<le> c \<Longrightarrow> a + x \<in> S \<Longrightarrow> c = 1"
     shows "negligible S"
 proof -
   have "negligible ((+) (-a) ` S)"
   proof (subst negligible_on_intervals, intro allI)
     fix u v
     show "negligible ((+) (- a) ` S \<inter> cbox u v)"
       using \<open>closed S\<close> eq1 by (auto simp add: negligible_iff_null_sets algebra_simps
         intro!: closed_translation_subtract starlike_negligible_compact cong: image_cong_simp)
         (metis add_diff_eq diff_add_cancel scale_right_diff_distrib)
   qed
   then show ?thesis
     by (rule negligible_translation_rev)
 qed
 
 lemma starlike_negligible_strong:
   assumes "closed S"
       and star: "\<And>c x. \<lbrakk>0 \<le> c; c < 1; a+x \<in> S\<rbrakk> \<Longrightarrow> a + c *\<^sub>R x \<notin> S"
     shows "negligible S"
 proof -
   show ?thesis
   proof (rule starlike_negligible [OF \<open>closed S\<close>, of a])
     fix c x
     assume cx: "a + c *\<^sub>R x \<in> S" "0 \<le> c" "a + x \<in> S"
     with star have "\<not> (c < 1)" by auto
     moreover have "\<not> (c > 1)"
       using star [of "1/c" "c *\<^sub>R x"] cx by force
     ultimately show "c = 1" by arith
   qed
 qed
 
 lemma negligible_hyperplane:
   assumes "a \<noteq> 0 \<or> b \<noteq> 0" shows "negligible {x. a \<bullet> x = b}"
 proof -
   obtain x where x: "a \<bullet> x \<noteq> b"
     using assms
     apply auto
      apply (metis inner_eq_zero_iff inner_zero_right)
     using inner_zero_right by fastforce
   show ?thesis
     apply (rule starlike_negligible [OF closed_hyperplane, of x])
     using x apply (auto simp: algebra_simps)
     done
 qed
 
 lemma negligible_lowdim:
   fixes S :: "'N :: euclidean_space set"
   assumes "dim S < DIM('N)"
     shows "negligible S"
 proof -
   obtain a where "a \<noteq> 0" and a: "span S \<subseteq> {x. a \<bullet> x = 0}"
     using lowdim_subset_hyperplane [OF assms] by blast
   have "negligible (span S)"
     using \<open>a \<noteq> 0\<close> a negligible_hyperplane by (blast intro: negligible_subset)
   then show ?thesis
     using span_base by (blast intro: negligible_subset)
 qed
 
 proposition negligible_convex_frontier:
   fixes S :: "'N :: euclidean_space set"
   assumes "convex S"
     shows "negligible(frontier S)"
 proof -
   have nf: "negligible(frontier S)" if "convex S" "0 \<in> S" for S :: "'N set"
   proof -
     obtain B where "B \<subseteq> S" and indB: "independent B"
                and spanB: "S \<subseteq> span B" and cardB: "card B = dim S"
       by (metis basis_exists)
     consider "dim S < DIM('N)" | "dim S = DIM('N)"
       using dim_subset_UNIV le_eq_less_or_eq by auto
     then show ?thesis
     proof cases
       case 1
       show ?thesis
         by (rule negligible_subset [of "closure S"])
            (simp_all add: frontier_def negligible_lowdim 1)
     next
       case 2
       obtain a where a: "a \<in> interior S"
         apply (rule interior_simplex_nonempty [OF indB])
           apply (simp add: indB independent_finite)
          apply (simp add: cardB 2)
         apply (metis \<open>B \<subseteq> S\<close> \<open>0 \<in> S\<close> \<open>convex S\<close> insert_absorb insert_subset interior_mono subset_hull)
         done
       show ?thesis
       proof (rule starlike_negligible_strong [where a=a])
         fix c::real and x
         have eq: "a + c *\<^sub>R x = (a + x) - (1 - c) *\<^sub>R ((a + x) - a)"
           by (simp add: algebra_simps)
         assume "0 \<le> c" "c < 1" "a + x \<in> frontier S"
         then show "a + c *\<^sub>R x \<notin> frontier S"
           apply (clarsimp simp: frontier_def)
           apply (subst eq)
           apply (rule mem_interior_closure_convex_shrink [OF \<open>convex S\<close> a, of _ "1-c"], auto)
           done
       qed auto
     qed
   qed
   show ?thesis
   proof (cases "S = {}")
     case True then show ?thesis by auto
   next
     case False
     then obtain a where "a \<in> S" by auto
     show ?thesis
       using nf [of "(\<lambda>x. -a + x) ` S"]
       by (metis \<open>a \<in> S\<close> add.left_inverse assms convex_translation_eq frontier_translation
                 image_eqI negligible_translation_rev)
   qed
 qed
 
 corollary negligible_sphere: "negligible (sphere a e)"
   using frontier_cball negligible_convex_frontier convex_cball
   by (blast intro: negligible_subset)
 
 lemma non_negligible_UNIV [simp]: "\<not> negligible UNIV"
   unfolding negligible_iff_null_sets by (auto simp: null_sets_def)
 
 lemma negligible_interval:
   "negligible (cbox a b) \<longleftrightarrow> box a b = {}" "negligible (box a b) \<longleftrightarrow> box a b = {}"
    by (auto simp: negligible_iff_null_sets null_sets_def prod_nonneg inner_diff_left box_eq_empty
                   not_le emeasure_lborel_cbox_eq emeasure_lborel_box_eq
             intro: eq_refl antisym less_imp_le)
 
 proposition open_not_negligible:
   assumes "open S" "S \<noteq> {}"
   shows "\<not> negligible S"
 proof
   assume neg: "negligible S"
   obtain a where "a \<in> S"
     using \<open>S \<noteq> {}\<close> by blast
   then obtain e where "e > 0" "cball a e \<subseteq> S"
     using \<open>open S\<close> open_contains_cball_eq by blast
   let ?p = "a - (e / DIM('a)) *\<^sub>R One" let ?q = "a + (e / DIM('a)) *\<^sub>R One"
   have "cbox ?p ?q \<subseteq> cball a e"
   proof (clarsimp simp: mem_box dist_norm)
     fix x
     assume "\<forall>i\<in>Basis. ?p \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> ?q \<bullet> i"
     then have ax: "\<bar>(a - x) \<bullet> i\<bar> \<le> e / real DIM('a)" if "i \<in> Basis" for i
       using that by (auto simp: algebra_simps)
     have "norm (a - x) \<le> (\<Sum>i\<in>Basis. \<bar>(a - x) \<bullet> i\<bar>)"
       by (rule norm_le_l1)
     also have "\<dots> \<le> DIM('a) * (e / real DIM('a))"
       by (intro sum_bounded_above ax)
     also have "\<dots> = e"
       by simp
     finally show "norm (a - x) \<le> e" .
   qed
   then have "negligible (cbox ?p ?q)"
     by (meson \<open>cball a e \<subseteq> S\<close> neg negligible_subset)
   with \<open>e > 0\<close> show False
     by (simp add: negligible_interval box_eq_empty algebra_simps field_split_simps mult_le_0_iff)
 qed
 
 lemma negligible_convex_interior:
    "convex S \<Longrightarrow> (negligible S \<longleftrightarrow> interior S = {})"
   apply safe
   apply (metis interior_subset negligible_subset open_interior open_not_negligible)
    apply (metis Diff_empty closure_subset frontier_def negligible_convex_frontier negligible_subset)
   done
 
 lemma measure_eq_0_null_sets: "S \<in> null_sets M \<Longrightarrow> measure M S = 0"
   by (auto simp: measure_def null_sets_def)
 
 lemma negligible_imp_measure0: "negligible S \<Longrightarrow> measure lebesgue S = 0"
   by (simp add: measure_eq_0_null_sets negligible_iff_null_sets)
 
 lemma negligible_iff_emeasure0: "S \<in> sets lebesgue \<Longrightarrow> (negligible S \<longleftrightarrow> emeasure lebesgue S = 0)"
   by (auto simp: measure_eq_0_null_sets negligible_iff_null_sets)
 
 lemma negligible_iff_measure0: "S \<in> lmeasurable \<Longrightarrow> (negligible S \<longleftrightarrow> measure lebesgue S = 0)"
   apply (auto simp: measure_eq_0_null_sets negligible_iff_null_sets)
   by (metis completion.null_sets_outer subsetI)
 
 lemma negligible_imp_sets: "negligible S \<Longrightarrow> S \<in> sets lebesgue"
   by (simp add: negligible_iff_null_sets null_setsD2)
 
 lemma negligible_imp_measurable: "negligible S \<Longrightarrow> S \<in> lmeasurable"
   by (simp add: fmeasurableI_null_sets negligible_iff_null_sets)
 
 lemma negligible_iff_measure: "negligible S \<longleftrightarrow> S \<in> lmeasurable \<and> measure lebesgue S = 0"
   by (fastforce simp: negligible_iff_measure0 negligible_imp_measurable dest: negligible_imp_measure0)
 
 lemma negligible_outer:
   "negligible S \<longleftrightarrow> (\<forall>e>0. \<exists>T. S \<subseteq> T \<and> T \<in> lmeasurable \<and> measure lebesgue T < e)" (is "_ = ?rhs")
 proof
   assume "negligible S" then show ?rhs
     by (metis negligible_iff_measure order_refl)
 next
   assume ?rhs then show "negligible S"
   by (meson completion.null_sets_outer negligible_iff_null_sets)
 qed
 
 lemma negligible_outer_le:
      "negligible S \<longleftrightarrow> (\<forall>e>0. \<exists>T. S \<subseteq> T \<and> T \<in> lmeasurable \<and> measure lebesgue T \<le> e)" (is "_ = ?rhs")
 proof
   assume "negligible S" then show ?rhs
     by (metis dual_order.strict_implies_order negligible_imp_measurable negligible_imp_measure0 order_refl)
 next
   assume ?rhs then show "negligible S"
     by (metis le_less_trans negligible_outer field_lbound_gt_zero)
 qed
 
 lemma negligible_UNIV: "negligible S \<longleftrightarrow> (indicat_real S has_integral 0) UNIV" (is "_=?rhs")
 proof
   assume ?rhs
   then show "negligible S"
     apply (auto simp: negligible_def has_integral_iff integrable_on_indicator)
     by (metis negligible integral_unique lmeasure_integral_UNIV negligible_iff_measure0)
 qed (simp add: negligible)
 
 lemma sets_negligible_symdiff:
    "\<lbrakk>S \<in> sets lebesgue; negligible((S - T) \<union> (T - S))\<rbrakk> \<Longrightarrow> T \<in> sets lebesgue"
   by (metis Diff_Diff_Int Int_Diff_Un inf_commute negligible_Un_eq negligible_imp_sets sets.Diff sets.Un)
 
 lemma lmeasurable_negligible_symdiff:
    "\<lbrakk>S \<in> lmeasurable; negligible((S - T) \<union> (T - S))\<rbrakk> \<Longrightarrow> T \<in> lmeasurable"
   using integrable_spike_set_eq lmeasurable_iff_integrable_on by blast
 
 
 lemma measure_Un3_negligible:
   assumes meas: "S \<in> lmeasurable" "T \<in> lmeasurable" "U \<in> lmeasurable"
   and neg: "negligible(S \<inter> T)" "negligible(S \<inter> U)" "negligible(T \<inter> U)" and V: "S \<union> T \<union> U = V"
 shows "measure lebesgue V = measure lebesgue S + measure lebesgue T + measure lebesgue U"
 proof -
   have [simp]: "measure lebesgue (S \<inter> T) = 0"
     using neg(1) negligible_imp_measure0 by blast
   have [simp]: "measure lebesgue (S \<inter> U \<union> T \<inter> U) = 0"
     using neg(2) neg(3) negligible_Un negligible_imp_measure0 by blast
   have "measure lebesgue V = measure lebesgue (S \<union> T \<union> U)"
     using V by simp
   also have "\<dots> = measure lebesgue S + measure lebesgue T + measure lebesgue U"
     by (simp add: measure_Un3 meas fmeasurable.Un Int_Un_distrib2)
   finally show ?thesis .
 qed
 
 lemma measure_translate_add:
   assumes meas: "S \<in> lmeasurable" "T \<in> lmeasurable"
     and U: "S \<union> ((+)a ` T) = U" and neg: "negligible(S \<inter> ((+)a ` T))"
   shows "measure lebesgue S + measure lebesgue T = measure lebesgue U"
 proof -
   have [simp]: "measure lebesgue (S \<inter> (+) a ` T) = 0"
     using neg negligible_imp_measure0 by blast
   have "measure lebesgue (S \<union> ((+)a ` T)) = measure lebesgue S + measure lebesgue T"
     by (simp add: measure_Un3 meas measurable_translation measure_translation fmeasurable.Un)
   then show ?thesis
     using U by auto
 qed
 
 lemma measure_negligible_symdiff:
   assumes S: "S \<in> lmeasurable"
     and neg: "negligible (S - T \<union> (T - S))"
   shows "measure lebesgue T = measure lebesgue S"
 proof -
   have "measure lebesgue (S - T) = 0"
     using neg negligible_Un_eq negligible_imp_measure0 by blast
   then show ?thesis
     by (metis S Un_commute add.right_neutral lmeasurable_negligible_symdiff measure_Un2 neg negligible_Un_eq negligible_imp_measure0)
 qed
 
 lemma measure_closure:
   assumes "bounded S" and neg: "negligible (frontier S)"
   shows "measure lebesgue (closure S) = measure lebesgue S"
 proof -
   have "measure lebesgue (frontier S) = 0"
     by (metis neg negligible_imp_measure0)
   then show ?thesis
     by (metis assms lmeasurable_iff_integrable_on eq_iff_diff_eq_0 has_integral_interior integrable_on_def integral_unique lmeasurable_interior lmeasure_integral measure_frontier)
 qed
 
 lemma measure_interior:
    "\<lbrakk>bounded S; negligible(frontier S)\<rbrakk> \<Longrightarrow> measure lebesgue (interior S) = measure lebesgue S"
   using measure_closure measure_frontier negligible_imp_measure0 by fastforce
 
 lemma measurable_Jordan:
   assumes "bounded S" and neg: "negligible (frontier S)"
   shows "S \<in> lmeasurable"
 proof -
   have "closure S \<in> lmeasurable"
     by (metis lmeasurable_closure \<open>bounded S\<close>)
   moreover have "interior S \<in> lmeasurable"
     by (simp add: lmeasurable_interior \<open>bounded S\<close>)
   moreover have "interior S \<subseteq> S"
     by (simp add: interior_subset)
   ultimately show ?thesis
     using assms by (metis (full_types) closure_subset completion.complete_sets_sandwich_fmeasurable measure_closure measure_interior)
 qed
 
 lemma measurable_convex: "\<lbrakk>convex S; bounded S\<rbrakk> \<Longrightarrow> S \<in> lmeasurable"
   by (simp add: measurable_Jordan negligible_convex_frontier)
 
+lemma content_cball_conv_ball: "content (cball c r) = content (ball c r)"
+proof -
+  have "ball c r - cball c r \<union> (cball c r - ball c r) = sphere c r"
+    by auto
+  hence "measure lebesgue (cball c r) = measure lebesgue (ball c r)"
+    using negligible_sphere[of c r] by (intro measure_negligible_symdiff) simp_all
+  thus ?thesis by simp
+qed
+
 subsection\<open>Negligibility of image under non-injective linear map\<close>
 
 lemma negligible_Union_nat:
   assumes "\<And>n::nat. negligible(S n)"
   shows "negligible(\<Union>n. S n)"
 proof -
   have "negligible (\<Union>m\<le>k. S m)" for k
     using assms by blast
   then have 0:  "integral UNIV (indicat_real (\<Union>m\<le>k. S m)) = 0"
     and 1: "(indicat_real (\<Union>m\<le>k. S m)) integrable_on UNIV" for k
     by (auto simp: negligible has_integral_iff)
   have 2: "\<And>k x. indicat_real (\<Union>m\<le>k. S m) x \<le> (indicat_real (\<Union>m\<le>Suc k. S m) x)"
     by (simp add: indicator_def)
   have 3: "\<And>x. (\<lambda>k. indicat_real (\<Union>m\<le>k. S m) x) \<longlonglongrightarrow> (indicat_real (\<Union>n. S n) x)"
     by (force simp: indicator_def eventually_sequentially intro: tendsto_eventually)
   have 4: "bounded (range (\<lambda>k. integral UNIV (indicat_real (\<Union>m\<le>k. S m))))"
     by (simp add: 0)
   have *: "indicat_real (\<Union>n. S n) integrable_on UNIV \<and>
         (\<lambda>k. integral UNIV (indicat_real (\<Union>m\<le>k. S m))) \<longlonglongrightarrow> (integral UNIV (indicat_real (\<Union>n. S n)))"
     by (intro monotone_convergence_increasing 1 2 3 4)
   then have "integral UNIV (indicat_real (\<Union>n. S n)) = (0::real)"
     using LIMSEQ_unique by (auto simp: 0)
   then show ?thesis
     using * by (simp add: negligible_UNIV has_integral_iff)
 qed
 
 
 lemma negligible_linear_singular_image:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'n"
   assumes "linear f" "\<not> inj f"
   shows "negligible (f ` S)"
 proof -
   obtain a where "a \<noteq> 0" "\<And>S. f ` S \<subseteq> {x. a \<bullet> x = 0}"
     using assms linear_singular_image_hyperplane by blast
   then show "negligible (f ` S)"
     by (metis negligible_hyperplane negligible_subset)
 qed
 
 lemma measure_negligible_finite_Union:
   assumes "finite \<F>"
     and meas: "\<And>S. S \<in> \<F> \<Longrightarrow> S \<in> lmeasurable"
     and djointish: "pairwise (\<lambda>S T. negligible (S \<inter> T)) \<F>"
   shows "measure lebesgue (\<Union>\<F>) = (\<Sum>S\<in>\<F>. measure lebesgue S)"
   using assms
 proof (induction)
   case empty
   then show ?case
     by auto
 next
   case (insert S \<F>)
   then have "S \<in> lmeasurable" "\<Union>\<F> \<in> lmeasurable" "pairwise (\<lambda>S T. negligible (S \<inter> T)) \<F>"
     by (simp_all add: fmeasurable.finite_Union insert.hyps(1) insert.prems(1) pairwise_insert subsetI)
   then show ?case
   proof (simp add: measure_Un3 insert)
     have *: "\<And>T. T \<in> (\<inter>) S ` \<F> \<Longrightarrow> negligible T"
       using insert by (force simp: pairwise_def)
     have "negligible(S \<inter> \<Union>\<F>)"
       unfolding Int_Union
       by (rule negligible_Union) (simp_all add: * insert.hyps(1))
     then show "measure lebesgue (S \<inter> \<Union>\<F>) = 0"
       using negligible_imp_measure0 by blast
   qed
 qed
 
 lemma measure_negligible_finite_Union_image:
   assumes "finite S"
     and meas: "\<And>x. x \<in> S \<Longrightarrow> f x \<in> lmeasurable"
     and djointish: "pairwise (\<lambda>x y. negligible (f x \<inter> f y)) S"
   shows "measure lebesgue (\<Union>(f ` S)) = (\<Sum>x\<in>S. measure lebesgue (f x))"
 proof -
   have "measure lebesgue (\<Union>(f ` S)) = sum (measure lebesgue) (f ` S)"
     using assms by (auto simp: pairwise_mono pairwise_image intro: measure_negligible_finite_Union)
   also have "\<dots> = sum (measure lebesgue \<circ> f) S"
     using djointish [unfolded pairwise_def] by (metis inf.idem negligible_imp_measure0 sum.reindex_nontrivial [OF \<open>finite S\<close>])
   also have "\<dots> = (\<Sum>x\<in>S. measure lebesgue (f x))"
     by simp
   finally show ?thesis .
 qed
 
 subsection \<open>Negligibility of a Lipschitz image of a negligible set\<close>
 
 text\<open>The bound will be eliminated by a sort of onion argument\<close>
 lemma locally_Lipschitz_negl_bounded:
   fixes f :: "'M::euclidean_space \<Rightarrow> 'N::euclidean_space"
   assumes MleN: "DIM('M) \<le> DIM('N)" "0 < B" "bounded S" "negligible S"
       and lips: "\<And>x. x \<in> S
                       \<Longrightarrow> \<exists>T. open T \<and> x \<in> T \<and>
                               (\<forall>y \<in> S \<inter> T. norm(f y - f x) \<le> B * norm(y - x))"
   shows "negligible (f ` S)"
   unfolding negligible_iff_null_sets
 proof (clarsimp simp: completion.null_sets_outer)
   fix e::real
   assume "0 < e"
   have "S \<in> lmeasurable"
     using \<open>negligible S\<close> by (simp add: negligible_iff_null_sets fmeasurableI_null_sets)
   then have "S \<in> sets lebesgue"
     by blast
   have e22: "0 < e/2 / (2 * B * real DIM('M)) ^ DIM('N)"
     using \<open>0 < e\<close> \<open>0 < B\<close> by (simp add: field_split_simps)
   obtain T where "open T" "S \<subseteq> T" "(T - S) \<in> lmeasurable"
                  "measure lebesgue (T - S) < e/2 / (2 * B * DIM('M)) ^ DIM('N)"
     using sets_lebesgue_outer_open [OF \<open>S \<in> sets lebesgue\<close> e22]
     by (metis emeasure_eq_measure2 ennreal_leI linorder_not_le)
   then have T: "measure lebesgue T \<le> e/2 / (2 * B * DIM('M)) ^ DIM('N)"
     using \<open>negligible S\<close> by (simp add: measure_Diff_null_set negligible_iff_null_sets)
   have "\<exists>r. 0 < r \<and> r \<le> 1/2 \<and>
             (x \<in> S \<longrightarrow> (\<forall>y. norm(y - x) < r
                        \<longrightarrow> y \<in> T \<and> (y \<in> S \<longrightarrow> norm(f y - f x) \<le> B * norm(y - x))))"
         for x
   proof (cases "x \<in> S")
     case True
     obtain U where "open U" "x \<in> U" and U: "\<And>y. y \<in> S \<inter> U \<Longrightarrow> norm(f y - f x) \<le> B * norm(y - x)"
       using lips [OF \<open>x \<in> S\<close>] by auto
     have "x \<in> T \<inter> U"
       using \<open>S \<subseteq> T\<close> \<open>x \<in> U\<close> \<open>x \<in> S\<close> by auto
     then obtain \<epsilon> where "0 < \<epsilon>" "ball x \<epsilon> \<subseteq> T \<inter> U"
       by (metis \<open>open T\<close> \<open>open U\<close> openE open_Int)
     then show ?thesis
       apply (rule_tac x="min (1/2) \<epsilon>" in exI)
       apply (simp del: divide_const_simps)
       apply (intro allI impI conjI)
        apply (metis dist_commute dist_norm mem_ball subsetCE)
       by (metis Int_iff subsetCE U dist_norm mem_ball norm_minus_commute)
   next
     case False
     then show ?thesis
       by (rule_tac x="1/4" in exI) auto
   qed
   then obtain R where R12: "\<And>x. 0 < R x \<and> R x \<le> 1/2"
                 and RT: "\<And>x y. \<lbrakk>x \<in> S; norm(y - x) < R x\<rbrakk> \<Longrightarrow> y \<in> T"
                 and RB: "\<And>x y. \<lbrakk>x \<in> S; y \<in> S; norm(y - x) < R x\<rbrakk> \<Longrightarrow> norm(f y - f x) \<le> B * norm(y - x)"
     by metis+
   then have gaugeR: "gauge (\<lambda>x. ball x (R x))"
     by (simp add: gauge_def)
   obtain c where c: "S \<subseteq> cbox (-c *\<^sub>R One) (c *\<^sub>R One)" "box (-c *\<^sub>R One:: 'M) (c *\<^sub>R One) \<noteq> {}"
   proof -
     obtain B where B: "\<And>x. x \<in> S \<Longrightarrow> norm x \<le> B"
       using \<open>bounded S\<close> bounded_iff by blast
     show ?thesis
       apply (rule_tac c = "abs B + 1" in that)
       using norm_bound_Basis_le Basis_le_norm
        apply (fastforce simp: box_eq_empty mem_box dest!: B intro: order_trans)+
       done
   qed
   obtain \<D> where "countable \<D>"
      and Dsub: "\<Union>\<D> \<subseteq> cbox (-c *\<^sub>R One) (c *\<^sub>R One)"
      and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> interior K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
      and pw:   "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
      and Ksub: "\<And>K. K \<in> \<D> \<Longrightarrow> \<exists>x \<in> S \<inter> K. K \<subseteq> (\<lambda>x. ball x (R x)) x"
      and exN:  "\<And>u v. cbox u v \<in> \<D> \<Longrightarrow> \<exists>n. \<forall>i \<in> Basis. v \<bullet> i - u \<bullet> i = (2*c) / 2^n"
      and "S \<subseteq> \<Union>\<D>"
     using covering_lemma [OF c gaugeR]  by force
   have "\<exists>u v z. K = cbox u v \<and> box u v \<noteq> {} \<and> z \<in> S \<and> z \<in> cbox u v \<and>
                 cbox u v \<subseteq> ball z (R z)" if "K \<in> \<D>" for K
   proof -
     obtain u v where "K = cbox u v"
       using \<open>K \<in> \<D>\<close> cbox by blast
     with that show ?thesis
       apply (rule_tac x=u in exI)
       apply (rule_tac x=v in exI)
       apply (metis Int_iff interior_cbox cbox Ksub)
       done
   qed
   then obtain uf vf zf
     where uvz: "\<And>K. K \<in> \<D> \<Longrightarrow>
                 K = cbox (uf K) (vf K) \<and> box (uf K) (vf K) \<noteq> {} \<and> zf K \<in> S \<and>
                 zf K \<in> cbox (uf K) (vf K) \<and> cbox (uf K) (vf K) \<subseteq> ball (zf K) (R (zf K))"
     by metis
   define prj1 where "prj1 \<equiv> \<lambda>x::'M. x \<bullet> (SOME i. i \<in> Basis)"
   define fbx where "fbx \<equiv> \<lambda>D. cbox (f(zf D) - (B * DIM('M) * (prj1(vf D - uf D))) *\<^sub>R One::'N)
                                     (f(zf D) + (B * DIM('M) * prj1(vf D - uf D)) *\<^sub>R One)"
   have vu_pos: "0 < prj1 (vf X - uf X)" if "X \<in> \<D>" for X
     using uvz [OF that] by (simp add: prj1_def box_ne_empty SOME_Basis inner_diff_left)
   have prj1_idem: "prj1 (vf X - uf X) = (vf X - uf X) \<bullet> i" if  "X \<in> \<D>" "i \<in> Basis" for X i
   proof -
     have "cbox (uf X) (vf X) \<in> \<D>"
       using uvz \<open>X \<in> \<D>\<close> by auto
     with exN obtain n where "\<And>i. i \<in> Basis \<Longrightarrow> vf X \<bullet> i - uf X \<bullet> i = (2*c) / 2^n"
       by blast
     then show ?thesis
       by (simp add: \<open>i \<in> Basis\<close> SOME_Basis inner_diff prj1_def)
   qed
   have countbl: "countable (fbx ` \<D>)"
     using \<open>countable \<D>\<close> by blast
   have "(\<Sum>k\<in>fbx`\<D>'. measure lebesgue k) \<le> e/2" if "\<D>' \<subseteq> \<D>" "finite \<D>'" for \<D>'
   proof -
     have BM_ge0: "0 \<le> B * (DIM('M) * prj1 (vf X - uf X))" if "X \<in> \<D>'" for X
       using \<open>0 < B\<close> \<open>\<D>' \<subseteq> \<D>\<close> that vu_pos by fastforce
     have "{} \<notin> \<D>'"
       using cbox \<open>\<D>' \<subseteq> \<D>\<close> interior_empty by blast
     have "(\<Sum>k\<in>fbx`\<D>'. measure lebesgue k) \<le> sum (measure lebesgue o fbx) \<D>'"
       by (rule sum_image_le [OF \<open>finite \<D>'\<close>]) (force simp: fbx_def)
     also have "\<dots> \<le> (\<Sum>X\<in>\<D>'. (2 * B * DIM('M)) ^ DIM('N) * measure lebesgue X)"
     proof (rule sum_mono)
       fix X assume "X \<in> \<D>'"
       then have "X \<in> \<D>" using \<open>\<D>' \<subseteq> \<D>\<close> by blast
       then have ufvf: "cbox (uf X) (vf X) = X"
         using uvz by blast
       have "prj1 (vf X - uf X) ^ DIM('M) = (\<Prod>i::'M \<in> Basis. prj1 (vf X - uf X))"
         by (rule prod_constant [symmetric])
       also have "\<dots> = (\<Prod>i\<in>Basis. vf X \<bullet> i - uf X \<bullet> i)"
         apply (rule prod.cong [OF refl])
         by (simp add: \<open>X \<in> \<D>\<close> inner_diff_left prj1_idem)
       finally have prj1_eq: "prj1 (vf X - uf X) ^ DIM('M) = (\<Prod>i\<in>Basis. vf X \<bullet> i - uf X \<bullet> i)" .
       have "uf X \<in> cbox (uf X) (vf X)" "vf X \<in> cbox (uf X) (vf X)"
         using uvz [OF \<open>X \<in> \<D>\<close>] by (force simp: mem_box)+
       moreover have "cbox (uf X) (vf X) \<subseteq> ball (zf X) (1/2)"
         by (meson R12 order_trans subset_ball uvz [OF \<open>X \<in> \<D>\<close>])
       ultimately have "uf X \<in> ball (zf X) (1/2)"  "vf X \<in> ball (zf X) (1/2)"
         by auto
       then have "dist (vf X) (uf X) \<le> 1"
         unfolding mem_ball
         by (metis dist_commute dist_triangle_half_l dual_order.order_iff_strict)
       then have 1: "prj1 (vf X - uf X) \<le> 1"
         unfolding prj1_def dist_norm using Basis_le_norm SOME_Basis order_trans by fastforce
       have 0: "0 \<le> prj1 (vf X - uf X)"
         using \<open>X \<in> \<D>\<close> prj1_def vu_pos by fastforce
       have "(measure lebesgue \<circ> fbx) X \<le> (2 * B * DIM('M)) ^ DIM('N) * content (cbox (uf X) (vf X))"
         apply (simp add: fbx_def content_cbox_cases algebra_simps BM_ge0 \<open>X \<in> \<D>'\<close>)
         apply (simp add: power_mult_distrib \<open>0 < B\<close> prj1_eq [symmetric])
         using MleN 0 1 uvz \<open>X \<in> \<D>\<close>
         apply (fastforce simp add: box_ne_empty power_decreasing)
         done
       also have "\<dots> = (2 * B * DIM('M)) ^ DIM('N) * measure lebesgue X"
         by (subst (3) ufvf[symmetric]) simp
       finally show "(measure lebesgue \<circ> fbx) X \<le> (2 * B * DIM('M)) ^ DIM('N) * measure lebesgue X" .
     qed
     also have "\<dots> = (2 * B * DIM('M)) ^ DIM('N) * sum (measure lebesgue) \<D>'"
       by (simp add: sum_distrib_left)
     also have "\<dots> \<le> e/2"
     proof -
       have div: "\<D>' division_of \<Union>\<D>'"
         apply (auto simp: \<open>finite \<D>'\<close> \<open>{} \<notin> \<D>'\<close> division_of_def)
         using cbox that apply blast
         using pairwise_subset [OF pw \<open>\<D>' \<subseteq> \<D>\<close>] unfolding pairwise_def apply force+
         done
       have le_meaT: "measure lebesgue (\<Union>\<D>') \<le> measure lebesgue T"
       proof (rule measure_mono_fmeasurable)
         show "(\<Union>\<D>') \<in> sets lebesgue"
           using div lmeasurable_division by auto
         have "\<Union>\<D>' \<subseteq> \<Union>\<D>"
           using \<open>\<D>' \<subseteq> \<D>\<close> by blast
         also have "... \<subseteq> T"
         proof (clarify)
           fix x D
           assume "x \<in> D" "D \<in> \<D>"
           show "x \<in> T"
             using Ksub [OF \<open>D \<in> \<D>\<close>]
             by (metis \<open>x \<in> D\<close> Int_iff dist_norm mem_ball norm_minus_commute subsetD RT)
         qed
         finally show "\<Union>\<D>' \<subseteq> T" .
         show "T \<in> lmeasurable"
           using \<open>S \<in> lmeasurable\<close> \<open>S \<subseteq> T\<close> \<open>T - S \<in> lmeasurable\<close> fmeasurable_Diff_D by blast
       qed
       have "sum (measure lebesgue) \<D>' = sum content \<D>'"
         using  \<open>\<D>' \<subseteq> \<D>\<close> cbox by (force intro: sum.cong)
       then have "(2 * B * DIM('M)) ^ DIM('N) * sum (measure lebesgue) \<D>' =
                  (2 * B * real DIM('M)) ^ DIM('N) * measure lebesgue (\<Union>\<D>')"
         using content_division [OF div] by auto
       also have "\<dots> \<le> (2 * B * real DIM('M)) ^ DIM('N) * measure lebesgue T"
         apply (rule mult_left_mono [OF le_meaT])
         using \<open>0 < B\<close>
         apply (simp add: algebra_simps)
         done
       also have "\<dots> \<le> e/2"
         using T \<open>0 < B\<close> by (simp add: field_simps)
       finally show ?thesis .
     qed
     finally show ?thesis .
   qed
   then have e2: "sum (measure lebesgue) \<G> \<le> e/2" if "\<G> \<subseteq> fbx ` \<D>" "finite \<G>" for \<G>
     by (metis finite_subset_image that)
   show "\<exists>W\<in>lmeasurable. f ` S \<subseteq> W \<and> measure lebesgue W < e"
   proof (intro bexI conjI)
     have "\<exists>X\<in>\<D>. f y \<in> fbx X" if "y \<in> S" for y
     proof -
       obtain X where "y \<in> X" "X \<in> \<D>"
         using \<open>S \<subseteq> \<Union>\<D>\<close> \<open>y \<in> S\<close> by auto
       then have y: "y \<in> ball(zf X) (R(zf X))"
         using uvz by fastforce
       have conj_le_eq: "z - b \<le> y \<and> y \<le> z + b \<longleftrightarrow> abs(y - z) \<le> b" for z y b::real
         by auto
       have yin: "y \<in> cbox (uf X) (vf X)" and zin: "(zf X) \<in> cbox (uf X) (vf X)"
         using uvz \<open>X \<in> \<D>\<close> \<open>y \<in> X\<close> by auto
       have "norm (y - zf X) \<le> (\<Sum>i\<in>Basis. \<bar>(y - zf X) \<bullet> i\<bar>)"
         by (rule norm_le_l1)
       also have "\<dots> \<le> real DIM('M) * prj1 (vf X - uf X)"
       proof (rule sum_bounded_above)
         fix j::'M assume j: "j \<in> Basis"
         show "\<bar>(y - zf X) \<bullet> j\<bar> \<le> prj1 (vf X - uf X)"
           using yin zin j
           by (fastforce simp add: mem_box prj1_idem [OF \<open>X \<in> \<D>\<close> j] inner_diff_left)
       qed
       finally have nole: "norm (y - zf X) \<le> DIM('M) * prj1 (vf X - uf X)"
         by simp
       have fle: "\<bar>f y \<bullet> i - f(zf X) \<bullet> i\<bar> \<le> B * DIM('M) * prj1 (vf X - uf X)" if "i \<in> Basis" for i
       proof -
         have "\<bar>f y \<bullet> i - f (zf X) \<bullet> i\<bar> = \<bar>(f y - f (zf X)) \<bullet> i\<bar>"
           by (simp add: algebra_simps)
         also have "\<dots> \<le> norm (f y - f (zf X))"
           by (simp add: Basis_le_norm that)
         also have "\<dots> \<le> B * norm(y - zf X)"
           by (metis uvz RB \<open>X \<in> \<D>\<close> dist_commute dist_norm mem_ball \<open>y \<in> S\<close> y)
         also have "\<dots> \<le> B * real DIM('M) * prj1 (vf X - uf X)"
           using \<open>0 < B\<close> by (simp add: nole)
         finally show ?thesis .
       qed
       show ?thesis
         by (rule_tac x=X in bexI)
            (auto simp: fbx_def prj1_idem mem_box conj_le_eq inner_add inner_diff fle \<open>X \<in> \<D>\<close>)
     qed
     then show "f ` S \<subseteq> (\<Union>D\<in>\<D>. fbx D)" by auto
   next
     have 1: "\<And>D. D \<in> \<D> \<Longrightarrow> fbx D \<in> lmeasurable"
       by (auto simp: fbx_def)
     have 2: "I' \<subseteq> \<D> \<Longrightarrow> finite I' \<Longrightarrow> measure lebesgue (\<Union>D\<in>I'. fbx D) \<le> e/2" for I'
       by (rule order_trans[OF measure_Union_le e2]) (auto simp: fbx_def)
     show "(\<Union>D\<in>\<D>. fbx D) \<in> lmeasurable"
       by (intro fmeasurable_UN_bound[OF \<open>countable \<D>\<close> 1 2])
     have "measure lebesgue (\<Union>D\<in>\<D>. fbx D) \<le> e/2"
       by (intro measure_UN_bound[OF \<open>countable \<D>\<close> 1 2])
     then show "measure lebesgue (\<Union>D\<in>\<D>. fbx D) < e"
       using \<open>0 < e\<close> by linarith
   qed
 qed
 
 proposition negligible_locally_Lipschitz_image:
   fixes f :: "'M::euclidean_space \<Rightarrow> 'N::euclidean_space"
   assumes MleN: "DIM('M) \<le> DIM('N)" "negligible S"
       and lips: "\<And>x. x \<in> S
                       \<Longrightarrow> \<exists>T B. open T \<and> x \<in> T \<and>
                               (\<forall>y \<in> S \<inter> T. norm(f y - f x) \<le> B * norm(y - x))"
     shows "negligible (f ` S)"
 proof -
   let ?S = "\<lambda>n. ({x \<in> S. norm x \<le> n \<and>
                           (\<exists>T. open T \<and> x \<in> T \<and>
                                (\<forall>y\<in>S \<inter> T. norm (f y - f x) \<le> (real n + 1) * norm (y - x)))})"
   have negfn: "f ` ?S n \<in> null_sets lebesgue" for n::nat
     unfolding negligible_iff_null_sets[symmetric]
     apply (rule_tac B = "real n + 1" in locally_Lipschitz_negl_bounded)
     by (auto simp: MleN bounded_iff intro: negligible_subset [OF \<open>negligible S\<close>])
   have "S = (\<Union>n. ?S n)"
   proof (intro set_eqI iffI)
     fix x assume "x \<in> S"
     with lips obtain T B where T: "open T" "x \<in> T"
                            and B: "\<And>y. y \<in> S \<inter> T \<Longrightarrow> norm(f y - f x) \<le> B * norm(y - x)"
       by metis+
     have no: "norm (f y - f x) \<le> (nat \<lceil>max B (norm x)\<rceil> + 1) * norm (y - x)" if "y \<in> S \<inter> T" for y
     proof -
       have "B * norm(y - x) \<le> (nat \<lceil>max B (norm x)\<rceil> + 1) * norm (y - x)"
         by (meson max.cobounded1 mult_right_mono nat_ceiling_le_eq nat_le_iff_add norm_ge_zero order_trans)
       then show ?thesis
         using B order_trans that by blast
     qed
     have "x \<in> ?S (nat (ceiling (max B (norm x))))"
       apply (simp add: \<open>x \<in> S \<close>, rule)
       using real_nat_ceiling_ge max.bounded_iff apply blast
       using T no
       apply (force simp: algebra_simps)
       done
     then show "x \<in> (\<Union>n. ?S n)" by force
   qed auto
   then show ?thesis
     by (rule ssubst) (auto simp: image_Union negligible_iff_null_sets intro: negfn)
 qed
 
 corollary negligible_differentiable_image_negligible:
   fixes f :: "'M::euclidean_space \<Rightarrow> 'N::euclidean_space"
   assumes MleN: "DIM('M) \<le> DIM('N)" "negligible S"
       and diff_f: "f differentiable_on S"
     shows "negligible (f ` S)"
 proof -
   have "\<exists>T B. open T \<and> x \<in> T \<and> (\<forall>y \<in> S \<inter> T. norm(f y - f x) \<le> B * norm(y - x))"
         if "x \<in> S" for x
   proof -
     obtain f' where "linear f'"
       and f': "\<And>e. e>0 \<Longrightarrow>
                   \<exists>d>0. \<forall>y\<in>S. norm (y - x) < d \<longrightarrow>
                               norm (f y - f x - f' (y - x)) \<le> e * norm (y - x)"
       using diff_f \<open>x \<in> S\<close>
       by (auto simp: linear_linear differentiable_on_def differentiable_def has_derivative_within_alt)
     obtain B where "B > 0" and B: "\<forall>x. norm (f' x) \<le> B * norm x"
       using linear_bounded_pos \<open>linear f'\<close> by blast
     obtain d where "d>0"
               and d: "\<And>y. \<lbrakk>y \<in> S; norm (y - x) < d\<rbrakk> \<Longrightarrow>
                           norm (f y - f x - f' (y - x)) \<le> norm (y - x)"
       using f' [of 1] by (force simp:)
     have *: "norm (f y - f x) \<le> (B + 1) * norm (y - x)"
               if "y \<in> S" "norm (y - x) < d" for y
     proof -
       have "norm (f y - f x) -B *  norm (y - x) \<le> norm (f y - f x) - norm (f' (y - x))"
         by (simp add: B)
       also have "\<dots> \<le> norm (f y - f x - f' (y - x))"
         by (rule norm_triangle_ineq2)
       also have "... \<le> norm (y - x)"
         by (rule d [OF that])
       finally show ?thesis
         by (simp add: algebra_simps)
     qed
     show ?thesis
       apply (rule_tac x="ball x d" in exI)
       apply (rule_tac x="B+1" in exI)
       using \<open>d>0\<close>
       apply (auto simp: dist_norm norm_minus_commute intro!: *)
       done
   qed
   with negligible_locally_Lipschitz_image assms show ?thesis by metis
 qed
 
 corollary negligible_differentiable_image_lowdim:
   fixes f :: "'M::euclidean_space \<Rightarrow> 'N::euclidean_space"
   assumes MlessN: "DIM('M) < DIM('N)" and diff_f: "f differentiable_on S"
     shows "negligible (f ` S)"
 proof -
   have "x \<le> DIM('M) \<Longrightarrow> x \<le> DIM('N)" for x
     using MlessN by linarith
   obtain lift :: "'M * real \<Rightarrow> 'N" and drop :: "'N \<Rightarrow> 'M * real" and j :: 'N
     where "linear lift" "linear drop" and dropl [simp]: "\<And>z. drop (lift z) = z"
       and "j \<in> Basis" and j: "\<And>x. lift(x,0) \<bullet> j = 0"
     using lowerdim_embeddings [OF MlessN] by metis
   have "negligible {x. x\<bullet>j = 0}"
     by (metis \<open>j \<in> Basis\<close> negligible_standard_hyperplane)
   then have neg0S: "negligible ((\<lambda>x. lift (x, 0)) ` S)"
     apply (rule negligible_subset)
     by (simp add: image_subsetI j)
   have diff_f': "f \<circ> fst \<circ> drop differentiable_on (\<lambda>x. lift (x, 0)) ` S"
     using diff_f
     apply (clarsimp simp add: differentiable_on_def)
     apply (intro differentiable_chain_within linear_imp_differentiable [OF \<open>linear drop\<close>]
              linear_imp_differentiable [OF fst_linear])
     apply (force simp: image_comp o_def)
     done
   have "f = (f o fst o drop o (\<lambda>x. lift (x, 0)))"
     by (simp add: o_def)
   then show ?thesis
     apply (rule ssubst)
     apply (subst image_comp [symmetric])
     apply (metis negligible_differentiable_image_negligible order_refl diff_f' neg0S)
     done
 qed
 
 subsection\<open>Measurability of countable unions and intersections of various kinds.\<close>
 
 lemma
   assumes S: "\<And>n. S n \<in> lmeasurable"
     and leB: "\<And>n. measure lebesgue (S n) \<le> B"
     and nest: "\<And>n. S n \<subseteq> S(Suc n)"
   shows measurable_nested_Union: "(\<Union>n. S n) \<in> lmeasurable"
   and measure_nested_Union:  "(\<lambda>n. measure lebesgue (S n)) \<longlonglongrightarrow> measure lebesgue (\<Union>n. S n)" (is ?Lim)
 proof -
   have 1: "\<And>n. (indicat_real (S n)) integrable_on UNIV"
     using S measurable_integrable by blast
   have 2: "\<And>n x::'a. indicat_real (S n) x \<le> (indicat_real (S (Suc n)) x)"
     by (simp add: indicator_leI nest rev_subsetD)
   have 3: "\<And>x. (\<lambda>n. indicat_real (S n) x) \<longlonglongrightarrow> (indicat_real (\<Union>(S ` UNIV)) x)"
     apply (rule tendsto_eventually)
     apply (simp add: indicator_def)
     by (metis eventually_sequentiallyI lift_Suc_mono_le nest subsetCE)
   have 4: "bounded (range (\<lambda>n. integral UNIV (indicat_real (S n))))"
     using leB by (auto simp: lmeasure_integral_UNIV [symmetric] S bounded_iff)
   have "(\<Union>n. S n) \<in> lmeasurable \<and> ?Lim"
     apply (simp add: lmeasure_integral_UNIV S cong: conj_cong)
     apply (simp add: measurable_integrable)
     apply (rule monotone_convergence_increasing [OF 1 2 3 4])
     done
   then show "(\<Union>n. S n) \<in> lmeasurable" "?Lim"
     by auto
 qed
 
 lemma
   assumes S: "\<And>n. S n \<in> lmeasurable"
     and djointish: "pairwise (\<lambda>m n. negligible (S m \<inter> S n)) UNIV"
     and leB: "\<And>n. (\<Sum>k\<le>n. measure lebesgue (S k)) \<le> B"
   shows measurable_countable_negligible_Union: "(\<Union>n. S n) \<in> lmeasurable"
   and   measure_countable_negligible_Union:    "(\<lambda>n. (measure lebesgue (S n))) sums measure lebesgue (\<Union>n. S n)" (is ?Sums)
 proof -
   have 1: "\<Union> (S ` {..n}) \<in> lmeasurable" for n
     using S by blast
   have 2: "measure lebesgue (\<Union> (S ` {..n})) \<le> B" for n
   proof -
     have "measure lebesgue (\<Union> (S ` {..n})) \<le> (\<Sum>k\<le>n. measure lebesgue (S k))"
       by (simp add: S fmeasurableD measure_UNION_le)
     with leB show ?thesis
       using order_trans by blast
   qed
   have 3: "\<And>n. \<Union> (S ` {..n}) \<subseteq> \<Union> (S ` {..Suc n})"
     by (simp add: SUP_subset_mono)
   have eqS: "(\<Union>n. S n) = (\<Union>n. \<Union> (S ` {..n}))"
     using atLeastAtMost_iff by blast
   also have "(\<Union>n. \<Union> (S ` {..n})) \<in> lmeasurable"
     by (intro measurable_nested_Union [OF 1 2] 3)
   finally show "(\<Union>n. S n) \<in> lmeasurable" .
   have eqm: "(\<Sum>i\<le>n. measure lebesgue (S i)) = measure lebesgue (\<Union> (S ` {..n}))" for n
     using assms by (simp add: measure_negligible_finite_Union_image pairwise_mono)
   have "(\<lambda>n. (measure lebesgue (S n))) sums measure lebesgue (\<Union>n. \<Union> (S ` {..n}))"
     by (simp add: sums_def' eqm atLeast0AtMost) (intro measure_nested_Union [OF 1 2] 3)
   then show ?Sums
     by (simp add: eqS)
 qed
 
 lemma negligible_countable_Union [intro]:
   assumes "countable \<F>" and meas: "\<And>S. S \<in> \<F> \<Longrightarrow> negligible S"
   shows "negligible (\<Union>\<F>)"
 proof (cases "\<F> = {}")
   case False
   then show ?thesis
     by (metis from_nat_into range_from_nat_into assms negligible_Union_nat)
 qed simp
 
 lemma
   assumes S: "\<And>n. (S n) \<in> lmeasurable"
     and djointish: "pairwise (\<lambda>m n. negligible (S m \<inter> S n)) UNIV"
     and bo: "bounded (\<Union>n. S n)"
   shows measurable_countable_negligible_Union_bounded: "(\<Union>n. S n) \<in> lmeasurable"
   and   measure_countable_negligible_Union_bounded:    "(\<lambda>n. (measure lebesgue (S n))) sums measure lebesgue (\<Union>n. S n)" (is ?Sums)
 proof -
   obtain a b where ab: "(\<Union>n. S n) \<subseteq> cbox a b"
     using bo bounded_subset_cbox_symmetric by metis
   then have B: "(\<Sum>k\<le>n. measure lebesgue (S k)) \<le> measure lebesgue (cbox a b)" for n
   proof -
     have "(\<Sum>k\<le>n. measure lebesgue (S k)) = measure lebesgue (\<Union> (S ` {..n}))"
       using measure_negligible_finite_Union_image [OF _ _ pairwise_subset] djointish
       by (metis S finite_atMost subset_UNIV)
     also have "\<dots> \<le> measure lebesgue (cbox a b)"
       apply (rule measure_mono_fmeasurable)
       using ab S by force+
     finally show ?thesis .
   qed
   show "(\<Union>n. S n) \<in> lmeasurable"
     by (rule measurable_countable_negligible_Union [OF S djointish B])
   show ?Sums
     by (rule measure_countable_negligible_Union [OF S djointish B])
 qed
 
 lemma measure_countable_Union_approachable:
   assumes "countable \<D>" "e > 0" and measD: "\<And>d. d \<in> \<D> \<Longrightarrow> d \<in> lmeasurable"
       and B: "\<And>D'. \<lbrakk>D' \<subseteq> \<D>; finite D'\<rbrakk> \<Longrightarrow> measure lebesgue (\<Union>D') \<le> B"
     obtains D' where "D' \<subseteq> \<D>" "finite D'" "measure lebesgue (\<Union>\<D>) - e < measure lebesgue (\<Union>D')"
 proof (cases "\<D> = {}")
   case True
   then show ?thesis
     by (simp add: \<open>e > 0\<close> that)
 next
   case False
   let ?S = "\<lambda>n. \<Union>k \<le> n. from_nat_into \<D> k"
   have "(\<lambda>n. measure lebesgue (?S n)) \<longlonglongrightarrow> measure lebesgue (\<Union>n. ?S n)"
   proof (rule measure_nested_Union)
     show "?S n \<in> lmeasurable" for n
       by (simp add: False fmeasurable.finite_UN from_nat_into measD)
     show "measure lebesgue (?S n) \<le> B" for n
       by (metis (mono_tags, lifting) B False finite_atMost finite_imageI from_nat_into image_iff subsetI)
     show "?S n \<subseteq> ?S (Suc n)" for n
       by force
   qed
   then obtain N where N: "\<And>n. n \<ge> N \<Longrightarrow> dist (measure lebesgue (?S n)) (measure lebesgue (\<Union>n. ?S n)) < e"
     using metric_LIMSEQ_D \<open>e > 0\<close> by blast
   show ?thesis
   proof
     show "from_nat_into \<D> ` {..N} \<subseteq> \<D>"
       by (auto simp: False from_nat_into)
     have eq: "(\<Union>n. \<Union>k\<le>n. from_nat_into \<D> k) = (\<Union>\<D>)"
       using \<open>countable \<D>\<close> False
       by (auto intro: from_nat_into dest: from_nat_into_surj [OF \<open>countable \<D>\<close>])
     show "measure lebesgue (\<Union>\<D>) - e < measure lebesgue (\<Union> (from_nat_into \<D> ` {..N}))"
       using N [OF order_refl]
       by (auto simp: eq algebra_simps dist_norm)
   qed auto
 qed
 
 
 subsection\<open>Negligibility is a local property\<close>
 
 lemma locally_negligible_alt:
     "negligible S \<longleftrightarrow> (\<forall>x \<in> S. \<exists>U. openin (top_of_set S) U \<and> x \<in> U \<and> negligible U)"
      (is "_ = ?rhs")
 proof
   assume "negligible S"
   then show ?rhs
     using openin_subtopology_self by blast
 next
   assume ?rhs
   then obtain U where ope: "\<And>x. x \<in> S \<Longrightarrow> openin (top_of_set S) (U x)"
     and cov: "\<And>x. x \<in> S \<Longrightarrow> x \<in> U x"
     and neg: "\<And>x. x \<in> S \<Longrightarrow> negligible (U x)"
     by metis
   obtain \<F> where "\<F> \<subseteq> U ` S" "countable \<F>" and eq: "\<Union>\<F> = \<Union>(U ` S)"
     using ope by (force intro: Lindelof_openin [of "U ` S" S])
   then have "negligible (\<Union>\<F>)"
     by (metis imageE neg negligible_countable_Union subset_eq)
   with eq have "negligible (\<Union>(U ` S))"
     by metis
   moreover have "S \<subseteq> \<Union>(U ` S)"
     using cov by blast
   ultimately show "negligible S"
     using negligible_subset by blast
 qed
 
 lemma locally_negligible:
      "locally negligible S \<longleftrightarrow> negligible S"
   unfolding locally_def
   apply safe
    apply (meson negligible_subset openin_subtopology_self locally_negligible_alt)
   by (meson negligible_subset openin_imp_subset order_refl)
 
 
 subsection\<open>Integral bounds\<close>
 
 lemma set_integral_norm_bound:
   fixes f :: "_ \<Rightarrow> 'a :: {banach, second_countable_topology}"
   shows "set_integrable M k f \<Longrightarrow> norm (LINT x:k|M. f x) \<le> LINT x:k|M. norm (f x)"
   using integral_norm_bound[of M "\<lambda>x. indicator k x *\<^sub>R f x"] by (simp add: set_lebesgue_integral_def)
 
 lemma set_integral_finite_UN_AE:
   fixes f :: "_ \<Rightarrow> _ :: {banach, second_countable_topology}"
   assumes "finite I"
     and ae: "\<And>i j. i \<in> I \<Longrightarrow> j \<in> I \<Longrightarrow> AE x in M. (x \<in> A i \<and> x \<in> A j) \<longrightarrow> i = j"
     and [measurable]: "\<And>i. i \<in> I \<Longrightarrow> A i \<in> sets M"
     and f: "\<And>i. i \<in> I \<Longrightarrow> set_integrable M (A i) f"
   shows "LINT x:(\<Union>i\<in>I. A i)|M. f x = (\<Sum>i\<in>I. LINT x:A i|M. f x)"
   using \<open>finite I\<close> order_refl[of I]
 proof (induction I rule: finite_subset_induct')
   case (insert i I')
   have "AE x in M. (\<forall>j\<in>I'. x \<in> A i \<longrightarrow> x \<notin> A j)"
   proof (intro AE_ball_countable[THEN iffD2] ballI)
     fix j assume "j \<in> I'"
     with \<open>I' \<subseteq> I\<close> \<open>i \<notin> I'\<close> have "i \<noteq> j" "j \<in> I"
       by auto
     then show "AE x in M. x \<in> A i \<longrightarrow> x \<notin> A j"
       using ae[of i j] \<open>i \<in> I\<close> by auto
   qed (use \<open>finite I'\<close> in \<open>rule countable_finite\<close>)
   then have "AE x\<in>A i in M. \<forall>xa\<in>I'. x \<notin> A xa "
     by auto
   with insert.hyps insert.IH[symmetric]
   show ?case
     by (auto intro!: set_integral_Un_AE sets.finite_UN f set_integrable_UN)
 qed (simp add: set_lebesgue_integral_def)
 
 lemma set_integrable_norm:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes f: "set_integrable M k f" shows "set_integrable M k (\<lambda>x. norm (f x))"
   using integrable_norm f by (force simp add: set_integrable_def)
 
 lemma absolutely_integrable_bounded_variation:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f absolutely_integrable_on UNIV"
   obtains B where "\<forall>d. d division_of (\<Union>d) \<longrightarrow> sum (\<lambda>k. norm (integral k f)) d \<le> B"
 proof (rule that[of "integral UNIV (\<lambda>x. norm (f x))"]; safe)
   fix d :: "'a set set" assume d: "d division_of \<Union>d"
   have *: "k \<in> d \<Longrightarrow> f absolutely_integrable_on k" for k
     using f[THEN set_integrable_subset, of k] division_ofD(2,4)[OF d, of k] by auto
   note d' = division_ofD[OF d]
   have "(\<Sum>k\<in>d. norm (integral k f)) = (\<Sum>k\<in>d. norm (LINT x:k|lebesgue. f x))"
     by (intro sum.cong refl arg_cong[where f=norm] set_lebesgue_integral_eq_integral(2)[symmetric] *)
   also have "\<dots> \<le> (\<Sum>k\<in>d. LINT x:k|lebesgue. norm (f x))"
     by (intro sum_mono set_integral_norm_bound *)
   also have "\<dots> = (\<Sum>k\<in>d. integral k (\<lambda>x. norm (f x)))"
     by (intro sum.cong refl set_lebesgue_integral_eq_integral(2) set_integrable_norm *)
   also have "\<dots> \<le> integral (\<Union>d) (\<lambda>x. norm (f x))"
     using integrable_on_subdivision[OF d] assms f unfolding absolutely_integrable_on_def
     by (subst integral_combine_division_topdown[OF _ d]) auto
   also have "\<dots> \<le> integral UNIV (\<lambda>x. norm (f x))"
     using integrable_on_subdivision[OF d] assms unfolding absolutely_integrable_on_def
     by (intro integral_subset_le) auto
   finally show "(\<Sum>k\<in>d. norm (integral k f)) \<le> integral UNIV (\<lambda>x. norm (f x))" .
 qed
 
 lemma absdiff_norm_less:
   assumes "sum (\<lambda>x. norm (f x - g x)) s < e"
     and "finite s"
   shows "\<bar>sum (\<lambda>x. norm(f x)) s - sum (\<lambda>x. norm(g x)) s\<bar> < e"
   unfolding sum_subtractf[symmetric]
   apply (rule le_less_trans[OF sum_abs])
   apply (rule le_less_trans[OF _ assms(1)])
   apply (rule sum_mono)
   apply (rule norm_triangle_ineq3)
   done
 
 proposition bounded_variation_absolutely_integrable_interval:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes f: "f integrable_on cbox a b"
     and *: "\<And>d. d division_of (cbox a b) \<Longrightarrow> sum (\<lambda>K. norm(integral K f)) d \<le> B"
   shows "f absolutely_integrable_on cbox a b"
 proof -
   let ?f = "\<lambda>d. \<Sum>K\<in>d. norm (integral K f)" and ?D = "{d. d division_of (cbox a b)}"
   have D_1: "?D \<noteq> {}"
     by (rule elementary_interval[of a b]) auto
   have D_2: "bdd_above (?f`?D)"
     by (metis * mem_Collect_eq bdd_aboveI2)
   note D = D_1 D_2
   let ?S = "SUP x\<in>?D. ?f x"
   have *: "\<exists>\<gamma>. gauge \<gamma> \<and>
              (\<forall>p. p tagged_division_of cbox a b \<and>
                   \<gamma> fine p \<longrightarrow>
                   norm ((\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) - ?S) < e)"
     if e: "e > 0" for e
   proof -
     have "?S - e/2 < ?S" using \<open>e > 0\<close> by simp
     then obtain d where d: "d division_of (cbox a b)" "?S - e/2 < (\<Sum>k\<in>d. norm (integral k f))"
       unfolding less_cSUP_iff[OF D] by auto
     note d' = division_ofD[OF this(1)]
 
     have "\<exists>e>0. \<forall>i\<in>d. x \<notin> i \<longrightarrow> ball x e \<inter> i = {}" for x
     proof -
       have "\<exists>d'>0. \<forall>x'\<in>\<Union>{i \<in> d. x \<notin> i}. d' \<le> dist x x'"
       proof (rule separate_point_closed)
         show "closed (\<Union>{i \<in> d. x \<notin> i})"
           using d' by force
         show "x \<notin> \<Union>{i \<in> d. x \<notin> i}"
           by auto
       qed
       then show ?thesis
         by force
     qed
     then obtain k where k: "\<And>x. 0 < k x" "\<And>i x. \<lbrakk>i \<in> d; x \<notin> i\<rbrakk> \<Longrightarrow> ball x (k x) \<inter> i = {}"
       by metis
     have "e/2 > 0"
       using e by auto
     with Henstock_lemma[OF f]
     obtain \<gamma> where g: "gauge \<gamma>"
       "\<And>p. \<lbrakk>p tagged_partial_division_of cbox a b; \<gamma> fine p\<rbrakk>
                 \<Longrightarrow> (\<Sum>(x,k) \<in> p. norm (content k *\<^sub>R f x - integral k f)) < e/2"
       by (metis (no_types, lifting))
     let ?g = "\<lambda>x. \<gamma> x \<inter> ball x (k x)"
     show ?thesis
     proof (intro exI conjI allI impI)
       show "gauge ?g"
         using g(1) k(1) by (auto simp: gauge_def)
     next
       fix p
       assume "p tagged_division_of (cbox a b) \<and> ?g fine p"
       then have p: "p tagged_division_of cbox a b" "\<gamma> fine p" "(\<lambda>x. ball x (k x)) fine p"
         by (auto simp: fine_Int)
       note p' = tagged_division_ofD[OF p(1)]
       define p' where "p' = {(x,k) | x k. \<exists>i l. x \<in> i \<and> i \<in> d \<and> (x,l) \<in> p \<and> k = i \<inter> l}"
       have gp': "\<gamma> fine p'"
         using p(2) by (auto simp: p'_def fine_def)
       have p'': "p' tagged_division_of (cbox a b)"
       proof (rule tagged_division_ofI)
         show "finite p'"
         proof (rule finite_subset)
           show "p' \<subseteq> (\<lambda>(k, x, l). (x, k \<inter> l)) ` (d \<times> p)"
             by (force simp: p'_def image_iff)
           show "finite ((\<lambda>(k, x, l). (x, k \<inter> l)) ` (d \<times> p))"
             by (simp add: d'(1) p'(1))
         qed
       next
         fix x K
         assume "(x, K) \<in> p'"
         then have "\<exists>i l. x \<in> i \<and> i \<in> d \<and> (x, l) \<in> p \<and> K = i \<inter> l"
           unfolding p'_def by auto
         then obtain i l where il: "x \<in> i" "i \<in> d" "(x, l) \<in> p" "K = i \<inter> l" by blast
         show "x \<in> K" and "K \<subseteq> cbox a b"
           using p'(2-3)[OF il(3)] il by auto
         show "\<exists>a b. K = cbox a b"
           unfolding il using p'(4)[OF il(3)] d'(4)[OF il(2)] by (meson Int_interval)
       next
         fix x1 K1
         assume "(x1, K1) \<in> p'"
         then have "\<exists>i l. x1 \<in> i \<and> i \<in> d \<and> (x1, l) \<in> p \<and> K1 = i \<inter> l"
           unfolding p'_def by auto
         then obtain i1 l1 where il1: "x1 \<in> i1" "i1 \<in> d" "(x1, l1) \<in> p" "K1 = i1 \<inter> l1" by blast
         fix x2 K2
         assume "(x2,K2) \<in> p'"
         then have "\<exists>i l. x2 \<in> i \<and> i \<in> d \<and> (x2, l) \<in> p \<and> K2 = i \<inter> l"
           unfolding p'_def by auto
         then obtain i2 l2 where il2: "x2 \<in> i2" "i2 \<in> d" "(x2, l2) \<in> p" "K2 = i2 \<inter> l2" by blast
         assume "(x1, K1) \<noteq> (x2, K2)"
         then have "interior i1 \<inter> interior i2 = {} \<or> interior l1 \<inter> interior l2 = {}"
           using d'(5)[OF il1(2) il2(2)] p'(5)[OF il1(3) il2(3)]  by (auto simp: il1 il2)
         then show "interior K1 \<inter> interior K2 = {}"
           unfolding il1 il2 by auto
       next
         have *: "\<forall>(x, X) \<in> p'. X \<subseteq> cbox a b"
           unfolding p'_def using d' by blast
         have "y \<in> \<Union>{K. \<exists>x. (x, K) \<in> p'}" if y: "y \<in> cbox a b" for y
         proof -
           obtain x l where xl: "(x, l) \<in> p" "y \<in> l"
             using y unfolding p'(6)[symmetric] by auto
           obtain i where i: "i \<in> d" "y \<in> i"
             using y unfolding d'(6)[symmetric] by auto
           have "x \<in> i"
             using fineD[OF p(3) xl(1)] using k(2) i xl by auto
           then show ?thesis
             unfolding p'_def by (rule_tac X="i \<inter> l" in UnionI) (use i xl in auto)
         qed
         show "\<Union>{K. \<exists>x. (x, K) \<in> p'} = cbox a b"
         proof
           show "\<Union>{k. \<exists>x. (x, k) \<in> p'} \<subseteq> cbox a b"
             using * by auto
         next
           show "cbox a b \<subseteq> \<Union>{k. \<exists>x. (x, k) \<in> p'}"
           proof
             fix y
             assume y: "y \<in> cbox a b"
             obtain x L where xl: "(x, L) \<in> p" "y \<in> L"
               using y unfolding p'(6)[symmetric] by auto
             obtain I where i: "I \<in> d" "y \<in> I"
               using y unfolding d'(6)[symmetric] by auto
             have "x \<in> I"
               using fineD[OF p(3) xl(1)] using k(2) i xl by auto
             then show "y \<in> \<Union>{k. \<exists>x. (x, k) \<in> p'}"
               apply (rule_tac X="I \<inter> L" in UnionI)
               using i xl by (auto simp: p'_def)
           qed
         qed
       qed
 
       then have sum_less_e2: "(\<Sum>(x,K) \<in> p'. norm (content K *\<^sub>R f x - integral K f)) < e/2"
         using g(2) gp' tagged_division_of_def by blast
 
       have "(x, I \<inter> L) \<in> p'" if x: "(x, L) \<in> p" "I \<in> d" and y: "y \<in> I" "y \<in> L"
         for x I L y
       proof -
         have "x \<in> I"
           using fineD[OF p(3) that(1)] k(2)[OF \<open>I \<in> d\<close>] y by auto
         with x have "(\<exists>i l. x \<in> i \<and> i \<in> d \<and> (x, l) \<in> p \<and> I \<inter> L = i \<inter> l)"
           by blast
         then have "(x, I \<inter> L) \<in> p'"
           by (simp add: p'_def)
         with y show ?thesis by auto
       qed
       moreover have "\<exists>y i l. (x, K) = (y, i \<inter> l) \<and> (y, l) \<in> p \<and> i \<in> d \<and> i \<inter> l \<noteq> {}"
         if xK: "(x,K) \<in> p'" for x K
       proof -
         obtain i l where il: "x \<in> i" "i \<in> d" "(x, l) \<in> p" "K = i \<inter> l"
           using xK unfolding p'_def by auto
         then show ?thesis
           using p'(2) by fastforce
       qed
       ultimately have p'alt: "p' = {(x, I \<inter> L) | x I L. (x,L) \<in> p \<and> I \<in> d \<and> I \<inter> L \<noteq> {}}"
         by auto
       have sum_p': "(\<Sum>(x,K) \<in> p'. norm (integral K f)) = (\<Sum>k\<in>snd ` p'. norm (integral k f))"
         apply (subst sum.over_tagged_division_lemma[OF p'',of "\<lambda>k. norm (integral k f)"])
          apply (auto intro: integral_null simp: content_eq_0_interior)
         done
       have snd_p_div: "snd ` p division_of cbox a b"
         by (rule division_of_tagged_division[OF p(1)])
       note snd_p = division_ofD[OF snd_p_div]
       have fin_d_sndp: "finite (d \<times> snd ` p)"
         by (simp add: d'(1) snd_p(1))
 
       have *: "\<And>sni sni' sf sf'. \<lbrakk>\<bar>sf' - sni'\<bar> < e/2; ?S - e/2 < sni; sni' \<le> ?S;
                        sni \<le> sni'; sf' = sf\<rbrakk> \<Longrightarrow> \<bar>sf - ?S\<bar> < e"
         by arith
       show "norm ((\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) - ?S) < e"
         unfolding real_norm_def
       proof (rule *)
         show "\<bar>(\<Sum>(x,K)\<in>p'. norm (content K *\<^sub>R f x)) - (\<Sum>(x,k)\<in>p'. norm (integral k f))\<bar> < e/2"
           using p'' sum_less_e2 unfolding split_def by (force intro!: absdiff_norm_less)
         show "(\<Sum>(x,k) \<in> p'. norm (integral k f)) \<le>?S"
           by (auto simp: sum_p' division_of_tagged_division[OF p''] D intro!: cSUP_upper)
         show "(\<Sum>k\<in>d. norm (integral k f)) \<le> (\<Sum>(x,k) \<in> p'. norm (integral k f))"
         proof -
           have *: "{k \<inter> l | k l. k \<in> d \<and> l \<in> snd ` p} = (\<lambda>(k,l). k \<inter> l) ` (d \<times> snd ` p)"
             by auto
           have "(\<Sum>K\<in>d. norm (integral K f)) \<le> (\<Sum>i\<in>d. \<Sum>l\<in>snd ` p. norm (integral (i \<inter> l) f))"
           proof (rule sum_mono)
             fix K assume k: "K \<in> d"
             from d'(4)[OF this] obtain u v where uv: "K = cbox u v" by metis
             define d' where "d' = {cbox u v \<inter> l |l. l \<in> snd ` p \<and>  cbox u v \<inter> l \<noteq> {}}"
             have uvab: "cbox u v \<subseteq> cbox a b"
               using d(1) k uv by blast
             have "d' division_of cbox u v"
               unfolding d'_def by (rule division_inter_1 [OF snd_p_div uvab])
             moreover then have "norm (\<Sum>i\<in>d'. integral i f) \<le> (\<Sum>k\<in>d'. norm (integral k f))"
               by (simp add: sum_norm_le)
             ultimately have "norm (integral K f) \<le> sum (\<lambda>k. norm (integral k f)) d'"
               apply (subst integral_combine_division_topdown[of _ _ d'])
                 apply (auto simp: uv intro: integrable_on_subcbox[OF assms(1) uvab])
               done
             also have "\<dots> = (\<Sum>I\<in>{K \<inter> L |L. L \<in> snd ` p}. norm (integral I f))"
             proof -
               have *: "norm (integral I f) = 0"
                 if "I \<in> {cbox u v \<inter> l |l. l \<in> snd ` p}"
                   "I \<notin> {cbox u v \<inter> l |l. l \<in> snd ` p \<and> cbox u v \<inter> l \<noteq> {}}" for I
                 using that by auto
               show ?thesis
                 apply (rule sum.mono_neutral_left)
                   apply (simp add: snd_p(1))
                 unfolding d'_def uv using * by auto
             qed
             also have "\<dots> = (\<Sum>l\<in>snd ` p. norm (integral (K \<inter> l) f))"
             proof -
               have *: "norm (integral (K \<inter> l) f) = 0"
                 if "l \<in> snd ` p" "y \<in> snd ` p" "l \<noteq> y" "K \<inter> l = K \<inter> y" for l y
               proof -
                 have "interior (K \<inter> l) \<subseteq> interior (l \<inter> y)"
                   by (metis Int_lower2 interior_mono le_inf_iff that(4))
                 then have "interior (K \<inter> l) = {}"
                   by (simp add: snd_p(5) that)
                 moreover from d'(4)[OF k] snd_p(4)[OF that(1)]
                 obtain u1 v1 u2 v2
                   where uv: "K = cbox u1 u2" "l = cbox v1 v2" by metis
                 ultimately show ?thesis
                   using that integral_null
                   unfolding uv Int_interval content_eq_0_interior
                   by (metis (mono_tags, lifting) norm_eq_zero)
               qed
               show ?thesis
                 unfolding Setcompr_eq_image
                 apply (rule sum.reindex_nontrivial [unfolded o_def])
                  apply (rule finite_imageI)
                  apply (rule p')
                 using * by auto
             qed
             finally show "norm (integral K f) \<le> (\<Sum>l\<in>snd ` p. norm (integral (K \<inter> l) f))" .
           qed
           also have "\<dots> = (\<Sum>(i,l) \<in> d \<times> snd ` p. norm (integral (i\<inter>l) f))"
             by (simp add: sum.cartesian_product)
           also have "\<dots> = (\<Sum>x \<in> d \<times> snd ` p. norm (integral (case_prod (\<inter>) x) f))"
             by (force simp: split_def intro!: sum.cong)
           also have "\<dots> = (\<Sum>k\<in>{i \<inter> l |i l. i \<in> d \<and> l \<in> snd ` p}. norm (integral k f))"
           proof -
             have eq0: " (integral (l1 \<inter> k1) f) = 0"
               if "l1 \<inter> k1 = l2 \<inter> k2" "(l1, k1) \<noteq> (l2, k2)"
                 "l1 \<in> d" "(j1,k1) \<in> p" "l2 \<in> d" "(j2,k2) \<in> p"
               for l1 l2 k1 k2 j1 j2
             proof -
               obtain u1 v1 u2 v2 where uv: "l1 = cbox u1 u2" "k1 = cbox v1 v2"
                 using \<open>(j1, k1) \<in> p\<close> \<open>l1 \<in> d\<close> d'(4) p'(4) by blast
               have "l1 \<noteq> l2 \<or> k1 \<noteq> k2"
                 using that by auto
               then have "interior k1 \<inter> interior k2 = {} \<or> interior l1 \<inter> interior l2 = {}"
                 by (meson d'(5) old.prod.inject p'(5) that(3) that(4) that(5) that(6))
               moreover have "interior (l1 \<inter> k1) = interior (l2 \<inter> k2)"
                 by (simp add: that(1))
               ultimately have "interior(l1 \<inter> k1) = {}"
                 by auto
               then show ?thesis
                 unfolding uv Int_interval content_eq_0_interior[symmetric] by auto
             qed
             show ?thesis
               unfolding *
               apply (rule sum.reindex_nontrivial [OF fin_d_sndp, symmetric, unfolded o_def])
               apply clarsimp
               by (metis eq0 fst_conv snd_conv)
           qed
           also have "\<dots> = (\<Sum>(x,k) \<in> p'. norm (integral k f))"
           proof -
             have 0: "integral (ia \<inter> snd (a, b)) f = 0"
               if "ia \<inter> snd (a, b) \<notin> snd ` p'" "ia \<in> d" "(a, b) \<in> p" for ia a b
             proof -
               have "ia \<inter> b = {}"
                 using that unfolding p'alt image_iff Bex_def not_ex
                 apply (erule_tac x="(a, ia \<inter> b)" in allE)
                 apply auto
                 done
               then show ?thesis by auto
             qed
             have 1: "\<exists>i l. snd (a, b) = i \<inter> l \<and> i \<in> d \<and> l \<in> snd ` p" if "(a, b) \<in> p'" for a b
               using that
               apply (clarsimp simp: p'_def image_iff)
               by (metis (no_types, hide_lams) snd_conv)
             show ?thesis
               unfolding sum_p'
               apply (rule sum.mono_neutral_right)
                 apply (metis * finite_imageI[OF fin_d_sndp])
               using 0 1 by auto
           qed
           finally show ?thesis .
         qed
         show "(\<Sum>(x,k) \<in> p'. norm (content k *\<^sub>R f x)) = (\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x))"
         proof -
           let ?S = "{(x, i \<inter> l) |x i l. (x, l) \<in> p \<and> i \<in> d}"
           have *: "?S = (\<lambda>(xl,i). (fst xl, snd xl \<inter> i)) ` (p \<times> d)"
             by force
           have fin_pd: "finite (p \<times> d)"
             using finite_cartesian_product[OF p'(1) d'(1)] by metis
           have "(\<Sum>(x,k) \<in> p'. norm (content k *\<^sub>R f x)) = (\<Sum>(x,k) \<in> ?S. \<bar>content k\<bar> * norm (f x))"
             unfolding norm_scaleR
             apply (rule sum.mono_neutral_left)
               apply (subst *)
               apply (rule finite_imageI [OF fin_pd])
             unfolding p'alt apply auto
             by fastforce
           also have "\<dots> = (\<Sum>((x,l),i)\<in>p \<times> d. \<bar>content (l \<inter> i)\<bar> * norm (f x))"
           proof -
             have "\<bar>content (l1 \<inter> k1)\<bar> * norm (f x1) = 0"
               if "(x1, l1) \<in> p" "(x2, l2) \<in> p" "k1 \<in> d" "k2 \<in> d"
                 "x1 = x2" "l1 \<inter> k1 = l2 \<inter> k2" "x1 \<noteq> x2 \<or> l1 \<noteq> l2 \<or> k1 \<noteq> k2"
               for x1 l1 k1 x2 l2 k2
             proof -
               obtain u1 v1 u2 v2 where uv: "k1 = cbox u1 u2" "l1 = cbox v1 v2"
                 by (meson \<open>(x1, l1) \<in> p\<close> \<open>k1 \<in> d\<close> d(1) division_ofD(4) p'(4))
               have "l1 \<noteq> l2 \<or> k1 \<noteq> k2"
                 using that by auto
               then have "interior k1 \<inter> interior k2 = {} \<or> interior l1 \<inter> interior l2 = {}"
                 apply (rule disjE)
                 using that p'(5) d'(5) by auto
               moreover have "interior (l1 \<inter> k1) = interior (l2 \<inter> k2)"
                 unfolding that ..
               ultimately have "interior (l1 \<inter> k1) = {}"
                 by auto
               then show "\<bar>content (l1 \<inter> k1)\<bar> * norm (f x1) = 0"
                 unfolding uv Int_interval content_eq_0_interior[symmetric] by auto
             qed
             then show ?thesis
               unfolding *
               apply (subst sum.reindex_nontrivial [OF fin_pd])
               unfolding split_paired_all o_def split_def prod.inject
                apply force+
               done
           qed
           also have "\<dots> = (\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x))"
           proof -
             have sumeq: "(\<Sum>i\<in>d. content (l \<inter> i) * norm (f x)) = content l * norm (f x)"
               if "(x, l) \<in> p" for x l
             proof -
               note xl = p'(2-4)[OF that]
               then obtain u v where uv: "l = cbox u v" by blast
               have "(\<Sum>i\<in>d. \<bar>content (l \<inter> i)\<bar>) = (\<Sum>k\<in>d. content (k \<inter> cbox u v))"
                 by (simp add: Int_commute uv)
               also have "\<dots> = sum content {k \<inter> cbox u v| k. k \<in> d}"
               proof -
                 have eq0: "content (k \<inter> cbox u v) = 0"
                   if "k \<in> d" "y \<in> d" "k \<noteq> y" and eq: "k \<inter> cbox u v = y \<inter> cbox u v" for k y
                 proof -
                   from d'(4)[OF that(1)] d'(4)[OF that(2)]
                   obtain \<alpha> \<beta> where \<alpha>: "k \<inter> cbox u v = cbox \<alpha> \<beta>"
                     by (meson Int_interval)
                   have "{} = interior ((k \<inter> y) \<inter> cbox u v)"
                     by (simp add: d'(5) that)
                   also have "\<dots> = interior (y \<inter> (k \<inter> cbox u v))"
                     by auto
                   also have "\<dots> = interior (k \<inter> cbox u v)"
                     unfolding eq by auto
                   finally show ?thesis
                     unfolding \<alpha> content_eq_0_interior ..
                 qed
                 then show ?thesis
                   unfolding Setcompr_eq_image
                   apply (rule sum.reindex_nontrivial [OF \<open>finite d\<close>, unfolded o_def, symmetric])
                   by auto
               qed
               also have "\<dots> = sum content {cbox u v \<inter> k |k. k \<in> d \<and> cbox u v \<inter> k \<noteq> {}}"
                 apply (rule sum.mono_neutral_right)
                 unfolding Setcompr_eq_image
                   apply (rule finite_imageI [OF \<open>finite d\<close>])
                  apply (fastforce simp: inf.commute)+
                 done
               finally show "(\<Sum>i\<in>d. content (l \<inter> i) * norm (f x)) = content l * norm (f x)"
                 unfolding sum_distrib_right[symmetric] real_scaleR_def
                 apply (subst(asm) additive_content_division[OF division_inter_1[OF d(1)]])
                 using xl(2)[unfolded uv] unfolding uv apply auto
                 done
             qed
             show ?thesis
               by (subst sum_Sigma_product[symmetric]) (auto intro!: sumeq sum.cong p' d')
           qed
           finally show ?thesis .
         qed
       qed (rule d)
     qed
   qed
   then show ?thesis
     using absolutely_integrable_onI [OF f has_integral_integrable] has_integral[of _ ?S]
     by blast
 qed
 
 
 lemma bounded_variation_absolutely_integrable:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "f integrable_on UNIV"
     and "\<forall>d. d division_of (\<Union>d) \<longrightarrow> sum (\<lambda>k. norm (integral k f)) d \<le> B"
   shows "f absolutely_integrable_on UNIV"
 proof (rule absolutely_integrable_onI, fact)
   let ?f = "\<lambda>d. \<Sum>k\<in>d. norm (integral k f)" and ?D = "{d. d division_of  (\<Union>d)}"
   have D_1: "?D \<noteq> {}"
     by (rule elementary_interval) auto
   have D_2: "bdd_above (?f`?D)"
     by (intro bdd_aboveI2[where M=B] assms(2)[rule_format]) simp
   note D = D_1 D_2
   let ?S = "SUP d\<in>?D. ?f d"
   have "\<And>a b. f integrable_on cbox a b"
     using assms(1) integrable_on_subcbox by blast
   then have f_int: "\<And>a b. f absolutely_integrable_on cbox a b"
     apply (rule bounded_variation_absolutely_integrable_interval[where B=B])
     using assms(2) apply blast
     done
   have "((\<lambda>x. norm (f x)) has_integral ?S) UNIV"
     apply (subst has_integral_alt')
     apply safe
   proof goal_cases
     case (1 a b)
     show ?case
       using f_int[of a b] unfolding absolutely_integrable_on_def by auto
   next
     case prems: (2 e)
     have "\<exists>y\<in>sum (\<lambda>k. norm (integral k f)) ` {d. d division_of \<Union>d}. \<not> y \<le> ?S - e"
     proof (rule ccontr)
       assume "\<not> ?thesis"
       then have "?S \<le> ?S - e"
         by (intro cSUP_least[OF D(1)]) auto
       then show False
         using prems by auto
     qed
     then obtain d K where ddiv: "d division_of \<Union>d" and "K = (\<Sum>k\<in>d. norm (integral k f))"
       "Sup (sum (\<lambda>k. norm (integral k f)) ` {d. d division_of \<Union> d}) - e < K"
       by (auto simp add: image_iff not_le)
     then have d: "Sup (sum (\<lambda>k. norm (integral k f)) ` {d. d division_of \<Union> d}) - e
                   < (\<Sum>k\<in>d. norm (integral k f))"
       by auto
     note d'=division_ofD[OF ddiv]
     have "bounded (\<Union>d)"
       by (rule elementary_bounded,fact)
     from this[unfolded bounded_pos] obtain K where
        K: "0 < K" "\<forall>x\<in>\<Union>d. norm x \<le> K" by auto
     show ?case
     proof (intro conjI impI allI exI)
       fix a b :: 'n
       assume ab: "ball 0 (K + 1) \<subseteq> cbox a b"
       have *: "\<And>s s1. \<lbrakk>?S - e < s1; s1 \<le> s; s < ?S + e\<rbrakk> \<Longrightarrow> \<bar>s - ?S\<bar> < e"
         by arith
       show "norm (integral (cbox a b) (\<lambda>x. if x \<in> UNIV then norm (f x) else 0) - ?S) < e"
         unfolding real_norm_def
       proof (rule * [OF d])
         have "(\<Sum>k\<in>d. norm (integral k f)) \<le> sum (\<lambda>k. integral k (\<lambda>x. norm (f x))) d"
         proof (intro sum_mono)
           fix k assume "k \<in> d"
           with d'(4) f_int show "norm (integral k f) \<le> integral k (\<lambda>x. norm (f x))"
             by (force simp: absolutely_integrable_on_def integral_norm_bound_integral)
         qed
         also have "\<dots> = integral (\<Union>d) (\<lambda>x. norm (f x))"
           apply (rule integral_combine_division_bottomup[OF ddiv, symmetric])
           using absolutely_integrable_on_def d'(4) f_int by blast
         also have "\<dots> \<le> integral (cbox a b) (\<lambda>x. if x \<in> UNIV then norm (f x) else 0)"
         proof -
           have "\<Union>d \<subseteq> cbox a b"
             using K(2) ab by fastforce
           then show ?thesis
             using integrable_on_subdivision[OF ddiv] f_int[of a b] unfolding absolutely_integrable_on_def
             by (auto intro!: integral_subset_le)
         qed
         finally show "(\<Sum>k\<in>d. norm (integral k f))
                       \<le> integral (cbox a b) (\<lambda>x. if x \<in> UNIV then norm (f x) else 0)" .
       next
         have "e/2>0"
           using \<open>e > 0\<close> by auto
         moreover
         have f: "f integrable_on cbox a b" "(\<lambda>x. norm (f x)) integrable_on cbox a b"
           using f_int by (auto simp: absolutely_integrable_on_def)
         ultimately obtain d1 where "gauge d1"
            and d1: "\<And>p. \<lbrakk>p tagged_division_of (cbox a b); d1 fine p\<rbrakk> \<Longrightarrow>
             norm ((\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) - integral (cbox a b) (\<lambda>x. norm (f x))) < e/2"
           unfolding has_integral_integral has_integral by meson
         obtain d2 where "gauge d2"
           and d2: "\<And>p. \<lbrakk>p tagged_partial_division_of (cbox a b); d2 fine p\<rbrakk> \<Longrightarrow>
             (\<Sum>(x,k) \<in> p. norm (content k *\<^sub>R f x - integral k f)) < e/2"
           by (blast intro: Henstock_lemma [OF f(1) \<open>e/2>0\<close>])
         obtain p where
           p: "p tagged_division_of (cbox a b)" "d1 fine p" "d2 fine p"
           by (rule fine_division_exists [OF gauge_Int [OF \<open>gauge d1\<close> \<open>gauge d2\<close>], of a b])
             (auto simp add: fine_Int)
         have *: "\<And>sf sf' si di. \<lbrakk>sf' = sf; si \<le> ?S; \<bar>sf - si\<bar> < e/2;
                       \<bar>sf' - di\<bar> < e/2\<rbrakk> \<Longrightarrow> di < ?S + e"
           by arith
         have "integral (cbox a b) (\<lambda>x. norm (f x)) < ?S + e"
         proof (rule *)
           show "\<bar>(\<Sum>(x,k)\<in>p. norm (content k *\<^sub>R f x)) - (\<Sum>(x,k)\<in>p. norm (integral k f))\<bar> < e/2"
             unfolding split_def
             apply (rule absdiff_norm_less)
             using d2[of p] p(1,3) apply (auto simp: tagged_division_of_def split_def)
             done
           show "\<bar>(\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) - integral (cbox a b) (\<lambda>x. norm(f x))\<bar> < e/2"
             using d1[OF p(1,2)] by (simp only: real_norm_def)
           show "(\<Sum>(x,k) \<in> p. content k *\<^sub>R norm (f x)) = (\<Sum>(x,k) \<in> p. norm (content k *\<^sub>R f x))"
             by (auto simp: split_paired_all sum.cong [OF refl])
           show "(\<Sum>(x,k) \<in> p. norm (integral k f)) \<le> ?S"
             using partial_division_of_tagged_division[of p "cbox a b"] p(1)
             apply (subst sum.over_tagged_division_lemma[OF p(1)])
             apply (auto simp: content_eq_0_interior tagged_partial_division_of_def intro!: cSUP_upper2 D)
             done
         qed
         then show "integral (cbox a b) (\<lambda>x. if x \<in> UNIV then norm (f x) else 0) < ?S + e"
           by simp
       qed
     qed (insert K, auto)
   qed
   then show "(\<lambda>x. norm (f x)) integrable_on UNIV"
     by blast
 qed
 
 
 subsection\<open>Outer and inner approximation of measurable sets by well-behaved sets.\<close>
 
 proposition measurable_outer_intervals_bounded:
   assumes "S \<in> lmeasurable" "S \<subseteq> cbox a b" "e > 0"
   obtains \<D>
   where "countable \<D>"
         "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
         "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
         "\<And>u v. cbox u v \<in> \<D> \<Longrightarrow> \<exists>n. \<forall>i \<in> Basis. v \<bullet> i - u \<bullet> i = (b \<bullet> i - a \<bullet> i)/2^n"
         "\<And>K. \<lbrakk>K \<in> \<D>; box a b \<noteq> {}\<rbrakk> \<Longrightarrow> interior K \<noteq> {}"
         "S \<subseteq> \<Union>\<D>" "\<Union>\<D> \<in> lmeasurable" "measure lebesgue (\<Union>\<D>) \<le> measure lebesgue S + e"
 proof (cases "box a b = {}")
   case True
   show ?thesis
   proof (cases "cbox a b = {}")
     case True
     with assms have [simp]: "S = {}"
       by auto
     show ?thesis
     proof
       show "countable {}"
         by simp
     qed (use \<open>e > 0\<close> in auto)
   next
     case False
     show ?thesis
     proof
       show "countable {cbox a b}"
         by simp
       show "\<And>u v. cbox u v \<in> {cbox a b} \<Longrightarrow> \<exists>n. \<forall>i\<in>Basis. v \<bullet> i - u \<bullet> i = (b \<bullet> i - a \<bullet> i)/2 ^ n"
         using False by (force simp: eq_cbox intro: exI [where x=0])
       show "measure lebesgue (\<Union>{cbox a b}) \<le> measure lebesgue S + e"
         using assms by (simp add: sum_content.box_empty_imp [OF True])
     qed (use assms \<open>cbox a b \<noteq> {}\<close> in auto)
   qed
 next
   case False
   let ?\<mu> = "measure lebesgue"
   have "S \<inter> cbox a b \<in> lmeasurable"
     using \<open>S \<in> lmeasurable\<close> by blast
   then have indS_int: "(indicator S has_integral (?\<mu> S)) (cbox a b)"
     by (metis integral_indicator \<open>S \<subseteq> cbox a b\<close> has_integral_integrable_integral inf.orderE integrable_on_indicator)
   with \<open>e > 0\<close> obtain \<gamma> where "gauge \<gamma>" and \<gamma>:
     "\<And>\<D>. \<lbrakk>\<D> tagged_division_of (cbox a b); \<gamma> fine \<D>\<rbrakk> \<Longrightarrow> norm ((\<Sum>(x,K)\<in>\<D>. content(K) *\<^sub>R indicator S x) - ?\<mu> S) < e"
     by (force simp: has_integral)
   have inteq: "integral (cbox a b) (indicat_real S) = integral UNIV (indicator S)"
     using assms by (metis has_integral_iff indS_int lmeasure_integral_UNIV)
   obtain \<D> where \<D>: "countable \<D>"  "\<Union>\<D> \<subseteq> cbox a b"
             and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> interior K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
             and djointish: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
             and covered: "\<And>K. K \<in> \<D> \<Longrightarrow> \<exists>x \<in> S \<inter> K. K \<subseteq> \<gamma> x"
             and close: "\<And>u v. cbox u v \<in> \<D> \<Longrightarrow> \<exists>n. \<forall>i \<in> Basis. v\<bullet>i - u\<bullet>i = (b\<bullet>i - a\<bullet>i)/2^n"
             and covers: "S \<subseteq> \<Union>\<D>"
     using covering_lemma [of S a b \<gamma>] \<open>gauge \<gamma>\<close> \<open>box a b \<noteq> {}\<close> assms by force
   show ?thesis
   proof
     show "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
       by (meson Sup_le_iff \<D>(2) cbox interior_empty)
     have negl_int: "negligible(K \<inter> L)" if "K \<in> \<D>" "L \<in> \<D>" "K \<noteq> L" for K L
     proof -
       have "interior K \<inter> interior L = {}"
         using djointish pairwiseD that by fastforce
       moreover obtain u v x y where "K = cbox u v" "L = cbox x y"
         using cbox \<open>K \<in> \<D>\<close> \<open>L \<in> \<D>\<close> by blast
       ultimately show ?thesis
         by (simp add: Int_interval box_Int_box negligible_interval(1))
     qed
     have fincase: "\<Union>\<F> \<in> lmeasurable \<and> ?\<mu> (\<Union>\<F>) \<le> ?\<mu> S + e" if "finite \<F>" "\<F> \<subseteq> \<D>" for \<F>
     proof -
       obtain t where t: "\<And>K. K \<in> \<F> \<Longrightarrow> t K \<in> S \<inter> K \<and> K \<subseteq> \<gamma>(t K)"
         using covered \<open>\<F> \<subseteq> \<D>\<close> subsetD by metis
       have "\<forall>K \<in> \<F>. \<forall>L \<in> \<F>. K \<noteq> L \<longrightarrow> interior K \<inter> interior L = {}"
         using that djointish by (simp add: pairwise_def) (metis subsetD)
       with cbox that \<D> have \<F>div: "\<F> division_of (\<Union>\<F>)"
         by (fastforce simp: division_of_def dest: cbox)
       then have 1: "\<Union>\<F> \<in> lmeasurable"
         by blast
       have norme: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma> fine p\<rbrakk>
           \<Longrightarrow> norm ((\<Sum>(x,K)\<in>p. content K * indicator S x) - integral (cbox a b) (indicator S)) < e"
         by (auto simp: lmeasure_integral_UNIV assms inteq dest: \<gamma>)
       have "\<forall>x K y L. (x,K) \<in> (\<lambda>K. (t K,K)) ` \<F> \<and> (y,L) \<in> (\<lambda>K. (t K,K)) ` \<F> \<and> (x,K) \<noteq> (y,L) \<longrightarrow>             interior K \<inter> interior L = {}"
         using that djointish  by (clarsimp simp: pairwise_def) (metis subsetD)
       with that \<D> have tagged: "(\<lambda>K. (t K, K)) ` \<F> tagged_partial_division_of cbox a b"
         by (auto simp: tagged_partial_division_of_def dest: t cbox)
       have fine: "\<gamma> fine (\<lambda>K. (t K, K)) ` \<F>"
         using t by (auto simp: fine_def)
       have *: "y \<le> ?\<mu> S \<Longrightarrow> \<bar>x - y\<bar> \<le> e \<Longrightarrow> x \<le> ?\<mu> S + e" for x y
         by arith
       have "?\<mu> (\<Union>\<F>) \<le> ?\<mu> S + e"
       proof (rule *)
         have "(\<Sum>K\<in>\<F>. ?\<mu> (K \<inter> S)) = ?\<mu> (\<Union>C\<in>\<F>. C \<inter> S)"
           apply (rule measure_negligible_finite_Union_image [OF \<open>finite \<F>\<close>, symmetric])
           using \<F>div \<open>S \<in> lmeasurable\<close> apply blast
           unfolding pairwise_def
           by (metis inf.commute inf_sup_aci(3) negligible_Int subsetCE negl_int \<open>\<F> \<subseteq> \<D>\<close>)
         also have "\<dots> = ?\<mu> (\<Union>\<F> \<inter> S)"
           by simp
         also have "\<dots> \<le> ?\<mu> S"
           by (simp add: "1" \<open>S \<in> lmeasurable\<close> fmeasurableD measure_mono_fmeasurable sets.Int)
         finally show "(\<Sum>K\<in>\<F>. ?\<mu> (K \<inter> S)) \<le> ?\<mu> S" .
       next
         have "?\<mu> (\<Union>\<F>) = sum ?\<mu> \<F>"
           by (metis \<F>div content_division)
         also have "\<dots> = (\<Sum>K\<in>\<F>. content K)"
           using \<F>div by (force intro: sum.cong)
         also have "\<dots> = (\<Sum>x\<in>\<F>. content x * indicator S (t x))"
           using t by auto
         finally have eq1: "?\<mu> (\<Union>\<F>) = (\<Sum>x\<in>\<F>. content x * indicator S (t x))" .
         have eq2: "(\<Sum>K\<in>\<F>. ?\<mu> (K \<inter> S)) = (\<Sum>K\<in>\<F>. integral K (indicator S))"
           apply (rule sum.cong [OF refl])
           by (metis integral_indicator \<F>div \<open>S \<in> lmeasurable\<close> division_ofD(4) fmeasurable.Int inf.commute lmeasurable_cbox)
         have "\<bar>\<Sum>(x,K)\<in>(\<lambda>K. (t K, K)) ` \<F>. content K * indicator S x - integral K (indicator S)\<bar> \<le> e"
           using Henstock_lemma_part1 [of "indicator S::'a\<Rightarrow>real", OF _ \<open>e > 0\<close> \<open>gauge \<gamma>\<close> _ tagged fine]
             indS_int norme by auto
         then show "\<bar>?\<mu> (\<Union>\<F>) - (\<Sum>K\<in>\<F>. ?\<mu> (K \<inter> S))\<bar> \<le> e"
           by (simp add: eq1 eq2 comm_monoid_add_class.sum.reindex inj_on_def sum_subtractf)
       qed
       with 1 show ?thesis by blast
     qed
     have "\<Union>\<D> \<in> lmeasurable \<and> ?\<mu> (\<Union>\<D>) \<le> ?\<mu> S + e"
     proof (cases "finite \<D>")
       case True
       with fincase show ?thesis
         by blast
     next
       case False
       let ?T = "from_nat_into \<D>"
       have T: "bij_betw ?T UNIV \<D>"
         by (simp add: False \<D>(1) bij_betw_from_nat_into)
       have TM: "\<And>n. ?T n \<in> lmeasurable"
         by (metis False cbox finite.emptyI from_nat_into lmeasurable_cbox)
       have TN: "\<And>m n. m \<noteq> n \<Longrightarrow> negligible (?T m \<inter> ?T n)"
         by (simp add: False \<D>(1) from_nat_into infinite_imp_nonempty negl_int)
       have TB: "(\<Sum>k\<le>n. ?\<mu> (?T k)) \<le> ?\<mu> S + e" for n
       proof -
         have "(\<Sum>k\<le>n. ?\<mu> (?T k)) = ?\<mu> (\<Union> (?T ` {..n}))"
           by (simp add: pairwise_def TM TN measure_negligible_finite_Union_image)
         also have "?\<mu> (\<Union> (?T ` {..n})) \<le> ?\<mu> S + e"
           using fincase [of "?T ` {..n}"] T by (auto simp: bij_betw_def)
         finally show ?thesis .
       qed
       have "\<Union>\<D> \<in> lmeasurable"
         by (metis lmeasurable_compact T \<D>(2) bij_betw_def cbox compact_cbox countable_Un_Int(1) fmeasurableD fmeasurableI2 rangeI)
       moreover
       have "?\<mu> (\<Union>x. from_nat_into \<D> x) \<le> ?\<mu> S + e"
       proof (rule measure_countable_Union_le [OF TM])
         show "?\<mu> (\<Union>x\<le>n. from_nat_into \<D> x) \<le> ?\<mu> S + e" for n
           by (metis (mono_tags, lifting) False fincase finite.emptyI finite_atMost finite_imageI from_nat_into imageE subsetI)
       qed
       ultimately show ?thesis by (metis T bij_betw_def)
     qed
     then show "\<Union>\<D> \<in> lmeasurable" "measure lebesgue (\<Union>\<D>) \<le> ?\<mu> S + e" by blast+
   qed (use \<D> cbox djointish close covers in auto)
 qed
 
 
 subsection\<open>Transformation of measure by linear maps\<close>
 
+lemma emeasure_lebesgue_ball_conv_unit_ball:
+  fixes c :: "'a :: euclidean_space"
+  assumes "r \<ge> 0"
+  shows "emeasure lebesgue (ball c r) =
+           ennreal (r ^ DIM('a)) * emeasure lebesgue (ball (0 :: 'a) 1)"
+proof (cases "r = 0")
+  case False
+  with assms have r: "r > 0" by auto
+  have "emeasure lebesgue ((\<lambda>x. c + x) ` (\<lambda>x. r *\<^sub>R x) ` ball (0 :: 'a) 1) =
+          r ^ DIM('a) * emeasure lebesgue (ball (0 :: 'a) 1)"
+    unfolding image_image using emeasure_lebesgue_affine[of r c "ball 0 1"] assms
+    by (simp add: add_ac)
+  also have "(\<lambda>x. r *\<^sub>R x) ` ball 0 1 = ball (0 :: 'a) r"
+    using r by (subst ball_scale) auto
+  also have "(\<lambda>x. c + x) ` \<dots> = ball c r"
+    by (subst image_add_ball) (simp_all add: algebra_simps)
+  finally show ?thesis by simp
+qed auto
+
+lemma content_ball_conv_unit_ball:
+  fixes c :: "'a :: euclidean_space"
+  assumes "r \<ge> 0"
+  shows "content (ball c r) = r ^ DIM('a) * content (ball (0 :: 'a) 1)"
+proof -
+  have "ennreal (content (ball c r)) = emeasure lebesgue (ball c r)"
+    using emeasure_lborel_ball_finite[of c r] by (subst emeasure_eq_ennreal_measure) auto
+  also have "\<dots> = ennreal (r ^ DIM('a)) * emeasure lebesgue (ball (0 :: 'a) 1)"
+    using assms by (intro emeasure_lebesgue_ball_conv_unit_ball) auto
+  also have "\<dots> = ennreal (r ^ DIM('a) * content (ball (0::'a) 1))"
+    using emeasure_lborel_ball_finite[of "0::'a" 1] assms
+    by (subst emeasure_eq_ennreal_measure) (auto simp: ennreal_mult')
+  finally show ?thesis 
+    using assms by (subst (asm) ennreal_inj) auto
+qed
+
 lemma measurable_linear_image_interval:
    "linear f \<Longrightarrow> f ` (cbox a b) \<in> lmeasurable"
   by (metis bounded_linear_image linear_linear bounded_cbox closure_bounded_linear_image closure_cbox compact_closure lmeasurable_compact)
 
 proposition measure_linear_sufficient:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'n"
   assumes "linear f" and S: "S \<in> lmeasurable"
     and im: "\<And>a b. measure lebesgue (f ` (cbox a b)) = m * measure lebesgue (cbox a b)"
   shows "f ` S \<in> lmeasurable \<and> m * measure lebesgue S = measure lebesgue (f ` S)"
   using le_less_linear [of 0 m]
 proof
   assume "m < 0"
   then show ?thesis
     using im [of 0 One] by auto
 next
   assume "m \<ge> 0"
   let ?\<mu> = "measure lebesgue"
   show ?thesis
   proof (cases "inj f")
     case False
     then have "?\<mu> (f ` S) = 0"
       using \<open>linear f\<close> negligible_imp_measure0 negligible_linear_singular_image by blast
     then have "m * ?\<mu> (cbox 0 (One)) = 0"
       by (metis False \<open>linear f\<close> cbox_borel content_unit im measure_completion negligible_imp_measure0 negligible_linear_singular_image sets_lborel)
     then show ?thesis
       using \<open>linear f\<close> negligible_linear_singular_image negligible_imp_measure0 False
       by (auto simp: lmeasurable_iff_has_integral negligible_UNIV)
   next
     case True
     then obtain h where "linear h" and hf: "\<And>x. h (f x) = x" and fh: "\<And>x. f (h x) = x"
       using \<open>linear f\<close> linear_injective_isomorphism by blast
     have fBS: "(f ` S) \<in> lmeasurable \<and> m * ?\<mu> S = ?\<mu> (f ` S)"
       if "bounded S" "S \<in> lmeasurable" for S
     proof -
       obtain a b where "S \<subseteq> cbox a b"
         using \<open>bounded S\<close> bounded_subset_cbox_symmetric by metis
       have fUD: "(f ` \<Union>\<D>) \<in> lmeasurable \<and> ?\<mu> (f ` \<Union>\<D>) = (m * ?\<mu> (\<Union>\<D>))"
         if "countable \<D>"
           and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
           and intint: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
         for \<D>
       proof -
         have conv: "\<And>K. K \<in> \<D> \<Longrightarrow> convex K"
           using cbox convex_box(1) by blast
         have neg: "negligible (g ` K \<inter> g ` L)" if "linear g" "K \<in> \<D>" "L \<in> \<D>" "K \<noteq> L"
           for K L and g :: "'n\<Rightarrow>'n"
         proof (cases "inj g")
           case True
           have "negligible (frontier(g ` K \<inter> g ` L) \<union> interior(g ` K \<inter> g ` L))"
           proof (rule negligible_Un)
             show "negligible (frontier (g ` K \<inter> g ` L))"
               by (simp add: negligible_convex_frontier convex_Int conv convex_linear_image that)
           next
             have "\<forall>p N. pairwise p N = (\<forall>Na. (Na::'n set) \<in> N \<longrightarrow> (\<forall>Nb. Nb \<in> N \<and> Na \<noteq> Nb \<longrightarrow> p Na Nb))"
               by (metis pairwise_def)
             then have "interior K \<inter> interior L = {}"
               using intint that(2) that(3) that(4) by presburger
             then show "negligible (interior (g ` K \<inter> g ` L))"
               by (metis True empty_imp_negligible image_Int image_empty interior_Int interior_injective_linear_image that(1))
           qed
           moreover have "g ` K \<inter> g ` L \<subseteq> frontier (g ` K \<inter> g ` L) \<union> interior (g ` K \<inter> g ` L)"
             apply (auto simp: frontier_def)
             using closure_subset contra_subsetD by fastforce+
           ultimately show ?thesis
             by (rule negligible_subset)
         next
           case False
           then show ?thesis
             by (simp add: negligible_Int negligible_linear_singular_image \<open>linear g\<close>)
         qed
         have negf: "negligible ((f ` K) \<inter> (f ` L))"
         and negid: "negligible (K \<inter> L)" if "K \<in> \<D>" "L \<in> \<D>" "K \<noteq> L" for K L
           using neg [OF \<open>linear f\<close>] neg [OF linear_id] that by auto
         show ?thesis
         proof (cases "finite \<D>")
           case True
           then have "?\<mu> (\<Union>x\<in>\<D>. f ` x) = (\<Sum>x\<in>\<D>. ?\<mu> (f ` x))"
             using \<open>linear f\<close> cbox measurable_linear_image_interval negf
             by (blast intro: measure_negligible_finite_Union_image [unfolded pairwise_def])
           also have "\<dots> = (\<Sum>k\<in>\<D>. m * ?\<mu> k)"
             by (metis (no_types, lifting) cbox im sum.cong)
           also have "\<dots> = m * ?\<mu> (\<Union>\<D>)"
             unfolding sum_distrib_left [symmetric]
             by (metis True cbox lmeasurable_cbox measure_negligible_finite_Union [unfolded pairwise_def] negid)
           finally show ?thesis
             by (metis True \<open>linear f\<close> cbox image_Union fmeasurable.finite_UN measurable_linear_image_interval)
         next
           case False
           with \<open>countable \<D>\<close> obtain X :: "nat \<Rightarrow> 'n set" where S: "bij_betw X UNIV \<D>"
             using bij_betw_from_nat_into by blast
           then have eq: "(\<Union>\<D>) = (\<Union>n. X n)" "(f ` \<Union>\<D>) = (\<Union>n. f ` X n)"
             by (auto simp: bij_betw_def)
           have meas: "\<And>K. K \<in> \<D> \<Longrightarrow> K \<in> lmeasurable"
             using cbox by blast
           with S have 1: "\<And>n. X n \<in> lmeasurable"
             by (auto simp: bij_betw_def)
           have 2: "pairwise (\<lambda>m n. negligible (X m \<inter> X n)) UNIV"
             using S unfolding bij_betw_def pairwise_def by (metis injD negid range_eqI)
           have "bounded (\<Union>\<D>)"
             by (meson Sup_least bounded_cbox bounded_subset cbox)
           then have 3: "bounded (\<Union>n. X n)"
             using S unfolding bij_betw_def by blast
           have "(\<Union>n. X n) \<in> lmeasurable"
             by (rule measurable_countable_negligible_Union_bounded [OF 1 2 3])
           with S have f1: "\<And>n. f ` (X n) \<in> lmeasurable"
             unfolding bij_betw_def by (metis assms(1) cbox measurable_linear_image_interval rangeI)
           have f2: "pairwise (\<lambda>m n. negligible (f ` (X m) \<inter> f ` (X n))) UNIV"
             using S unfolding bij_betw_def pairwise_def by (metis injD negf rangeI)
           have "bounded (\<Union>\<D>)"
             by (meson Sup_least bounded_cbox bounded_subset cbox)
           then have f3: "bounded (\<Union>n. f ` X n)"
             using S unfolding bij_betw_def
             by (metis bounded_linear_image linear_linear assms(1) image_Union range_composition)
           have "(\<lambda>n. ?\<mu> (X n)) sums ?\<mu> (\<Union>n. X n)"
             by (rule measure_countable_negligible_Union_bounded [OF 1 2 3])
           have meq: "?\<mu> (\<Union>n. f ` X n) = m * ?\<mu> (\<Union>(X ` UNIV))"
           proof (rule sums_unique2 [OF measure_countable_negligible_Union_bounded [OF f1 f2 f3]])
             have m: "\<And>n. ?\<mu> (f ` X n) = (m * ?\<mu> (X n))"
               using S unfolding bij_betw_def by (metis cbox im rangeI)
             show "(\<lambda>n. ?\<mu> (f ` X n)) sums (m * ?\<mu> (\<Union>(X ` UNIV)))"
               unfolding m
               using measure_countable_negligible_Union_bounded [OF 1 2 3] sums_mult by blast
           qed
           show ?thesis
             using measurable_countable_negligible_Union_bounded [OF f1 f2 f3] meq
             by (auto simp: eq [symmetric])
         qed
       qed
       show ?thesis
         unfolding completion.fmeasurable_measure_inner_outer_le
       proof (intro conjI allI impI)
         fix e :: real
         assume "e > 0"
         have 1: "cbox a b - S \<in> lmeasurable"
           by (simp add: fmeasurable.Diff that)
         have 2: "0 < e / (1 + \<bar>m\<bar>)"
           using \<open>e > 0\<close> by (simp add: field_split_simps abs_add_one_gt_zero)
         obtain \<D>
           where "countable \<D>"
             and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
             and intdisj: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
             and DD: "cbox a b - S \<subseteq> \<Union>\<D>" "\<Union>\<D> \<in> lmeasurable"
             and le: "?\<mu> (\<Union>\<D>) \<le> ?\<mu> (cbox a b - S) + e/(1 + \<bar>m\<bar>)"
           by (rule measurable_outer_intervals_bounded [of "cbox a b - S" a b "e/(1 + \<bar>m\<bar>)"]; use 1 2 pairwise_def in force)
         have meq: "?\<mu> (cbox a b - S) = ?\<mu> (cbox a b) - ?\<mu> S"
           by (simp add: measurable_measure_Diff \<open>S \<subseteq> cbox a b\<close> fmeasurableD that(2))
         show "\<exists>T \<in> lmeasurable. T \<subseteq> f ` S \<and> m * ?\<mu> S - e \<le> ?\<mu> T"
         proof (intro bexI conjI)
           show "f ` (cbox a b) - f ` (\<Union>\<D>) \<subseteq> f ` S"
             using \<open>cbox a b - S \<subseteq> \<Union>\<D>\<close> by force
           have "m * ?\<mu> S - e \<le> m * (?\<mu> S - e / (1 + \<bar>m\<bar>))"
             using \<open>m \<ge> 0\<close> \<open>e > 0\<close> by (simp add: field_simps)
           also have "\<dots> \<le> ?\<mu> (f ` cbox a b) - ?\<mu> (f ` (\<Union>\<D>))"
             using le \<open>m \<ge> 0\<close> \<open>e > 0\<close>
             apply (simp add: im fUD [OF \<open>countable \<D>\<close> cbox intdisj] right_diff_distrib [symmetric])
             apply (rule mult_left_mono; simp add: algebra_simps meq)
             done
           also have "\<dots> = ?\<mu> (f ` cbox a b - f ` \<Union>\<D>)"
             apply (rule measurable_measure_Diff [symmetric])
             apply (simp add: assms(1) measurable_linear_image_interval)
             apply (simp add: \<open>countable \<D>\<close> cbox fUD fmeasurableD intdisj)
              apply (simp add: Sup_le_iff cbox image_mono)
             done
           finally show "m * ?\<mu> S - e \<le> ?\<mu> (f ` cbox a b - f ` \<Union>\<D>)" .
           show "f ` cbox a b - f ` \<Union>\<D> \<in> lmeasurable"
             by (simp add: fUD \<open>countable \<D>\<close> \<open>linear f\<close> cbox fmeasurable.Diff intdisj measurable_linear_image_interval)
         qed
       next
         fix e :: real
         assume "e > 0"
         have em: "0 < e / (1 + \<bar>m\<bar>)"
           using \<open>e > 0\<close> by (simp add: field_split_simps abs_add_one_gt_zero)
         obtain \<D>
           where "countable \<D>"
             and cbox: "\<And>K. K \<in> \<D> \<Longrightarrow> K \<subseteq> cbox a b \<and> K \<noteq> {} \<and> (\<exists>c d. K = cbox c d)"
             and intdisj: "pairwise (\<lambda>A B. interior A \<inter> interior B = {}) \<D>"
             and DD: "S \<subseteq> \<Union>\<D>" "\<Union>\<D> \<in> lmeasurable"
             and le: "?\<mu> (\<Union>\<D>) \<le> ?\<mu> S + e/(1 + \<bar>m\<bar>)"
           by (rule measurable_outer_intervals_bounded [of S a b "e/(1 + \<bar>m\<bar>)"]; use \<open>S \<in> lmeasurable\<close> \<open>S \<subseteq> cbox a b\<close> em in force)
         show "\<exists>U \<in> lmeasurable. f ` S \<subseteq> U \<and> ?\<mu> U \<le> m * ?\<mu> S + e"
         proof (intro bexI conjI)
           show "f ` S \<subseteq> f ` (\<Union>\<D>)"
             by (simp add: DD(1) image_mono)
           have "?\<mu> (f ` \<Union>\<D>) \<le> m * (?\<mu> S + e / (1 + \<bar>m\<bar>))"
             using \<open>m \<ge> 0\<close> le mult_left_mono
             by (auto simp: fUD \<open>countable \<D>\<close> \<open>linear f\<close> cbox fmeasurable.Diff intdisj measurable_linear_image_interval)
           also have "\<dots> \<le> m * ?\<mu> S + e"
             using \<open>m \<ge> 0\<close> \<open>e > 0\<close> by (simp add: fUD [OF \<open>countable \<D>\<close> cbox intdisj] field_simps)
           finally show "?\<mu> (f ` \<Union>\<D>) \<le> m * ?\<mu> S + e" .
           show "f ` \<Union>\<D> \<in> lmeasurable"
             by (simp add: \<open>countable \<D>\<close> cbox fUD intdisj)
         qed
       qed
     qed
     show ?thesis
       unfolding has_measure_limit_iff
     proof (intro allI impI)
       fix e :: real
       assume "e > 0"
       obtain B where "B > 0" and B:
         "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> \<bar>?\<mu> (S \<inter> cbox a b) - ?\<mu> S\<bar> < e / (1 + \<bar>m\<bar>)"
         using has_measure_limit [OF S] \<open>e > 0\<close> by (metis abs_add_one_gt_zero zero_less_divide_iff)
       obtain c d::'n where cd: "ball 0 B \<subseteq> cbox c d"
         by (metis bounded_subset_cbox_symmetric bounded_ball)
       with B have less: "\<bar>?\<mu> (S \<inter> cbox c d) - ?\<mu> S\<bar> < e / (1 + \<bar>m\<bar>)" .
       obtain D where "D > 0" and D: "cbox c d \<subseteq> ball 0 D"
         by (metis bounded_cbox bounded_subset_ballD)
       obtain C where "C > 0" and C: "\<And>x. norm (f x) \<le> C * norm x"
         using linear_bounded_pos \<open>linear f\<close> by blast
       have "f ` S \<inter> cbox a b \<in> lmeasurable \<and>
             \<bar>?\<mu> (f ` S \<inter> cbox a b) - m * ?\<mu> S\<bar> < e"
         if "ball 0 (D*C) \<subseteq> cbox a b" for a b
       proof -
         have "bounded (S \<inter> h ` cbox a b)"
           by (simp add: bounded_linear_image linear_linear \<open>linear h\<close> bounded_Int)
         moreover have Shab: "S \<inter> h ` cbox a b \<in> lmeasurable"
           by (simp add: S \<open>linear h\<close> fmeasurable.Int measurable_linear_image_interval)
         moreover have fim: "f ` (S \<inter> h ` (cbox a b)) = (f ` S) \<inter> cbox a b"
           by (auto simp: hf rev_image_eqI fh)
         ultimately have 1: "(f ` S) \<inter> cbox a b \<in> lmeasurable"
               and 2: "m * ?\<mu> (S \<inter> h ` cbox a b) = ?\<mu> ((f ` S) \<inter> cbox a b)"
           using fBS [of "S \<inter> (h ` (cbox a b))"] by auto
         have *: "\<lbrakk>\<bar>z - m\<bar> < e; z \<le> w; w \<le> m\<rbrakk> \<Longrightarrow> \<bar>w - m\<bar> \<le> e"
           for w z m and e::real by auto
         have meas_adiff: "\<bar>?\<mu> (S \<inter> h ` cbox a b) - ?\<mu> S\<bar> \<le> e / (1 + \<bar>m\<bar>)"
         proof (rule * [OF less])
           show "?\<mu> (S \<inter> cbox c d) \<le> ?\<mu> (S \<inter> h ` cbox a b)"
           proof (rule measure_mono_fmeasurable [OF _ _ Shab])
             have "f ` ball 0 D \<subseteq> ball 0 (C * D)"
               using C \<open>C > 0\<close>
               apply (clarsimp simp: algebra_simps)
               by (meson le_less_trans linordered_comm_semiring_strict_class.comm_mult_strict_left_mono)
             then have "f ` ball 0 D \<subseteq> cbox a b"
               by (metis mult.commute order_trans that)
             have "ball 0 D \<subseteq> h ` cbox a b"
               by (metis \<open>f ` ball 0 D \<subseteq> cbox a b\<close> hf image_subset_iff subsetI)
             then show "S \<inter> cbox c d \<subseteq> S \<inter> h ` cbox a b"
               using D by blast
           next
             show "S \<inter> cbox c d \<in> sets lebesgue"
               using S fmeasurable_cbox by blast
           qed
         next
           show "?\<mu> (S \<inter> h ` cbox a b) \<le> ?\<mu> S"
             by (simp add: S Shab fmeasurableD measure_mono_fmeasurable)
         qed
         have "\<bar>?\<mu> (f ` S \<inter> cbox a b) - m * ?\<mu> S\<bar> \<le> m * e / (1 + \<bar>m\<bar>)"
         proof -
           have mm: "\<bar>m\<bar> = m"
             by (simp add: \<open>0 \<le> m\<close>)
           then have "\<bar>?\<mu> S - ?\<mu> (S \<inter> h ` cbox a b)\<bar> * m \<le> e / (1 + m) * m"
             by (metis (no_types) \<open>0 \<le> m\<close> meas_adiff abs_minus_commute mult_right_mono)
           moreover have "\<forall>r. \<bar>r * m\<bar> = m * \<bar>r\<bar>"
             by (metis \<open>0 \<le> m\<close> abs_mult_pos mult.commute)
           ultimately show ?thesis
             apply (simp add: 2 [symmetric])
             by (metis (no_types) abs_minus_commute mult.commute right_diff_distrib' mm)
         qed
         also have "\<dots> < e"
           using \<open>e > 0\<close> by (cases "m \<ge> 0") (simp_all add: field_simps)
         finally have "\<bar>?\<mu> (f ` S \<inter> cbox a b) - m * ?\<mu> S\<bar> < e" .
         with 1 show ?thesis by auto
       qed
       then show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
                          f ` S \<inter> cbox a b \<in> lmeasurable \<and>
                          \<bar>?\<mu> (f ` S \<inter> cbox a b) - m * ?\<mu> S\<bar> < e"
         using \<open>C>0\<close> \<open>D>0\<close> by (metis mult_zero_left real_mult_less_iff1)
     qed
   qed
 qed
 
 subsection\<open>Lemmas about absolute integrability\<close>
 
 lemma absolutely_integrable_linear:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
     and h :: "'n::euclidean_space \<Rightarrow> 'p::euclidean_space"
   shows "f absolutely_integrable_on s \<Longrightarrow> bounded_linear h \<Longrightarrow> (h \<circ> f) absolutely_integrable_on s"
   using integrable_bounded_linear[of h lebesgue "\<lambda>x. indicator s x *\<^sub>R f x"]
   by (simp add: linear_simps[of h] set_integrable_def)
 
 lemma absolutely_integrable_sum:
   fixes f :: "'a \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "finite T" and "\<And>a. a \<in> T \<Longrightarrow> (f a) absolutely_integrable_on S"
   shows "(\<lambda>x. sum (\<lambda>a. f a x) T) absolutely_integrable_on S"
   using assms by induction auto
 
 lemma absolutely_integrable_integrable_bound:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes le: "\<And>x. x\<in>S \<Longrightarrow> norm (f x) \<le> g x" and f: "f integrable_on S" and g: "g integrable_on S"
   shows "f absolutely_integrable_on S"
     unfolding set_integrable_def
 proof (rule Bochner_Integration.integrable_bound)
   have "g absolutely_integrable_on S"
     unfolding absolutely_integrable_on_def
   proof
     show "(\<lambda>x. norm (g x)) integrable_on S"
       using le norm_ge_zero[of "f _"]
       by (intro integrable_spike_finite[OF _ _ g, of "{}"])
          (auto intro!: abs_of_nonneg intro: order_trans simp del: norm_ge_zero)
   qed fact
   then show "integrable lebesgue (\<lambda>x. indicat_real S x *\<^sub>R g x)"
     by (simp add: set_integrable_def)
   show "(\<lambda>x. indicat_real S x *\<^sub>R f x) \<in> borel_measurable lebesgue"
     using f by (auto intro: has_integral_implies_lebesgue_measurable simp: integrable_on_def)
 qed (use le in \<open>force intro!: always_eventually split: split_indicator\<close>)
 
 corollary absolutely_integrable_on_const [simp]:
   fixes c :: "'a::euclidean_space"
   assumes "S \<in> lmeasurable"
   shows "(\<lambda>x. c) absolutely_integrable_on S"
   by (metis (full_types) assms absolutely_integrable_integrable_bound integrable_on_const order_refl)
 
 lemma absolutely_integrable_continuous:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "continuous_on (cbox a b) f \<Longrightarrow> f absolutely_integrable_on cbox a b"
   using absolutely_integrable_integrable_bound
   by (simp add: absolutely_integrable_on_def continuous_on_norm integrable_continuous)
 
 lemma absolutely_integrable_continuous_real:
   fixes f :: "real \<Rightarrow> 'b::euclidean_space"
   shows "continuous_on {a..b} f \<Longrightarrow> f absolutely_integrable_on {a..b}"
   by (metis absolutely_integrable_continuous box_real(2))
 
 lemma continuous_imp_integrable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "continuous_on (cbox a b) f"
   shows "integrable (lebesgue_on (cbox a b)) f"
 proof -
   have "f absolutely_integrable_on cbox a b"
     by (simp add: absolutely_integrable_continuous assms)
   then show ?thesis
     by (simp add: integrable_restrict_space set_integrable_def)
 qed
 
 lemma continuous_imp_integrable_real:
   fixes f :: "real \<Rightarrow> 'b::euclidean_space"
   assumes "continuous_on {a..b} f"
   shows "integrable (lebesgue_on {a..b}) f"
   by (metis assms continuous_imp_integrable interval_cbox)
 
 
 
 subsection \<open>Componentwise\<close>
 
 proposition absolutely_integrable_componentwise_iff:
   shows "f absolutely_integrable_on A \<longleftrightarrow> (\<forall>b\<in>Basis. (\<lambda>x. f x \<bullet> b) absolutely_integrable_on A)"
 proof -
   have *: "(\<lambda>x. norm (f x)) integrable_on A \<longleftrightarrow> (\<forall>b\<in>Basis. (\<lambda>x. norm (f x \<bullet> b)) integrable_on A)"
           if "f integrable_on A"
   proof -
     have 1: "\<And>i. \<lbrakk>(\<lambda>x. norm (f x)) integrable_on A; i \<in> Basis\<rbrakk>
                  \<Longrightarrow> (\<lambda>x. f x \<bullet> i) absolutely_integrable_on A"
       apply (rule absolutely_integrable_integrable_bound [where g = "\<lambda>x. norm(f x)"])
       using Basis_le_norm integrable_component that apply fastforce+
       done
     have 2: "\<forall>i\<in>Basis. (\<lambda>x. \<bar>f x \<bullet> i\<bar>) integrable_on A \<Longrightarrow> f absolutely_integrable_on A"
       apply (rule absolutely_integrable_integrable_bound [where g = "\<lambda>x. \<Sum>i\<in>Basis. norm (f x \<bullet> i)"])
       using norm_le_l1 that apply (force intro: integrable_sum)+
       done
     show ?thesis
       apply auto
        apply (metis (full_types) absolutely_integrable_on_def set_integrable_abs 1)
       apply (metis (full_types) absolutely_integrable_on_def 2)
       done
   qed
   show ?thesis
     unfolding absolutely_integrable_on_def
     by (simp add:  integrable_componentwise_iff [symmetric] ball_conj_distrib * cong: conj_cong)
 qed
 
 lemma absolutely_integrable_componentwise:
   shows "(\<And>b. b \<in> Basis \<Longrightarrow> (\<lambda>x. f x \<bullet> b) absolutely_integrable_on A) \<Longrightarrow> f absolutely_integrable_on A"
   using absolutely_integrable_componentwise_iff by blast
 
 lemma absolutely_integrable_component:
   "f absolutely_integrable_on A \<Longrightarrow> (\<lambda>x. f x \<bullet> (b :: 'b :: euclidean_space)) absolutely_integrable_on A"
   by (drule absolutely_integrable_linear[OF _ bounded_linear_inner_left[of b]]) (simp add: o_def)
 
 
 lemma absolutely_integrable_scaleR_left:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
     assumes "f absolutely_integrable_on S"
   shows "(\<lambda>x. c *\<^sub>R f x) absolutely_integrable_on S"
 proof -
   have "(\<lambda>x. c *\<^sub>R x) o f absolutely_integrable_on S"
     apply (rule absolutely_integrable_linear [OF assms])
     by (simp add: bounded_linear_scaleR_right)
   then show ?thesis
     using assms by blast
 qed
 
 lemma absolutely_integrable_scaleR_right:
   assumes "f absolutely_integrable_on S"
   shows "(\<lambda>x. f x *\<^sub>R c) absolutely_integrable_on S"
   using assms by blast
 
 lemma absolutely_integrable_norm:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes "f absolutely_integrable_on S"
   shows "(norm o f) absolutely_integrable_on S"
   using assms by (simp add: absolutely_integrable_on_def o_def)
 
 lemma absolutely_integrable_abs:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes "f absolutely_integrable_on S"
   shows "(\<lambda>x. \<Sum>i\<in>Basis. \<bar>f x \<bullet> i\<bar> *\<^sub>R i) absolutely_integrable_on S"
         (is "?g absolutely_integrable_on S")
 proof -
   have eq: "?g =
         (\<lambda>x. \<Sum>i\<in>Basis. ((\<lambda>y. \<Sum>j\<in>Basis. if j = i then y *\<^sub>R j else 0) \<circ>
                (\<lambda>x. norm(\<Sum>j\<in>Basis. if j = i then (x \<bullet> i) *\<^sub>R j else 0)) \<circ> f) x)"
     by (simp add: sum.delta)
   have *: "(\<lambda>y. \<Sum>j\<in>Basis. if j = i then y *\<^sub>R j else 0) \<circ>
            (\<lambda>x. norm (\<Sum>j\<in>Basis. if j = i then (x \<bullet> i) *\<^sub>R j else 0)) \<circ> f
            absolutely_integrable_on S"
         if "i \<in> Basis" for i
   proof -
     have "bounded_linear (\<lambda>y. \<Sum>j\<in>Basis. if j = i then y *\<^sub>R j else 0)"
       by (simp add: linear_linear algebra_simps linearI)
     moreover have "(\<lambda>x. norm (\<Sum>j\<in>Basis. if j = i then (x \<bullet> i) *\<^sub>R j else 0)) \<circ> f
                    absolutely_integrable_on S"
       unfolding o_def
       apply (rule absolutely_integrable_norm [unfolded o_def])
       using assms \<open>i \<in> Basis\<close>
       apply (auto simp: algebra_simps dest: absolutely_integrable_component[where b=i])
       done
     ultimately show ?thesis
       by (subst comp_assoc) (blast intro: absolutely_integrable_linear)
   qed
   show ?thesis
     apply (rule ssubst [OF eq])
     apply (rule absolutely_integrable_sum)
      apply (force simp: intro!: *)+
     done
 qed
 
 lemma abs_absolutely_integrableI_1:
   fixes f :: "'a :: euclidean_space \<Rightarrow> real"
   assumes f: "f integrable_on A" and "(\<lambda>x. \<bar>f x\<bar>) integrable_on A"
   shows "f absolutely_integrable_on A"
   by (rule absolutely_integrable_integrable_bound [OF _ assms]) auto
 
 
 lemma abs_absolutely_integrableI:
   assumes f: "f integrable_on S" and fcomp: "(\<lambda>x. \<Sum>i\<in>Basis. \<bar>f x \<bullet> i\<bar> *\<^sub>R i) integrable_on S"
   shows "f absolutely_integrable_on S"
 proof -
   have "(\<lambda>x. (f x \<bullet> i) *\<^sub>R i) absolutely_integrable_on S" if "i \<in> Basis" for i
   proof -
     have "(\<lambda>x. \<bar>f x \<bullet> i\<bar>) integrable_on S"
       using assms integrable_component [OF fcomp, where y=i] that by simp
     then have "(\<lambda>x. f x \<bullet> i) absolutely_integrable_on S"
       using abs_absolutely_integrableI_1 f integrable_component by blast
     then show ?thesis
       by (rule absolutely_integrable_scaleR_right)
   qed
   then have "(\<lambda>x. \<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i) absolutely_integrable_on S"
     by (simp add: absolutely_integrable_sum)
   then show ?thesis
     by (simp add: euclidean_representation)
 qed
 
 
 lemma absolutely_integrable_abs_iff:
    "f absolutely_integrable_on S \<longleftrightarrow>
     f integrable_on S \<and> (\<lambda>x. \<Sum>i\<in>Basis. \<bar>f x \<bullet> i\<bar> *\<^sub>R i) integrable_on S"
     (is "?lhs = ?rhs")
 proof
   assume ?lhs then show ?rhs
     using absolutely_integrable_abs absolutely_integrable_on_def by blast
 next
   assume ?rhs
   moreover
   have "(\<lambda>x. if x \<in> S then \<Sum>i\<in>Basis. \<bar>f x \<bullet> i\<bar> *\<^sub>R i else 0) = (\<lambda>x. \<Sum>i\<in>Basis. \<bar>(if x \<in> S then f x else 0) \<bullet> i\<bar> *\<^sub>R i)"
     by force
   ultimately show ?lhs
     by (simp only: absolutely_integrable_restrict_UNIV [of S, symmetric] integrable_restrict_UNIV [of S, symmetric] abs_absolutely_integrableI)
 qed
 
 lemma absolutely_integrable_max:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "f absolutely_integrable_on S" "g absolutely_integrable_on S"
    shows "(\<lambda>x. \<Sum>i\<in>Basis. max (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i)
             absolutely_integrable_on S"
 proof -
   have "(\<lambda>x. \<Sum>i\<in>Basis. max (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) =
         (\<lambda>x. (1/2) *\<^sub>R (f x + g x + (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i)))"
   proof (rule ext)
     fix x
     have "(\<Sum>i\<in>Basis. max (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) = (\<Sum>i\<in>Basis. ((f x \<bullet> i + g x \<bullet> i + \<bar>f x \<bullet> i - g x \<bullet> i\<bar>) / 2) *\<^sub>R i)"
       by (force intro: sum.cong)
     also have "... = (1 / 2) *\<^sub>R (\<Sum>i\<in>Basis. (f x \<bullet> i + g x \<bullet> i + \<bar>f x \<bullet> i - g x \<bullet> i\<bar>) *\<^sub>R i)"
       by (simp add: scaleR_right.sum)
     also have "... = (1 / 2) *\<^sub>R (f x + g x + (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i))"
       by (simp add: sum.distrib algebra_simps euclidean_representation)
     finally
     show "(\<Sum>i\<in>Basis. max (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) =
          (1 / 2) *\<^sub>R (f x + g x + (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i))" .
   qed
   moreover have "(\<lambda>x. (1 / 2) *\<^sub>R (f x + g x + (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i)))
                  absolutely_integrable_on S"
     apply (intro set_integral_add absolutely_integrable_scaleR_left assms)
     using absolutely_integrable_abs [OF set_integral_diff(1) [OF assms]]
     apply (simp add: algebra_simps)
     done
   ultimately show ?thesis by metis
 qed
 
 corollary absolutely_integrable_max_1:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "f absolutely_integrable_on S" "g absolutely_integrable_on S"
    shows "(\<lambda>x. max (f x) (g x)) absolutely_integrable_on S"
   using absolutely_integrable_max [OF assms] by simp
 
 lemma absolutely_integrable_min:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "f absolutely_integrable_on S" "g absolutely_integrable_on S"
    shows "(\<lambda>x. \<Sum>i\<in>Basis. min (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i)
             absolutely_integrable_on S"
 proof -
   have "(\<lambda>x. \<Sum>i\<in>Basis. min (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) =
         (\<lambda>x. (1/2) *\<^sub>R (f x + g x - (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i)))"
   proof (rule ext)
     fix x
     have "(\<Sum>i\<in>Basis. min (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) = (\<Sum>i\<in>Basis. ((f x \<bullet> i + g x \<bullet> i - \<bar>f x \<bullet> i - g x \<bullet> i\<bar>) / 2) *\<^sub>R i)"
       by (force intro: sum.cong)
     also have "... = (1 / 2) *\<^sub>R (\<Sum>i\<in>Basis. (f x \<bullet> i + g x \<bullet> i - \<bar>f x \<bullet> i - g x \<bullet> i\<bar>) *\<^sub>R i)"
       by (simp add: scaleR_right.sum)
     also have "... = (1 / 2) *\<^sub>R (f x + g x - (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i))"
       by (simp add: sum.distrib sum_subtractf algebra_simps euclidean_representation)
     finally
     show "(\<Sum>i\<in>Basis. min (f x \<bullet> i) (g x \<bullet> i) *\<^sub>R i) =
          (1 / 2) *\<^sub>R (f x + g x - (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i))" .
   qed
   moreover have "(\<lambda>x. (1 / 2) *\<^sub>R (f x + g x - (\<Sum>i\<in>Basis. \<bar>f x \<bullet> i - g x \<bullet> i\<bar> *\<^sub>R i)))
                  absolutely_integrable_on S"
     apply (intro set_integral_add set_integral_diff absolutely_integrable_scaleR_left assms)
     using absolutely_integrable_abs [OF set_integral_diff(1) [OF assms]]
     apply (simp add: algebra_simps)
     done
   ultimately show ?thesis by metis
 qed
 
 corollary absolutely_integrable_min_1:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "f absolutely_integrable_on S" "g absolutely_integrable_on S"
    shows "(\<lambda>x. min (f x) (g x)) absolutely_integrable_on S"
   using absolutely_integrable_min [OF assms] by simp
 
 lemma nonnegative_absolutely_integrable:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes "f integrable_on A" and comp: "\<And>x b. \<lbrakk>x \<in> A; b \<in> Basis\<rbrakk> \<Longrightarrow> 0 \<le> f x \<bullet> b"
   shows "f absolutely_integrable_on A"
 proof -
   have "(\<lambda>x. (f x \<bullet> i) *\<^sub>R i) absolutely_integrable_on A" if "i \<in> Basis" for i
   proof -
     have "(\<lambda>x. f x \<bullet> i) integrable_on A"
       by (simp add: assms(1) integrable_component)
     then have "(\<lambda>x. f x \<bullet> i) absolutely_integrable_on A"
       by (metis that comp nonnegative_absolutely_integrable_1)
     then show ?thesis
       by (rule absolutely_integrable_scaleR_right)
   qed
   then have "(\<lambda>x. \<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i) absolutely_integrable_on A"
     by (simp add: absolutely_integrable_sum)
   then show ?thesis
     by (simp add: euclidean_representation)
 qed
 
 lemma absolutely_integrable_component_ubound:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes f: "f integrable_on A" and g: "g absolutely_integrable_on A"
       and comp: "\<And>x b. \<lbrakk>x \<in> A; b \<in> Basis\<rbrakk> \<Longrightarrow> f x \<bullet> b \<le> g x \<bullet> b"
   shows "f absolutely_integrable_on A"
 proof -
   have "(\<lambda>x. g x - (g x - f x)) absolutely_integrable_on A"
     apply (rule set_integral_diff [OF g nonnegative_absolutely_integrable])
     using Henstock_Kurzweil_Integration.integrable_diff absolutely_integrable_on_def f g apply blast
     by (simp add: comp inner_diff_left)
   then show ?thesis
     by simp
 qed
 
 lemma absolutely_integrable_component_lbound:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes f: "f absolutely_integrable_on A" and g: "g integrable_on A"
       and comp: "\<And>x b. \<lbrakk>x \<in> A; b \<in> Basis\<rbrakk> \<Longrightarrow> f x \<bullet> b \<le> g x \<bullet> b"
   shows "g absolutely_integrable_on A"
 proof -
   have "(\<lambda>x. f x + (g x - f x)) absolutely_integrable_on A"
     apply (rule set_integral_add [OF f nonnegative_absolutely_integrable])
     using Henstock_Kurzweil_Integration.integrable_diff absolutely_integrable_on_def f g apply blast
     by (simp add: comp inner_diff_left)
   then show ?thesis
     by simp
 qed
 
 lemma integrable_on_1_iff:
   fixes f :: "'a::euclidean_space \<Rightarrow> real^1"
   shows "f integrable_on S \<longleftrightarrow> (\<lambda>x. f x $ 1) integrable_on S"
   by (auto simp: integrable_componentwise_iff [of f] Basis_vec_def cart_eq_inner_axis)
 
 lemma integral_on_1_eq:
   fixes f :: "'a::euclidean_space \<Rightarrow> real^1"
   shows "integral S f = vec (integral S (\<lambda>x. f x $ 1))"
 by (cases "f integrable_on S") (simp_all add: integrable_on_1_iff vec_eq_iff not_integrable_integral)
 
 lemma absolutely_integrable_on_1_iff:
   fixes f :: "'a::euclidean_space \<Rightarrow> real^1"
   shows "f absolutely_integrable_on S \<longleftrightarrow> (\<lambda>x. f x $ 1) absolutely_integrable_on S"
   unfolding absolutely_integrable_on_def
   by (auto simp: integrable_on_1_iff norm_real)
 
 lemma absolutely_integrable_absolutely_integrable_lbound:
   fixes f :: "'m::euclidean_space \<Rightarrow> real"
   assumes f: "f integrable_on S" and g: "g absolutely_integrable_on S"
     and *: "\<And>x. x \<in> S \<Longrightarrow> g x \<le> f x"
   shows "f absolutely_integrable_on S"
   by (rule absolutely_integrable_component_lbound [OF g f]) (simp add: *)
 
 lemma absolutely_integrable_absolutely_integrable_ubound:
   fixes f :: "'m::euclidean_space \<Rightarrow> real"
   assumes fg: "f integrable_on S" "g absolutely_integrable_on S"
     and *: "\<And>x. x \<in> S \<Longrightarrow> f x \<le> g x"
   shows "f absolutely_integrable_on S"
   by (rule absolutely_integrable_component_ubound [OF fg]) (simp add: *)
 
 lemma has_integral_vec1_I_cbox:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral y) (cbox a b)"
   shows "((f \<circ> vec) has_integral y) {a$1..b$1}"
 proof -
   have "((\<lambda>x. f(vec x)) has_integral (1 / 1) *\<^sub>R y) ((\<lambda>x. x $ 1) ` cbox a b)"
   proof (rule has_integral_twiddle)
     show "\<exists>w z::real^1. vec ` cbox u v = cbox w z"
          "content (vec ` cbox u v :: (real^1) set) = 1 * content (cbox u v)" for u v
       unfolding vec_cbox_1_eq
       by (auto simp: content_cbox_if_cart interval_eq_empty_cart)
     show "\<exists>w z. (\<lambda>x. x $ 1) ` cbox u v = cbox w z" for u v :: "real^1"
       using vec_nth_cbox_1_eq by blast
   qed (auto simp: continuous_vec assms)
   then show ?thesis
     by (simp add: o_def)
 qed
 
 lemma has_integral_vec1_I:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral y) S"
   shows "(f \<circ> vec has_integral y) ((\<lambda>x. x $ 1) ` S)"
 proof -
   have *: "\<exists>z. ((\<lambda>x. if x \<in> (\<lambda>x. x $ 1) ` S then (f \<circ> vec) x else 0) has_integral z) {a..b} \<and> norm (z - y) < e"
     if int: "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow>
                     (\<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b) \<and> norm (z - y) < e)"
       and B: "ball 0 B \<subseteq> {a..b}" for e B a b
   proof -
     have [simp]: "(\<exists>y\<in>S. x = y $ 1) \<longleftrightarrow> vec x \<in> S" for x
       by force
     have B': "ball (0::real^1) B \<subseteq> cbox (vec a) (vec b)"
       using B by (simp add: Basis_vec_def cart_eq_inner_axis [symmetric] mem_box norm_real subset_iff)
     show ?thesis
       using int [OF B'] by (auto simp: image_iff o_def cong: if_cong dest!: has_integral_vec1_I_cbox)
   qed
   show ?thesis
     using assms
     apply (subst has_integral_alt)
     apply (subst (asm) has_integral_alt)
     apply (simp add: has_integral_vec1_I_cbox split: if_split_asm)
     apply (metis vector_one_nth)
     apply (erule all_forward imp_forward asm_rl ex_forward conj_forward)+
     apply (blast intro!: *)
     done
 qed
 
 lemma has_integral_vec1_nth_cbox:
   fixes f :: "real \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral y) {a..b}"
   shows "((\<lambda>x::real^1. f(x$1)) has_integral y) (cbox (vec a) (vec b))"
 proof -
   have "((\<lambda>x::real^1. f(x$1)) has_integral (1 / 1) *\<^sub>R y) (vec ` cbox a b)"
   proof (rule has_integral_twiddle)
     show "\<exists>w z::real. (\<lambda>x. x $ 1) ` cbox u v = cbox w z"
          "content ((\<lambda>x. x $ 1) ` cbox u v) = 1 * content (cbox u v)" for u v::"real^1"
       unfolding vec_cbox_1_eq by (auto simp: content_cbox_if_cart interval_eq_empty_cart)
     show "\<exists>w z::real^1. vec ` cbox u v = cbox w z" for u v :: "real"
       using vec_cbox_1_eq by auto
   qed (auto simp: continuous_vec assms)
   then show ?thesis
     using vec_cbox_1_eq by auto
 qed
 
 lemma has_integral_vec1_D_cbox:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   assumes "((f \<circ> vec) has_integral y) {a$1..b$1}"
   shows "(f has_integral y) (cbox a b)"
   by (metis (mono_tags, lifting) assms comp_apply has_integral_eq has_integral_vec1_nth_cbox vector_one_nth)
 
 lemma has_integral_vec1_D:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   assumes "((f \<circ> vec) has_integral y) ((\<lambda>x. x $ 1) ` S)"
   shows "(f has_integral y) S"
 proof -
   have *: "\<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b) \<and> norm (z - y) < e"
     if int: "\<And>a b. ball 0 B \<subseteq> {a..b} \<Longrightarrow>
                              (\<exists>z. ((\<lambda>x. if x \<in> (\<lambda>x. x $ 1) ` S then (f \<circ> vec) x else 0) has_integral z) {a..b} \<and> norm (z - y) < e)"
       and B: "ball 0 B \<subseteq> cbox a b" for e B and a b::"real^1"
   proof -
     have B': "ball 0 B \<subseteq> {a$1..b$1}"
       using B
       apply (simp add: subset_iff Basis_vec_def cart_eq_inner_axis [symmetric] mem_box)
       apply (metis (full_types) norm_real vec_component)
       done
     have eq: "(\<lambda>x. if vec x \<in> S then f (vec x) else 0) = (\<lambda>x. if x \<in> S then f x else 0) \<circ> vec"
       by force
     have [simp]: "(\<exists>y\<in>S. x = y $ 1) \<longleftrightarrow> vec x \<in> S" for x
       by force
     show ?thesis
       using int [OF B'] by (auto simp: image_iff eq cong: if_cong dest!: has_integral_vec1_D_cbox)
 qed
   show ?thesis
     using assms
     apply (subst has_integral_alt)
     apply (subst (asm) has_integral_alt)
     apply (simp add: has_integral_vec1_D_cbox eq_cbox split: if_split_asm, blast)
     apply (intro conjI impI)
      apply (metis vector_one_nth)
     apply (erule thin_rl)
     apply (erule all_forward imp_forward asm_rl ex_forward conj_forward)+
     using * apply blast
     done
 qed
 
 
 lemma integral_vec1_eq:
   fixes f :: "real^1 \<Rightarrow> 'a::real_normed_vector"
   shows "integral S f = integral ((\<lambda>x. x $ 1) ` S) (f \<circ> vec)"
   using has_integral_vec1_I [of f] has_integral_vec1_D [of f]
   by (metis has_integral_iff not_integrable_integral)
 
 lemma absolutely_integrable_drop:
   fixes f :: "real^1 \<Rightarrow> 'b::euclidean_space"
   shows "f absolutely_integrable_on S \<longleftrightarrow> (f \<circ> vec) absolutely_integrable_on (\<lambda>x. x $ 1) ` S"
   unfolding absolutely_integrable_on_def integrable_on_def
 proof safe
   fix y r
   assume "(f has_integral y) S" "((\<lambda>x. norm (f x)) has_integral r) S"
   then show "\<exists>y. (f \<circ> vec has_integral y) ((\<lambda>x. x $ 1) ` S)"
             "\<exists>y. ((\<lambda>x. norm ((f \<circ> vec) x)) has_integral y) ((\<lambda>x. x $ 1) ` S)"
     by (force simp: o_def dest!: has_integral_vec1_I)+
 next
   fix y :: "'b" and r :: "real"
   assume "(f \<circ> vec has_integral y) ((\<lambda>x. x $ 1) ` S)"
          "((\<lambda>x. norm ((f \<circ> vec) x)) has_integral r) ((\<lambda>x. x $ 1) ` S)"
   then show "\<exists>y. (f has_integral y) S"  "\<exists>y. ((\<lambda>x. norm (f x)) has_integral y) S"
     by (force simp: o_def intro: has_integral_vec1_D)+
 qed
 
 subsection \<open>Dominated convergence\<close>
 
 lemma dominated_convergence:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes f: "\<And>k. (f k) integrable_on S" and h: "h integrable_on S"
     and le: "\<And>k x. x \<in> S \<Longrightarrow> norm (f k x) \<le> h x"
     and conv: "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
   shows "g integrable_on S" "(\<lambda>k. integral S (f k)) \<longlonglongrightarrow> integral S g"
 proof -
   have 3: "h absolutely_integrable_on S"
     unfolding absolutely_integrable_on_def
   proof
     show "(\<lambda>x. norm (h x)) integrable_on S"
     proof (intro integrable_spike_finite[OF _ _ h, of "{}"] ballI)
       fix x assume "x \<in> S - {}" then show "norm (h x) = h x"
         by (metis Diff_empty abs_of_nonneg bot_set_def le norm_ge_zero order_trans real_norm_def)
     qed auto
   qed fact
   have 2: "set_borel_measurable lebesgue S (f k)" for k
     unfolding set_borel_measurable_def
     using f by (auto intro: has_integral_implies_lebesgue_measurable simp: integrable_on_def)
   then have 1: "set_borel_measurable lebesgue S g"
     unfolding set_borel_measurable_def
     by (rule borel_measurable_LIMSEQ_metric) (use conv in \<open>auto split: split_indicator\<close>)
   have 4: "AE x in lebesgue. (\<lambda>i. indicator S x *\<^sub>R f i x) \<longlonglongrightarrow> indicator S x *\<^sub>R g x"
     "AE x in lebesgue. norm (indicator S x *\<^sub>R f k x) \<le> indicator S x *\<^sub>R h x" for k
     using conv le by (auto intro!: always_eventually split: split_indicator)
   have g: "g absolutely_integrable_on S"
     using 1 2 3 4 unfolding set_borel_measurable_def set_integrable_def
     by (rule integrable_dominated_convergence)
   then show "g integrable_on S"
     by (auto simp: absolutely_integrable_on_def)
   have "(\<lambda>k. (LINT x:S|lebesgue. f k x)) \<longlonglongrightarrow> (LINT x:S|lebesgue. g x)"
     unfolding set_borel_measurable_def set_lebesgue_integral_def
     using 1 2 3 4 unfolding set_borel_measurable_def set_lebesgue_integral_def set_integrable_def
     by (rule integral_dominated_convergence)
   then show "(\<lambda>k. integral S (f k)) \<longlonglongrightarrow> integral S g"
     using g absolutely_integrable_integrable_bound[OF le f h]
     by (subst (asm) (1 2) set_lebesgue_integral_eq_integral) auto
 qed
 
 lemma has_integral_dominated_convergence:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "\<And>k. (f k has_integral y k) S" "h integrable_on S"
     "\<And>k. \<forall>x\<in>S. norm (f k x) \<le> h x" "\<forall>x\<in>S. (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
     and x: "y \<longlonglongrightarrow> x"
   shows "(g has_integral x) S"
 proof -
   have int_f: "\<And>k. (f k) integrable_on S"
     using assms by (auto simp: integrable_on_def)
   have "(g has_integral (integral S g)) S"
     by (metis assms(2-4) dominated_convergence(1) has_integral_integral int_f)
   moreover have "integral S g = x"
   proof (rule LIMSEQ_unique)
     show "(\<lambda>i. integral S (f i)) \<longlonglongrightarrow> x"
       using integral_unique[OF assms(1)] x by simp
     show "(\<lambda>i. integral S (f i)) \<longlonglongrightarrow> integral S g"
       by (metis assms(2) assms(3) assms(4) dominated_convergence(2) int_f)
   qed
   ultimately show ?thesis
     by simp
 qed
 
 lemma dominated_convergence_integrable_1:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real"
   assumes f: "\<And>k. f k absolutely_integrable_on S"
     and h: "h integrable_on S"
     and normg: "\<And>x. x \<in> S \<Longrightarrow> norm(g x) \<le> (h x)"
     and lim: "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
  shows "g integrable_on S"
 proof -
   have habs: "h absolutely_integrable_on S"
     using h normg nonnegative_absolutely_integrable_1 norm_ge_zero order_trans by blast
   let ?f = "\<lambda>n x. (min (max (- h x) (f n x)) (h x))"
   have h0: "h x \<ge> 0" if "x \<in> S" for x
     using normg that by force
   have leh: "norm (?f k x) \<le> h x" if "x \<in> S" for k x
     using h0 that by force
   have limf: "(\<lambda>k. ?f k x) \<longlonglongrightarrow> g x" if "x \<in> S" for x
   proof -
     have "\<And>e y. \<bar>f y x - g x\<bar> < e \<Longrightarrow> \<bar>min (max (- h x) (f y x)) (h x) - g x\<bar> < e"
       using h0 [OF that] normg [OF that] by simp
     then show ?thesis
       using lim [OF that] by (auto simp add: tendsto_iff dist_norm elim!: eventually_mono)
   qed
   show ?thesis
   proof (rule dominated_convergence [of ?f S h g])
     have "(\<lambda>x. - h x) absolutely_integrable_on S"
       using habs unfolding set_integrable_def by auto
     then show "?f k integrable_on S" for k
       by (intro set_lebesgue_integral_eq_integral absolutely_integrable_min_1 absolutely_integrable_max_1 f habs)
   qed (use assms leh limf in auto)
 qed
 
 lemma dominated_convergence_integrable:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes f: "\<And>k. f k absolutely_integrable_on S"
     and h: "h integrable_on S"
     and normg: "\<And>x. x \<in> S \<Longrightarrow> norm(g x) \<le> (h x)"
     and lim: "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
   shows "g integrable_on S"
   using f
   unfolding integrable_componentwise_iff [of g] absolutely_integrable_componentwise_iff [where f = "f k" for k]
 proof clarify
   fix b :: "'m"
   assume fb [rule_format]: "\<And>k. \<forall>b\<in>Basis. (\<lambda>x. f k x \<bullet> b) absolutely_integrable_on S" and b: "b \<in> Basis"
   show "(\<lambda>x. g x \<bullet> b) integrable_on S"
   proof (rule dominated_convergence_integrable_1 [OF fb h])
     fix x
     assume "x \<in> S"
     show "norm (g x \<bullet> b) \<le> h x"
       using norm_nth_le \<open>x \<in> S\<close> b normg order.trans by blast
     show "(\<lambda>k. f k x \<bullet> b) \<longlonglongrightarrow> g x \<bullet> b"
       using \<open>x \<in> S\<close> b lim tendsto_componentwise_iff by fastforce
   qed (use b in auto)
 qed
 
 lemma dominated_convergence_absolutely_integrable:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes f: "\<And>k. f k absolutely_integrable_on S"
     and h: "h integrable_on S"
     and normg: "\<And>x. x \<in> S \<Longrightarrow> norm(g x) \<le> (h x)"
     and lim: "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
   shows "g absolutely_integrable_on S"
 proof -
   have "g integrable_on S"
     by (rule dominated_convergence_integrable [OF assms])
   with assms show ?thesis
     by (blast intro:  absolutely_integrable_integrable_bound [where g=h])
 qed
 
 
 proposition integral_countable_UN:
   fixes f :: "real^'m \<Rightarrow> real^'n"
   assumes f: "f absolutely_integrable_on (\<Union>(range s))"
     and s: "\<And>m. s m \<in> sets lebesgue"
   shows "\<And>n. f absolutely_integrable_on (\<Union>m\<le>n. s m)"
     and "(\<lambda>n. integral (\<Union>m\<le>n. s m) f) \<longlonglongrightarrow> integral (\<Union>(s ` UNIV)) f" (is "?F \<longlonglongrightarrow> ?I")
 proof -
   show fU: "f absolutely_integrable_on (\<Union>m\<le>n. s m)" for n
     using assms by (blast intro: set_integrable_subset [OF f])
   have fint: "f integrable_on (\<Union> (range s))"
     using absolutely_integrable_on_def f by blast
   let ?h = "\<lambda>x. if x \<in> \<Union>(s ` UNIV) then norm(f x) else 0"
   have "(\<lambda>n. integral UNIV (\<lambda>x. if x \<in> (\<Union>m\<le>n. s m) then f x else 0))
         \<longlonglongrightarrow> integral UNIV (\<lambda>x. if x \<in> \<Union>(s ` UNIV) then f x else 0)"
   proof (rule dominated_convergence)
     show "(\<lambda>x. if x \<in> (\<Union>m\<le>n. s m) then f x else 0) integrable_on UNIV" for n
       unfolding integrable_restrict_UNIV
       using fU absolutely_integrable_on_def by blast
     show "(\<lambda>x. if x \<in> \<Union>(s ` UNIV) then norm(f x) else 0) integrable_on UNIV"
       by (metis (no_types) absolutely_integrable_on_def f integrable_restrict_UNIV)
     show "\<And>x. (\<lambda>n. if x \<in> (\<Union>m\<le>n. s m) then f x else 0)
          \<longlonglongrightarrow> (if x \<in> \<Union>(s ` UNIV) then f x else 0)"
       by (force intro: tendsto_eventually eventually_sequentiallyI)
   qed auto
   then show "?F \<longlonglongrightarrow> ?I"
     by (simp only: integral_restrict_UNIV)
 qed
 
 
 subsection \<open>Fundamental Theorem of Calculus for the Lebesgue integral\<close>
 
 text \<open>
 
 For the positive integral we replace continuity with Borel-measurability.
 
 \<close>
 
 lemma
   fixes f :: "real \<Rightarrow> real"
   assumes [measurable]: "f \<in> borel_measurable borel"
   assumes f: "\<And>x. x \<in> {a..b} \<Longrightarrow> DERIV F x :> f x" "\<And>x. x \<in> {a..b} \<Longrightarrow> 0 \<le> f x" and "a \<le> b"
   shows nn_integral_FTC_Icc: "(\<integral>\<^sup>+x. ennreal (f x) * indicator {a .. b} x \<partial>lborel) = F b - F a" (is ?nn)
     and has_bochner_integral_FTC_Icc_nonneg:
       "has_bochner_integral lborel (\<lambda>x. f x * indicator {a .. b} x) (F b - F a)" (is ?has)
     and integral_FTC_Icc_nonneg: "(\<integral>x. f x * indicator {a .. b} x \<partial>lborel) = F b - F a" (is ?eq)
     and integrable_FTC_Icc_nonneg: "integrable lborel (\<lambda>x. f x * indicator {a .. b} x)" (is ?int)
 proof -
   have *: "(\<lambda>x. f x * indicator {a..b} x) \<in> borel_measurable borel" "\<And>x. 0 \<le> f x * indicator {a..b} x"
     using f(2) by (auto split: split_indicator)
 
   have F_mono: "a \<le> x \<Longrightarrow> x \<le> y \<Longrightarrow> y \<le> b\<Longrightarrow> F x \<le> F y" for x y
     using f by (intro DERIV_nonneg_imp_nondecreasing[of x y F]) (auto intro: order_trans)
 
   have "(f has_integral F b - F a) {a..b}"
     by (intro fundamental_theorem_of_calculus)
        (auto simp: has_field_derivative_iff_has_vector_derivative[symmetric]
              intro: has_field_derivative_subset[OF f(1)] \<open>a \<le> b\<close>)
   then have i: "((\<lambda>x. f x * indicator {a .. b} x) has_integral F b - F a) UNIV"
     unfolding indicator_def if_distrib[where f="\<lambda>x. a * x" for a]
     by (simp cong del: if_weak_cong del: atLeastAtMost_iff)
   then have nn: "(\<integral>\<^sup>+x. f x * indicator {a .. b} x \<partial>lborel) = F b - F a"
     by (rule nn_integral_has_integral_lborel[OF *])
   then show ?has
     by (rule has_bochner_integral_nn_integral[rotated 3]) (simp_all add: * F_mono \<open>a \<le> b\<close>)
   then show ?eq ?int
     unfolding has_bochner_integral_iff by auto
   show ?nn
     by (subst nn[symmetric])
        (auto intro!: nn_integral_cong simp add: ennreal_mult f split: split_indicator)
 qed
 
 lemma
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space"
   assumes "a \<le> b"
   assumes "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> (F has_vector_derivative f x) (at x within {a .. b})"
   assumes cont: "continuous_on {a .. b} f"
   shows has_bochner_integral_FTC_Icc:
       "has_bochner_integral lborel (\<lambda>x. indicator {a .. b} x *\<^sub>R f x) (F b - F a)" (is ?has)
     and integral_FTC_Icc: "(\<integral>x. indicator {a .. b} x *\<^sub>R f x \<partial>lborel) = F b - F a" (is ?eq)
 proof -
   let ?f = "\<lambda>x. indicator {a .. b} x *\<^sub>R f x"
   have int: "integrable lborel ?f"
     using borel_integrable_compact[OF _ cont] by auto
   have "(f has_integral F b - F a) {a..b}"
     using assms(1,2) by (intro fundamental_theorem_of_calculus) auto
   moreover
   have "(f has_integral integral\<^sup>L lborel ?f) {a..b}"
     using has_integral_integral_lborel[OF int]
     unfolding indicator_def if_distrib[where f="\<lambda>x. x *\<^sub>R a" for a]
     by (simp cong del: if_weak_cong del: atLeastAtMost_iff)
   ultimately show ?eq
     by (auto dest: has_integral_unique)
   then show ?has
     using int by (auto simp: has_bochner_integral_iff)
 qed
 
 lemma
   fixes f :: "real \<Rightarrow> real"
   assumes "a \<le> b"
   assumes deriv: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> DERIV F x :> f x"
   assumes cont: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> isCont f x"
   shows has_bochner_integral_FTC_Icc_real:
       "has_bochner_integral lborel (\<lambda>x. f x * indicator {a .. b} x) (F b - F a)" (is ?has)
     and integral_FTC_Icc_real: "(\<integral>x. f x * indicator {a .. b} x \<partial>lborel) = F b - F a" (is ?eq)
 proof -
   have 1: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> (F has_vector_derivative f x) (at x within {a .. b})"
     unfolding has_field_derivative_iff_has_vector_derivative[symmetric]
     using deriv by (auto intro: DERIV_subset)
   have 2: "continuous_on {a .. b} f"
     using cont by (intro continuous_at_imp_continuous_on) auto
   show ?has ?eq
     using has_bochner_integral_FTC_Icc[OF \<open>a \<le> b\<close> 1 2] integral_FTC_Icc[OF \<open>a \<le> b\<close> 1 2]
     by (auto simp: mult.commute)
 qed
 
 lemma nn_integral_FTC_atLeast:
   fixes f :: "real \<Rightarrow> real"
   assumes f_borel: "f \<in> borel_measurable borel"
   assumes f: "\<And>x. a \<le> x \<Longrightarrow> DERIV F x :> f x"
   assumes nonneg: "\<And>x. a \<le> x \<Longrightarrow> 0 \<le> f x"
   assumes lim: "(F \<longlongrightarrow> T) at_top"
   shows "(\<integral>\<^sup>+x. ennreal (f x) * indicator {a ..} x \<partial>lborel) = T - F a"
 proof -
   let ?f = "\<lambda>(i::nat) (x::real). ennreal (f x) * indicator {a..a + real i} x"
   let ?fR = "\<lambda>x. ennreal (f x) * indicator {a ..} x"
 
   have F_mono: "a \<le> x \<Longrightarrow> x \<le> y \<Longrightarrow> F x \<le> F y" for x y
     using f nonneg by (intro DERIV_nonneg_imp_nondecreasing[of x y F]) (auto intro: order_trans)
   then have F_le_T: "a \<le> x \<Longrightarrow> F x \<le> T" for x
     by (intro tendsto_lowerbound[OF lim])
        (auto simp: eventually_at_top_linorder)
 
   have "(SUP i. ?f i x) = ?fR x" for x
   proof (rule LIMSEQ_unique[OF LIMSEQ_SUP])
     obtain n where "x - a < real n"
       using reals_Archimedean2[of "x - a"] ..
     then have "eventually (\<lambda>n. ?f n x = ?fR x) sequentially"
       by (auto intro!: eventually_sequentiallyI[where c=n] split: split_indicator)
     then show "(\<lambda>n. ?f n x) \<longlonglongrightarrow> ?fR x"
       by (rule tendsto_eventually)
   qed (auto simp: nonneg incseq_def le_fun_def split: split_indicator)
   then have "integral\<^sup>N lborel ?fR = (\<integral>\<^sup>+ x. (SUP i. ?f i x) \<partial>lborel)"
     by simp
   also have "\<dots> = (SUP i. (\<integral>\<^sup>+ x. ?f i x \<partial>lborel))"
   proof (rule nn_integral_monotone_convergence_SUP)
     show "incseq ?f"
       using nonneg by (auto simp: incseq_def le_fun_def split: split_indicator)
     show "\<And>i. (?f i) \<in> borel_measurable lborel"
       using f_borel by auto
   qed
   also have "\<dots> = (SUP i. ennreal (F (a + real i) - F a))"
     by (subst nn_integral_FTC_Icc[OF f_borel f nonneg]) auto
   also have "\<dots> = T - F a"
   proof (rule LIMSEQ_unique[OF LIMSEQ_SUP])
     have "(\<lambda>x. F (a + real x)) \<longlonglongrightarrow> T"
       apply (rule filterlim_compose[OF lim filterlim_tendsto_add_at_top])
       apply (rule LIMSEQ_const_iff[THEN iffD2, OF refl])
       apply (rule filterlim_real_sequentially)
       done
     then show "(\<lambda>n. ennreal (F (a + real n) - F a)) \<longlonglongrightarrow> ennreal (T - F a)"
       by (simp add: F_mono F_le_T tendsto_diff)
   qed (auto simp: incseq_def intro!: ennreal_le_iff[THEN iffD2] F_mono)
   finally show ?thesis .
 qed
 
 lemma integral_power:
   "a \<le> b \<Longrightarrow> (\<integral>x. x^k * indicator {a..b} x \<partial>lborel) = (b^Suc k - a^Suc k) / Suc k"
 proof (subst integral_FTC_Icc_real)
   fix x show "DERIV (\<lambda>x. x^Suc k / Suc k) x :> x^k"
     by (intro derivative_eq_intros) auto
 qed (auto simp: field_simps simp del: of_nat_Suc)
 
 subsection \<open>Integration by parts\<close>
 
 lemma integral_by_parts_integrable:
   fixes f g F G::"real \<Rightarrow> real"
   assumes "a \<le> b"
   assumes cont_f[intro]: "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont f x"
   assumes cont_g[intro]: "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont g x"
   assumes [intro]: "!!x. DERIV F x :> f x"
   assumes [intro]: "!!x. DERIV G x :> g x"
   shows  "integrable lborel (\<lambda>x.((F x) * (g x) + (f x) * (G x)) * indicator {a .. b} x)"
   by (auto intro!: borel_integrable_atLeastAtMost continuous_intros) (auto intro!: DERIV_isCont)
 
 lemma integral_by_parts:
   fixes f g F G::"real \<Rightarrow> real"
   assumes [arith]: "a \<le> b"
   assumes cont_f[intro]: "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont f x"
   assumes cont_g[intro]: "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont g x"
   assumes [intro]: "!!x. DERIV F x :> f x"
   assumes [intro]: "!!x. DERIV G x :> g x"
   shows "(\<integral>x. (F x * g x) * indicator {a .. b} x \<partial>lborel)
             =  F b * G b - F a * G a - \<integral>x. (f x * G x) * indicator {a .. b} x \<partial>lborel"
 proof-
   have 0: "(\<integral>x. (F x * g x + f x * G x) * indicator {a .. b} x \<partial>lborel) = F b * G b - F a * G a"
     by (rule integral_FTC_Icc_real, auto intro!: derivative_eq_intros continuous_intros)
       (auto intro!: DERIV_isCont)
 
   have "(\<integral>x. (F x * g x + f x * G x) * indicator {a .. b} x \<partial>lborel) =
     (\<integral>x. (F x * g x) * indicator {a .. b} x \<partial>lborel) + \<integral>x. (f x * G x) * indicator {a .. b} x \<partial>lborel"
     apply (subst Bochner_Integration.integral_add[symmetric])
     apply (auto intro!: borel_integrable_atLeastAtMost continuous_intros)
     by (auto intro!: DERIV_isCont Bochner_Integration.integral_cong split: split_indicator)
 
   thus ?thesis using 0 by auto
 qed
 
 lemma integral_by_parts':
   fixes f g F G::"real \<Rightarrow> real"
   assumes "a \<le> b"
   assumes "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont f x"
   assumes "!!x. a \<le>x \<Longrightarrow> x\<le>b \<Longrightarrow> isCont g x"
   assumes "!!x. DERIV F x :> f x"
   assumes "!!x. DERIV G x :> g x"
   shows "(\<integral>x. indicator {a .. b} x *\<^sub>R (F x * g x) \<partial>lborel)
             =  F b * G b - F a * G a - \<integral>x. indicator {a .. b} x *\<^sub>R (f x * G x) \<partial>lborel"
   using integral_by_parts[OF assms] by (simp add: ac_simps)
 
 lemma has_bochner_integral_even_function:
   fixes f :: "real \<Rightarrow> 'a :: {banach, second_countable_topology}"
   assumes f: "has_bochner_integral lborel (\<lambda>x. indicator {0..} x *\<^sub>R f x) x"
   assumes even: "\<And>x. f (- x) = f x"
   shows "has_bochner_integral lborel f (2 *\<^sub>R x)"
 proof -
   have indicator: "\<And>x::real. indicator {..0} (- x) = indicator {0..} x"
     by (auto split: split_indicator)
   have "has_bochner_integral lborel (\<lambda>x. indicator {.. 0} x *\<^sub>R f x) x"
     by (subst lborel_has_bochner_integral_real_affine_iff[where c="-1" and t=0])
        (auto simp: indicator even f)
   with f have "has_bochner_integral lborel (\<lambda>x. indicator {0..} x *\<^sub>R f x + indicator {.. 0} x *\<^sub>R f x) (x + x)"
     by (rule has_bochner_integral_add)
   then have "has_bochner_integral lborel f (x + x)"
     by (rule has_bochner_integral_discrete_difference[where X="{0}", THEN iffD1, rotated 4])
        (auto split: split_indicator)
   then show ?thesis
     by (simp add: scaleR_2)
 qed
 
 lemma has_bochner_integral_odd_function:
   fixes f :: "real \<Rightarrow> 'a :: {banach, second_countable_topology}"
   assumes f: "has_bochner_integral lborel (\<lambda>x. indicator {0..} x *\<^sub>R f x) x"
   assumes odd: "\<And>x. f (- x) = - f x"
   shows "has_bochner_integral lborel f 0"
 proof -
   have indicator: "\<And>x::real. indicator {..0} (- x) = indicator {0..} x"
     by (auto split: split_indicator)
   have "has_bochner_integral lborel (\<lambda>x. - indicator {.. 0} x *\<^sub>R f x) x"
     by (subst lborel_has_bochner_integral_real_affine_iff[where c="-1" and t=0])
        (auto simp: indicator odd f)
   from has_bochner_integral_minus[OF this]
   have "has_bochner_integral lborel (\<lambda>x. indicator {.. 0} x *\<^sub>R f x) (- x)"
     by simp
   with f have "has_bochner_integral lborel (\<lambda>x. indicator {0..} x *\<^sub>R f x + indicator {.. 0} x *\<^sub>R f x) (x + - x)"
     by (rule has_bochner_integral_add)
   then have "has_bochner_integral lborel f (x + - x)"
     by (rule has_bochner_integral_discrete_difference[where X="{0}", THEN iffD1, rotated 4])
        (auto split: split_indicator)
   then show ?thesis
     by simp
 qed
 
 lemma has_integral_0_closure_imp_0:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f: "continuous_on (closure S) f"
     and nonneg_interior: "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f x"
     and pos: "0 < emeasure lborel S"
     and finite: "emeasure lborel S < \<infinity>"
     and regular: "emeasure lborel (closure S) = emeasure lborel S"
     and opn: "open S"
   assumes int: "(f has_integral 0) (closure S)"
   assumes x: "x \<in> closure S"
   shows "f x = 0"
 proof -
   have zero: "emeasure lborel (frontier S) = 0"
     using finite closure_subset regular
     unfolding frontier_def
     by (subst emeasure_Diff) (auto simp: frontier_def interior_open \<open>open S\<close> )
   have nonneg: "0 \<le> f x" if "x \<in> closure S" for x
     using continuous_ge_on_closure[OF f that nonneg_interior] by simp
   have "0 = integral (closure S) f"
     by (blast intro: int sym)
   also
   note intl = has_integral_integrable[OF int]
   have af: "f absolutely_integrable_on (closure S)"
     using nonneg
     by (intro absolutely_integrable_onI intl integrable_eq[OF intl]) simp
   then have "integral (closure S) f = set_lebesgue_integral lebesgue (closure S) f"
     by (intro set_lebesgue_integral_eq_integral(2)[symmetric])
   also have "\<dots> = 0 \<longleftrightarrow> (AE x in lebesgue. indicator (closure S) x *\<^sub>R f x = 0)"
     unfolding set_lebesgue_integral_def
   proof (rule integral_nonneg_eq_0_iff_AE)
     show "integrable lebesgue (\<lambda>x. indicat_real (closure S) x *\<^sub>R f x)"
       by (metis af set_integrable_def)
   qed (use nonneg in \<open>auto simp: indicator_def\<close>)
   also have "\<dots> \<longleftrightarrow> (AE x in lebesgue. x \<in> {x. x \<in> closure S \<longrightarrow> f x = 0})"
     by (auto simp: indicator_def)
   finally have "(AE x in lebesgue. x \<in> {x. x \<in> closure S \<longrightarrow> f x = 0})" by simp
   moreover have "(AE x in lebesgue. x \<in> - frontier S)"
     using zero
     by (auto simp: eventually_ae_filter null_sets_def intro!: exI[where x="frontier S"])
   ultimately have ae: "AE x \<in> S in lebesgue. x \<in> {x \<in> closure S. f x = 0}" (is ?th)
     by eventually_elim (use closure_subset in \<open>auto simp: \<close>)
   have "closed {0::real}" by simp
   with continuous_on_closed_vimage[OF closed_closure, of S f] f
   have "closed (f -` {0} \<inter> closure S)" by blast
   then have "closed {x \<in> closure S. f x = 0}" by (auto simp: vimage_def Int_def conj_commute)
   with \<open>open S\<close> have "x \<in> {x \<in> closure S. f x = 0}" if "x \<in> S" for x using ae that
     by (rule mem_closed_if_AE_lebesgue_open)
   then have "f x = 0" if "x \<in> S" for x using that by auto
   from continuous_constant_on_closure[OF f this \<open>x \<in> closure S\<close>]
   show "f x = 0" .
 qed
 
 lemma has_integral_0_cbox_imp_0:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes f: "continuous_on (cbox a b) f"
     and nonneg_interior: "\<And>x. x \<in> box a b \<Longrightarrow> 0 \<le> f x"
   assumes int: "(f has_integral 0) (cbox a b)"
   assumes ne: "box a b \<noteq> {}"
   assumes x: "x \<in> cbox a b"
   shows "f x = 0"
 proof -
   have "0 < emeasure lborel (box a b)"
     using ne x unfolding emeasure_lborel_box_eq
     by (force intro!: prod_pos simp: mem_box algebra_simps)
   then show ?thesis using assms
     by (intro has_integral_0_closure_imp_0[of "box a b" f x])
       (auto simp: emeasure_lborel_box_eq emeasure_lborel_cbox_eq algebra_simps mem_box)
 qed
 
 subsection\<open>Various common equivalent forms of function measurability\<close>
 
 lemma indicator_sum_eq:
   fixes m::real and f :: "'a \<Rightarrow> real"
   assumes "\<bar>m\<bar> \<le> 2 ^ (2*n)" "m/2^n \<le> f x" "f x < (m+1)/2^n" "m \<in> \<int>"
   shows   "(\<Sum>k::real | k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n).
             k/2^n * indicator {y. k/2^n \<le> f y \<and> f y < (k+1)/2^n} x)  = m/2^n"
           (is "sum ?f ?S = _")
 proof -
   have "sum ?f ?S = sum (\<lambda>k. k/2^n * indicator {y. k/2^n \<le> f y \<and> f y < (k+1)/2^n} x) {m}"
   proof (rule comm_monoid_add_class.sum.mono_neutral_right)
     show "finite ?S"
       by (rule finite_abs_int_segment)
     show "{m} \<subseteq> {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}"
       using assms by auto
     show "\<forall>i\<in>{k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)} - {m}. ?f i = 0"
       using assms by (auto simp: indicator_def Ints_def abs_le_iff field_split_simps)
   qed
   also have "\<dots> = m/2^n"
     using assms by (auto simp: indicator_def not_less)
   finally show ?thesis .
 qed
 
 lemma measurable_on_sf_limit_lemma1:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "\<And>a b. {x \<in> S. a \<le> f x \<and> f x < b} \<in> sets (lebesgue_on S)"
   obtains g where "\<And>n. g n \<in> borel_measurable (lebesgue_on S)"
                   "\<And>n. finite(range (g n))"
                   "\<And>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x"
 proof
   show "(\<lambda>x. sum (\<lambda>k::real. k/2^n * indicator {y. k/2^n \<le> f y \<and> f y < (k+1)/2^n} x)
                  {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}) \<in> borel_measurable (lebesgue_on S)"
         (is "?g \<in> _")  for n
   proof -
     have "\<And>k. \<lbrakk>k \<in> \<int>; \<bar>k\<bar> \<le> 2 ^ (2*n)\<rbrakk>
          \<Longrightarrow> Measurable.pred (lebesgue_on S) (\<lambda>x. k / (2^n) \<le> f x \<and> f x < (k+1) / (2^n))"
       using assms by (force simp: pred_def space_restrict_space)
     then show ?thesis
       by (simp add: field_class.field_divide_inverse)
   qed
   show "finite (range (?g n))" for n
   proof -
     have "range (?g n) \<subseteq> (\<lambda>k. k/2^n) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}"
     proof clarify
       fix x
       show "?g n x  \<in> (\<lambda>k. k/2^n) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)}"
       proof (cases "\<exists>k::real. k \<in> \<int> \<and> \<bar>k\<bar> \<le> 2 ^ (2*n) \<and> k/2^n \<le> (f x) \<and> (f x) < (k+1)/2^n")
         case True
         then show ?thesis
           apply clarify
           by (subst indicator_sum_eq) auto
       next
         case False
         then have "?g n x = 0" by auto
         then show ?thesis by force
       qed
     qed
     moreover have "finite ((\<lambda>k::real. (k/2^n)) ` {k \<in> \<int>. \<bar>k\<bar> \<le> 2 ^ (2*n)})"
       by (simp add: finite_abs_int_segment)
     ultimately show ?thesis
       using finite_subset by blast
   qed
   show "(\<lambda>n. ?g n x) \<longlonglongrightarrow> f x" for x
   proof (rule LIMSEQ_I)
     fix e::real
     assume "e > 0"
     obtain N1 where N1: "\<bar>f x\<bar> < 2 ^ N1"
       using real_arch_pow by fastforce
     obtain N2 where N2: "(1/2) ^ N2 < e"
       using real_arch_pow_inv \<open>e > 0\<close> by force
     have "norm (?g n x - f x) < e" if n: "n \<ge> max N1 N2" for n
     proof -
       define m where "m \<equiv> floor(2^n * (f x))"
       have "1 \<le> \<bar>2^n\<bar> * e"
         using n N2 \<open>e > 0\<close> less_eq_real_def less_le_trans by (fastforce simp add: field_split_simps)
       then have *: "\<lbrakk>x \<le> y; y < x + 1\<rbrakk> \<Longrightarrow> abs(x - y) < \<bar>2^n\<bar> * e" for x y::real
         by linarith
       have "\<bar>2^n\<bar> * \<bar>m/2^n - f x\<bar> = \<bar>2^n * (m/2^n - f x)\<bar>"
         by (simp add: abs_mult)
       also have "\<dots> = \<bar>real_of_int \<lfloor>2^n * f x\<rfloor> - f x * 2^n\<bar>"
         by (simp add: algebra_simps m_def)
       also have "\<dots> < \<bar>2^n\<bar> * e"
         by (rule *; simp add: mult.commute)
       finally have "\<bar>2^n\<bar> * \<bar>m/2^n - f x\<bar> < \<bar>2^n\<bar> * e" .
       then have me: "\<bar>m/2^n - f x\<bar> < e"
         by simp
       have "\<bar>real_of_int m\<bar> \<le> 2 ^ (2*n)"
       proof (cases "f x < 0")
         case True
         then have "-\<lfloor>f x\<rfloor> \<le> \<lfloor>(2::real) ^ N1\<rfloor>"
           using N1 le_floor_iff minus_le_iff by fastforce
         with n True have "\<bar>real_of_int\<lfloor>f x\<rfloor>\<bar> \<le> 2 ^ N1"
           by linarith
         also have "\<dots> \<le> 2^n"
           using n by (simp add: m_def)
         finally have "\<bar>real_of_int \<lfloor>f x\<rfloor>\<bar> * 2^n \<le> 2^n * 2^n"
           by simp
         moreover
         have "\<bar>real_of_int \<lfloor>2^n * f x\<rfloor>\<bar> \<le> \<bar>real_of_int \<lfloor>f x\<rfloor>\<bar> * 2^n"
         proof -
           have "\<bar>real_of_int \<lfloor>2^n * f x\<rfloor>\<bar> = - (real_of_int \<lfloor>2^n * f x\<rfloor>)"
             using True by (simp add: abs_if mult_less_0_iff)
           also have "\<dots> \<le> - (real_of_int (\<lfloor>(2::real) ^ n\<rfloor> * \<lfloor>f x\<rfloor>))"
             using le_mult_floor_Ints [of "(2::real)^n"] by simp
           also have "\<dots> \<le> \<bar>real_of_int \<lfloor>f x\<rfloor>\<bar> * 2^n"
             using True
             by simp
           finally show ?thesis .
         qed
         ultimately show ?thesis
           by (metis (no_types, hide_lams) m_def order_trans power2_eq_square power_even_eq)
       next
         case False
         with n N1 have "f x \<le> 2^n"
           by (simp add: not_less) (meson less_eq_real_def one_le_numeral order_trans power_increasing)
         moreover have "0 \<le> m"
           using False m_def by force
         ultimately show ?thesis
           by (metis abs_of_nonneg floor_mono le_floor_iff m_def of_int_0_le_iff power2_eq_square power_mult real_mult_le_cancel_iff1 zero_less_numeral mult.commute zero_less_power)
       qed
       then have "?g n x = m/2^n"
         by (rule indicator_sum_eq) (auto simp add: m_def field_split_simps, linarith)
       then have "norm (?g n x - f x) = norm (m/2^n - f x)"
         by simp
       also have "\<dots> < e"
         by (simp add: me)
       finally show ?thesis .
     qed
     then show "\<exists>no. \<forall>n\<ge>no. norm (?g n x - f x) < e"
       by blast
   qed
 qed
 
 
 lemma borel_measurable_simple_function_limit:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<exists>g. (\<forall>n. (g n) \<in> borel_measurable (lebesgue_on S)) \<and>
               (\<forall>n. finite (range (g n))) \<and> (\<forall>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x))"
 proof -
   have "\<exists>g. (\<forall>n. (g n) \<in> borel_measurable (lebesgue_on S)) \<and>
             (\<forall>n. finite (range (g n))) \<and> (\<forall>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x)"
        if f: "\<And>a i. i \<in> Basis \<Longrightarrow> {x \<in> S. f x \<bullet> i < a} \<in> sets (lebesgue_on S)"
   proof -
     have "\<exists>g. (\<forall>n. (g n) \<in> borel_measurable (lebesgue_on S)) \<and>
                   (\<forall>n. finite(image (g n) UNIV)) \<and>
                   (\<forall>x. ((\<lambda>n. g n x) \<longlonglongrightarrow> f x \<bullet> i))" if "i \<in> Basis" for i
     proof (rule measurable_on_sf_limit_lemma1 [of S "\<lambda>x. f x \<bullet> i"])
       show "{x \<in> S. a \<le> f x \<bullet> i \<and> f x \<bullet> i < b} \<in> sets (lebesgue_on S)" for a b
       proof -
         have "{x \<in> S. a \<le> f x \<bullet> i \<and> f x \<bullet> i < b} = {x \<in> S. f x \<bullet> i < b} - {x \<in> S. a > f x \<bullet> i}"
           by auto
         also have "\<dots> \<in> sets (lebesgue_on S)"
           using f that by blast
         finally show ?thesis .
       qed
     qed blast
     then obtain g where g:
           "\<And>i n. i \<in> Basis \<Longrightarrow> g i n \<in> borel_measurable (lebesgue_on S)"
           "\<And>i n. i \<in> Basis \<Longrightarrow> finite(range (g i n))"
           "\<And>i x. i \<in> Basis \<Longrightarrow> ((\<lambda>n. g i n x) \<longlonglongrightarrow> f x \<bullet> i)"
       by metis
     show ?thesis
     proof (intro conjI allI exI)
       show "(\<lambda>x. \<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<in> borel_measurable (lebesgue_on S)" for n
         by (intro borel_measurable_sum borel_measurable_scaleR) (auto intro: g)
       show "finite (range (\<lambda>x. \<Sum>i\<in>Basis. g i n x *\<^sub>R i))" for n
       proof -
         have "range (\<lambda>x. \<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<subseteq> (\<lambda>h. \<Sum>i\<in>Basis. h i *\<^sub>R i) ` PiE Basis (\<lambda>i. range (g i n))"
         proof clarify
           fix x
           show "(\<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<in> (\<lambda>h. \<Sum>i\<in>Basis. h i *\<^sub>R i) ` (\<Pi>\<^sub>E i\<in>Basis. range (g i n))"
             by (rule_tac x="\<lambda>i\<in>Basis. g i n x" in image_eqI) auto
         qed
         moreover have "finite(PiE Basis (\<lambda>i. range (g i n)))"
           by (simp add: g finite_PiE)
         ultimately show ?thesis
           by (metis (mono_tags, lifting) finite_surj)
       qed
       show "(\<lambda>n. \<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<longlonglongrightarrow> f x" for x
       proof -
         have "(\<lambda>n. \<Sum>i\<in>Basis. g i n x *\<^sub>R i) \<longlonglongrightarrow> (\<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i)"
           by (auto intro!: tendsto_sum tendsto_scaleR g)
         moreover have "(\<Sum>i\<in>Basis. (f x \<bullet> i) *\<^sub>R i) = f x"
           using euclidean_representation by blast
         ultimately show ?thesis
           by metis
       qed
     qed
   qed
   moreover have "f \<in> borel_measurable (lebesgue_on S)"
               if meas_g: "\<And>n. g n \<in> borel_measurable (lebesgue_on S)"
                  and fin: "\<And>n. finite (range (g n))"
                  and to_f: "\<And>x. (\<lambda>n. g n x) \<longlonglongrightarrow> f x" for  g
     by (rule borel_measurable_LIMSEQ_metric [OF meas_g to_f])
   ultimately show ?thesis
     using borel_measurable_vimage_halfspace_component_lt by blast
 qed
 
 subsection \<open>Lebesgue sets and continuous images\<close>
 
 proposition lebesgue_regular_inner:
  assumes "S \<in> sets lebesgue"
  obtains K C where "negligible K" "\<And>n::nat. compact(C n)" "S = (\<Union>n. C n) \<union> K"
 proof -
   have "\<exists>T. closed T \<and> T \<subseteq> S \<and> (S - T) \<in> lmeasurable \<and> emeasure lebesgue (S - T) < ennreal ((1/2)^n)" for n
     using sets_lebesgue_inner_closed assms
     by (metis sets_lebesgue_inner_closed zero_less_divide_1_iff zero_less_numeral zero_less_power)
   then obtain C where clo: "\<And>n. closed (C n)" and subS: "\<And>n. C n \<subseteq> S"
     and mea: "\<And>n. (S - C n) \<in> lmeasurable"
     and less: "\<And>n. emeasure lebesgue (S - C n) < ennreal ((1/2)^n)"
     by metis
   have "\<exists>F. (\<forall>n::nat. compact(F n)) \<and> (\<Union>n. F n) = C m" for m::nat
     by (metis clo closed_Union_compact_subsets)
   then obtain D :: "[nat,nat] \<Rightarrow> 'a set" where D: "\<And>m n. compact(D m n)" "\<And>m. (\<Union>n. D m n) = C m"
     by metis
   let ?C = "from_nat_into (\<Union>m. range (D m))"
   have "countable (\<Union>m. range (D m))"
     by blast
   have "range (from_nat_into (\<Union>m. range (D m))) = (\<Union>m. range (D m))"
     using range_from_nat_into by simp
   then have CD: "\<exists>m n. ?C k = D m n"  for k
     by (metis (mono_tags, lifting) UN_iff rangeE range_eqI)
   show thesis
   proof
     show "negligible (S - (\<Union>n. C n))"
     proof (clarsimp simp: negligible_outer_le)
       fix e :: "real"
       assume "e > 0"
       then obtain n where n: "(1/2)^n < e"
         using real_arch_pow_inv [of e "1/2"] by auto
       show "\<exists>T. S - (\<Union>n. C n) \<subseteq> T \<and> T \<in> lmeasurable \<and> measure lebesgue T \<le> e"
       proof (intro exI conjI)
         show "S - (\<Union>n. C n) \<subseteq> S - C n"
           by blast
         show "S - C n \<in> lmeasurable"
           by (simp add: mea)
         show "measure lebesgue (S - C n) \<le> e"
           using less [of n] n
           by (simp add: emeasure_eq_measure2 less_le mea)
       qed
     qed
     show "compact (?C n)" for n
       using CD D by metis
     show "S = (\<Union>n. ?C n) \<union> (S - (\<Union>n. C n))" (is "_ = ?rhs")
     proof
       show "S \<subseteq> ?rhs"
         using D by fastforce
       show "?rhs \<subseteq> S"
         using subS D CD by auto (metis Sup_upper range_eqI subsetCE)
     qed
   qed
 qed
 
 lemma sets_lebesgue_continuous_image:
   assumes T: "T \<in> sets lebesgue" and contf: "continuous_on S f"
     and negim: "\<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible(f ` T)" and "T \<subseteq> S"
  shows "f ` T \<in> sets lebesgue"
 proof -
   obtain K C where "negligible K" and com: "\<And>n::nat. compact(C n)" and Teq: "T = (\<Union>n. C n) \<union> K"
     using lebesgue_regular_inner [OF T] by metis
   then have comf: "\<And>n::nat. compact(f ` C n)"
     by (metis Un_subset_iff Union_upper \<open>T \<subseteq> S\<close> compact_continuous_image contf continuous_on_subset rangeI)
   have "((\<Union>n. f ` C n) \<union> f ` K) \<in> sets lebesgue"
   proof (rule sets.Un)
     have "K \<subseteq> S"
       using Teq \<open>T \<subseteq> S\<close> by blast
     show "(\<Union>n. f ` C n) \<in> sets lebesgue"
     proof (rule sets.countable_Union)
       show "range (\<lambda>n. f ` C n) \<subseteq> sets lebesgue"
         using borel_compact comf by (auto simp: borel_compact)
     qed auto
     show "f ` K \<in> sets lebesgue"
       by (simp add: \<open>K \<subseteq> S\<close> \<open>negligible K\<close> negim negligible_imp_sets)
   qed
   then show ?thesis
     by (simp add: Teq image_Un image_Union)
 qed
 
 lemma differentiable_image_in_sets_lebesgue:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
   assumes S: "S \<in> sets lebesgue" and dim: "DIM('m) \<le> DIM('n)" and f: "f differentiable_on S"
   shows "f`S \<in> sets lebesgue"
 proof (rule sets_lebesgue_continuous_image [OF S])
   show "continuous_on S f"
     by (meson differentiable_imp_continuous_on f)
   show "\<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible (f ` T)"
     using differentiable_on_subset f
     by (auto simp: intro!: negligible_differentiable_image_negligible [OF dim])
 qed auto
 
 lemma sets_lebesgue_on_continuous_image:
   assumes S: "S \<in> sets lebesgue" and X: "X \<in> sets (lebesgue_on S)" and contf: "continuous_on S f"
     and negim: "\<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible(f ` T)"
   shows "f ` X \<in> sets (lebesgue_on (f ` S))"
 proof -
   have "X \<subseteq> S"
     by (metis S X sets.Int_space_eq2 sets_restrict_space_iff)
   moreover have "f ` S \<in> sets lebesgue"
     using S contf negim sets_lebesgue_continuous_image by blast
   moreover have "f ` X \<in> sets lebesgue"
     by (metis S X contf negim sets_lebesgue_continuous_image sets_restrict_space_iff space_restrict_space space_restrict_space2)
   ultimately show ?thesis
     by (auto simp: sets_restrict_space_iff)
 qed
 
 lemma differentiable_image_in_sets_lebesgue_on:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
   assumes S: "S \<in> sets lebesgue" and X: "X \<in> sets (lebesgue_on S)" and dim: "DIM('m) \<le> DIM('n)"
        and f: "f differentiable_on S"
      shows "f ` X \<in> sets (lebesgue_on (f`S))"
 proof (rule sets_lebesgue_on_continuous_image [OF S X])
   show "continuous_on S f"
     by (meson differentiable_imp_continuous_on f)
   show "\<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible (f ` T)"
     using differentiable_on_subset f
     by (auto simp: intro!: negligible_differentiable_image_negligible [OF dim])
 qed
 
 subsection \<open>Affine lemmas\<close>
 
 lemma borel_measurable_affine:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes f: "f \<in> borel_measurable lebesgue" and "c \<noteq> 0"
   shows "(\<lambda>x. f(t + c *\<^sub>R x)) \<in> borel_measurable lebesgue"
 proof -
   { fix a b
     have "{x. f x \<in> cbox a b} \<in> sets lebesgue"
       using f cbox_borel lebesgue_measurable_vimage_borel by blast
     then have "(\<lambda>x. (x - t) /\<^sub>R c) ` {x. f x \<in> cbox a b} \<in> sets lebesgue"
     proof (rule differentiable_image_in_sets_lebesgue)
       show "(\<lambda>x. (x - t) /\<^sub>R c) differentiable_on {x. f x \<in> cbox a b}"
         unfolding differentiable_on_def differentiable_def
         by (rule \<open>c \<noteq> 0\<close> derivative_eq_intros strip exI | simp)+
     qed auto
     moreover
     have "{x. f(t + c *\<^sub>R x) \<in> cbox a b} = (\<lambda>x. (x-t) /\<^sub>R c) ` {x. f x \<in> cbox a b}"
       using \<open>c \<noteq> 0\<close> by (auto simp: image_def)
     ultimately have "{x. f(t + c *\<^sub>R x) \<in> cbox a b} \<in> sets lebesgue"
       by (auto simp: borel_measurable_vimage_closed_interval) }
   then show ?thesis
     by (subst lebesgue_on_UNIV_eq [symmetric]; auto simp: borel_measurable_vimage_closed_interval)
 qed
     
 lemma lebesgue_integrable_real_affine:
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space"
   assumes f: "integrable lebesgue f" and "c \<noteq> 0"
   shows "integrable lebesgue (\<lambda>x. f(t + c * x))"
 proof -
   have "(\<lambda>x. norm (f x)) \<in> borel_measurable lebesgue"
     by (simp add: borel_measurable_integrable f)
   then show ?thesis
     using assms borel_measurable_affine [of f c]
     unfolding integrable_iff_bounded
     by (subst (asm) nn_integral_real_affine_lebesgue[where c=c and t=t])  (auto simp: ennreal_mult_less_top)
 qed
 
 lemma lebesgue_integrable_real_affine_iff:
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space"
   shows "c \<noteq> 0 \<Longrightarrow> integrable lebesgue (\<lambda>x. f(t + c * x)) \<longleftrightarrow> integrable lebesgue f"
   using lebesgue_integrable_real_affine[of f c t]
         lebesgue_integrable_real_affine[of "\<lambda>x. f(t + c * x)" "1/c" "-t/c"]
   by (auto simp: field_simps)
 
 lemma\<^marker>\<open>tag important\<close> lebesgue_integral_real_affine:
   fixes f :: "real \<Rightarrow> 'a :: euclidean_space" and c :: real
   assumes c: "c \<noteq> 0" shows "(\<integral>x. f x \<partial> lebesgue) = \<bar>c\<bar> *\<^sub>R (\<integral>x. f(t + c * x) \<partial>lebesgue)"
 proof cases
   have "(\<lambda>x. t + c * x) \<in> lebesgue \<rightarrow>\<^sub>M lebesgue"
     using lebesgue_affine_measurable[where c= "\<lambda>x::real. c"] \<open>c \<noteq> 0\<close> by simp
   moreover
   assume "integrable lebesgue f"
   ultimately show ?thesis
     by (subst lebesgue_real_affine[OF c, of t]) (auto simp: integral_density integral_distr)
 next
   assume "\<not> integrable lebesgue f" with c show ?thesis
     by (simp add: lebesgue_integrable_real_affine_iff not_integrable_integral_eq)
 qed
 
 lemma has_bochner_integral_lebesgue_real_affine_iff:
   fixes i :: "'a :: euclidean_space"
   shows "c \<noteq> 0 \<Longrightarrow>
     has_bochner_integral lebesgue f i \<longleftrightarrow>
     has_bochner_integral lebesgue (\<lambda>x. f(t + c * x)) (i /\<^sub>R \<bar>c\<bar>)"
   unfolding has_bochner_integral_iff lebesgue_integrable_real_affine_iff
   by (simp_all add: lebesgue_integral_real_affine[symmetric] divideR_right cong: conj_cong)
 
 lemma has_bochner_integral_reflect_real_lemma[intro]:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "has_bochner_integral (lebesgue_on {a..b}) f i"
   shows "has_bochner_integral (lebesgue_on {-b..-a}) (\<lambda>x. f(-x)) i"
 proof -
   have eq: "indicat_real {a..b} (- x) *\<^sub>R f(- x) = indicat_real {- b..- a} x *\<^sub>R f(- x)" for x
     by (auto simp: indicator_def)
   have i: "has_bochner_integral lebesgue (\<lambda>x. indicator {a..b} x *\<^sub>R f x) i"
     using assms by (auto simp: has_bochner_integral_restrict_space)
   then have "has_bochner_integral lebesgue (\<lambda>x. indicator {-b..-a} x *\<^sub>R f(-x)) i"
     using has_bochner_integral_lebesgue_real_affine_iff [of "-1" "(\<lambda>x. indicator {a..b} x *\<^sub>R f x)" i 0]
     by (auto simp: eq)
   then show ?thesis
     by (auto simp: has_bochner_integral_restrict_space)
 qed
 
 lemma has_bochner_integral_reflect_real[simp]:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   shows "has_bochner_integral (lebesgue_on {-b..-a}) (\<lambda>x. f(-x)) i \<longleftrightarrow> has_bochner_integral (lebesgue_on {a..b}) f i"
   by (auto simp: dest: has_bochner_integral_reflect_real_lemma)
 
 lemma integrable_reflect_real[simp]:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   shows "integrable (lebesgue_on {-b..-a}) (\<lambda>x. f(-x)) \<longleftrightarrow> integrable (lebesgue_on {a..b}) f"
   by (metis has_bochner_integral_iff has_bochner_integral_reflect_real)
 
 lemma integral_reflect_real[simp]:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   shows "integral\<^sup>L (lebesgue_on {-b .. -a}) (\<lambda>x. f(-x)) = integral\<^sup>L (lebesgue_on {a..b::real}) f"
   using has_bochner_integral_reflect_real [of b a f]
   by (metis has_bochner_integral_iff not_integrable_integral_eq)
 
 subsection\<open>More results on integrability\<close>
 
 lemma integrable_on_all_intervals_UNIV:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes intf: "\<And>a b. f integrable_on cbox a b"
     and normf: "\<And>x. norm(f x) \<le> g x" and g: "g integrable_on UNIV"
   shows "f integrable_on UNIV"
 proof -
 have intg: "(\<forall>a b. g integrable_on cbox a b)"
     and gle_e: "\<forall>e>0. \<exists>B>0. \<forall>a b c d.
                     ball 0 B \<subseteq> cbox a b \<and> cbox a b \<subseteq> cbox c d \<longrightarrow>
                     \<bar>integral (cbox a b) g - integral (cbox c d) g\<bar>
                     < e"
     using g
     by (auto simp: integrable_alt_subset [of _ UNIV] intf)
   have le: "norm (integral (cbox a b) f - integral (cbox c d) f) \<le> \<bar>integral (cbox a b) g - integral (cbox c d) g\<bar>"
     if "cbox a b \<subseteq> cbox c d" for a b c d
   proof -
     have "norm (integral (cbox a b) f - integral (cbox c d) f) = norm (integral (cbox c d - cbox a b) f)"
       using intf that by (simp add: norm_minus_commute integral_setdiff)
     also have "\<dots> \<le> integral (cbox c d - cbox a b) g"
     proof (rule integral_norm_bound_integral [OF _ _ normf])
       show "f integrable_on cbox c d - cbox a b" "g integrable_on cbox c d - cbox a b"
         by (meson integrable_integral integrable_setdiff intf intg negligible_setdiff that)+
     qed
     also have "\<dots> = integral (cbox c d) g - integral (cbox a b) g"
       using intg that by (simp add: integral_setdiff)
     also have "\<dots> \<le> \<bar>integral (cbox a b) g - integral (cbox c d) g\<bar>"
       by simp
     finally show ?thesis .
   qed
   show ?thesis
     using gle_e
     apply (simp add: integrable_alt_subset [of _ UNIV] intf)
     apply (erule imp_forward all_forward ex_forward asm_rl)+
     by (meson not_less order_trans le)
 qed
 
 lemma integrable_on_all_intervals_integrable_bound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes intf: "\<And>a b. (\<lambda>x. if x \<in> S then f x else 0) integrable_on cbox a b"
     and normf: "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> g x" and g: "g integrable_on S"
   shows "f integrable_on S"
   using integrable_on_all_intervals_UNIV [OF intf, of "(\<lambda>x. if x \<in> S then g x else 0)"]
   by (simp add: g integrable_restrict_UNIV normf)
 
 lemma measurable_bounded_lemma:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f \<in> borel_measurable lebesgue" and g: "g integrable_on cbox a b"
     and normf: "\<And>x. x \<in> cbox a b \<Longrightarrow> norm(f x) \<le> g x"
   shows "f integrable_on cbox a b"
 proof -
   have "g absolutely_integrable_on cbox a b"
     by (metis (full_types) add_increasing g le_add_same_cancel1 nonnegative_absolutely_integrable_1 norm_ge_zero normf)
   then have "integrable (lebesgue_on (cbox a b)) g"
     by (simp add: integrable_restrict_space set_integrable_def)
   then have "integrable (lebesgue_on (cbox a b)) f"
   proof (rule Bochner_Integration.integrable_bound)
     show "AE x in lebesgue_on (cbox a b). norm (f x) \<le> norm (g x)"
       by (rule AE_I2) (auto intro: normf order_trans)
   qed (simp add: f measurable_restrict_space1)
   then show ?thesis
     by (simp add: integrable_on_lebesgue_on)
 qed
 
 proposition measurable_bounded_by_integrable_imp_integrable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f \<in> borel_measurable (lebesgue_on S)" and g: "g integrable_on S"
     and normf: "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> g x" and S: "S \<in> sets lebesgue"
   shows "f integrable_on S"
 proof (rule integrable_on_all_intervals_integrable_bound [OF _ normf g])
   show "(\<lambda>x. if x \<in> S then f x else 0) integrable_on cbox a b" for a b
   proof (rule measurable_bounded_lemma)
     show "(\<lambda>x. if x \<in> S then f x else 0) \<in> borel_measurable lebesgue"
       by (simp add: S borel_measurable_if f)
     show "(\<lambda>x. if x \<in> S then g x else 0) integrable_on cbox a b"
       by (simp add: g integrable_altD(1))
     show "norm (if x \<in> S then f x else 0) \<le> (if x \<in> S then g x else 0)" for x
       using normf by simp
   qed
 qed
 
 lemma measurable_bounded_by_integrable_imp_lebesgue_integrable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f \<in> borel_measurable (lebesgue_on S)" and g: "integrable (lebesgue_on S) g"
     and normf: "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> g x" and S: "S \<in> sets lebesgue"
   shows "integrable (lebesgue_on S) f"
 proof -
   have "f absolutely_integrable_on S"
     by (metis (no_types) S absolutely_integrable_integrable_bound f g integrable_on_lebesgue_on measurable_bounded_by_integrable_imp_integrable normf)
   then show ?thesis
     by (simp add: S integrable_restrict_space set_integrable_def)
 qed
 
 lemma measurable_bounded_by_integrable_imp_integrable_real:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "f \<in> borel_measurable (lebesgue_on S)" "g integrable_on S" "\<And>x. x \<in> S \<Longrightarrow> abs(f x) \<le> g x" "S \<in> sets lebesgue"
   shows "f integrable_on S"
   using measurable_bounded_by_integrable_imp_integrable [of f S g] assms by simp
 
 subsection\<open> Relation between Borel measurability and integrability.\<close>
 
 lemma integrable_imp_measurable_weak:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue" "f integrable_on S"
   shows "f \<in> borel_measurable (lebesgue_on S)"
   by (metis (mono_tags, lifting) assms has_integral_implies_lebesgue_measurable borel_measurable_restrict_space_iff integrable_on_def sets.Int_space_eq2)
 
 lemma integrable_imp_measurable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f integrable_on S"
   shows "f \<in> borel_measurable (lebesgue_on S)"
 proof -
   have "(UNIV::'a set) \<in> sets lborel"
     by simp
   then show ?thesis
     by (metis (mono_tags, lifting) assms borel_measurable_if_D integrable_imp_measurable_weak integrable_restrict_UNIV lebesgue_on_UNIV_eq sets_lebesgue_on_refl)
 qed
 
 lemma integrable_iff_integrable_on:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue" "(\<integral>\<^sup>+ x. ennreal (norm (f x)) \<partial>lebesgue_on S) < \<infinity>"
   shows "integrable (lebesgue_on S) f \<longleftrightarrow> f integrable_on S"
   using assms integrable_iff_bounded integrable_imp_measurable integrable_on_lebesgue_on by blast
 
 lemma absolutely_integrable_measurable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue"
   shows "f absolutely_integrable_on S \<longleftrightarrow> f \<in> borel_measurable (lebesgue_on S) \<and> integrable (lebesgue_on S) (norm \<circ> f)"
     (is "?lhs = ?rhs")
 proof
   assume L: ?lhs
   then have "f \<in> borel_measurable (lebesgue_on S)"
     by (simp add: absolutely_integrable_on_def integrable_imp_measurable)
   then show ?rhs
     using assms set_integrable_norm [of lebesgue S f] L
     by (simp add: integrable_restrict_space set_integrable_def)
 next
   assume ?rhs then show ?lhs
     using assms integrable_on_lebesgue_on
     by (metis absolutely_integrable_integrable_bound comp_def eq_iff measurable_bounded_by_integrable_imp_integrable)
 qed
 
 lemma absolutely_integrable_measurable_real:
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "S \<in> sets lebesgue"
   shows "f absolutely_integrable_on S \<longleftrightarrow>
          f \<in> borel_measurable (lebesgue_on S) \<and> integrable (lebesgue_on S) (\<lambda>x. \<bar>f x\<bar>)"
   by (simp add: absolutely_integrable_measurable assms o_def)
 
 lemma absolutely_integrable_measurable_real':
   fixes f :: "'a::euclidean_space \<Rightarrow> real"
   assumes "S \<in> sets lebesgue"
   shows "f absolutely_integrable_on S \<longleftrightarrow> f \<in> borel_measurable (lebesgue_on S) \<and> (\<lambda>x. \<bar>f x\<bar>) integrable_on S"
   using assms
   apply (auto simp: absolutely_integrable_measurable integrable_on_lebesgue_on)
   apply (simp add: integrable_on_lebesgue_on measurable_bounded_by_integrable_imp_lebesgue_integrable)
   using abs_absolutely_integrableI_1 absolutely_integrable_measurable measurable_bounded_by_integrable_imp_integrable_real by blast
 
 lemma absolutely_integrable_imp_borel_measurable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f absolutely_integrable_on S" "S \<in> sets lebesgue"
   shows "f \<in> borel_measurable (lebesgue_on S)"
   using absolutely_integrable_measurable assms by blast
 
 lemma measurable_bounded_by_integrable_imp_absolutely_integrable:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f \<in> borel_measurable (lebesgue_on S)" "S \<in> sets lebesgue"
     and "g integrable_on S" and "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> (g x)"
   shows "f absolutely_integrable_on S"
   using assms absolutely_integrable_integrable_bound measurable_bounded_by_integrable_imp_integrable by blast
 
 proposition negligible_differentiable_vimage:
   fixes f :: "'a \<Rightarrow> 'a::euclidean_space"
   assumes "negligible T"
     and f': "\<And>x. x \<in> S \<Longrightarrow> inj(f' x)"
     and derf: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   shows "negligible {x \<in> S. f x \<in> T}"
 proof -
   define U where
     "U \<equiv> \<lambda>n::nat. {x \<in> S. \<forall>y. y \<in> S \<and> norm(y - x) < 1/n
                      \<longrightarrow> norm(y - x) \<le> n * norm(f y - f x)}"
   have "negligible {x \<in> U n. f x \<in> T}" if "n > 0" for n
   proof (subst locally_negligible_alt, clarify)
     fix a
     assume a: "a \<in> U n" and fa: "f a \<in> T"
     define V where "V \<equiv> {x. x \<in> U n \<and> f x \<in> T} \<inter> ball a (1 / n / 2)"
     show "\<exists>V. openin (top_of_set {x \<in> U n. f x \<in> T}) V \<and> a \<in> V \<and> negligible V"
     proof (intro exI conjI)
       have noxy: "norm(x - y) \<le> n * norm(f x - f y)" if "x \<in> V" "y \<in> V" for x y
         using that unfolding U_def V_def mem_Collect_eq Int_iff mem_ball dist_norm
         by (meson norm_triangle_half_r)
       then have "inj_on f V"
         by (force simp: inj_on_def)
       then obtain g where g: "\<And>x. x \<in> V \<Longrightarrow> g(f x) = x"
         by (metis inv_into_f_f)
       have "\<exists>T' B. open T' \<and> f x \<in> T' \<and>
                    (\<forall>y\<in>f ` V \<inter> T \<inter> T'. norm (g y - g (f x)) \<le> B * norm (y - f x))"
         if "f x \<in> T" "x \<in> V" for x
         apply (rule_tac x = "ball (f x) 1" in exI)
         using that noxy by (force simp: g)
       then have "negligible (g ` (f ` V \<inter> T))"
         by (force simp: \<open>negligible T\<close> negligible_Int intro!: negligible_locally_Lipschitz_image)
       moreover have "V \<subseteq> g ` (f ` V \<inter> T)"
         by (force simp: g image_iff V_def)
       ultimately show "negligible V"
         by (rule negligible_subset)
     qed (use a fa V_def that in auto)
   qed
   with negligible_countable_Union have "negligible (\<Union>n \<in> {0<..}. {x. x \<in> U n \<and> f x \<in> T})"
     by auto
   moreover have "{x \<in> S. f x \<in> T} \<subseteq> (\<Union>n \<in> {0<..}. {x. x \<in> U n \<and> f x \<in> T})"
   proof clarsimp
     fix x
     assume "x \<in> S" and "f x \<in> T"
     then obtain inj: "inj(f' x)" and der: "(f has_derivative f' x) (at x within S)"
       using assms by metis
     moreover have "linear(f' x)"
       and eps: "\<And>\<epsilon>. \<epsilon> > 0 \<Longrightarrow> \<exists>\<delta>>0. \<forall>y\<in>S. norm (y - x) < \<delta> \<longrightarrow>
                       norm (f y - f x - f' x (y - x)) \<le> \<epsilon> * norm (y - x)"
       using der by (auto simp: has_derivative_within_alt linear_linear)
     ultimately obtain g where "linear g" and g: "g \<circ> f' x = id"
       using linear_injective_left_inverse by metis
     then obtain B where "B > 0" and B: "\<And>z. B * norm z \<le> norm(f' x z)"
       using linear_invertible_bounded_below_pos \<open>linear (f' x)\<close> by blast
     then obtain i where "i \<noteq> 0" and i: "1 / real i < B"
       by (metis (full_types) inverse_eq_divide real_arch_invD)
     then obtain \<delta> where "\<delta> > 0"
          and \<delta>: "\<And>y. \<lbrakk>y\<in>S; norm (y - x) < \<delta>\<rbrakk> \<Longrightarrow>
                   norm (f y - f x - f' x (y - x)) \<le> (B - 1 / real i) * norm (y - x)"
       using eps [of "B - 1/i"] by auto
     then obtain j where "j \<noteq> 0" and j: "inverse (real j) < \<delta>"
       using real_arch_inverse by blast
     have "norm (y - x)/(max i j) \<le> norm (f y - f x)"
       if "y \<in> S" and less: "norm (y - x) < 1 / (max i j)" for y
     proof -
       have "1 / real (max i j) < \<delta>"
         using j \<open>j \<noteq> 0\<close> \<open>0 < \<delta>\<close>
         by (auto simp: field_split_simps max_mult_distrib_left of_nat_max)
     then have "norm (y - x) < \<delta>"
       using less by linarith
     with \<delta> \<open>y \<in> S\<close> have le: "norm (f y - f x - f' x (y - x)) \<le> B * norm (y - x) - norm (y - x)/i"
       by (auto simp: algebra_simps)
     have *: "\<lbrakk>norm(f - f' - y) \<le> b - c; b \<le> norm y; d \<le> c\<rbrakk> \<Longrightarrow> d \<le> norm(f - f')"
       for b c d and y f f'::'a
       using norm_triangle_ineq3 [of "f - f'" y] by simp
     show ?thesis
       apply (rule * [OF le B])
       using \<open>i \<noteq> 0\<close> \<open>j \<noteq> 0\<close> by (simp add: field_split_simps max_mult_distrib_left of_nat_max less_max_iff_disj)
   qed
   with \<open>x \<in> S\<close> \<open>i \<noteq> 0\<close> \<open>j \<noteq> 0\<close> show "\<exists>n\<in>{0<..}. x \<in> U n"
     by (rule_tac x="max i j" in bexI) (auto simp: field_simps U_def less_max_iff_disj)
 qed
   ultimately show ?thesis
     by (rule negligible_subset)
 qed
 
 lemma absolutely_integrable_Un:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes S: "f absolutely_integrable_on S" and T: "f absolutely_integrable_on T"
   shows "f absolutely_integrable_on (S \<union> T)"
 proof -
   have [simp]: "{x. (if x \<in> A then f x else 0) \<noteq> 0} = {x \<in> A. f x \<noteq> 0}" for A
     by auto
   let ?ST = "{x \<in> S. f x \<noteq> 0} \<inter> {x \<in> T. f x \<noteq> 0}"
   have "?ST \<in> sets lebesgue"
   proof (rule Sigma_Algebra.sets.Int)
     have "f integrable_on S"
       using S absolutely_integrable_on_def by blast
     then have "(\<lambda>x. if x \<in> S then f x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have borel: "(\<lambda>x. if x \<in> S then f x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
       using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
     then show "{x \<in> S. f x \<noteq> 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_open
       by (rule allE [where x = "-{0}"]) auto
   next
     have "f integrable_on T"
       using T absolutely_integrable_on_def by blast
     then have "(\<lambda>x. if x \<in> T then f x else 0) integrable_on UNIV"
       by (simp add: integrable_restrict_UNIV)
     then have borel: "(\<lambda>x. if x \<in> T then f x else 0) \<in> borel_measurable (lebesgue_on UNIV)"
       using integrable_imp_measurable lebesgue_on_UNIV_eq by blast
     then show "{x \<in> T. f x \<noteq> 0} \<in> sets lebesgue"
       unfolding borel_measurable_vimage_open
       by (rule allE [where x = "-{0}"]) auto
   qed
   then have "f absolutely_integrable_on ?ST"
     by (rule set_integrable_subset [OF S]) auto
   then have Int: "(\<lambda>x. if x \<in> ?ST then f x else 0) absolutely_integrable_on UNIV"
     using absolutely_integrable_restrict_UNIV by blast
   have "(\<lambda>x. if x \<in> S then f x else 0) absolutely_integrable_on UNIV"
        "(\<lambda>x. if x \<in> T then f x else 0) absolutely_integrable_on UNIV"
     using S T absolutely_integrable_restrict_UNIV by blast+
   then have "(\<lambda>x. (if x \<in> S then f x else 0) + (if x \<in> T then f x else 0)) absolutely_integrable_on UNIV"
     by (rule set_integral_add)
   then have "(\<lambda>x. ((if x \<in> S then f x else 0) + (if x \<in> T then f x else 0)) - (if x \<in> ?ST then f x else 0)) absolutely_integrable_on UNIV"
     using Int by (rule set_integral_diff)
   then have "(\<lambda>x. if x \<in> S \<union> T then f x else 0) absolutely_integrable_on UNIV"
     by (rule absolutely_integrable_spike) (auto intro: empty_imp_negligible)
   then show ?thesis
     unfolding absolutely_integrable_restrict_UNIV .
 qed
 
 lemma absolutely_integrable_on_combine:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "f absolutely_integrable_on {a..c}"
     and "f absolutely_integrable_on {c..b}"
     and "a \<le> c"
     and "c \<le> b"
   shows "f absolutely_integrable_on {a..b}"
   by (metis absolutely_integrable_Un assms ivl_disj_un_two_touch(4))
 
 lemma uniform_limit_set_lebesgue_integral_at_top:
   fixes f :: "'a \<Rightarrow> real \<Rightarrow> 'b::{banach, second_countable_topology}"
     and g :: "real \<Rightarrow> real"
   assumes bound: "\<And>x y. x \<in> A \<Longrightarrow> y \<ge> a \<Longrightarrow> norm (f x y) \<le> g y"
   assumes integrable: "set_integrable M {a..} g"
   assumes measurable: "\<And>x. x \<in> A \<Longrightarrow> set_borel_measurable M {a..} (f x)"
   assumes "sets borel \<subseteq> sets M"
   shows   "uniform_limit A (\<lambda>b x. LINT y:{a..b}|M. f x y) (\<lambda>x. LINT y:{a..}|M. f x y) at_top"
 proof (cases "A = {}")
   case False
   then obtain x where x: "x \<in> A" by auto
   have g_nonneg: "g y \<ge> 0" if "y \<ge> a" for y
   proof -
     have "0 \<le> norm (f x y)" by simp
     also have "\<dots> \<le> g y" using bound[OF x that] by simp
     finally show ?thesis .
   qed
 
   have integrable': "set_integrable M {a..} (\<lambda>y. f x y)" if "x \<in> A" for x
     unfolding set_integrable_def
   proof (rule Bochner_Integration.integrable_bound)
     show "integrable M (\<lambda>x. indicator {a..} x * g x)"
       using integrable by (simp add: set_integrable_def)
     show "(\<lambda>y. indicat_real {a..} y *\<^sub>R f x y) \<in> borel_measurable M" using measurable[OF that]
       by (simp add: set_borel_measurable_def)
     show "AE y in M. norm (indicat_real {a..} y *\<^sub>R f x y) \<le> norm (indicat_real {a..} y * g y)"
       using bound[OF that] by (intro AE_I2) (auto simp: indicator_def g_nonneg)
   qed
 
   show ?thesis
   proof (rule uniform_limitI)
     fix e :: real assume e: "e > 0"
     have sets [intro]: "A \<in> sets M" if "A \<in> sets borel" for A
       using that assms by blast
 
     have "((\<lambda>b. LINT y:{a..b}|M. g y) \<longlongrightarrow> (LINT y:{a..}|M. g y)) at_top"
       by (intro tendsto_set_lebesgue_integral_at_top assms sets) auto
     with e obtain b0 :: real where b0: "\<forall>b\<ge>b0. \<bar>(LINT y:{a..}|M. g y) - (LINT y:{a..b}|M. g y)\<bar> < e"
       by (auto simp: tendsto_iff eventually_at_top_linorder dist_real_def abs_minus_commute)
     define b where "b = max a b0"
     have "a \<le> b" by (simp add: b_def)
     from b0 have "\<bar>(LINT y:{a..}|M. g y) - (LINT y:{a..b}|M. g y)\<bar> < e"
       by (auto simp: b_def)
     also have "{a..} = {a..b} \<union> {b<..}" by (auto simp: b_def)
     also have "\<bar>(LINT y:\<dots>|M. g y) - (LINT y:{a..b}|M. g y)\<bar> = \<bar>(LINT y:{b<..}|M. g y)\<bar>"
       using \<open>a \<le> b\<close> by (subst set_integral_Un) (auto intro!: set_integrable_subset[OF integrable])
     also have "(LINT y:{b<..}|M. g y) \<ge> 0"
       using g_nonneg \<open>a \<le> b\<close> unfolding set_lebesgue_integral_def
       by (intro Bochner_Integration.integral_nonneg) (auto simp: indicator_def)
     hence "\<bar>(LINT y:{b<..}|M. g y)\<bar> = (LINT y:{b<..}|M. g y)" by simp
     finally have less: "(LINT y:{b<..}|M. g y) < e" .
 
     have "eventually (\<lambda>b. b \<ge> b0) at_top" by (rule eventually_ge_at_top)
     moreover have "eventually (\<lambda>b. b \<ge> a) at_top" by (rule eventually_ge_at_top)
     ultimately show "eventually (\<lambda>b. \<forall>x\<in>A.
                        dist (LINT y:{a..b}|M. f x y) (LINT y:{a..}|M. f x y) < e) at_top"
     proof eventually_elim
       case (elim b)
       show ?case
       proof
         fix x assume x: "x \<in> A"
         have "dist (LINT y:{a..b}|M. f x y) (LINT y:{a..}|M. f x y) =
                 norm ((LINT y:{a..}|M. f x y) - (LINT y:{a..b}|M. f x y))"
           by (simp add: dist_norm norm_minus_commute)
         also have "{a..} = {a..b} \<union> {b<..}" using elim by auto
         also have "(LINT y:\<dots>|M. f x y) - (LINT y:{a..b}|M. f x y) = (LINT y:{b<..}|M. f x y)"
           using elim x
           by (subst set_integral_Un) (auto intro!: set_integrable_subset[OF integrable'])
         also have "norm \<dots> \<le> (LINT y:{b<..}|M. norm (f x y))" using elim x
           by (intro set_integral_norm_bound set_integrable_subset[OF integrable']) auto
         also have "\<dots> \<le> (LINT y:{b<..}|M. g y)" using elim x bound g_nonneg
           by (intro set_integral_mono set_integrable_norm set_integrable_subset[OF integrable']
                     set_integrable_subset[OF integrable]) auto
         also have "(LINT y:{b<..}|M. g y) \<ge> 0"
           using g_nonneg \<open>a \<le> b\<close> unfolding set_lebesgue_integral_def
           by (intro Bochner_Integration.integral_nonneg) (auto simp: indicator_def)
         hence "(LINT y:{b<..}|M. g y) = \<bar>(LINT y:{b<..}|M. g y)\<bar>" by simp
         also have "\<dots> = \<bar>(LINT y:{a..b} \<union> {b<..}|M. g y) - (LINT y:{a..b}|M. g y)\<bar>"
           using elim by (subst set_integral_Un) (auto intro!: set_integrable_subset[OF integrable])
         also have "{a..b} \<union> {b<..} = {a..}" using elim by auto
         also have "\<bar>(LINT y:{a..}|M. g y) - (LINT y:{a..b}|M. g y)\<bar> < e"
           using b0 elim by blast
         finally show "dist (LINT y:{a..b}|M. f x y) (LINT y:{a..}|M. f x y) < e" .
       qed
     qed
   qed
 qed auto
 
 
 
 subsubsection\<open>Differentiability of inverse function (most basic form)\<close>
 
 proposition has_derivative_inverse_within:
   fixes f :: "'a::real_normed_vector \<Rightarrow> 'b::euclidean_space"
   assumes der_f: "(f has_derivative f') (at a within S)"
     and cont_g: "continuous (at (f a) within f ` S) g"
     and "a \<in> S" "linear g'" and id: "g' \<circ> f' = id"
     and gf: "\<And>x. x \<in> S \<Longrightarrow> g(f x) = x"
   shows "(g has_derivative g') (at (f a) within f ` S)"
 proof -
   have [simp]: "g' (f' x) = x" for x
     by (simp add: local.id pointfree_idE)
   have "bounded_linear f'"
     and f': "\<And>e. e>0 \<Longrightarrow> \<exists>d>0. \<forall>y\<in>S. norm (y - a) < d \<longrightarrow>
                         norm (f y - f a - f' (y - a)) \<le> e * norm (y - a)"
     using der_f by (auto simp: has_derivative_within_alt)
   obtain C where "C > 0" and C: "\<And>x. norm (g' x) \<le> C * norm x"
     using linear_bounded_pos [OF \<open>linear g'\<close>] by metis
   obtain B k where "B > 0" "k > 0"
     and Bk: "\<And>x. \<lbrakk>x \<in> S; norm(f x - f a) < k\<rbrakk> \<Longrightarrow> norm(x - a) \<le> B * norm(f x - f a)"
   proof -
     obtain B where "B > 0" and B: "\<And>x. B * norm x \<le> norm (f' x)"
       using linear_inj_bounded_below_pos [of f'] \<open>linear g'\<close> id der_f has_derivative_linear
         linear_invertible_bounded_below_pos by blast
     then obtain d where "d>0"
       and d: "\<And>y. \<lbrakk>y \<in> S; norm (y - a) < d\<rbrakk> \<Longrightarrow>
                     norm (f y - f a - f' (y - a)) \<le> B / 2 * norm (y - a)"
       using f' [of "B/2"] by auto
     then obtain e where "e > 0"
       and e: "\<And>x. \<lbrakk>x \<in> S; norm (f x - f a) < e\<rbrakk> \<Longrightarrow> norm (g (f x) - g (f a)) < d"
       using cont_g by (auto simp: continuous_within_eps_delta dist_norm)
     show thesis
     proof
       show "2/B > 0"
         using \<open>B > 0\<close> by simp
       show "norm (x - a) \<le> 2 / B * norm (f x - f a)"
         if "x \<in> S" "norm (f x - f a) < e" for x
       proof -
         have xa: "norm (x - a) < d"
           using e [OF that] gf by (simp add: \<open>a \<in> S\<close> that)
         have *: "\<lbrakk>norm(y - f') \<le> B / 2 * norm x; B * norm x \<le> norm f'\<rbrakk>
                  \<Longrightarrow> norm y \<ge> B / 2 * norm x" for y f'::'b and x::'a
           using norm_triangle_ineq3 [of y f'] by linarith
         show ?thesis
           using * [OF d [OF \<open>x \<in> S\<close> xa] B] \<open>B > 0\<close> by (simp add: field_simps)
       qed
     qed (use \<open>e > 0\<close> in auto)
   qed
   show ?thesis
     unfolding has_derivative_within_alt
   proof (intro conjI impI allI)
     show "bounded_linear g'"
       using \<open>linear g'\<close> by (simp add: linear_linear)
   next
     fix e :: "real"
     assume "e > 0"
     then obtain d where "d>0"
       and d: "\<And>y. \<lbrakk>y \<in> S; norm (y - a) < d\<rbrakk> \<Longrightarrow>
                     norm (f y - f a - f' (y - a)) \<le> e / (B * C) * norm (y - a)"
       using f' [of "e / (B * C)"] \<open>B > 0\<close> \<open>C > 0\<close> by auto
     have "norm (x - a - g' (f x - f a)) \<le> e * norm (f x - f a)"
       if "x \<in> S" and lt_k: "norm (f x - f a) < k" and lt_dB: "norm (f x - f a) < d/B" for x
     proof -
       have "norm (x - a) \<le> B * norm(f x - f a)"
         using Bk lt_k \<open>x \<in> S\<close> by blast
       also have "\<dots> < d"
         by (metis \<open>0 < B\<close> lt_dB mult.commute pos_less_divide_eq)
       finally have lt_d: "norm (x - a) < d" .
       have "norm (x - a - g' (f x - f a)) \<le> norm(g'(f x - f a - (f' (x - a))))"
         by (simp add: linear_diff [OF \<open>linear g'\<close>] norm_minus_commute)
       also have "\<dots> \<le> C * norm (f x - f a - f' (x - a))"
         using C by blast
       also have "\<dots> \<le> e * norm (f x - f a)"
       proof -
         have "norm (f x - f a - f' (x - a)) \<le> e / (B * C) * norm (x - a)"
           using d [OF \<open>x \<in> S\<close> lt_d] .
         also have "\<dots> \<le> (norm (f x - f a) * e) / C"
           using \<open>B > 0\<close> \<open>C > 0\<close> \<open>e > 0\<close> by (simp add: field_simps Bk lt_k \<open>x \<in> S\<close>)
         finally show ?thesis
           using \<open>C > 0\<close> by (simp add: field_simps)
       qed
     finally show ?thesis .
     qed
     then show "\<exists>d>0. \<forall>y\<in>f ` S.
                norm (y - f a) < d \<longrightarrow>
                norm (g y - g (f a) - g' (y - f a)) \<le> e * norm (y - f a)"
       apply (rule_tac x="min k (d / B)" in exI)
       using \<open>k > 0\<close> \<open>B > 0\<close> \<open>d > 0\<close> \<open>a \<in> S\<close> by (auto simp: gf)
   qed
 qed
 
 end
diff --git a/src/HOL/Analysis/Henstock_Kurzweil_Integration.thy b/src/HOL/Analysis/Henstock_Kurzweil_Integration.thy
--- a/src/HOL/Analysis/Henstock_Kurzweil_Integration.thy
+++ b/src/HOL/Analysis/Henstock_Kurzweil_Integration.thy
@@ -1,7627 +1,7665 @@
 (*  Author:     John Harrison
     Author:     Robert Himmelmann, TU Muenchen (Translation from HOL light)
                 Huge cleanup by LCP
 *)
 
 section \<open>Henstock-Kurzweil Gauge Integration in Many Dimensions\<close>
 
 theory Henstock_Kurzweil_Integration
 imports
   Lebesgue_Measure Tagged_Division
 begin
 
 lemma norm_diff2: "\<lbrakk>y = y1 + y2; x = x1 + x2; e = e1 + e2; norm(y1 - x1) \<le> e1; norm(y2 - x2) \<le> e2\<rbrakk>
   \<Longrightarrow> norm(y-x) \<le> e"
   using norm_triangle_mono [of "y1 - x1" "e1" "y2 - x2" "e2"]
   by (simp add: add_diff_add)
 
 lemma setcomp_dot1: "{z. P (z \<bullet> (i,0))} = {(x,y). P(x \<bullet> i)}"
   by auto
 
 lemma setcomp_dot2: "{z. P (z \<bullet> (0,i))} = {(x,y). P(y \<bullet> i)}"
   by auto
 
 lemma Sigma_Int_Paircomp1: "(Sigma A B) \<inter> {(x, y). P x} = Sigma (A \<inter> {x. P x}) B"
   by blast
 
 lemma Sigma_Int_Paircomp2: "(Sigma A B) \<inter> {(x, y). P y} = Sigma A (\<lambda>z. B z \<inter> {y. P y})"
   by blast
 (* END MOVE *)
 
 subsection \<open>Content (length, area, volume...) of an interval\<close>
 
 abbreviation content :: "'a::euclidean_space set \<Rightarrow> real"
   where "content s \<equiv> measure lborel s"
 
 lemma content_cbox_cases:
   "content (cbox a b) = (if \<forall>i\<in>Basis. a\<bullet>i \<le> b\<bullet>i then prod (\<lambda>i. b\<bullet>i - a\<bullet>i) Basis else 0)"
   by (simp add: measure_lborel_cbox_eq inner_diff)
 
 lemma content_cbox: "\<forall>i\<in>Basis. a\<bullet>i \<le> b\<bullet>i \<Longrightarrow> content (cbox a b) = (\<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i)"
   unfolding content_cbox_cases by simp
 
 lemma content_cbox': "cbox a b \<noteq> {} \<Longrightarrow> content (cbox a b) = (\<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i)"
   by (simp add: box_ne_empty inner_diff)
 
 lemma content_cbox_if: "content (cbox a b) = (if cbox a b = {} then 0 else \<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i)"
   by (simp add: content_cbox')
 
 lemma content_cbox_cart:
    "cbox a b \<noteq> {} \<Longrightarrow> content(cbox a b) = prod (\<lambda>i. b$i - a$i) UNIV"
   by (simp add: content_cbox_if Basis_vec_def cart_eq_inner_axis axis_eq_axis prod.UNION_disjoint)
 
 lemma content_cbox_if_cart:
    "content(cbox a b) = (if cbox a b = {} then 0 else prod (\<lambda>i. b$i - a$i) UNIV)"
   by (simp add: content_cbox_cart)
 
 lemma content_division_of:
   assumes "K \<in> \<D>" "\<D> division_of S"
   shows "content K = (\<Prod>i \<in> Basis. interval_upperbound K \<bullet> i - interval_lowerbound K \<bullet> i)"
 proof -
   obtain a b where "K = cbox a b"
     using cbox_division_memE assms by metis
   then show ?thesis
     using assms by (force simp: division_of_def content_cbox')
 qed
 
 lemma content_real: "a \<le> b \<Longrightarrow> content {a..b} = b - a"
   by simp
 
 lemma abs_eq_content: "\<bar>y - x\<bar> = (if x\<le>y then content {x..y} else content {y..x})"
   by (auto simp: content_real)
 
 lemma content_singleton: "content {a} = 0"
   by simp
 
 lemma content_unit[iff]: "content (cbox 0 (One::'a::euclidean_space)) = 1"
   by simp
 
 lemma content_pos_le [iff]: "0 \<le> content X"
   by simp
 
 corollary\<^marker>\<open>tag unimportant\<close> content_nonneg [simp]: "\<not> content (cbox a b) < 0"
   using not_le by blast
 
 lemma content_pos_lt: "\<forall>i\<in>Basis. a\<bullet>i < b\<bullet>i \<Longrightarrow> 0 < content (cbox a b)"
   by (auto simp: less_imp_le inner_diff box_eq_empty intro!: prod_pos)
 
 lemma content_eq_0: "content (cbox a b) = 0 \<longleftrightarrow> (\<exists>i\<in>Basis. b\<bullet>i \<le> a\<bullet>i)"
   by (auto simp: content_cbox_cases not_le intro: less_imp_le antisym eq_refl)
 
 lemma content_eq_0_interior: "content (cbox a b) = 0 \<longleftrightarrow> interior(cbox a b) = {}"
   unfolding content_eq_0 interior_cbox box_eq_empty by auto
 
 lemma content_pos_lt_eq: "0 < content (cbox a (b::'a::euclidean_space)) \<longleftrightarrow> (\<forall>i\<in>Basis. a\<bullet>i < b\<bullet>i)"
   by (auto simp add: content_cbox_cases less_le prod_nonneg)
 
 lemma content_empty [simp]: "content {} = 0"
   by simp
 
 lemma content_real_if [simp]: "content {a..b} = (if a \<le> b then b - a else 0)"
   by (simp add: content_real)
 
 lemma content_subset: "cbox a b \<subseteq> cbox c d \<Longrightarrow> content (cbox a b) \<le> content (cbox c d)"
   unfolding measure_def
   by (intro enn2real_mono emeasure_mono) (auto simp: emeasure_lborel_cbox_eq)
 
 lemma content_lt_nz: "0 < content (cbox a b) \<longleftrightarrow> content (cbox a b) \<noteq> 0"
   unfolding content_pos_lt_eq content_eq_0 unfolding not_ex not_le by fastforce
 
 lemma content_Pair: "content (cbox (a,c) (b,d)) = content (cbox a b) * content (cbox c d)"
   unfolding measure_lborel_cbox_eq Basis_prod_def
   apply (subst prod.union_disjoint)
   apply (auto simp: bex_Un ball_Un)
   apply (subst (1 2) prod.reindex_nontrivial)
   apply auto
   done
 
 lemma content_cbox_pair_eq0_D:
    "content (cbox (a,c) (b,d)) = 0 \<Longrightarrow> content (cbox a b) = 0 \<or> content (cbox c d) = 0"
   by (simp add: content_Pair)
 
 lemma content_cbox_plus:
   fixes x :: "'a::euclidean_space"
   shows "content(cbox x (x + h *\<^sub>R One)) = (if h \<ge> 0 then h ^ DIM('a) else 0)"
   by (simp add: algebra_simps content_cbox_if box_eq_empty)
 
 lemma content_0_subset: "content(cbox a b) = 0 \<Longrightarrow> s \<subseteq> cbox a b \<Longrightarrow> content s = 0"
   using emeasure_mono[of s "cbox a b" lborel]
   by (auto simp: measure_def enn2real_eq_0_iff emeasure_lborel_cbox_eq)
 
+lemma content_ball_pos:
+  assumes "r > 0"
+  shows   "content (ball c r) > 0"
+proof -
+  from rational_boxes[OF assms, of c] obtain a b where ab: "c \<in> box a b" "box a b \<subseteq> ball c r"
+    by auto
+  from ab have "0 < content (box a b)"
+    by (subst measure_lborel_box_eq) (auto intro!: prod_pos simp: algebra_simps box_def)
+  have "emeasure lborel (box a b) \<le> emeasure lborel (ball c r)"
+    using ab by (intro emeasure_mono) auto
+  also have "emeasure lborel (box a b) = ennreal (content (box a b))"
+    using emeasure_lborel_box_finite[of a b] by (intro emeasure_eq_ennreal_measure) auto
+  also have "emeasure lborel (ball c r) = ennreal (content (ball c r))"
+    using emeasure_lborel_ball_finite[of c r] by (intro emeasure_eq_ennreal_measure) auto
+  finally show ?thesis
+    using \<open>content (box a b) > 0\<close> by simp
+qed
+
+lemma content_cball_pos:
+  assumes "r > 0"
+  shows   "content (cball c r) > 0"
+proof -
+  from rational_boxes[OF assms, of c] obtain a b where ab: "c \<in> box a b" "box a b \<subseteq> ball c r"
+    by auto
+  from ab have "0 < content (box a b)"
+    by (subst measure_lborel_box_eq) (auto intro!: prod_pos simp: algebra_simps box_def)
+  have "emeasure lborel (box a b) \<le> emeasure lborel (ball c r)"
+    using ab by (intro emeasure_mono) auto
+  also have "\<dots> \<le> emeasure lborel (cball c r)"
+    by (intro emeasure_mono) auto
+  also have "emeasure lborel (box a b) = ennreal (content (box a b))"
+    using emeasure_lborel_box_finite[of a b] by (intro emeasure_eq_ennreal_measure) auto
+  also have "emeasure lborel (cball c r) = ennreal (content (cball c r))"
+    using emeasure_lborel_cball_finite[of c r] by (intro emeasure_eq_ennreal_measure) auto
+  finally show ?thesis
+    using \<open>content (box a b) > 0\<close> by simp
+qed
+
 lemma content_split:
   fixes a :: "'a::euclidean_space"
   assumes "k \<in> Basis"
   shows "content (cbox a b) = content(cbox a b \<inter> {x. x\<bullet>k \<le> c}) + content(cbox a b \<inter> {x. x\<bullet>k \<ge> c})"
   \<comment> \<open>Prove using measure theory\<close>
 proof (cases "\<forall>i\<in>Basis. a \<bullet> i \<le> b \<bullet> i")
   case True
   have 1: "\<And>X Y Z. (\<Prod>i\<in>Basis. Z i (if i = k then X else Y i)) = Z k X * (\<Prod>i\<in>Basis-{k}. Z i (Y i))"
     by (simp add: if_distrib prod.delta_remove assms)
   note simps = interval_split[OF assms] content_cbox_cases
   have 2: "(\<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i) = (\<Prod>i\<in>Basis-{k}. b\<bullet>i - a\<bullet>i) * (b\<bullet>k - a\<bullet>k)"
     by (metis (no_types, lifting) assms finite_Basis mult.commute prod.remove)
   have "\<And>x. min (b \<bullet> k) c = max (a \<bullet> k) c \<Longrightarrow>
     x * (b\<bullet>k - a\<bullet>k) = x * (max (a \<bullet> k) c - a \<bullet> k) + x * (b \<bullet> k - max (a \<bullet> k) c)"
     by  (auto simp add: field_simps)
   moreover
   have **: "(\<Prod>i\<in>Basis. ((\<Sum>i\<in>Basis. (if i = k then min (b \<bullet> k) c else b \<bullet> i) *\<^sub>R i) \<bullet> i - a \<bullet> i)) =
       (\<Prod>i\<in>Basis. (if i = k then min (b \<bullet> k) c else b \<bullet> i) - a \<bullet> i)"
     "(\<Prod>i\<in>Basis. b \<bullet> i - ((\<Sum>i\<in>Basis. (if i = k then max (a \<bullet> k) c else a \<bullet> i) *\<^sub>R i) \<bullet> i)) =
       (\<Prod>i\<in>Basis. b \<bullet> i - (if i = k then max (a \<bullet> k) c else a \<bullet> i))"
     by (auto intro!: prod.cong)
   have "\<not> a \<bullet> k \<le> c \<Longrightarrow> \<not> c \<le> b \<bullet> k \<Longrightarrow> False"
     unfolding not_le using True assms by auto
   ultimately show ?thesis
     using assms unfolding simps ** 1[of "\<lambda>i x. b\<bullet>i - x"] 1[of "\<lambda>i x. x - a\<bullet>i"] 2
     by auto
 next
   case False
   then have "cbox a b = {}"
     unfolding box_eq_empty by (auto simp: not_le)
   then show ?thesis
     by (auto simp: not_le)
 qed
 
 lemma division_of_content_0:
   assumes "content (cbox a b) = 0" "d division_of (cbox a b)" "K \<in> d"
   shows "content K = 0"
   unfolding forall_in_division[OF assms(2)]
   by (meson assms content_0_subset division_of_def)
 
 lemma sum_content_null:
   assumes "content (cbox a b) = 0"
     and "p tagged_division_of (cbox a b)"
   shows "(\<Sum>(x,K)\<in>p. content K *\<^sub>R f x) = (0::'a::real_normed_vector)"
 proof (rule sum.neutral, rule)
   fix y
   assume y: "y \<in> p"
   obtain x K where xk: "y = (x, K)"
     using surj_pair[of y] by blast
   then obtain c d where k: "K = cbox c d" "K \<subseteq> cbox a b"
     by (metis assms(2) tagged_division_ofD(3) tagged_division_ofD(4) y)
   have "(\<lambda>(x',K'). content K' *\<^sub>R f x') y = content K *\<^sub>R f x"
     unfolding xk by auto
   also have "\<dots> = 0"
     using assms(1) content_0_subset k(2) by auto
   finally show "(\<lambda>(x, k). content k *\<^sub>R f x) y = 0" .
 qed
 
 global_interpretation sum_content: operative plus 0 content
   rewrites "comm_monoid_set.F plus 0 = sum"
 proof -
   interpret operative plus 0 content
     by standard (auto simp add: content_split [symmetric] content_eq_0_interior)
   show "operative plus 0 content"
     by standard
   show "comm_monoid_set.F plus 0 = sum"
     by (simp add: sum_def)
 qed
 
 lemma additive_content_division: "d division_of (cbox a b) \<Longrightarrow> sum content d = content (cbox a b)"
   by (fact sum_content.division)
 
 lemma additive_content_tagged_division:
   "d tagged_division_of (cbox a b) \<Longrightarrow> sum (\<lambda>(x,l). content l) d = content (cbox a b)"
   by (fact sum_content.tagged_division)
 
 lemma subadditive_content_division:
   assumes "\<D> division_of S" "S \<subseteq> cbox a b"
   shows "sum content \<D> \<le> content(cbox a b)"
 proof -
   have "\<D> division_of \<Union>\<D>" "\<Union>\<D> \<subseteq> cbox a b"
     using assms by auto
   then obtain \<D>' where "\<D> \<subseteq> \<D>'" "\<D>' division_of cbox a b"
     using partial_division_extend_interval by metis
   then have "sum content \<D> \<le> sum content \<D>'"
     using sum_mono2 by blast
   also have "... \<le> content(cbox a b)"
     by (simp add: \<open>\<D>' division_of cbox a b\<close> additive_content_division less_eq_real_def)
   finally show ?thesis .
 qed
 
 lemma content_real_eq_0: "content {a..b::real} = 0 \<longleftrightarrow> a \<ge> b"
   by (metis atLeastatMost_empty_iff2 content_empty content_real diff_self eq_iff le_cases le_iff_diff_le_0)
 
 lemma property_empty_interval: "\<forall>a b. content (cbox a b) = 0 \<longrightarrow> P (cbox a b) \<Longrightarrow> P {}"
   using content_empty unfolding empty_as_interval by auto
 
 lemma interval_bounds_nz_content [simp]:
   assumes "content (cbox a b) \<noteq> 0"
   shows "interval_upperbound (cbox a b) = b"
     and "interval_lowerbound (cbox a b) = a"
   by (metis assms content_empty interval_bounds')+
 
 subsection \<open>Gauge integral\<close>
 
 text \<open>Case distinction to define it first on compact intervals first, then use a limit. This is only
 much later unified. In Fremlin: Measure Theory, Volume 4I this is generalized using residual sets.\<close>
 
 definition has_integral :: "('n::euclidean_space \<Rightarrow> 'b::real_normed_vector) \<Rightarrow> 'b \<Rightarrow> 'n set \<Rightarrow> bool"
   (infixr "has'_integral" 46)
   where "(f has_integral I) s \<longleftrightarrow>
     (if \<exists>a b. s = cbox a b
       then ((\<lambda>p. \<Sum>(x,k)\<in>p. content k *\<^sub>R f x) \<longlongrightarrow> I) (division_filter s)
       else (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
         (\<exists>z. ((\<lambda>p. \<Sum>(x,k)\<in>p. content k *\<^sub>R (if x \<in> s then f x else 0)) \<longlongrightarrow> z) (division_filter (cbox a b)) \<and>
           norm (z - I) < e)))"
 
 lemma has_integral_cbox:
   "(f has_integral I) (cbox a b) \<longleftrightarrow> ((\<lambda>p. \<Sum>(x,k)\<in>p. content k *\<^sub>R f x) \<longlongrightarrow> I) (division_filter (cbox a b))"
   by (auto simp add: has_integral_def)
 
 lemma has_integral:
   "(f has_integral y) (cbox a b) \<longleftrightarrow>
     (\<forall>e>0. \<exists>\<gamma>. gauge \<gamma> \<and>
       (\<forall>\<D>. \<D> tagged_division_of (cbox a b) \<and> \<gamma> fine \<D> \<longrightarrow>
         norm (sum (\<lambda>(x,k). content(k) *\<^sub>R f x) \<D> - y) < e))"
   by (auto simp: dist_norm eventually_division_filter has_integral_def tendsto_iff)
 
 lemma has_integral_real:
   "(f has_integral y) {a..b::real} \<longleftrightarrow>
     (\<forall>e>0. \<exists>\<gamma>. gauge \<gamma> \<and>
       (\<forall>\<D>. \<D> tagged_division_of {a..b} \<and> \<gamma> fine \<D> \<longrightarrow>
         norm (sum (\<lambda>(x,k). content(k) *\<^sub>R f x) \<D> - y) < e))"
   unfolding box_real[symmetric] by (rule has_integral)
 
 lemma has_integralD[dest]:
   assumes "(f has_integral y) (cbox a b)"
     and "e > 0"
   obtains \<gamma>
     where "gauge \<gamma>"
       and "\<And>\<D>. \<D> tagged_division_of (cbox a b) \<Longrightarrow> \<gamma> fine \<D> \<Longrightarrow>
         norm ((\<Sum>(x,k)\<in>\<D>. content k *\<^sub>R f x) - y) < e"
   using assms unfolding has_integral by auto
 
 lemma has_integral_alt:
   "(f has_integral y) i \<longleftrightarrow>
     (if \<exists>a b. i = cbox a b
      then (f has_integral y) i
      else (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       (\<exists>z. ((\<lambda>x. if x \<in> i then f x else 0) has_integral z) (cbox a b) \<and> norm (z - y) < e)))"
   by (subst has_integral_def) (auto simp add: has_integral_cbox)
 
 lemma has_integral_altD:
   assumes "(f has_integral y) i"
     and "\<not> (\<exists>a b. i = cbox a b)"
     and "e>0"
   obtains B where "B > 0"
     and "\<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       (\<exists>z. ((\<lambda>x. if x \<in> i then f(x) else 0) has_integral z) (cbox a b) \<and> norm(z - y) < e)"
   using assms has_integral_alt[of f y i] by auto
 
 definition integrable_on (infixr "integrable'_on" 46)
   where "f integrable_on i \<longleftrightarrow> (\<exists>y. (f has_integral y) i)"
 
 definition "integral i f = (SOME y. (f has_integral y) i \<or> \<not> f integrable_on i \<and> y=0)"
 
 lemma integrable_integral[intro]: "f integrable_on i \<Longrightarrow> (f has_integral (integral i f)) i"
   unfolding integrable_on_def integral_def by (metis (mono_tags, lifting) someI_ex)
 
 lemma not_integrable_integral: "\<not> f integrable_on i \<Longrightarrow> integral i f = 0"
   unfolding integrable_on_def integral_def by blast
 
 lemma has_integral_integrable[dest]: "(f has_integral i) s \<Longrightarrow> f integrable_on s"
   unfolding integrable_on_def by auto
 
 lemma has_integral_integral: "f integrable_on s \<longleftrightarrow> (f has_integral (integral s f)) s"
   by auto
 
 subsection \<open>Basic theorems about integrals\<close>
 
 lemma has_integral_eq_rhs: "(f has_integral j) S \<Longrightarrow> i = j \<Longrightarrow> (f has_integral i) S"
   by (rule forw_subst)
 
 lemma has_integral_unique_cbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   shows "(f has_integral k1) (cbox a b) \<Longrightarrow> (f has_integral k2) (cbox a b) \<Longrightarrow> k1 = k2"
     by (auto simp: has_integral_cbox intro: tendsto_unique[OF division_filter_not_empty])    
 
 lemma has_integral_unique:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral k1) i" "(f has_integral k2) i"
   shows "k1 = k2"
 proof (rule ccontr)
   let ?e = "norm (k1 - k2)/2"
   let ?F = "(\<lambda>x. if x \<in> i then f x else 0)"
   assume "k1 \<noteq> k2"
   then have e: "?e > 0"
     by auto
   have nonbox: "\<not> (\<exists>a b. i = cbox a b)"
     using \<open>k1 \<noteq> k2\<close> assms has_integral_unique_cbox by blast
   obtain B1 where B1:
       "0 < B1"
       "\<And>a b. ball 0 B1 \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?F has_integral z) (cbox a b) \<and> norm (z - k1) < norm (k1 - k2)/2"
     by (rule has_integral_altD[OF assms(1) nonbox,OF e]) blast
   obtain B2 where B2:
       "0 < B2"
       "\<And>a b. ball 0 B2 \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?F has_integral z) (cbox a b) \<and> norm (z - k2) < norm (k1 - k2)/2"
     by (rule has_integral_altD[OF assms(2) nonbox,OF e]) blast
   obtain a b :: 'n where ab: "ball 0 B1 \<subseteq> cbox a b" "ball 0 B2 \<subseteq> cbox a b"
     by (metis Un_subset_iff bounded_Un bounded_ball bounded_subset_cbox_symmetric)
   obtain w where w: "(?F has_integral w) (cbox a b)" "norm (w - k1) < norm (k1 - k2)/2"
     using B1(2)[OF ab(1)] by blast
   obtain z where z: "(?F has_integral z) (cbox a b)" "norm (z - k2) < norm (k1 - k2)/2"
     using B2(2)[OF ab(2)] by blast
   have "z = w"
     using has_integral_unique_cbox[OF w(1) z(1)] by auto
   then have "norm (k1 - k2) \<le> norm (z - k2) + norm (w - k1)"
     using norm_triangle_ineq4 [of "k1 - w" "k2 - z"]
     by (auto simp add: norm_minus_commute)
   also have "\<dots> < norm (k1 - k2)/2 + norm (k1 - k2)/2"
     by (metis add_strict_mono z(2) w(2))
   finally show False by auto
 qed
 
 lemma integral_unique [intro]: "(f has_integral y) k \<Longrightarrow> integral k f = y"
   unfolding integral_def
   by (rule some_equality) (auto intro: has_integral_unique)
 
 lemma has_integral_iff: "(f has_integral i) S \<longleftrightarrow> (f integrable_on S \<and> integral S f = i)"
   by blast
 
 lemma eq_integralD: "integral k f = y \<Longrightarrow> (f has_integral y) k \<or> \<not> f integrable_on k \<and> y=0"
   unfolding integral_def integrable_on_def
   apply (erule subst)
   apply (rule someI_ex)
   by blast
 
 lemma has_integral_const [intro]:
   fixes a b :: "'a::euclidean_space"
   shows "((\<lambda>x. c) has_integral (content (cbox a b) *\<^sub>R c)) (cbox a b)"
   using eventually_division_filter_tagged_division[of "cbox a b"]
      additive_content_tagged_division[of _ a b]
   by (auto simp: has_integral_cbox split_beta' scaleR_sum_left[symmetric]
            elim!: eventually_mono intro!: tendsto_cong[THEN iffD1, OF _ tendsto_const])
 
 lemma has_integral_const_real [intro]:
   fixes a b :: real
   shows "((\<lambda>x. c) has_integral (content {a..b} *\<^sub>R c)) {a..b}"
   by (metis box_real(2) has_integral_const)
 
 lemma has_integral_integrable_integral: "(f has_integral i) s \<longleftrightarrow> f integrable_on s \<and> integral s f = i"
   by blast
 
 lemma integral_const [simp]:
   fixes a b :: "'a::euclidean_space"
   shows "integral (cbox a b) (\<lambda>x. c) = content (cbox a b) *\<^sub>R c"
   by (rule integral_unique) (rule has_integral_const)
 
 lemma integral_const_real [simp]:
   fixes a b :: real
   shows "integral {a..b} (\<lambda>x. c) = content {a..b} *\<^sub>R c"
   by (metis box_real(2) integral_const)
 
 lemma has_integral_is_0_cbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "\<And>x. x \<in> cbox a b \<Longrightarrow> f x = 0"
   shows "(f has_integral 0) (cbox a b)"
     unfolding has_integral_cbox
     using eventually_division_filter_tagged_division[of "cbox a b"] assms
     by (subst tendsto_cong[where g="\<lambda>_. 0"])
        (auto elim!: eventually_mono intro!: sum.neutral simp: tag_in_interval)
 
 lemma has_integral_is_0:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "\<And>x. x \<in> S \<Longrightarrow> f x = 0"
   shows "(f has_integral 0) S"
 proof (cases "(\<exists>a b. S = cbox a b)")
   case True with assms has_integral_is_0_cbox show ?thesis
     by blast
 next
   case False
   have *: "(\<lambda>x. if x \<in> S then f x else 0) = (\<lambda>x. 0)"
     by (auto simp add: assms)
   show ?thesis
     using has_integral_is_0_cbox False
     by (subst has_integral_alt) (force simp add: *)
 qed
 
 lemma has_integral_0[simp]: "((\<lambda>x::'n::euclidean_space. 0) has_integral 0) S"
   by (rule has_integral_is_0) auto
 
 lemma has_integral_0_eq[simp]: "((\<lambda>x. 0) has_integral i) S \<longleftrightarrow> i = 0"
   using has_integral_unique[OF has_integral_0] by auto
 
 lemma has_integral_linear_cbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes f: "(f has_integral y) (cbox a b)"
     and h: "bounded_linear h"
   shows "((h \<circ> f) has_integral (h y)) (cbox a b)"
 proof -
   interpret bounded_linear h using h .
   show ?thesis
     unfolding has_integral_cbox using tendsto [OF f [unfolded has_integral_cbox]]
     by (simp add: sum scaleR split_beta')
 qed
 
 lemma has_integral_linear:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes f: "(f has_integral y) S"
     and h: "bounded_linear h"
   shows "((h \<circ> f) has_integral (h y)) S"
 proof (cases "(\<exists>a b. S = cbox a b)")
   case True with f h has_integral_linear_cbox show ?thesis 
     by blast
 next
   case False
   interpret bounded_linear h using h .
   from pos_bounded obtain B where B: "0 < B" "\<And>x. norm (h x) \<le> norm x * B"
     by blast
   let ?S = "\<lambda>f x. if x \<in> S then f x else 0"
   show ?thesis
   proof (subst has_integral_alt, clarsimp simp: False)
     fix e :: real
     assume e: "e > 0"
     have *: "0 < e/B" using e B(1) by simp
     obtain M where M:
       "M > 0"
       "\<And>a b. ball 0 M \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?S f has_integral z) (cbox a b) \<and> norm (z - y) < e/B"
       using has_integral_altD[OF f False *] by blast
     show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       (\<exists>z. (?S(h \<circ> f) has_integral z) (cbox a b) \<and> norm (z - h y) < e)"
     proof (rule exI, intro allI conjI impI)
       show "M > 0" using M by metis
     next
       fix a b::'n
       assume sb: "ball 0 M \<subseteq> cbox a b"
       obtain z where z: "(?S f has_integral z) (cbox a b)" "norm (z - y) < e/B"
         using M(2)[OF sb] by blast
       have *: "?S(h \<circ> f) = h \<circ> ?S f"
         using zero by auto
       show "\<exists>z. (?S(h \<circ> f) has_integral z) (cbox a b) \<and> norm (z - h y) < e"
         apply (rule_tac x="h z" in exI)
         apply (simp add: * has_integral_linear_cbox[OF z(1) h])
         apply (metis B diff le_less_trans pos_less_divide_eq z(2))
         done
     qed
   qed
 qed
 
 lemma has_integral_scaleR_left:
   "(f has_integral y) S \<Longrightarrow> ((\<lambda>x. f x *\<^sub>R c) has_integral (y *\<^sub>R c)) S"
   using has_integral_linear[OF _ bounded_linear_scaleR_left] by (simp add: comp_def)
 
 lemma integrable_on_scaleR_left:
   assumes "f integrable_on A"
   shows "(\<lambda>x. f x *\<^sub>R y) integrable_on A"
   using assms has_integral_scaleR_left unfolding integrable_on_def by blast
 
 lemma has_integral_mult_left:
   fixes c :: "_ :: real_normed_algebra"
   shows "(f has_integral y) S \<Longrightarrow> ((\<lambda>x. f x * c) has_integral (y * c)) S"
   using has_integral_linear[OF _ bounded_linear_mult_left] by (simp add: comp_def)
 
 lemma has_integral_divide:
   fixes c :: "_ :: real_normed_div_algebra"
   shows "(f has_integral y) S \<Longrightarrow> ((\<lambda>x. f x / c) has_integral (y / c)) S"
   unfolding divide_inverse by (simp add: has_integral_mult_left)
 
 text\<open>The case analysis eliminates the condition \<^term>\<open>f integrable_on S\<close> at the cost
      of the type class constraint \<open>division_ring\<close>\<close>
 corollary integral_mult_left [simp]:
   fixes c:: "'a::{real_normed_algebra,division_ring}"
   shows "integral S (\<lambda>x. f x * c) = integral S f * c"
 proof (cases "f integrable_on S \<or> c = 0")
   case True then show ?thesis
     by (force intro: has_integral_mult_left)
 next
   case False then have "\<not> (\<lambda>x. f x * c) integrable_on S"
     using has_integral_mult_left [of "(\<lambda>x. f x * c)" _ S "inverse c"]
     by (auto simp add: mult.assoc)
   with False show ?thesis by (simp add: not_integrable_integral)
 qed
 
 corollary integral_mult_right [simp]:
   fixes c:: "'a::{real_normed_field}"
   shows "integral S (\<lambda>x. c * f x) = c * integral S f"
 by (simp add: mult.commute [of c])
 
 corollary integral_divide [simp]:
   fixes z :: "'a::real_normed_field"
   shows "integral S (\<lambda>x. f x / z) = integral S (\<lambda>x. f x) / z"
 using integral_mult_left [of S f "inverse z"]
   by (simp add: divide_inverse_commute)
 
 lemma has_integral_mult_right:
   fixes c :: "'a :: real_normed_algebra"
   shows "(f has_integral y) i \<Longrightarrow> ((\<lambda>x. c * f x) has_integral (c * y)) i"
   using has_integral_linear[OF _ bounded_linear_mult_right] by (simp add: comp_def)
 
 lemma has_integral_cmul: "(f has_integral k) S \<Longrightarrow> ((\<lambda>x. c *\<^sub>R f x) has_integral (c *\<^sub>R k)) S"
   unfolding o_def[symmetric]
   by (metis has_integral_linear bounded_linear_scaleR_right)
 
 lemma has_integral_cmult_real:
   fixes c :: real
   assumes "c \<noteq> 0 \<Longrightarrow> (f has_integral x) A"
   shows "((\<lambda>x. c * f x) has_integral c * x) A"
 proof (cases "c = 0")
   case True
   then show ?thesis by simp
 next
   case False
   from has_integral_cmul[OF assms[OF this], of c] show ?thesis
     unfolding real_scaleR_def .
 qed
 
 lemma has_integral_neg: "(f has_integral k) S \<Longrightarrow> ((\<lambda>x. -(f x)) has_integral -k) S"
   by (drule_tac c="-1" in has_integral_cmul) auto
 
 lemma has_integral_neg_iff: "((\<lambda>x. - f x) has_integral k) S \<longleftrightarrow> (f has_integral - k) S"
   using has_integral_neg[of f "- k"] has_integral_neg[of "\<lambda>x. - f x" k] by auto
 
 lemma has_integral_add_cbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "(f has_integral k) (cbox a b)" "(g has_integral l) (cbox a b)"
   shows "((\<lambda>x. f x + g x) has_integral (k + l)) (cbox a b)"
   using assms
     unfolding has_integral_cbox
     by (simp add: split_beta' scaleR_add_right sum.distrib[abs_def] tendsto_add)
 
 lemma has_integral_add:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes f: "(f has_integral k) S" and g: "(g has_integral l) S"
   shows "((\<lambda>x. f x + g x) has_integral (k + l)) S"
 proof (cases "\<exists>a b. S = cbox a b")
   case True with has_integral_add_cbox assms show ?thesis
     by blast 
 next
   let ?S = "\<lambda>f x. if x \<in> S then f x else 0"
   case False
   then show ?thesis
   proof (subst has_integral_alt, clarsimp, goal_cases)
     case (1 e)
     then have e2: "e/2 > 0"
       by auto
     obtain Bf where "0 < Bf"
       and Bf: "\<And>a b. ball 0 Bf \<subseteq> cbox a b \<Longrightarrow>
                      \<exists>z. (?S f has_integral z) (cbox a b) \<and> norm (z - k) < e/2"
       using has_integral_altD[OF f False e2] by blast
     obtain Bg where "0 < Bg"
       and Bg: "\<And>a b. ball 0 Bg \<subseteq> (cbox a b) \<Longrightarrow>
                      \<exists>z. (?S g has_integral z) (cbox a b) \<and> norm (z - l) < e/2"
       using has_integral_altD[OF g False e2] by blast
     show ?case
     proof (rule_tac x="max Bf Bg" in exI, clarsimp simp add: max.strict_coboundedI1 \<open>0 < Bf\<close>)
       fix a b
       assume "ball 0 (max Bf Bg) \<subseteq> cbox a (b::'n)"
       then have fs: "ball 0 Bf \<subseteq> cbox a (b::'n)" and gs: "ball 0 Bg \<subseteq> cbox a (b::'n)"
         by auto
       obtain w where w: "(?S f has_integral w) (cbox a b)" "norm (w - k) < e/2"
         using Bf[OF fs] by blast
       obtain z where z: "(?S g has_integral z) (cbox a b)" "norm (z - l) < e/2"
         using Bg[OF gs] by blast
       have *: "\<And>x. (if x \<in> S then f x + g x else 0) = (?S f x) + (?S g x)"
         by auto
       show "\<exists>z. (?S(\<lambda>x. f x + g x) has_integral z) (cbox a b) \<and> norm (z - (k + l)) < e"
         apply (rule_tac x="w + z" in exI)
         apply (simp add: has_integral_add_cbox[OF w(1) z(1), unfolded *[symmetric]])
         using norm_triangle_ineq[of "w - k" "z - l"] w(2) z(2)
         apply (auto simp add: field_simps)
         done
     qed
   qed
 qed
 
 lemma has_integral_diff:
   "(f has_integral k) S \<Longrightarrow> (g has_integral l) S \<Longrightarrow>
     ((\<lambda>x. f x - g x) has_integral (k - l)) S"
   using has_integral_add[OF _ has_integral_neg, of f k S g l]
   by (auto simp: algebra_simps)
 
 lemma integral_0 [simp]:
   "integral S (\<lambda>x::'n::euclidean_space. 0::'m::real_normed_vector) = 0"
   by (rule integral_unique has_integral_0)+
 
 lemma integral_add: "f integrable_on S \<Longrightarrow> g integrable_on S \<Longrightarrow>
     integral S (\<lambda>x. f x + g x) = integral S f + integral S g"
   by (rule integral_unique) (metis integrable_integral has_integral_add)
 
 lemma integral_cmul [simp]: "integral S (\<lambda>x. c *\<^sub>R f x) = c *\<^sub>R integral S f"
 proof (cases "f integrable_on S \<or> c = 0")
   case True with has_integral_cmul integrable_integral show ?thesis
     by fastforce
 next
   case False then have "\<not> (\<lambda>x. c *\<^sub>R f x) integrable_on S"
     using has_integral_cmul [of "(\<lambda>x. c *\<^sub>R f x)" _ S "inverse c"] by auto
   with False show ?thesis by (simp add: not_integrable_integral)
 qed
 
 lemma integral_mult:
   fixes K::real
   shows "f integrable_on X \<Longrightarrow> K * integral X f = integral X (\<lambda>x. K * f x)"
   unfolding real_scaleR_def[symmetric] integral_cmul ..
 
 lemma integral_neg [simp]: "integral S (\<lambda>x. - f x) = - integral S f"
 proof (cases "f integrable_on S")
   case True then show ?thesis
     by (simp add: has_integral_neg integrable_integral integral_unique)
 next
   case False then have "\<not> (\<lambda>x. - f x) integrable_on S"
     using has_integral_neg [of "(\<lambda>x. - f x)" _ S ] by auto
   with False show ?thesis by (simp add: not_integrable_integral)
 qed
 
 lemma integral_diff: "f integrable_on S \<Longrightarrow> g integrable_on S \<Longrightarrow>
     integral S (\<lambda>x. f x - g x) = integral S f - integral S g"
   by (rule integral_unique) (metis integrable_integral has_integral_diff)
 
 lemma integrable_0: "(\<lambda>x. 0) integrable_on S"
   unfolding integrable_on_def using has_integral_0 by auto
 
 lemma integrable_add: "f integrable_on S \<Longrightarrow> g integrable_on S \<Longrightarrow> (\<lambda>x. f x + g x) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_add)
 
 lemma integrable_cmul: "f integrable_on S \<Longrightarrow> (\<lambda>x. c *\<^sub>R f(x)) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_cmul)
 
 lemma integrable_on_scaleR_iff [simp]:
   fixes c :: real
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. c *\<^sub>R f x) integrable_on S \<longleftrightarrow> f integrable_on S"
   using integrable_cmul[of "\<lambda>x. c *\<^sub>R f x" S "1 / c"] integrable_cmul[of f S c] \<open>c \<noteq> 0\<close>
   by auto
 
 lemma integrable_on_cmult_iff [simp]:
   fixes c :: real
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. c * f x) integrable_on S \<longleftrightarrow> f integrable_on S"
   using integrable_on_scaleR_iff [of c f] assms by simp
 
 lemma integrable_on_cmult_left:
   assumes "f integrable_on S"
   shows "(\<lambda>x. of_real c * f x) integrable_on S"
     using integrable_cmul[of f S "of_real c"] assms
     by (simp add: scaleR_conv_of_real)
 
 lemma integrable_neg: "f integrable_on S \<Longrightarrow> (\<lambda>x. -f(x)) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_neg)
 
 lemma integrable_neg_iff: "(\<lambda>x. -f(x)) integrable_on S \<longleftrightarrow> f integrable_on S"
   using integrable_neg by fastforce
 
 lemma integrable_diff:
   "f integrable_on S \<Longrightarrow> g integrable_on S \<Longrightarrow> (\<lambda>x. f x - g x) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_diff)
 
 lemma integrable_linear:
   "f integrable_on S \<Longrightarrow> bounded_linear h \<Longrightarrow> (h \<circ> f) integrable_on S"
   unfolding integrable_on_def by(auto intro: has_integral_linear)
 
 lemma integral_linear:
   "f integrable_on S \<Longrightarrow> bounded_linear h \<Longrightarrow> integral S (h \<circ> f) = h (integral S f)"
   apply (rule has_integral_unique [where i=S and f = "h \<circ> f"])
   apply (simp_all add: integrable_integral integrable_linear has_integral_linear )
   done
 
 lemma integrable_on_cnj_iff:
   "(\<lambda>x. cnj (f x)) integrable_on A \<longleftrightarrow> f integrable_on A"
   using integrable_linear[OF _ bounded_linear_cnj, of f A]
         integrable_linear[OF _ bounded_linear_cnj, of "cnj \<circ> f" A]
   by (auto simp: o_def)
 
 lemma integral_cnj: "cnj (integral A f) = integral A (\<lambda>x. cnj (f x))"
   by (cases "f integrable_on A")
      (simp_all add: integral_linear[OF _ bounded_linear_cnj, symmetric]
                     o_def integrable_on_cnj_iff not_integrable_integral)
 
 lemma integral_component_eq[simp]:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "f integrable_on S"
   shows "integral S (\<lambda>x. f x \<bullet> k) = integral S f \<bullet> k"
   unfolding integral_linear[OF assms(1) bounded_linear_inner_left,unfolded o_def] ..
 
 lemma has_integral_sum:
   assumes "finite T"
     and "\<And>a. a \<in> T \<Longrightarrow> ((f a) has_integral (i a)) S"
   shows "((\<lambda>x. sum (\<lambda>a. f a x) T) has_integral (sum i T)) S"
   using assms(1) subset_refl[of T]
 proof (induct rule: finite_subset_induct)
   case empty
   then show ?case by auto
 next
   case (insert x F)
   with assms show ?case
     by (simp add: has_integral_add)
 qed
 
 lemma integral_sum:
   "\<lbrakk>finite I;  \<And>a. a \<in> I \<Longrightarrow> f a integrable_on S\<rbrakk> \<Longrightarrow>
    integral S (\<lambda>x. \<Sum>a\<in>I. f a x) = (\<Sum>a\<in>I. integral S (f a))"
   by (simp add: has_integral_sum integrable_integral integral_unique)
 
 lemma integrable_sum:
   "\<lbrakk>finite I;  \<And>a. a \<in> I \<Longrightarrow> f a integrable_on S\<rbrakk> \<Longrightarrow> (\<lambda>x. \<Sum>a\<in>I. f a x) integrable_on S"
   unfolding integrable_on_def using has_integral_sum[of I] by metis
 
 lemma has_integral_eq:
   assumes "\<And>x. x \<in> s \<Longrightarrow> f x = g x"
     and "(f has_integral k) s"
   shows "(g has_integral k) s"
   using has_integral_diff[OF assms(2), of "\<lambda>x. f x - g x" 0]
   using has_integral_is_0[of s "\<lambda>x. f x - g x"]
   using assms(1)
   by auto
 
 lemma integrable_eq: "\<lbrakk>f integrable_on s; \<And>x. x \<in> s \<Longrightarrow> f x = g x\<rbrakk> \<Longrightarrow> g integrable_on s"
   unfolding integrable_on_def
   using has_integral_eq[of s f g] has_integral_eq by blast
 
 lemma has_integral_cong:
   assumes "\<And>x. x \<in> s \<Longrightarrow> f x = g x"
   shows "(f has_integral i) s = (g has_integral i) s"
   using has_integral_eq[of s f g] has_integral_eq[of s g f] assms
   by auto
 
 lemma integral_cong:
   assumes "\<And>x. x \<in> s \<Longrightarrow> f x = g x"
   shows "integral s f = integral s g"
   unfolding integral_def
 by (metis (full_types, hide_lams) assms has_integral_cong integrable_eq)
 
 lemma integrable_on_cmult_left_iff [simp]:
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. of_real c * f x) integrable_on s \<longleftrightarrow> f integrable_on s"
         (is "?lhs = ?rhs")
 proof
   assume ?lhs
   then have "(\<lambda>x. of_real (1 / c) * (of_real c * f x)) integrable_on s"
     using integrable_cmul[of "\<lambda>x. of_real c * f x" s "1 / of_real c"]
     by (simp add: scaleR_conv_of_real)
   then have "(\<lambda>x. (of_real (1 / c) * of_real c * f x)) integrable_on s"
     by (simp add: algebra_simps)
   with \<open>c \<noteq> 0\<close> show ?rhs
     by (metis (no_types, lifting) integrable_eq mult.left_neutral nonzero_divide_eq_eq of_real_1 of_real_mult)
 qed (blast intro: integrable_on_cmult_left)
 
 lemma integrable_on_cmult_right:
   fixes f :: "_ \<Rightarrow> 'b :: {comm_ring,real_algebra_1,real_normed_vector}"
   assumes "f integrable_on s"
   shows "(\<lambda>x. f x * of_real c) integrable_on s"
 using integrable_on_cmult_left [OF assms] by (simp add: mult.commute)
 
 lemma integrable_on_cmult_right_iff [simp]:
   fixes f :: "_ \<Rightarrow> 'b :: {comm_ring,real_algebra_1,real_normed_vector}"
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. f x * of_real c) integrable_on s \<longleftrightarrow> f integrable_on s"
 using integrable_on_cmult_left_iff [OF assms] by (simp add: mult.commute)
 
 lemma integrable_on_cdivide:
   fixes f :: "_ \<Rightarrow> 'b :: real_normed_field"
   assumes "f integrable_on s"
   shows "(\<lambda>x. f x / of_real c) integrable_on s"
 by (simp add: integrable_on_cmult_right divide_inverse assms flip: of_real_inverse)
 
 lemma integrable_on_cdivide_iff [simp]:
   fixes f :: "_ \<Rightarrow> 'b :: real_normed_field"
   assumes "c \<noteq> 0"
   shows "(\<lambda>x. f x / of_real c) integrable_on s \<longleftrightarrow> f integrable_on s"
 by (simp add: divide_inverse assms flip: of_real_inverse)
 
 lemma has_integral_null [intro]: "content(cbox a b) = 0 \<Longrightarrow> (f has_integral 0) (cbox a b)"
   unfolding has_integral_cbox
   using eventually_division_filter_tagged_division[of "cbox a b"]
   by (subst tendsto_cong[where g="\<lambda>_. 0"]) (auto elim: eventually_mono intro: sum_content_null)
 
 lemma has_integral_null_real [intro]: "content {a..b::real} = 0 \<Longrightarrow> (f has_integral 0) {a..b}"
   by (metis box_real(2) has_integral_null)
 
 lemma has_integral_null_eq[simp]: "content (cbox a b) = 0 \<Longrightarrow> (f has_integral i) (cbox a b) \<longleftrightarrow> i = 0"
   by (auto simp add: has_integral_null dest!: integral_unique)
 
 lemma integral_null [simp]: "content (cbox a b) = 0 \<Longrightarrow> integral (cbox a b) f = 0"
   by (metis has_integral_null integral_unique)
 
 lemma integrable_on_null [intro]: "content (cbox a b) = 0 \<Longrightarrow> f integrable_on (cbox a b)"
   by (simp add: has_integral_integrable)
 
 lemma has_integral_empty[intro]: "(f has_integral 0) {}"
   by (meson ex_in_conv has_integral_is_0)
 
 lemma has_integral_empty_eq[simp]: "(f has_integral i) {} \<longleftrightarrow> i = 0"
   by (auto simp add: has_integral_empty has_integral_unique)
 
 lemma integrable_on_empty[intro]: "f integrable_on {}"
   unfolding integrable_on_def by auto
 
 lemma integral_empty[simp]: "integral {} f = 0"
   by (rule integral_unique) (rule has_integral_empty)
 
 lemma has_integral_refl[intro]:
   fixes a :: "'a::euclidean_space"
   shows "(f has_integral 0) (cbox a a)"
     and "(f has_integral 0) {a}"
 proof -
   show "(f has_integral 0) (cbox a a)"
      by (rule has_integral_null) simp
   then show "(f has_integral 0) {a}"
     by simp
 qed
 
 lemma integrable_on_refl[intro]: "f integrable_on cbox a a"
   unfolding integrable_on_def by auto
 
 lemma integral_refl [simp]: "integral (cbox a a) f = 0"
   by (rule integral_unique) auto
 
 lemma integral_singleton [simp]: "integral {a} f = 0"
   by auto
 
 lemma integral_blinfun_apply:
   assumes "f integrable_on s"
   shows "integral s (\<lambda>x. blinfun_apply h (f x)) = blinfun_apply h (integral s f)"
   by (subst integral_linear[symmetric, OF assms blinfun.bounded_linear_right]) (simp add: o_def)
 
 lemma blinfun_apply_integral:
   assumes "f integrable_on s"
   shows "blinfun_apply (integral s f) x = integral s (\<lambda>y. blinfun_apply (f y) x)"
   by (metis (no_types, lifting) assms blinfun.prod_left.rep_eq integral_blinfun_apply integral_cong)
 
 lemma has_integral_componentwise_iff:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "(f has_integral y) A \<longleftrightarrow> (\<forall>b\<in>Basis. ((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A)"
 proof safe
   fix b :: 'b assume "(f has_integral y) A"
   from has_integral_linear[OF this(1) bounded_linear_inner_left, of b]
     show "((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A" by (simp add: o_def)
 next
   assume "(\<forall>b\<in>Basis. ((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A)"
   hence "\<forall>b\<in>Basis. (((\<lambda>x. x *\<^sub>R b) \<circ> (\<lambda>x. f x \<bullet> b)) has_integral ((y \<bullet> b) *\<^sub>R b)) A"
     by (intro ballI has_integral_linear) (simp_all add: bounded_linear_scaleR_left)
   hence "((\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) has_integral (\<Sum>b\<in>Basis. (y \<bullet> b) *\<^sub>R b)) A"
     by (intro has_integral_sum) (simp_all add: o_def)
   thus "(f has_integral y) A" by (simp add: euclidean_representation)
 qed
 
 lemma has_integral_componentwise:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "(\<And>b. b \<in> Basis \<Longrightarrow> ((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A) \<Longrightarrow> (f has_integral y) A"
   by (subst has_integral_componentwise_iff) blast
 
 lemma integrable_componentwise_iff:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "f integrable_on A \<longleftrightarrow> (\<forall>b\<in>Basis. (\<lambda>x. f x \<bullet> b) integrable_on A)"
 proof
   assume "f integrable_on A"
   then obtain y where "(f has_integral y) A" by (auto simp: integrable_on_def)
   hence "(\<forall>b\<in>Basis. ((\<lambda>x. f x \<bullet> b) has_integral (y \<bullet> b)) A)"
     by (subst (asm) has_integral_componentwise_iff)
   thus "(\<forall>b\<in>Basis. (\<lambda>x. f x \<bullet> b) integrable_on A)" by (auto simp: integrable_on_def)
 next
   assume "(\<forall>b\<in>Basis. (\<lambda>x. f x \<bullet> b) integrable_on A)"
   then obtain y where "\<forall>b\<in>Basis. ((\<lambda>x. f x \<bullet> b) has_integral y b) A"
     unfolding integrable_on_def by (subst (asm) bchoice_iff) blast
   hence "\<forall>b\<in>Basis. (((\<lambda>x. x *\<^sub>R b) \<circ> (\<lambda>x. f x \<bullet> b)) has_integral (y b *\<^sub>R b)) A"
     by (intro ballI has_integral_linear) (simp_all add: bounded_linear_scaleR_left)
   hence "((\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b) has_integral (\<Sum>b\<in>Basis. y b *\<^sub>R b)) A"
     by (intro has_integral_sum) (simp_all add: o_def)
   thus "f integrable_on A" by (auto simp: integrable_on_def o_def euclidean_representation)
 qed
 
 lemma integrable_componentwise:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   shows "(\<And>b. b \<in> Basis \<Longrightarrow> (\<lambda>x. f x \<bullet> b) integrable_on A) \<Longrightarrow> f integrable_on A"
   by (subst integrable_componentwise_iff) blast
 
 lemma integral_componentwise:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: euclidean_space"
   assumes "f integrable_on A"
   shows "integral A f = (\<Sum>b\<in>Basis. integral A (\<lambda>x. (f x \<bullet> b) *\<^sub>R b))"
 proof -
   from assms have integrable: "\<forall>b\<in>Basis. (\<lambda>x. x *\<^sub>R b) \<circ> (\<lambda>x. (f x \<bullet> b)) integrable_on A"
     by (subst (asm) integrable_componentwise_iff, intro integrable_linear ballI)
        (simp_all add: bounded_linear_scaleR_left)
   have "integral A f = integral A (\<lambda>x. \<Sum>b\<in>Basis. (f x \<bullet> b) *\<^sub>R b)"
     by (simp add: euclidean_representation)
   also from integrable have "\<dots> = (\<Sum>a\<in>Basis. integral A (\<lambda>x. (f x \<bullet> a) *\<^sub>R a))"
     by (subst integral_sum) (simp_all add: o_def)
   finally show ?thesis .
 qed
 
 lemma integrable_component:
   "f integrable_on A \<Longrightarrow> (\<lambda>x. f x \<bullet> (y :: 'b :: euclidean_space)) integrable_on A"
   by (drule integrable_linear[OF _ bounded_linear_inner_left[of y]]) (simp add: o_def)
 
 
 
 subsection \<open>Cauchy-type criterion for integrability\<close>
 
 proposition integrable_Cauchy:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::{real_normed_vector,complete_space}"
   shows "f integrable_on cbox a b \<longleftrightarrow>
         (\<forall>e>0. \<exists>\<gamma>. gauge \<gamma> \<and>
           (\<forall>\<D>1 \<D>2. \<D>1 tagged_division_of (cbox a b) \<and> \<gamma> fine \<D>1 \<and>
             \<D>2 tagged_division_of (cbox a b) \<and> \<gamma> fine \<D>2 \<longrightarrow>
             norm ((\<Sum>(x,K)\<in>\<D>1. content K *\<^sub>R f x) - (\<Sum>(x,K)\<in>\<D>2. content K *\<^sub>R f x)) < e))"
   (is "?l = (\<forall>e>0. \<exists>\<gamma>. ?P e \<gamma>)")
 proof (intro iffI allI impI)
   assume ?l
   then obtain y
     where y: "\<And>e. e > 0 \<Longrightarrow>
         \<exists>\<gamma>. gauge \<gamma> \<and>
             (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                  norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - y) < e)"
     by (auto simp: integrable_on_def has_integral)
   show "\<exists>\<gamma>. ?P e \<gamma>" if "e > 0" for e
   proof -
     have "e/2 > 0" using that by auto
     with y obtain \<gamma> where "gauge \<gamma>"
       and \<gamma>: "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<Longrightarrow>
                   norm ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f x) - y) < e/2"
       by meson
     show ?thesis
     apply (rule_tac x=\<gamma> in exI, clarsimp simp: \<open>gauge \<gamma>\<close>)
         by (blast intro!: \<gamma> dist_triangle_half_l[where y=y,unfolded dist_norm])
     qed
 next
   assume "\<forall>e>0. \<exists>\<gamma>. ?P e \<gamma>"
   then have "\<forall>n::nat. \<exists>\<gamma>. ?P (1 / (n + 1)) \<gamma>"
     by auto
   then obtain \<gamma> :: "nat \<Rightarrow> 'n \<Rightarrow> 'n set" where \<gamma>:
     "\<And>m. gauge (\<gamma> m)"
     "\<And>m \<D>1 \<D>2. \<lbrakk>\<D>1 tagged_division_of cbox a b;
               \<gamma> m fine \<D>1; \<D>2 tagged_division_of cbox a b; \<gamma> m fine \<D>2\<rbrakk>
               \<Longrightarrow> norm ((\<Sum>(x,K) \<in> \<D>1. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> \<D>2. content K *\<^sub>R f x))
                   < 1 / (m + 1)"
     by metis
   have "\<And>n. gauge (\<lambda>x. \<Inter>{\<gamma> i x |i. i \<in> {0..n}})"
     apply (rule gauge_Inter)
     using \<gamma> by auto
   then have "\<forall>n. \<exists>p. p tagged_division_of (cbox a b) \<and> (\<lambda>x. \<Inter>{\<gamma> i x |i. i \<in> {0..n}}) fine p"
     by (meson fine_division_exists)
   then obtain p where p: "\<And>z. p z tagged_division_of cbox a b"
                          "\<And>z. (\<lambda>x. \<Inter>{\<gamma> i x |i. i \<in> {0..z}}) fine p z"
     by meson
   have dp: "\<And>i n. i\<le>n \<Longrightarrow> \<gamma> i fine p n"
     using p unfolding fine_Inter
     using atLeastAtMost_iff by blast
   have "Cauchy (\<lambda>n. sum (\<lambda>(x,K). content K *\<^sub>R (f x)) (p n))"
   proof (rule CauchyI)
     fix e::real
     assume "0 < e"
     then obtain N where "N \<noteq> 0" and N: "inverse (real N) < e"
       using real_arch_inverse[of e] by blast
     show "\<exists>M. \<forall>m\<ge>M. \<forall>n\<ge>M. norm ((\<Sum>(x,K) \<in> p m. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x)) < e"
     proof (intro exI allI impI)
       fix m n
       assume mn: "N \<le> m" "N \<le> n"
       have "norm ((\<Sum>(x,K) \<in> p m. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x)) < 1 / (real N + 1)"
         by (simp add: p(1) dp mn \<gamma>)
       also have "... < e"
         using  N \<open>N \<noteq> 0\<close> \<open>0 < e\<close> by (auto simp: field_simps)
       finally show "norm ((\<Sum>(x,K) \<in> p m. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x)) < e" .
     qed
   qed
   then obtain y where y: "\<exists>no. \<forall>n\<ge>no. norm ((\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x) - y) < r" if "r > 0" for r
     by (auto simp: convergent_eq_Cauchy[symmetric] dest: LIMSEQ_D)
   show ?l
     unfolding integrable_on_def has_integral
   proof (rule_tac x=y in exI, clarify)
     fix e :: real
     assume "e>0"
     then have e2: "e/2 > 0" by auto
     then obtain N1::nat where N1: "N1 \<noteq> 0" "inverse (real N1) < e/2"
       using real_arch_inverse by blast
     obtain N2::nat where N2: "\<And>n. n \<ge> N2 \<Longrightarrow> norm ((\<Sum>(x,K) \<in> p n. content K *\<^sub>R f x) - y) < e/2"
       using y[OF e2] by metis
     show "\<exists>\<gamma>. gauge \<gamma> \<and>
               (\<forall>\<D>. \<D> tagged_division_of (cbox a b) \<and> \<gamma> fine \<D> \<longrightarrow>
                 norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - y) < e)"
     proof (intro exI conjI allI impI)
       show "gauge (\<gamma> (N1+N2))"
         using \<gamma> by auto
       show "norm ((\<Sum>(x,K) \<in> q. content K *\<^sub>R f x) - y) < e"
            if "q tagged_division_of cbox a b \<and> \<gamma> (N1+N2) fine q" for q
       proof (rule norm_triangle_half_r)
         have "norm ((\<Sum>(x,K) \<in> p (N1+N2). content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> q. content K *\<^sub>R f x))
                < 1 / (real (N1+N2) + 1)"
           by (rule \<gamma>; simp add: dp p that)
         also have "... < e/2"
           using N1 \<open>0 < e\<close> by (auto simp: field_simps intro: less_le_trans)
         finally show "norm ((\<Sum>(x,K) \<in> p (N1+N2). content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> q. content K *\<^sub>R f x)) < e/2" .
         show "norm ((\<Sum>(x,K) \<in> p (N1+N2). content K *\<^sub>R f x) - y) < e/2"
           using N2 le_add_same_cancel2 by blast
       qed
     qed
   qed
 qed
 
 
 subsection \<open>Additivity of integral on abutting intervals\<close>
 
 lemma tagged_division_split_left_inj_content:
   assumes \<D>: "\<D> tagged_division_of S"
     and "(x1, K1) \<in> \<D>" "(x2, K2) \<in> \<D>" "K1 \<noteq> K2" "K1 \<inter> {x. x\<bullet>k \<le> c} = K2 \<inter> {x. x\<bullet>k \<le> c}" "k \<in> Basis"
   shows "content (K1 \<inter> {x. x\<bullet>k \<le> c}) = 0"
 proof -
   from tagged_division_ofD(4)[OF \<D> \<open>(x1, K1) \<in> \<D>\<close>] obtain a b where K1: "K1 = cbox a b"
     by auto
   then have "interior (K1 \<inter> {x. x \<bullet> k \<le> c}) = {}"
     by (metis tagged_division_split_left_inj assms)
   then show ?thesis
     unfolding K1 interval_split[OF \<open>k \<in> Basis\<close>] by (auto simp: content_eq_0_interior)
 qed
 
 lemma tagged_division_split_right_inj_content:
   assumes \<D>: "\<D> tagged_division_of S"
     and "(x1, K1) \<in> \<D>" "(x2, K2) \<in> \<D>" "K1 \<noteq> K2" "K1 \<inter> {x. x\<bullet>k \<ge> c} = K2 \<inter> {x. x\<bullet>k \<ge> c}" "k \<in> Basis"
   shows "content (K1 \<inter> {x. x\<bullet>k \<ge> c}) = 0"
 proof -
   from tagged_division_ofD(4)[OF \<D> \<open>(x1, K1) \<in> \<D>\<close>] obtain a b where K1: "K1 = cbox a b"
     by auto
   then have "interior (K1 \<inter> {x. c \<le> x \<bullet> k}) = {}"
     by (metis tagged_division_split_right_inj assms)
   then show ?thesis
     unfolding K1 interval_split[OF \<open>k \<in> Basis\<close>]
     by (auto simp: content_eq_0_interior)
 qed
 
 
 proposition has_integral_split:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes fi: "(f has_integral i) (cbox a b \<inter> {x. x\<bullet>k \<le> c})"
       and fj: "(f has_integral j) (cbox a b \<inter> {x. x\<bullet>k \<ge> c})"
       and k: "k \<in> Basis"
 shows "(f has_integral (i + j)) (cbox a b)"
   unfolding has_integral
 proof clarify
   fix e::real
   assume "0 < e"
   then have e: "e/2 > 0"
     by auto
     obtain \<gamma>1 where \<gamma>1: "gauge \<gamma>1"
       and \<gamma>1norm:
         "\<And>\<D>. \<lbrakk>\<D> tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c}; \<gamma>1 fine \<D>\<rbrakk>
              \<Longrightarrow> norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - i) < e/2"
        apply (rule has_integralD[OF fi[unfolded interval_split[OF k]] e])
        apply (simp add: interval_split[symmetric] k)
       done
     obtain \<gamma>2 where \<gamma>2: "gauge \<gamma>2"
       and \<gamma>2norm:
         "\<And>\<D>. \<lbrakk>\<D> tagged_division_of cbox a b \<inter> {x. c \<le> x \<bullet> k}; \<gamma>2 fine \<D>\<rbrakk>
              \<Longrightarrow> norm ((\<Sum>(x, k) \<in> \<D>. content k *\<^sub>R f x) - j) < e/2"
        apply (rule has_integralD[OF fj[unfolded interval_split[OF k]] e])
        apply (simp add: interval_split[symmetric] k)
        done
   let ?\<gamma> = "\<lambda>x. if x\<bullet>k = c then (\<gamma>1 x \<inter> \<gamma>2 x) else ball x \<bar>x\<bullet>k - c\<bar> \<inter> \<gamma>1 x \<inter> \<gamma>2 x"
   have "gauge ?\<gamma>"
     using \<gamma>1 \<gamma>2 unfolding gauge_def by auto
   then show "\<exists>\<gamma>. gauge \<gamma> \<and>
                  (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                       norm ((\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R f x) - (i + j)) < e)"
   proof (rule_tac x="?\<gamma>" in exI, safe)
     fix p
     assume p: "p tagged_division_of (cbox a b)" and "?\<gamma> fine p"
     have ab_eqp: "cbox a b = \<Union>{K. \<exists>x. (x, K) \<in> p}"
       using p by blast
     have xk_le_c: "x\<bullet>k \<le> c" if as: "(x,K) \<in> p" and K: "K \<inter> {x. x\<bullet>k \<le> c} \<noteq> {}" for x K
     proof (rule ccontr)
       assume **: "\<not> x \<bullet> k \<le> c"
       then have "K \<subseteq> ball x \<bar>x \<bullet> k - c\<bar>"
         using \<open>?\<gamma> fine p\<close> as by (fastforce simp: not_le algebra_simps)
       with K obtain y where y: "y \<in> ball x \<bar>x \<bullet> k - c\<bar>" "y\<bullet>k \<le> c"
         by blast
       then have "\<bar>x \<bullet> k - y \<bullet> k\<bar> < \<bar>x \<bullet> k - c\<bar>"
         using Basis_le_norm[OF k, of "x - y"]
         by (auto simp add: dist_norm inner_diff_left intro: le_less_trans)
       with y show False
         using ** by (auto simp add: field_simps)
     qed
     have xk_ge_c: "x\<bullet>k \<ge> c" if as: "(x,K) \<in> p" and K: "K \<inter> {x. x\<bullet>k \<ge> c} \<noteq> {}" for x K
     proof (rule ccontr)
       assume **: "\<not> x \<bullet> k \<ge> c"
       then have "K \<subseteq> ball x \<bar>x \<bullet> k - c\<bar>"
         using \<open>?\<gamma> fine p\<close> as by (fastforce simp: not_le algebra_simps)
       with K obtain y where y: "y \<in> ball x \<bar>x \<bullet> k - c\<bar>" "y\<bullet>k \<ge> c"
         by blast
       then have "\<bar>x \<bullet> k - y \<bullet> k\<bar> < \<bar>x \<bullet> k - c\<bar>"
         using Basis_le_norm[OF k, of "x - y"]
         by (auto simp add: dist_norm inner_diff_left intro: le_less_trans)
       with y show False
         using ** by (auto simp add: field_simps)
     qed
     have fin_finite: "finite {(x,f K) | x K. (x,K) \<in> s \<and> P x K}"
       if "finite s" for s and f :: "'a set \<Rightarrow> 'a set" and P :: "'a \<Rightarrow> 'a set \<Rightarrow> bool"
     proof -
       from that have "finite ((\<lambda>(x,K). (x, f K)) ` s)"
         by auto
       then show ?thesis
         by (rule rev_finite_subset) auto
     qed
     { fix \<G> :: "'a set \<Rightarrow> 'a set"
       fix i :: "'a \<times> 'a set"
       assume "i \<in> (\<lambda>(x, k). (x, \<G> k)) ` p - {(x, \<G> k) |x k. (x, k) \<in> p \<and> \<G> k \<noteq> {}}"
       then obtain x K where xk: "i = (x, \<G> K)"  "(x,K) \<in> p"
                                  "(x, \<G> K) \<notin> {(x, \<G> K) |x K. (x,K) \<in> p \<and> \<G> K \<noteq> {}}"
         by auto
       have "content (\<G> K) = 0"
         using xk using content_empty by auto
       then have "(\<lambda>(x,K). content K *\<^sub>R f x) i = 0"
         unfolding xk split_conv by auto
     } note [simp] = this
     have "finite p"
       using p by blast
     let ?M1 = "{(x, K \<inter> {x. x\<bullet>k \<le> c}) |x K. (x,K) \<in> p \<and> K \<inter> {x. x\<bullet>k \<le> c} \<noteq> {}}"
     have \<gamma>1_fine: "\<gamma>1 fine ?M1"
       using \<open>?\<gamma> fine p\<close> by (fastforce simp: fine_def split: if_split_asm)
     have "norm ((\<Sum>(x, k)\<in>?M1. content k *\<^sub>R f x) - i) < e/2"
     proof (rule \<gamma>1norm [OF tagged_division_ofI \<gamma>1_fine])
       show "finite ?M1"
         by (rule fin_finite) (use p in blast)
       show "\<Union>{k. \<exists>x. (x, k) \<in> ?M1} = cbox a b \<inter> {x. x\<bullet>k \<le> c}"
         by (auto simp: ab_eqp)
 
       fix x L
       assume xL: "(x, L) \<in> ?M1"
       then obtain x' L' where xL': "x = x'" "L = L' \<inter> {x. x \<bullet> k \<le> c}"
                                    "(x', L') \<in> p" "L' \<inter> {x. x \<bullet> k \<le> c} \<noteq> {}"
         by blast
       then obtain a' b' where ab': "L' = cbox a' b'"
         using p by blast
       show "x \<in> L" "L \<subseteq> cbox a b \<inter> {x. x \<bullet> k \<le> c}"
         using p xk_le_c xL' by auto
       show "\<exists>a b. L = cbox a b"
         using p xL' ab' by (auto simp add: interval_split[OF k,where c=c])
 
       fix y R
       assume yR: "(y, R) \<in> ?M1"
       then obtain y' R' where yR': "y = y'" "R = R' \<inter> {x. x \<bullet> k \<le> c}"
                                    "(y', R') \<in> p" "R' \<inter> {x. x \<bullet> k \<le> c} \<noteq> {}"
         by blast
       assume as: "(x, L) \<noteq> (y, R)"
       show "interior L \<inter> interior R = {}"
       proof (cases "L' = R' \<longrightarrow> x' = y'")
         case False
         have "interior R' = {}"
           by (metis (no_types) False Pair_inject inf.idem tagged_division_ofD(5) [OF p] xL'(3) yR'(3))
         then show ?thesis
           using yR' by simp
       next
         case True
         then have "L' \<noteq> R'"
           using as unfolding xL' yR' by auto
         have "interior L' \<inter> interior R' = {}"
           by (metis (no_types) Pair_inject \<open>L' \<noteq> R'\<close> p tagged_division_ofD(5) xL'(3) yR'(3))
         then show ?thesis
           using xL'(2) yR'(2) by auto
       qed
     qed
     moreover
     let ?M2 = "{(x,K \<inter> {x. x\<bullet>k \<ge> c}) |x K. (x,K) \<in> p \<and> K \<inter> {x. x\<bullet>k \<ge> c} \<noteq> {}}"
     have \<gamma>2_fine: "\<gamma>2 fine ?M2"
       using \<open>?\<gamma> fine p\<close> by (fastforce simp: fine_def split: if_split_asm)
     have "norm ((\<Sum>(x, k)\<in>?M2. content k *\<^sub>R f x) - j) < e/2"
     proof (rule \<gamma>2norm [OF tagged_division_ofI \<gamma>2_fine])
       show "finite ?M2"
         by (rule fin_finite) (use p in blast)
       show "\<Union>{k. \<exists>x. (x, k) \<in> ?M2} = cbox a b \<inter> {x. x\<bullet>k \<ge> c}"
         by (auto simp: ab_eqp)
 
       fix x L
       assume xL: "(x, L) \<in> ?M2"
       then obtain x' L' where xL': "x = x'" "L = L' \<inter> {x. x \<bullet> k \<ge> c}"
                                    "(x', L') \<in> p" "L' \<inter> {x. x \<bullet> k \<ge> c} \<noteq> {}"
         by blast
       then obtain a' b' where ab': "L' = cbox a' b'"
         using p by blast
       show "x \<in> L" "L \<subseteq> cbox a b \<inter> {x. x \<bullet> k \<ge> c}"
         using p xk_ge_c xL' by auto
       show "\<exists>a b. L = cbox a b"
         using p xL' ab' by (auto simp add: interval_split[OF k,where c=c])
 
       fix y R
       assume yR: "(y, R) \<in> ?M2"
       then obtain y' R' where yR': "y = y'" "R = R' \<inter> {x. x \<bullet> k \<ge> c}"
                                    "(y', R') \<in> p" "R' \<inter> {x. x \<bullet> k \<ge> c} \<noteq> {}"
         by blast
       assume as: "(x, L) \<noteq> (y, R)"
       show "interior L \<inter> interior R = {}"
       proof (cases "L' = R' \<longrightarrow> x' = y'")
         case False
         have "interior R' = {}"
           by (metis (no_types) False Pair_inject inf.idem tagged_division_ofD(5) [OF p] xL'(3) yR'(3))
         then show ?thesis
           using yR' by simp
       next
         case True
         then have "L' \<noteq> R'"
           using as unfolding xL' yR' by auto
         have "interior L' \<inter> interior R' = {}"
           by (metis (no_types) Pair_inject \<open>L' \<noteq> R'\<close> p tagged_division_ofD(5) xL'(3) yR'(3))
         then show ?thesis
           using xL'(2) yR'(2) by auto
       qed
     qed
     ultimately
     have "norm (((\<Sum>(x,K) \<in> ?M1. content K *\<^sub>R f x) - i) + ((\<Sum>(x,K) \<in> ?M2. content K *\<^sub>R f x) - j)) < e/2 + e/2"
       using norm_add_less by blast
     moreover have "((\<Sum>(x,K) \<in> ?M1. content K *\<^sub>R f x) - i) +
                    ((\<Sum>(x,K) \<in> ?M2. content K *\<^sub>R f x) - j) =
                    (\<Sum>(x, ka)\<in>p. content ka *\<^sub>R f x) - (i + j)"
     proof -
       have eq0: "\<And>x y. x = (0::real) \<Longrightarrow> x *\<^sub>R (y::'b) = 0"
          by auto
       have cont_eq: "\<And>g. (\<lambda>(x,l). content l *\<^sub>R f x) \<circ> (\<lambda>(x,l). (x,g l)) = (\<lambda>(x,l). content (g l) *\<^sub>R f x)"
         by auto
       have *: "\<And>\<G> :: 'a set \<Rightarrow> 'a set.
                   (\<Sum>(x,K)\<in>{(x, \<G> K) |x K. (x,K) \<in> p \<and> \<G> K \<noteq> {}}. content K *\<^sub>R f x) =
                   (\<Sum>(x,K)\<in>(\<lambda>(x,K). (x, \<G> K)) ` p. content K *\<^sub>R f x)"
         by (rule sum.mono_neutral_left) (auto simp: \<open>finite p\<close>)
       have "((\<Sum>(x, k)\<in>?M1. content k *\<^sub>R f x) - i) + ((\<Sum>(x, k)\<in>?M2. content k *\<^sub>R f x) - j) =
         (\<Sum>(x, k)\<in>?M1. content k *\<^sub>R f x) + (\<Sum>(x, k)\<in>?M2. content k *\<^sub>R f x) - (i + j)"
         by auto
       moreover have "\<dots> = (\<Sum>(x,K) \<in> p. content (K \<inter> {x. x \<bullet> k \<le> c}) *\<^sub>R f x) +
         (\<Sum>(x,K) \<in> p. content (K \<inter> {x. c \<le> x \<bullet> k}) *\<^sub>R f x) - (i + j)"
         unfolding *
         apply (subst (1 2) sum.reindex_nontrivial)
            apply (auto intro!: k p eq0 tagged_division_split_left_inj_content tagged_division_split_right_inj_content
                        simp: cont_eq \<open>finite p\<close>)
         done
       moreover have "\<And>x. x \<in> p \<Longrightarrow> (\<lambda>(a,B). content (B \<inter> {a. a \<bullet> k \<le> c}) *\<^sub>R f a) x +
                                 (\<lambda>(a,B). content (B \<inter> {a. c \<le> a \<bullet> k}) *\<^sub>R f a) x =
                                 (\<lambda>(a,B). content B *\<^sub>R f a) x"
       proof clarify
         fix a B
         assume "(a, B) \<in> p"
         with p obtain u v where uv: "B = cbox u v" by blast
         then show "content (B \<inter> {x. x \<bullet> k \<le> c}) *\<^sub>R f a + content (B \<inter> {x. c \<le> x \<bullet> k}) *\<^sub>R f a = content B *\<^sub>R f a"
           by (auto simp: scaleR_left_distrib uv content_split[OF k,of u v c])
       qed
       ultimately show ?thesis
         by (auto simp: sum.distrib[symmetric])
       qed
     ultimately show "norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - (i + j)) < e"
       by auto
   qed
 qed
 
 
 subsection \<open>A sort of converse, integrability on subintervals\<close>
 
 lemma has_integral_separate_sides:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes f: "(f has_integral i) (cbox a b)"
     and "e > 0"
     and k: "k \<in> Basis"
   obtains d where "gauge d"
     "\<forall>p1 p2. p1 tagged_division_of (cbox a b \<inter> {x. x\<bullet>k \<le> c}) \<and> d fine p1 \<and>
         p2 tagged_division_of (cbox a b \<inter> {x. x\<bullet>k \<ge> c}) \<and> d fine p2 \<longrightarrow>
         norm ((sum (\<lambda>(x,k). content k *\<^sub>R f x) p1 + sum (\<lambda>(x,k). content k *\<^sub>R f x) p2) - i) < e"
 proof -
   obtain \<gamma> where d: "gauge \<gamma>"
       "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma> fine p\<rbrakk>
             \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) < e"
     using has_integralD[OF f \<open>e > 0\<close>] by metis
   { fix p1 p2
     assume tdiv1: "p1 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<le> c}" and "\<gamma> fine p1"
     note p1=tagged_division_ofD[OF this(1)] 
     assume tdiv2: "p2 tagged_division_of (cbox a b) \<inter> {x. c \<le> x \<bullet> k}" and "\<gamma> fine p2"
     note p2=tagged_division_ofD[OF this(1)] 
     note tagged_division_Un_interval[OF tdiv1 tdiv2] 
     note p12 = tagged_division_ofD[OF this] this
     { fix a b
       assume ab: "(a, b) \<in> p1 \<inter> p2"
       have "(a, b) \<in> p1"
         using ab by auto
       obtain u v where uv: "b = cbox u v"
         using \<open>(a, b) \<in> p1\<close> p1(4) by moura
       have "b \<subseteq> {x. x\<bullet>k = c}"
         using ab p1(3)[of a b] p2(3)[of a b] by fastforce
       moreover
       have "interior {x::'a. x \<bullet> k = c} = {}"
       proof (rule ccontr)
         assume "\<not> ?thesis"
         then obtain x where x: "x \<in> interior {x::'a. x\<bullet>k = c}"
           by auto
         then obtain \<epsilon> where "0 < \<epsilon>" and \<epsilon>: "ball x \<epsilon> \<subseteq> {x. x \<bullet> k = c}"
           using mem_interior by metis
         have x: "x\<bullet>k = c"
           using x interior_subset by fastforce
         have *: "\<And>i. i \<in> Basis \<Longrightarrow> \<bar>(x - (x + (\<epsilon>/2) *\<^sub>R k)) \<bullet> i\<bar> = (if i = k then \<epsilon>/2 else 0)"
           using \<open>0 < \<epsilon>\<close> k by (auto simp: inner_simps inner_not_same_Basis)
         have "(\<Sum>i\<in>Basis. \<bar>(x - (x + (\<epsilon>/2 ) *\<^sub>R k)) \<bullet> i\<bar>) =
               (\<Sum>i\<in>Basis. (if i = k then \<epsilon>/2 else 0))"
           using "*" by (blast intro: sum.cong)
         also have "\<dots> < \<epsilon>"
           by (subst sum.delta) (use \<open>0 < \<epsilon>\<close> in auto)
         finally have "x + (\<epsilon>/2) *\<^sub>R k \<in> ball x \<epsilon>"
           unfolding mem_ball dist_norm by(rule le_less_trans[OF norm_le_l1])
         then have "x + (\<epsilon>/2) *\<^sub>R k \<in> {x. x\<bullet>k = c}"
           using \<epsilon> by auto
         then show False
           using \<open>0 < \<epsilon>\<close> x k by (auto simp: inner_simps)
       qed
       ultimately have "content b = 0"
         unfolding uv content_eq_0_interior
         using interior_mono by blast
       then have "content b *\<^sub>R f a = 0"
         by auto
     }
     then have "norm ((\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) + (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x) - i) =
                norm ((\<Sum>(x, k)\<in>p1 \<union> p2. content k *\<^sub>R f x) - i)"
       by (subst sum.union_inter_neutral) (auto simp: p1 p2)
     also have "\<dots> < e"
       using d(2) p12 by (simp add: fine_Un k \<open>\<gamma> fine p1\<close> \<open>\<gamma> fine p2\<close>)
     finally have "norm ((\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) + (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x) - i) < e" .
    }
   then show ?thesis
     using d(1) that by auto
 qed
 
 lemma integrable_split [intro]:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::{real_normed_vector,complete_space}"
   assumes f: "f integrable_on cbox a b"
       and k: "k \<in> Basis"
     shows "f integrable_on (cbox a b \<inter> {x. x\<bullet>k \<le> c})"   (is ?thesis1)
     and   "f integrable_on (cbox a b \<inter> {x. x\<bullet>k \<ge> c})"   (is ?thesis2)
 proof -
   obtain y where y: "(f has_integral y) (cbox a b)"
     using f by blast
   define a' where "a' = (\<Sum>i\<in>Basis. (if i = k then max (a\<bullet>k) c else a\<bullet>i)*\<^sub>R i)"
   define b' where "b' = (\<Sum>i\<in>Basis. (if i = k then min (b\<bullet>k) c else b\<bullet>i)*\<^sub>R i)"
   have "\<exists>d. gauge d \<and>
             (\<forall>p1 p2. p1 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c} \<and> d fine p1 \<and>
                      p2 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c} \<and> d fine p2 \<longrightarrow>
                      norm ((\<Sum>(x,K) \<in> p1. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p2. content K *\<^sub>R f x)) < e)"
     if "e > 0" for e
   proof -
     have "e/2 > 0" using that by auto
   with has_integral_separate_sides[OF y this k, of c]
   obtain d
     where "gauge d"
          and d: "\<And>p1 p2. \<lbrakk>p1 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c}; d fine p1;
                           p2 tagged_division_of cbox a b \<inter> {x. c \<le> x \<bullet> k}; d fine p2\<rbrakk>
                   \<Longrightarrow> norm ((\<Sum>(x,K)\<in>p1. content K *\<^sub>R f x) + (\<Sum>(x,K)\<in>p2. content K *\<^sub>R f x) - y) < e/2"
     by metis
   show ?thesis
     proof (rule_tac x=d in exI, clarsimp simp add: \<open>gauge d\<close>)
       fix p1 p2
       assume as: "p1 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<le> c}" "d fine p1"
                  "p2 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<le> c}" "d fine p2"
       show "norm ((\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) - (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x)) < e"
       proof (rule fine_division_exists[OF \<open>gauge d\<close>, of a' b])
         fix p
         assume "p tagged_division_of cbox a' b" "d fine p"
         then show ?thesis
           using as norm_triangle_half_l[OF d[of p1 p] d[of p2 p]]
           unfolding interval_split[OF k] b'_def[symmetric] a'_def[symmetric]
           by (auto simp add: algebra_simps)
       qed
     qed
   qed
   with f show ?thesis1
     by (simp add: interval_split[OF k] integrable_Cauchy)
   have "\<exists>d. gauge d \<and>
             (\<forall>p1 p2. p1 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<ge> c} \<and> d fine p1 \<and>
                      p2 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<ge> c} \<and> d fine p2 \<longrightarrow>
                      norm ((\<Sum>(x,K) \<in> p1. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p2. content K *\<^sub>R f x)) < e)"
     if "e > 0" for e
   proof -
     have "e/2 > 0" using that by auto
   with has_integral_separate_sides[OF y this k, of c]
   obtain d
     where "gauge d"
          and d: "\<And>p1 p2. \<lbrakk>p1 tagged_division_of cbox a b \<inter> {x. x \<bullet> k \<le> c}; d fine p1;
                           p2 tagged_division_of cbox a b \<inter> {x. c \<le> x \<bullet> k}; d fine p2\<rbrakk>
                   \<Longrightarrow> norm ((\<Sum>(x,K)\<in>p1. content K *\<^sub>R f x) + (\<Sum>(x,K)\<in>p2. content K *\<^sub>R f x) - y) < e/2"
     by metis
   show ?thesis
     proof (rule_tac x=d in exI, clarsimp simp add: \<open>gauge d\<close>)
       fix p1 p2
       assume as: "p1 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<ge> c}" "d fine p1"
                  "p2 tagged_division_of (cbox a b) \<inter> {x. x \<bullet> k \<ge> c}" "d fine p2"
       show "norm ((\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) - (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x)) < e"
       proof (rule fine_division_exists[OF \<open>gauge d\<close>, of a b'])
         fix p
         assume "p tagged_division_of cbox a b'" "d fine p"
         then show ?thesis
           using as norm_triangle_half_l[OF d[of p p1] d[of p p2]]
           unfolding interval_split[OF k] b'_def[symmetric] a'_def[symmetric]
           by (auto simp add: algebra_simps)
       qed
     qed
   qed
   with f show ?thesis2
     by (simp add: interval_split[OF k] integrable_Cauchy)
 qed
 
 lemma operative_integralI:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   shows "operative (lift_option (+)) (Some 0)
     (\<lambda>i. if f integrable_on i then Some (integral i f) else None)"
 proof -
   interpret comm_monoid "lift_option plus" "Some (0::'b)"
     by (rule comm_monoid_lift_option)
       (rule add.comm_monoid_axioms)
   show ?thesis
   proof
     fix a b c
     fix k :: 'a
     assume k: "k \<in> Basis"
     show "(if f integrable_on cbox a b then Some (integral (cbox a b) f) else None) =
           lift_option (+) (if f integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c} then Some (integral (cbox a b \<inter> {x. x \<bullet> k \<le> c}) f) else None)
           (if f integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k} then Some (integral (cbox a b \<inter> {x. c \<le> x \<bullet> k}) f) else None)"
     proof (cases "f integrable_on cbox a b")
       case True
       with k show ?thesis
         apply (simp add: integrable_split)
         apply (rule integral_unique [OF has_integral_split[OF _ _ k]])
         apply (auto intro: integrable_integral)
         done
     next
     case False
       have "\<not> (f integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c}) \<or> \<not> ( f integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k})"
       proof (rule ccontr)
         assume "\<not> ?thesis"
         then have "f integrable_on cbox a b"
           unfolding integrable_on_def
           apply (rule_tac x="integral (cbox a b \<inter> {x. x \<bullet> k \<le> c}) f + integral (cbox a b \<inter> {x. x \<bullet> k \<ge> c}) f" in exI)
           apply (rule has_integral_split[OF _ _ k])
           apply (auto intro: integrable_integral)
           done
         then show False
           using False by auto
       qed
       then show ?thesis
         using False by auto
     qed
   next
     fix a b :: 'a
     assume "box a b = {}"
     then show "(if f integrable_on cbox a b then Some (integral (cbox a b) f) else None) = Some 0"
       using has_integral_null_eq
       by (auto simp: integrable_on_null content_eq_0_interior)
   qed
 qed
 
 subsection \<open>Bounds on the norm of Riemann sums and the integral itself\<close>
 
 lemma dsum_bound:
   assumes "p division_of (cbox a b)"
     and "norm c \<le> e"
   shows "norm (sum (\<lambda>l. content l *\<^sub>R c) p) \<le> e * content(cbox a b)"
 proof -
   have sumeq: "(\<Sum>i\<in>p. \<bar>content i\<bar>) = sum content p"
     apply (rule sum.cong)
     using assms
     apply simp
     apply (metis abs_of_nonneg assms(1) content_pos_le division_ofD(4))
     done
   have e: "0 \<le> e"
     using assms(2) norm_ge_zero order_trans by blast
   have "norm (sum (\<lambda>l. content l *\<^sub>R c) p) \<le> (\<Sum>i\<in>p. norm (content i *\<^sub>R c))"
     using norm_sum by blast
   also have "...  \<le> e * (\<Sum>i\<in>p. \<bar>content i\<bar>)"
     by (simp add: sum_distrib_left[symmetric] mult.commute assms(2) mult_right_mono sum_nonneg)
   also have "... \<le> e * content (cbox a b)"
     apply (rule mult_left_mono [OF _ e])
     apply (simp add: sumeq)
     using additive_content_division assms(1) eq_iff apply blast
     done
   finally show ?thesis .
 qed
 
 lemma rsum_bound:
   assumes p: "p tagged_division_of (cbox a b)"
       and "\<forall>x\<in>cbox a b. norm (f x) \<le> e"
     shows "norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p) \<le> e * content (cbox a b)"
 proof (cases "cbox a b = {}")
   case True show ?thesis
     using p unfolding True tagged_division_of_trivial by auto
 next
   case False
   then have e: "e \<ge> 0"
     by (meson ex_in_conv assms(2) norm_ge_zero order_trans)
   have sum_le: "sum (content \<circ> snd) p \<le> content (cbox a b)"
     unfolding additive_content_tagged_division[OF p, symmetric] split_def
     by (auto intro: eq_refl)
   have con: "\<And>xk. xk \<in> p \<Longrightarrow> 0 \<le> content (snd xk)"
     using tagged_division_ofD(4) [OF p] content_pos_le
     by force
   have norm: "\<And>xk. xk \<in> p \<Longrightarrow> norm (f (fst xk)) \<le> e"
     unfolding fst_conv using tagged_division_ofD(2,3)[OF p] assms
     by (metis prod.collapse subset_eq)
   have "norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p) \<le> (\<Sum>i\<in>p. norm (case i of (x, k) \<Rightarrow> content k *\<^sub>R f x))"
     by (rule norm_sum)
   also have "...  \<le> e * content (cbox a b)"
     unfolding split_def norm_scaleR
     apply (rule order_trans[OF sum_mono])
     apply (rule mult_left_mono[OF _ abs_ge_zero, of _ e])
     apply (metis norm)
     unfolding sum_distrib_right[symmetric]
     using con sum_le
     apply (auto simp: mult.commute intro: mult_left_mono [OF _ e])
     done
   finally show ?thesis .
 qed
 
 lemma rsum_diff_bound:
   assumes "p tagged_division_of (cbox a b)"
     and "\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e"
   shows "norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p - sum (\<lambda>(x,k). content k *\<^sub>R g x) p) \<le>
          e * content (cbox a b)"
   apply (rule order_trans[OF _ rsum_bound[OF assms]])
   apply (simp add: split_def scaleR_diff_right sum_subtractf eq_refl)
   done
 
 lemma has_integral_bound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "0 \<le> B"
       and f: "(f has_integral i) (cbox a b)"
       and "\<And>x. x\<in>cbox a b \<Longrightarrow> norm (f x) \<le> B"
     shows "norm i \<le> B * content (cbox a b)"
 proof (rule ccontr)
   assume "\<not> ?thesis"
   then have "norm i - B * content (cbox a b) > 0"
     by auto
   with f[unfolded has_integral]
   obtain \<gamma> where "gauge \<gamma>" and \<gamma>:
     "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma> fine p\<rbrakk>
           \<Longrightarrow> norm ((\<Sum>(x, K)\<in>p. content K *\<^sub>R f x) - i) < norm i - B * content (cbox a b)"
     by metis
   then obtain p where p: "p tagged_division_of cbox a b" and "\<gamma> fine p"
     using fine_division_exists by blast
   have "\<And>s B. norm s \<le> B \<Longrightarrow> \<not> norm (s - i) < norm i - B"
     unfolding not_less
     by (metis diff_left_mono dist_commute dist_norm norm_triangle_ineq2 order_trans)
   then show False
     using \<gamma> [OF p \<open>\<gamma> fine p\<close>] rsum_bound[OF p] assms by metis
 qed
 
 corollary integrable_bound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "0 \<le> B"
       and "f integrable_on (cbox a b)"
       and "\<And>x. x\<in>cbox a b \<Longrightarrow> norm (f x) \<le> B"
     shows "norm (integral (cbox a b) f) \<le> B * content (cbox a b)"
 by (metis integrable_integral has_integral_bound assms)
 
 
 subsection \<open>Similar theorems about relationship among components\<close>
 
 lemma rsum_component_le:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes p: "p tagged_division_of (cbox a b)"
       and "\<And>x. x \<in> cbox a b \<Longrightarrow> (f x)\<bullet>i \<le> (g x)\<bullet>i"
     shows "(\<Sum>(x, K)\<in>p. content K *\<^sub>R f x) \<bullet> i \<le> (\<Sum>(x, K)\<in>p. content K *\<^sub>R g x) \<bullet> i"
 unfolding inner_sum_left
 proof (rule sum_mono, clarify)
   fix x K
   assume ab: "(x, K) \<in> p"
   with p obtain u v where K: "K = cbox u v"
     by blast
   then show "(content K *\<^sub>R f x) \<bullet> i \<le> (content K *\<^sub>R g x) \<bullet> i"
     by (metis ab assms inner_scaleR_left measure_nonneg mult_left_mono tag_in_interval)
 qed
 
 lemma has_integral_component_le:
   fixes f g :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes k: "k \<in> Basis"
   assumes "(f has_integral i) S" "(g has_integral j) S"
     and f_le_g: "\<And>x. x \<in> S \<Longrightarrow> (f x)\<bullet>k \<le> (g x)\<bullet>k"
   shows "i\<bullet>k \<le> j\<bullet>k"
 proof -
   have ik_le_jk: "i\<bullet>k \<le> j\<bullet>k"
     if f_i: "(f has_integral i) (cbox a b)"
     and g_j: "(g has_integral j) (cbox a b)"
     and le: "\<forall>x\<in>cbox a b. (f x)\<bullet>k \<le> (g x)\<bullet>k"
     for a b i and j :: 'b and f g :: "'a \<Rightarrow> 'b"
   proof (rule ccontr)
     assume "\<not> ?thesis"
     then have *: "0 < (i\<bullet>k - j\<bullet>k) / 3"
       by auto
     obtain \<gamma>1 where "gauge \<gamma>1" 
       and \<gamma>1: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma>1 fine p\<rbrakk>
                 \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) < (i \<bullet> k - j \<bullet> k) / 3"
       using f_i[unfolded has_integral,rule_format,OF *] by fastforce 
     obtain \<gamma>2 where "gauge \<gamma>2" 
       and \<gamma>2: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; \<gamma>2 fine p\<rbrakk>
                 \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R g x) - j) < (i \<bullet> k - j \<bullet> k) / 3"
       using g_j[unfolded has_integral,rule_format,OF *] by fastforce 
     obtain p where p: "p tagged_division_of cbox a b" and "\<gamma>1 fine p" "\<gamma>2 fine p"
        using fine_division_exists[OF gauge_Int[OF \<open>gauge \<gamma>1\<close> \<open>gauge \<gamma>2\<close>], of a b] unfolding fine_Int
        by metis
     then have "\<bar>((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) \<bullet> k\<bar> < (i \<bullet> k - j \<bullet> k) / 3"
          "\<bar>((\<Sum>(x, k)\<in>p. content k *\<^sub>R g x) - j) \<bullet> k\<bar> < (i \<bullet> k - j \<bullet> k) / 3"
       using le_less_trans[OF Basis_le_norm[OF k]] k \<gamma>1 \<gamma>2 by metis+ 
     then show False
       unfolding inner_simps
       using rsum_component_le[OF p] le
       by (fastforce simp add: abs_real_def split: if_split_asm)
   qed
   show ?thesis
   proof (cases "\<exists>a b. S = cbox a b")
     case True
     with ik_le_jk assms show ?thesis
       by auto
   next
     case False
     show ?thesis
     proof (rule ccontr)
       assume "\<not> i\<bullet>k \<le> j\<bullet>k"
       then have ij: "(i\<bullet>k - j\<bullet>k) / 3 > 0"
         by auto
       obtain B1 where "0 < B1" 
            and B1: "\<And>a b. ball 0 B1 \<subseteq> cbox a b \<Longrightarrow>
                     \<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b) \<and>
                         norm (z - i) < (i \<bullet> k - j \<bullet> k) / 3"
         using has_integral_altD[OF _ False ij] assms by blast
       obtain B2 where "0 < B2" 
            and B2: "\<And>a b. ball 0 B2 \<subseteq> cbox a b \<Longrightarrow>
                     \<exists>z. ((\<lambda>x. if x \<in> S then g x else 0) has_integral z) (cbox a b) \<and>
                         norm (z - j) < (i \<bullet> k - j \<bullet> k) / 3"
         using has_integral_altD[OF _ False ij] assms by blast
       have "bounded (ball 0 B1 \<union> ball (0::'a) B2)"
         unfolding bounded_Un by(rule conjI bounded_ball)+
       from bounded_subset_cbox_symmetric[OF this] 
       obtain a b::'a where ab: "ball 0 B1 \<subseteq> cbox a b" "ball 0 B2 \<subseteq> cbox a b"
         by (meson Un_subset_iff)
       then obtain w1 w2 where int_w1: "((\<lambda>x. if x \<in> S then f x else 0) has_integral w1) (cbox a b)"
                         and norm_w1:  "norm (w1 - i) < (i \<bullet> k - j \<bullet> k) / 3"
                         and int_w2: "((\<lambda>x. if x \<in> S then g x else 0) has_integral w2) (cbox a b)"
                         and norm_w2: "norm (w2 - j) < (i \<bullet> k - j \<bullet> k) / 3"
         using B1 B2 by blast
       have *: "\<And>w1 w2 j i::real .\<bar>w1 - i\<bar> < (i - j) / 3 \<Longrightarrow> \<bar>w2 - j\<bar> < (i - j) / 3 \<Longrightarrow> w1 \<le> w2 \<Longrightarrow> False"
         by (simp add: abs_real_def split: if_split_asm)
       have "\<bar>(w1 - i) \<bullet> k\<bar> < (i \<bullet> k - j \<bullet> k) / 3"
            "\<bar>(w2 - j) \<bullet> k\<bar> < (i \<bullet> k - j \<bullet> k) / 3"
         using Basis_le_norm k le_less_trans norm_w1 norm_w2 by blast+
       moreover
       have "w1\<bullet>k \<le> w2\<bullet>k"
         using ik_le_jk int_w1 int_w2 f_le_g by auto
       ultimately show False
         unfolding inner_simps by(rule *)
     qed
   qed
 qed
 
 lemma integral_component_le:
   fixes g f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "k \<in> Basis"
     and "f integrable_on S" "g integrable_on S"
     and "\<And>x. x \<in> S \<Longrightarrow> (f x)\<bullet>k \<le> (g x)\<bullet>k"
   shows "(integral S f)\<bullet>k \<le> (integral S g)\<bullet>k"
   apply (rule has_integral_component_le)
   using integrable_integral assms
   apply auto
   done
 
 lemma has_integral_component_nonneg:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "k \<in> Basis"
     and "(f has_integral i) S"
     and "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> (f x)\<bullet>k"
   shows "0 \<le> i\<bullet>k"
   using has_integral_component_le[OF assms(1) has_integral_0 assms(2)]
   using assms(3-)
   by auto
 
 lemma integral_component_nonneg:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "k \<in> Basis"
     and  "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> (f x)\<bullet>k"
   shows "0 \<le> (integral S f)\<bullet>k"
 proof (cases "f integrable_on S")
   case True show ?thesis
     apply (rule has_integral_component_nonneg)
     using assms True
     apply auto
     done
 next
   case False then show ?thesis by (simp add: not_integrable_integral)
 qed
 
 lemma has_integral_component_neg:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "k \<in> Basis"
     and "(f has_integral i) S"
     and "\<And>x. x \<in> S \<Longrightarrow> (f x)\<bullet>k \<le> 0"
   shows "i\<bullet>k \<le> 0"
   using has_integral_component_le[OF assms(1,2) has_integral_0] assms(2-)
   by auto
 
 lemma has_integral_component_lbound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "(f has_integral i) (cbox a b)"
     and "\<forall>x\<in>cbox a b. B \<le> f(x)\<bullet>k"
     and "k \<in> Basis"
   shows "B * content (cbox a b) \<le> i\<bullet>k"
   using has_integral_component_le[OF assms(3) has_integral_const assms(1),of "(\<Sum>i\<in>Basis. B *\<^sub>R i)::'b"] assms(2-)
   by (auto simp add: field_simps)
 
 lemma has_integral_component_ubound:
   fixes f::"'a::euclidean_space => 'b::euclidean_space"
   assumes "(f has_integral i) (cbox a b)"
     and "\<forall>x\<in>cbox a b. f x\<bullet>k \<le> B"
     and "k \<in> Basis"
   shows "i\<bullet>k \<le> B * content (cbox a b)"
   using has_integral_component_le[OF assms(3,1) has_integral_const, of "\<Sum>i\<in>Basis. B *\<^sub>R i"] assms(2-)
   by (auto simp add: field_simps)
 
 lemma integral_component_lbound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f integrable_on cbox a b"
     and "\<forall>x\<in>cbox a b. B \<le> f(x)\<bullet>k"
     and "k \<in> Basis"
   shows "B * content (cbox a b) \<le> (integral(cbox a b) f)\<bullet>k"
   apply (rule has_integral_component_lbound)
   using assms
   unfolding has_integral_integral
   apply auto
   done
 
 lemma integral_component_lbound_real:
   assumes "f integrable_on {a ::real..b}"
     and "\<forall>x\<in>{a..b}. B \<le> f(x)\<bullet>k"
     and "k \<in> Basis"
   shows "B * content {a..b} \<le> (integral {a..b} f)\<bullet>k"
   using assms
   by (metis box_real(2) integral_component_lbound)
 
 lemma integral_component_ubound:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f integrable_on cbox a b"
     and "\<forall>x\<in>cbox a b. f x\<bullet>k \<le> B"
     and "k \<in> Basis"
   shows "(integral (cbox a b) f)\<bullet>k \<le> B * content (cbox a b)"
   apply (rule has_integral_component_ubound)
   using assms
   unfolding has_integral_integral
   apply auto
   done
 
 lemma integral_component_ubound_real:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes "f integrable_on {a..b}"
     and "\<forall>x\<in>{a..b}. f x\<bullet>k \<le> B"
     and "k \<in> Basis"
   shows "(integral {a..b} f)\<bullet>k \<le> B * content {a..b}"
   using assms
   by (metis box_real(2) integral_component_ubound)
 
 subsection \<open>Uniform limit of integrable functions is integrable\<close>
 
 lemma real_arch_invD:
   "0 < (e::real) \<Longrightarrow> (\<exists>n::nat. n \<noteq> 0 \<and> 0 < inverse (real n) \<and> inverse (real n) < e)"
   by (subst(asm) real_arch_inverse)
 
 
 lemma integrable_uniform_limit:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "\<And>e. e > 0 \<Longrightarrow> \<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
   shows "f integrable_on cbox a b"
 proof (cases "content (cbox a b) > 0")
   case False then show ?thesis
     using has_integral_null by (simp add: content_lt_nz integrable_on_def)
 next
   case True
   have "1 / (real n + 1) > 0" for n
     by auto
   then have "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> 1 / (real n + 1)) \<and> g integrable_on cbox a b" for n
     using assms by blast
   then obtain g where g_near_f: "\<And>n x. x \<in> cbox a b \<Longrightarrow> norm (f x - g n x) \<le> 1 / (real n + 1)"
                   and int_g: "\<And>n. g n integrable_on cbox a b"
     by metis
   then obtain h where h: "\<And>n. (g n has_integral h n) (cbox a b)"
     unfolding integrable_on_def by metis
   have "Cauchy h"
     unfolding Cauchy_def
   proof clarify
     fix e :: real
     assume "e>0"
     then have "e/4 / content (cbox a b) > 0"
       using True by (auto simp: field_simps)
     then obtain M where "M \<noteq> 0" and M: "1 / (real M) < e/4 / content (cbox a b)"
       by (metis inverse_eq_divide real_arch_inverse)
     show "\<exists>M. \<forall>m\<ge>M. \<forall>n\<ge>M. dist (h m) (h n) < e"
     proof (rule exI [where x=M], clarify)
       fix m n
       assume m: "M \<le> m" and n: "M \<le> n"
       have "e/4>0" using \<open>e>0\<close> by auto
       then obtain gm gn where "gauge gm" "gauge gn"
               and gm: "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> gm fine \<D> 
                             \<Longrightarrow> norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g m x) - h m) < e/4"
               and gn: "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> gn fine \<D> \<Longrightarrow>
                       norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g n x) - h n) < e/4"
         using h[unfolded has_integral] by meson
       then obtain \<D> where \<D>: "\<D> tagged_division_of cbox a b" "(\<lambda>x. gm x \<inter> gn x) fine \<D>"
         by (metis (full_types) fine_division_exists gauge_Int)
       have triangle3: "norm (i1 - i2) < e"
         if no: "norm(s2 - s1) \<le> e/2" "norm (s1 - i1) < e/4" "norm (s2 - i2) < e/4" for s1 s2 i1 and i2::'b
       proof -
         have "norm (i1 - i2) \<le> norm (i1 - s1) + norm (s1 - s2) + norm (s2 - i2)"
           using norm_triangle_ineq[of "i1 - s1" "s1 - i2"]
           using norm_triangle_ineq[of "s1 - s2" "s2 - i2"]
           by (auto simp: algebra_simps)
         also have "\<dots> < e"
           using no by (auto simp: algebra_simps norm_minus_commute)
         finally show ?thesis .
       qed
       have finep: "gm fine \<D>" "gn fine \<D>"
         using fine_Int \<D>  by auto
       have norm_le: "norm (g n x - g m x) \<le> 2 / real M" if x: "x \<in> cbox a b" for x
       proof -
         have "norm (f x - g n x) + norm (f x - g m x) \<le> 1 / (real n + 1) + 1 / (real m + 1)"          
           using g_near_f[OF x, of n] g_near_f[OF x, of m] by simp
         also have "\<dots> \<le> 1 / (real M) + 1 / (real M)"
           apply (rule add_mono)
           using \<open>M \<noteq> 0\<close> m n by (auto simp: field_split_simps)
         also have "\<dots> = 2 / real M"
           by auto
         finally show "norm (g n x - g m x) \<le> 2 / real M"
           using norm_triangle_le[of "g n x - f x" "f x - g m x" "2 / real M"]
           by (auto simp: algebra_simps simp add: norm_minus_commute)
       qed
       have "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g n x) - (\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g m x)) \<le> 2 / real M * content (cbox a b)"
         by (blast intro: norm_le rsum_diff_bound[OF \<D>(1), where e="2 / real M"])
       also have "... \<le> e/2"
         using M True
         by (auto simp: field_simps)
       finally have le_e2: "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g n x) - (\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g m x)) \<le> e/2" .
       then show "dist (h m) (h n) < e"
         unfolding dist_norm using gm gn \<D> finep by (auto intro!: triangle3)
     qed
   qed
   then obtain s where s: "h \<longlonglongrightarrow> s"
     using convergent_eq_Cauchy[symmetric] by blast
   show ?thesis
     unfolding integrable_on_def has_integral
   proof (rule_tac x=s in exI, clarify)
     fix e::real
     assume e: "0 < e"
     then have "e/3 > 0" by auto
     then obtain N1 where N1: "\<forall>n\<ge>N1. norm (h n - s) < e/3"
       using LIMSEQ_D [OF s] by metis
     from e True have "e/3 / content (cbox a b) > 0"
       by (auto simp: field_simps)
     then obtain N2 :: nat
          where "N2 \<noteq> 0" and N2: "1 / (real N2) < e/3 / content (cbox a b)"
       by (metis inverse_eq_divide real_arch_inverse)
     obtain g' where "gauge g'"
             and g': "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> g' fine \<D> \<Longrightarrow>
                     norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g (N1 + N2) x) - h (N1 + N2)) < e/3"
       by (metis h has_integral \<open>e/3 > 0\<close>)
     have *: "norm (sf - s) < e" 
         if no: "norm (sf - sg) \<le> e/3" "norm(h - s) < e/3" "norm (sg - h) < e/3" for sf sg h
     proof -
       have "norm (sf - s) \<le> norm (sf - sg) + norm (sg - h) + norm (h - s)"
         using norm_triangle_ineq[of "sf - sg" "sg - s"]
         using norm_triangle_ineq[of "sg -  h" " h - s"]
         by (auto simp: algebra_simps)
       also have "\<dots> < e"
         using no by (auto simp: algebra_simps norm_minus_commute)
       finally show ?thesis .
     qed
     { fix \<D>
       assume ptag: "\<D> tagged_division_of (cbox a b)" and "g' fine \<D>"
       then have norm_less: "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g (N1 + N2) x) - h (N1 + N2)) < e/3"
         using g' by blast
       have "content (cbox a b) < e/3 * (of_nat N2)"
         using \<open>N2 \<noteq> 0\<close> N2 using True by (auto simp: field_split_simps)
       moreover have "e/3 * of_nat N2 \<le> e/3 * (of_nat (N1 + N2) + 1)"
         using \<open>e>0\<close> by auto
       ultimately have "content (cbox a b) < e/3 * (of_nat (N1 + N2) + 1)"
         by linarith
       then have le_e3: "1 / (real (N1 + N2) + 1) * content (cbox a b) \<le> e/3"
         unfolding inverse_eq_divide
         by (auto simp: field_simps)
       have ne3: "norm (h (N1 + N2) - s) < e/3"
         using N1 by auto
       have "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R g (N1 + N2) x))
             \<le> 1 / (real (N1 + N2) + 1) * content (cbox a b)"
         by (blast intro: g_near_f rsum_diff_bound[OF ptag])
       then have "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - s) < e"
         by (rule *[OF order_trans [OF _ le_e3] ne3 norm_less])
     }
     then show "\<exists>d. gauge d \<and>
              (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> d fine \<D> \<longrightarrow> norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - s) < e)"
       by (blast intro: g' \<open>gauge g'\<close>)
   qed
 qed
 
 lemmas integrable_uniform_limit_real = integrable_uniform_limit [where 'a=real, simplified]
 
 
 subsection \<open>Negligible sets\<close>
 
 definition "negligible (s:: 'a::euclidean_space set) \<longleftrightarrow>
   (\<forall>a b. ((indicator s :: 'a\<Rightarrow>real) has_integral 0) (cbox a b))"
 
 
 subsubsection \<open>Negligibility of hyperplane\<close>
 
 lemma content_doublesplit:
   fixes a :: "'a::euclidean_space"
   assumes "0 < e"
     and k: "k \<in> Basis"
   obtains d where "0 < d" and "content (cbox a b \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d}) < e"
 proof cases
   assume *: "a \<bullet> k \<le> c \<and> c \<le> b \<bullet> k \<and> (\<forall>j\<in>Basis. a \<bullet> j \<le> b \<bullet> j)"
   define a' where "a' d = (\<Sum>j\<in>Basis. (if j = k then max (a\<bullet>j) (c - d) else a\<bullet>j) *\<^sub>R j)" for d
   define b' where "b' d = (\<Sum>j\<in>Basis. (if j = k then min (b\<bullet>j) (c + d) else b\<bullet>j) *\<^sub>R j)" for d
 
   have "((\<lambda>d. \<Prod>j\<in>Basis. (b' d - a' d) \<bullet> j) \<longlongrightarrow> (\<Prod>j\<in>Basis. (b' 0 - a' 0) \<bullet> j)) (at_right 0)"
     by (auto simp: b'_def a'_def intro!: tendsto_min tendsto_max tendsto_eq_intros)
   also have "(\<Prod>j\<in>Basis. (b' 0 - a' 0) \<bullet> j) = 0"
     using k *
     by (intro prod_zero bexI[OF _ k])
        (auto simp: b'_def a'_def inner_diff inner_sum_left inner_not_same_Basis intro!: sum.cong)
   also have "((\<lambda>d. \<Prod>j\<in>Basis. (b' d - a' d) \<bullet> j) \<longlongrightarrow> 0) (at_right 0) =
     ((\<lambda>d. content (cbox a b \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d})) \<longlongrightarrow> 0) (at_right 0)"
   proof (intro tendsto_cong eventually_at_rightI)
     fix d :: real assume d: "d \<in> {0<..<1}"
     have "cbox a b \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d} = cbox (a' d) (b' d)" for d
       using * d k by (auto simp add: cbox_def set_eq_iff Int_def ball_conj_distrib abs_diff_le_iff a'_def b'_def)
     moreover have "j \<in> Basis \<Longrightarrow> a' d \<bullet> j \<le> b' d \<bullet> j" for j
       using * d k by (auto simp: a'_def b'_def)
     ultimately show "(\<Prod>j\<in>Basis. (b' d - a' d) \<bullet> j) = content (cbox a b \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d})"
       by simp
   qed simp
   finally have "((\<lambda>d. content (cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})) \<longlongrightarrow> 0) (at_right 0)" .
   from order_tendstoD(2)[OF this \<open>0<e\<close>]
   obtain d' where "0 < d'" and d': "\<And>y. y > 0 \<Longrightarrow> y < d' \<Longrightarrow> content (cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> y}) < e"
     by (subst (asm) eventually_at_right[of _ 1]) auto
   show ?thesis
     by (rule that[of "d'/2"], insert \<open>0<d'\<close> d'[of "d'/2"], auto)
 next
   assume *: "\<not> (a \<bullet> k \<le> c \<and> c \<le> b \<bullet> k \<and> (\<forall>j\<in>Basis. a \<bullet> j \<le> b \<bullet> j))"
   then have "(\<exists>j\<in>Basis. b \<bullet> j < a \<bullet> j) \<or> (c < a \<bullet> k \<or> b \<bullet> k < c)"
     by (auto simp: not_le)
   show thesis
   proof cases
     assume "\<exists>j\<in>Basis. b \<bullet> j < a \<bullet> j"
     then have [simp]: "cbox a b = {}"
       using box_ne_empty(1)[of a b] by auto
     show ?thesis
       by (rule that[of 1]) (simp_all add: \<open>0<e\<close>)
   next
     assume "\<not> (\<exists>j\<in>Basis. b \<bullet> j < a \<bullet> j)"
     with * have "c < a \<bullet> k \<or> b \<bullet> k < c"
       by auto
     then show thesis
     proof
       assume c: "c < a \<bullet> k"
       moreover have "x \<in> cbox a b \<Longrightarrow> c \<le> x \<bullet> k" for x
         using k c by (auto simp: cbox_def)
       ultimately have "cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> (a \<bullet> k - c)/2} = {}"
         using k by (auto simp: cbox_def)
       with \<open>0<e\<close> c that[of "(a \<bullet> k - c)/2"] show ?thesis
         by auto
     next
       assume c: "b \<bullet> k < c"
       moreover have "x \<in> cbox a b \<Longrightarrow> x \<bullet> k \<le> c" for x
         using k c by (auto simp: cbox_def)
       ultimately have "cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> (c - b \<bullet> k)/2} = {}"
         using k by (auto simp: cbox_def)
       with \<open>0<e\<close> c that[of "(c - b \<bullet> k)/2"] show ?thesis
         by auto
     qed
   qed
 qed
 
 
 proposition negligible_standard_hyperplane[intro]:
   fixes k :: "'a::euclidean_space"
   assumes k: "k \<in> Basis"
   shows "negligible {x. x\<bullet>k = c}"
   unfolding negligible_def has_integral
 proof clarsimp
   fix a b and e::real assume "e > 0"
   with k obtain d where "0 < d" and d: "content (cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) < e"
     by (metis content_doublesplit)
   let ?i = "indicator {x::'a. x\<bullet>k = c} :: 'a\<Rightarrow>real"
   show "\<exists>\<gamma>. gauge \<gamma> \<and>
            (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                  \<bar>\<Sum>(x,K) \<in> \<D>. content K * ?i x\<bar> < e)"
   proof (intro exI, safe)
     show "gauge (\<lambda>x. ball x d)"
       using \<open>0 < d\<close> by blast
   next
     fix \<D>
     assume p: "\<D> tagged_division_of (cbox a b)" "(\<lambda>x. ball x d) fine \<D>"
     have "content L = content (L \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})" 
       if "(x, L) \<in> \<D>" "?i x \<noteq> 0" for x L
     proof -
       have xk: "x\<bullet>k = c"
         using that by (simp add: indicator_def split: if_split_asm)
       have "L \<subseteq> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}"
       proof 
         fix y
         assume y: "y \<in> L"
         have "L \<subseteq> ball x d"
           using p(2) that(1) by auto
         then have "norm (x - y) < d"
           by (simp add: dist_norm subset_iff y)
         then have "\<bar>(x - y) \<bullet> k\<bar> < d"
           using k norm_bound_Basis_lt by blast
         then show "y \<in> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}"
           unfolding inner_simps xk by auto
       qed 
       then show "content L = content (L \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})"
         by (metis inf.orderE)
     qed
     then have *: "(\<Sum>(x,K)\<in>\<D>. content K * ?i x) = (\<Sum>(x,K)\<in>\<D>. content (K \<inter> {x. \<bar>x\<bullet>k - c\<bar> \<le> d}) *\<^sub>R ?i x)"
       by (force simp add: split_paired_all intro!: sum.cong [OF refl])
     note p'= tagged_division_ofD[OF p(1)] and p''=division_of_tagged_division[OF p(1)]
     have "(\<Sum>(x,K)\<in>\<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) * indicator {x. x \<bullet> k = c} x) < e"
     proof -
       have "(\<Sum>(x,K)\<in>\<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) * ?i x) \<le> (\<Sum>(x,K)\<in>\<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}))"
         by (force simp add: indicator_def intro!: sum_mono)
       also have "\<dots> < e"
       proof (subst sum.over_tagged_division_lemma[OF p(1)])
         fix u v::'a
         assume "box u v = {}"
         then have *: "content (cbox u v) = 0"
           unfolding content_eq_0_interior by simp
         have "cbox u v \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<subseteq> cbox u v"
           by auto
         then have "content (cbox u v \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) \<le> content (cbox u v)"
           unfolding interval_doublesplit[OF k] by (rule content_subset)
         then show "content (cbox u v \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) = 0"
           unfolding * interval_doublesplit[OF k]
           by (blast intro: antisym)
       next
         have "(\<Sum>l\<in>snd ` \<D>. content (l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})) =
           sum content ((\<lambda>l. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})`{l\<in>snd ` \<D>. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}})"
         proof (subst (2) sum.reindex_nontrivial)
           fix x y assume "x \<in> {l \<in> snd ` \<D>. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}}" "y \<in> {l \<in> snd ` \<D>. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}}"
             "x \<noteq> y" and eq: "x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} = y \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}"
           then obtain x' y' where "(x', x) \<in> \<D>" "x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}" "(y', y) \<in> \<D>" "y \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}"
             by (auto)
           from p'(5)[OF \<open>(x', x) \<in> \<D>\<close> \<open>(y', y) \<in> \<D>\<close>] \<open>x \<noteq> y\<close> have "interior (x \<inter> y) = {}"
             by auto
           moreover have "interior ((x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) \<inter> (y \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})) \<subseteq> interior (x \<inter> y)"
             by (auto intro: interior_mono)
           ultimately have "interior (x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) = {}"
             by (auto simp: eq)
           then show "content (x \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) = 0"
             using p'(4)[OF \<open>(x', x) \<in> \<D>\<close>] by (auto simp: interval_doublesplit[OF k] content_eq_0_interior simp del: interior_Int)
         qed (insert p'(1), auto intro!: sum.mono_neutral_right)
         also have "\<dots> \<le> norm (\<Sum>l\<in>(\<lambda>l. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})`{l\<in>snd ` \<D>. l \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d} \<noteq> {}}. content l *\<^sub>R 1::real)"
           by simp
         also have "\<dots> \<le> 1 * content (cbox a b \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})"
           using division_doublesplit[OF p'' k, unfolded interval_doublesplit[OF k]]
           unfolding interval_doublesplit[OF k] by (intro dsum_bound) auto
         also have "\<dots> < e"
           using d by simp
         finally show "(\<Sum>K\<in>snd ` \<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d})) < e" .
       qed
       finally show "(\<Sum>(x, K)\<in>\<D>. content (K \<inter> {x. \<bar>x \<bullet> k - c\<bar> \<le> d}) * ?i x) < e" .
     qed
     then show "\<bar>\<Sum>(x, K)\<in>\<D>. content K * ?i x\<bar> < e"
       unfolding * 
       apply (subst abs_of_nonneg)
       using measure_nonneg       
       by (force simp add: indicator_def intro: sum_nonneg)+
   qed
 qed
 
 corollary negligible_standard_hyperplane_cart:
   fixes k :: "'a::finite"
   shows "negligible {x. x$k = (0::real)}"
   by (simp add: cart_eq_inner_axis negligible_standard_hyperplane)
 
 
 subsubsection \<open>Hence the main theorem about negligible sets\<close>
 
 
 lemma has_integral_negligible_cbox:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes negs: "negligible S"
     and 0: "\<And>x. x \<notin> S \<Longrightarrow> f x = 0"
   shows "(f has_integral 0) (cbox a b)"
   unfolding has_integral
 proof clarify
   fix e::real
   assume "e > 0"
   then have nn_gt0: "e/2 / ((real n+1) * (2 ^ n)) > 0" for n
     by simp
   then have "\<exists>\<gamma>. gauge \<gamma> \<and>
                    (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                         \<bar>\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R indicator S x\<bar>
                         < e/2 / ((real n + 1) * 2 ^ n))" for n
     using negs [unfolded negligible_def has_integral] by auto
   then obtain \<gamma> where 
     gd: "\<And>n. gauge (\<gamma> n)"
     and \<gamma>: "\<And>n \<D>. \<lbrakk>\<D> tagged_division_of cbox a b; \<gamma> n fine \<D>\<rbrakk>
                   \<Longrightarrow> \<bar>\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R indicator S x\<bar> < e/2 / ((real n + 1) * 2 ^ n)"
     by metis
   show "\<exists>\<gamma>. gauge \<gamma> \<and>
              (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> \<longrightarrow>
                   norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - 0) < e)"
   proof (intro exI, safe)
     show "gauge (\<lambda>x. \<gamma> (nat \<lfloor>norm (f x)\<rfloor>) x)"
       using gd by (auto simp: gauge_def)
 
     show "norm ((\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) - 0) < e"
       if "\<D> tagged_division_of (cbox a b)" "(\<lambda>x. \<gamma> (nat \<lfloor>norm (f x)\<rfloor>) x) fine \<D>" for \<D>
     proof (cases "\<D> = {}")
       case True with \<open>0 < e\<close> show ?thesis by simp
     next
       case False
       obtain N where "Max ((\<lambda>(x, K). norm (f x)) ` \<D>) \<le> real N"
         using real_arch_simple by blast
       then have N: "\<And>x. x \<in> (\<lambda>(x, K). norm (f x)) ` \<D> \<Longrightarrow> x \<le> real N"
         by (meson Max_ge that(1) dual_order.trans finite_imageI tagged_division_of_finite)
       have "\<forall>i. \<exists>q. q tagged_division_of (cbox a b) \<and> (\<gamma> i) fine q \<and> (\<forall>(x,K) \<in> \<D>. K \<subseteq> (\<gamma> i) x \<longrightarrow> (x, K) \<in> q)"
         by (auto intro: tagged_division_finer[OF that(1) gd])
       from choice[OF this] 
       obtain q where q: "\<And>n. q n tagged_division_of cbox a b"
                         "\<And>n. \<gamma> n fine q n"
                         "\<And>n x K. \<lbrakk>(x, K) \<in> \<D>; K \<subseteq> \<gamma> n x\<rbrakk> \<Longrightarrow> (x, K) \<in> q n"
         by fastforce
       have "finite \<D>"
         using that(1) by blast
       then have sum_le_inc: "\<lbrakk>finite T; \<And>x y. (x,y) \<in> T \<Longrightarrow> (0::real) \<le> g(x,y);
                       \<And>y. y\<in>\<D> \<Longrightarrow> \<exists>x. (x,y) \<in> T \<and> f(y) \<le> g(x,y)\<rbrakk> \<Longrightarrow> sum f \<D> \<le> sum g T" for f g T
         by (rule sum_le_included[of \<D> T g snd f]; force)
       have "norm (\<Sum>(x,K) \<in> \<D>. content K *\<^sub>R f x) \<le> (\<Sum>(x,K) \<in> \<D>. norm (content K *\<^sub>R f x))"
         unfolding split_def by (rule norm_sum)
       also have "... \<le> (\<Sum>(i, j) \<in> Sigma {..N + 1} q.
                           (real i + 1) * (case j of (x, K) \<Rightarrow> content K *\<^sub>R indicator S x))"
       proof (rule sum_le_inc, safe)
         show "finite (Sigma {..N+1} q)"
           by (meson finite_SigmaI finite_atMost tagged_division_of_finite q(1)) 
       next
         fix x K
         assume xk: "(x, K) \<in> \<D>"
         define n where "n = nat \<lfloor>norm (f x)\<rfloor>"
         have *: "norm (f x) \<in> (\<lambda>(x, K). norm (f x)) ` \<D>"
           using xk by auto
         have nfx: "real n \<le> norm (f x)" "norm (f x) \<le> real n + 1"
           unfolding n_def by auto
         then have "n \<in> {0..N + 1}"
           using N[OF *] by auto
         moreover have "K \<subseteq> \<gamma> (nat \<lfloor>norm (f x)\<rfloor>) x"
           using that(2) xk by auto
         moreover then have "(x, K) \<in> q (nat \<lfloor>norm (f x)\<rfloor>)"
           by (simp add: q(3) xk)
         moreover then have "(x, K) \<in> q n"
           using n_def by blast
         moreover
         have "norm (content K *\<^sub>R f x) \<le> (real n + 1) * (content K * indicator S x)"
         proof (cases "x \<in> S")
           case False
           then show ?thesis by (simp add: 0)
         next
           case True
           have *: "content K \<ge> 0"
             using tagged_division_ofD(4)[OF that(1) xk] by auto
           moreover have "content K * norm (f x) \<le> content K * (real n + 1)"
             by (simp add: mult_left_mono nfx(2))
           ultimately show ?thesis
             using nfx True by (auto simp: field_simps)
         qed
         ultimately show "\<exists>y. (y, x, K) \<in> (Sigma {..N + 1} q) \<and> norm (content K *\<^sub>R f x) \<le>
           (real y + 1) * (content K *\<^sub>R indicator S x)"
           by force
       qed auto
       also have "... = (\<Sum>i\<le>N + 1. \<Sum>j\<in>q i. (real i + 1) * (case j of (x, K) \<Rightarrow> content K *\<^sub>R indicator S x))"
         apply (rule sum_Sigma_product [symmetric])
         using q(1) apply auto
         done
       also have "... \<le> (\<Sum>i\<le>N + 1. (real i + 1) * \<bar>\<Sum>(x,K) \<in> q i. content K *\<^sub>R indicator S x\<bar>)"
         by (rule sum_mono) (simp add: sum_distrib_left [symmetric])
       also have "... \<le> (\<Sum>i\<le>N + 1. e/2/2 ^ i)"
       proof (rule sum_mono)
         show "(real i + 1) * \<bar>\<Sum>(x,K) \<in> q i. content K *\<^sub>R indicator S x\<bar> \<le> e/2/2 ^ i"
           if "i \<in> {..N + 1}" for i
           using \<gamma>[of "q i" i] q by (simp add: divide_simps mult.left_commute)
       qed
       also have "... = e/2 * (\<Sum>i\<le>N + 1. (1/2) ^ i)"
         unfolding sum_distrib_left by (metis divide_inverse inverse_eq_divide power_one_over)
       also have "\<dots> < e/2 * 2"
       proof (rule mult_strict_left_mono)
         have "sum (power (1/2)) {..N + 1} = sum (power (1/2::real)) {..<N + 2}"
           using lessThan_Suc_atMost by auto
         also have "... < 2"
           by (auto simp: geometric_sum)
         finally show "sum (power (1/2::real)) {..N + 1} < 2" .
       qed (use \<open>0 < e\<close> in auto)
       finally  show ?thesis by auto
     qed
   qed
 qed
 
 
 proposition has_integral_negligible:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes negs: "negligible S"
     and "\<And>x. x \<in> (T - S) \<Longrightarrow> f x = 0"
   shows "(f has_integral 0) T"
 proof (cases "\<exists>a b. T = cbox a b")
   case True
   then have "((\<lambda>x. if x \<in> T then f x else 0) has_integral 0) T"
     using assms by (auto intro!: has_integral_negligible_cbox)
   then show ?thesis
     by (rule has_integral_eq [rotated]) auto
 next
   case False
   let ?f = "(\<lambda>x. if x \<in> T then f x else 0)"
   have "((\<lambda>x. if x \<in> T then f x else 0) has_integral 0) T"
     apply (auto simp: False has_integral_alt [of ?f])
     apply (rule_tac x=1 in exI, auto)
     apply (rule_tac x=0 in exI, simp add: has_integral_negligible_cbox [OF negs] assms)
     done
   then show ?thesis
     by (rule_tac f="?f" in has_integral_eq) auto
 qed
 
 lemma
   assumes "negligible S"
   shows integrable_negligible: "f integrable_on S" and integral_negligible: "integral S f = 0"
   using has_integral_negligible [OF assms]
   by (auto simp: has_integral_iff)
 
 lemma has_integral_spike:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::real_normed_vector"
   assumes "negligible S"
     and gf: "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
     and fint: "(f has_integral y) T"
   shows "(g has_integral y) T"
 proof -
   have *: "(g has_integral y) (cbox a b)"
        if "(f has_integral y) (cbox a b)" "\<forall>x \<in> cbox a b - S. g x = f x" for a b f and g:: "'b \<Rightarrow> 'a" and y
   proof -
     have "((\<lambda>x. f x + (g x - f x)) has_integral (y + 0)) (cbox a b)"
       using that by (intro has_integral_add has_integral_negligible) (auto intro!: \<open>negligible S\<close>)
     then show ?thesis
       by auto
   qed
   show ?thesis
     using fint gf
     apply (subst has_integral_alt)
     apply (subst (asm) has_integral_alt)
     apply (simp split: if_split_asm)
      apply (blast dest: *)
       apply (erule_tac V = "\<forall>a b. T \<noteq> cbox a b" in thin_rl)
     apply (elim all_forward imp_forward ex_forward all_forward conj_forward asm_rl)
      apply (auto dest!: *[where f="\<lambda>x. if x\<in>T then f x else 0" and g="\<lambda>x. if x \<in> T then g x else 0"])
     done
 qed
 
 lemma has_integral_spike_eq:
   assumes "negligible S"
     and gf: "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "(f has_integral y) T \<longleftrightarrow> (g has_integral y) T"
     using has_integral_spike [OF \<open>negligible S\<close>] gf
     by metis
 
 lemma integrable_spike:
   assumes "f integrable_on T" "negligible S" "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
     shows "g integrable_on T"
   using assms unfolding integrable_on_def by (blast intro: has_integral_spike)
 
 lemma integral_spike:
   assumes "negligible S"
     and "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "integral T f = integral T g"
   using has_integral_spike_eq[OF assms]
     by (auto simp: integral_def integrable_on_def)
 
 
 subsection \<open>Some other trivialities about negligible sets\<close>
 
 lemma negligible_subset:
   assumes "negligible s" "t \<subseteq> s"
   shows "negligible t"
   unfolding negligible_def
     by (metis (no_types) Diff_iff assms contra_subsetD has_integral_negligible indicator_simps(2))
 
 lemma negligible_diff[intro?]:
   assumes "negligible s"
   shows "negligible (s - t)"
   using assms by (meson Diff_subset negligible_subset)
 
 lemma negligible_Int:
   assumes "negligible s \<or> negligible t"
   shows "negligible (s \<inter> t)"
   using assms negligible_subset by force
 
 lemma negligible_Un:
   assumes "negligible S" and T: "negligible T"
   shows "negligible (S \<union> T)"
 proof -
   have "(indicat_real (S \<union> T) has_integral 0) (cbox a b)"
     if S0: "(indicat_real S has_integral 0) (cbox a b)" 
       and  "(indicat_real T has_integral 0) (cbox a b)" for a b
   proof (subst has_integral_spike_eq[OF T])
     show "indicat_real S x = indicat_real (S \<union> T) x" if "x \<in> cbox a b - T" for x
       by (metis Diff_iff Un_iff indicator_def that)
     show "(indicat_real S has_integral 0) (cbox a b)"
       by (simp add: S0)
   qed
   with assms show ?thesis
     unfolding negligible_def by blast
 qed
 
 lemma negligible_Un_eq[simp]: "negligible (s \<union> t) \<longleftrightarrow> negligible s \<and> negligible t"
   using negligible_Un negligible_subset by blast
 
 lemma negligible_sing[intro]: "negligible {a::'a::euclidean_space}"
   using negligible_standard_hyperplane[OF SOME_Basis, of "a \<bullet> (SOME i. i \<in> Basis)"] negligible_subset by blast
 
 lemma negligible_insert[simp]: "negligible (insert a s) \<longleftrightarrow> negligible s"
   apply (subst insert_is_Un)
   unfolding negligible_Un_eq
   apply auto
   done
 
 lemma negligible_empty[iff]: "negligible {}"
   using negligible_insert by blast
 
 text\<open>Useful in this form for backchaining\<close>
 lemma empty_imp_negligible: "S = {} \<Longrightarrow> negligible S"
   by simp
 
 lemma negligible_finite[intro]:
   assumes "finite s"
   shows "negligible s"
   using assms by (induct s) auto
 
 lemma negligible_Union[intro]:
   assumes "finite \<T>"
     and "\<And>t. t \<in> \<T> \<Longrightarrow> negligible t"
   shows "negligible(\<Union>\<T>)"
   using assms by induct auto
 
 lemma negligible: "negligible S \<longleftrightarrow> (\<forall>T. (indicat_real S has_integral 0) T)"
 proof (intro iffI allI)
   fix T
   assume "negligible S"
   then show "(indicator S has_integral 0) T"
     by (meson Diff_iff has_integral_negligible indicator_simps(2))
 qed (simp add: negligible_def)
 
 subsection \<open>Finite case of the spike theorem is quite commonly needed\<close>
 
 lemma has_integral_spike_finite:
   assumes "finite S"
     and "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
     and "(f has_integral y) T"
   shows "(g has_integral y) T"
   using assms has_integral_spike negligible_finite by blast
 
 lemma has_integral_spike_finite_eq:
   assumes "finite S"
     and "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
   shows "((f has_integral y) T \<longleftrightarrow> (g has_integral y) T)"
   by (metis assms has_integral_spike_finite)
 
 lemma integrable_spike_finite:
   assumes "finite S"
     and "\<And>x. x \<in> T - S \<Longrightarrow> g x = f x"
     and "f integrable_on T"
   shows "g integrable_on T"
   using assms has_integral_spike_finite by blast
 
 lemma has_integral_bound_spike_finite:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "0 \<le> B" "finite S"
       and f: "(f has_integral i) (cbox a b)"
       and leB: "\<And>x. x \<in> cbox a b - S \<Longrightarrow> norm (f x) \<le> B"
     shows "norm i \<le> B * content (cbox a b)"
 proof -
   define g where "g \<equiv> (\<lambda>x. if x \<in> S then 0 else f x)"
   then have "\<And>x. x \<in> cbox a b - S \<Longrightarrow> norm (g x) \<le> B"
     using leB by simp
   moreover have "(g has_integral i) (cbox a b)"
     using has_integral_spike_finite [OF \<open>finite S\<close> _ f]
     by (simp add: g_def)
   ultimately show ?thesis
     by (simp add: \<open>0 \<le> B\<close> g_def has_integral_bound)
 qed
 
 corollary has_integral_bound_real:
   fixes f :: "real \<Rightarrow> 'b::real_normed_vector"
   assumes "0 \<le> B" "finite S"
       and "(f has_integral i) {a..b}"
       and "\<And>x. x \<in> {a..b} - S \<Longrightarrow> norm (f x) \<le> B"
     shows "norm i \<le> B * content {a..b}"
   by (metis assms box_real(2) has_integral_bound_spike_finite)
 
 
 subsection \<open>In particular, the boundary of an interval is negligible\<close>
 
 lemma negligible_frontier_interval: "negligible(cbox (a::'a::euclidean_space) b - box a b)"
 proof -
   let ?A = "\<Union>((\<lambda>k. {x. x\<bullet>k = a\<bullet>k} \<union> {x::'a. x\<bullet>k = b\<bullet>k}) ` Basis)"
   have "negligible ?A"
     by (force simp add: negligible_Union[OF finite_imageI])
   moreover have "cbox a b - box a b \<subseteq> ?A"
     by (force simp add: mem_box)
   ultimately show ?thesis
     by (rule negligible_subset)
 qed
 
 lemma has_integral_spike_interior:
   assumes f: "(f has_integral y) (cbox a b)" and gf: "\<And>x. x \<in> box a b \<Longrightarrow> g x = f x"
   shows "(g has_integral y) (cbox a b)"
   apply (rule has_integral_spike[OF negligible_frontier_interval _ f])
   using gf by auto
 
 lemma has_integral_spike_interior_eq:
   assumes "\<And>x. x \<in> box a b \<Longrightarrow> g x = f x"
   shows "(f has_integral y) (cbox a b) \<longleftrightarrow> (g has_integral y) (cbox a b)"
   by (metis assms has_integral_spike_interior)
 
 lemma integrable_spike_interior:
   assumes "\<And>x. x \<in> box a b \<Longrightarrow> g x = f x"
     and "f integrable_on cbox a b"
   shows "g integrable_on cbox a b"
   using assms has_integral_spike_interior_eq by blast
 
 
 subsection \<open>Integrability of continuous functions\<close>
 
 lemma operative_approximableI:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "0 \<le> e"
   shows "operative conj True (\<lambda>i. \<exists>g. (\<forall>x\<in>i. norm (f x - g (x::'b)) \<le> e) \<and> g integrable_on i)"
 proof -
   interpret comm_monoid conj True
     by standard auto
   show ?thesis
   proof (standard, safe)
     fix a b :: 'b
     show "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
       if "box a b = {}" for a b
       apply (rule_tac x=f in exI)
       using assms that by (auto simp: content_eq_0_interior)
     {
       fix c g and k :: 'b
       assume fg: "\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e" and g: "g integrable_on cbox a b"
       assume k: "k \<in> Basis"
       show "\<exists>g. (\<forall>x\<in>cbox a b \<inter> {x. x \<bullet> k \<le> c}. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c}"
            "\<exists>g. (\<forall>x\<in>cbox a b \<inter> {x. c \<le> x \<bullet> k}. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k}"
          apply (rule_tac[!] x=g in exI)
         using fg integrable_split[OF g k] by auto
     }
     show "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
       if fg1: "\<forall>x\<in>cbox a b \<inter> {x. x \<bullet> k \<le> c}. norm (f x - g1 x) \<le> e" 
         and g1: "g1 integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c}"
         and fg2: "\<forall>x\<in>cbox a b \<inter> {x. c \<le> x \<bullet> k}. norm (f x - g2 x) \<le> e" 
         and g2: "g2 integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k}" 
         and k: "k \<in> Basis"
       for c k g1 g2
     proof -
       let ?g = "\<lambda>x. if x\<bullet>k = c then f x else if x\<bullet>k \<le> c then g1 x else g2 x"
       show "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
       proof (intro exI conjI ballI)
         show "norm (f x - ?g x) \<le> e" if "x \<in> cbox a b" for x
           by (auto simp: that assms fg1 fg2)
         show "?g integrable_on cbox a b"
         proof -
           have "?g integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c}" "?g integrable_on cbox a b \<inter> {x. x \<bullet> k \<ge> c}"
             by(rule integrable_spike[OF _ negligible_standard_hyperplane[of k c]], use k g1 g2 in auto)+
           with has_integral_split[OF _ _ k] show ?thesis
             unfolding integrable_on_def by blast
         qed
       qed
     qed
   qed
 qed
 
 lemma comm_monoid_set_F_and: "comm_monoid_set.F (\<and>) True f s \<longleftrightarrow> (finite s \<longrightarrow> (\<forall>x\<in>s. f x))"
 proof -
   interpret bool: comm_monoid_set "(\<and>)" True
     proof qed auto
   show ?thesis
     by (induction s rule: infinite_finite_induct) auto
 qed
 
 lemma approximable_on_division:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "0 \<le> e"
     and d: "d division_of (cbox a b)"
     and f: "\<forall>i\<in>d. \<exists>g. (\<forall>x\<in>i. norm (f x - g x) \<le> e) \<and> g integrable_on i"
   obtains g where "\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e" "g integrable_on cbox a b"
 proof -
   interpret operative conj True "\<lambda>i. \<exists>g. (\<forall>x\<in>i. norm (f x - g (x::'b)) \<le> e) \<and> g integrable_on i"
     using \<open>0 \<le> e\<close> by (rule operative_approximableI)
   from f local.division [OF d] that show thesis
     by auto
 qed
 
 lemma integrable_continuous:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "continuous_on (cbox a b) f"
   shows "f integrable_on cbox a b"
 proof (rule integrable_uniform_limit)
   fix e :: real
   assume e: "e > 0"
   then obtain d where "0 < d" and d: "\<And>x x'. \<lbrakk>x \<in> cbox a b; x' \<in> cbox a b; dist x' x < d\<rbrakk> \<Longrightarrow> dist (f x') (f x) < e"
     using compact_uniformly_continuous[OF assms compact_cbox] unfolding uniformly_continuous_on_def by metis
   obtain p where ptag: "p tagged_division_of cbox a b" and finep: "(\<lambda>x. ball x d) fine p"
     using fine_division_exists[OF gauge_ball[OF \<open>0 < d\<close>], of a b] .
   have *: "\<forall>i\<in>snd ` p. \<exists>g. (\<forall>x\<in>i. norm (f x - g x) \<le> e) \<and> g integrable_on i"
   proof (safe, unfold snd_conv)
     fix x l
     assume as: "(x, l) \<in> p"
     obtain a b where l: "l = cbox a b"
       using as ptag by blast
     then have x: "x \<in> cbox a b"
       using as ptag by auto
     show "\<exists>g. (\<forall>x\<in>l. norm (f x - g x) \<le> e) \<and> g integrable_on l"
       apply (rule_tac x="\<lambda>y. f x" in exI)
     proof safe
       show "(\<lambda>y. f x) integrable_on l"
         unfolding integrable_on_def l by blast
     next
       fix y
       assume y: "y \<in> l"
       then have "y \<in> ball x d"
         using as finep by fastforce
       then show "norm (f y - f x) \<le> e"
         using d x y as l
         by (metis dist_commute dist_norm less_imp_le mem_ball ptag subsetCE tagged_division_ofD(3))
     qed
   qed
   from e have "e \<ge> 0"
     by auto
   from approximable_on_division[OF this division_of_tagged_division[OF ptag] *]
   show "\<exists>g. (\<forall>x\<in>cbox a b. norm (f x - g x) \<le> e) \<and> g integrable_on cbox a b"
     by metis
 qed
 
 lemma integrable_continuous_interval:
   fixes f :: "'b::ordered_euclidean_space \<Rightarrow> 'a::banach"
   assumes "continuous_on {a..b} f"
   shows "f integrable_on {a..b}"
   by (metis assms integrable_continuous interval_cbox)
 
 lemmas integrable_continuous_real = integrable_continuous_interval[where 'b=real]
 
 lemma integrable_continuous_closed_segment:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "continuous_on (closed_segment a b) f"
   shows "f integrable_on (closed_segment a b)"
   using assms
   by (auto intro!: integrable_continuous_interval simp: closed_segment_eq_real_ivl)
 
 
 subsection \<open>Specialization of additivity to one dimension\<close>
 
 
 subsection \<open>A useful lemma allowing us to factor out the content size\<close>
 
 lemma has_integral_factor_content:
   "(f has_integral i) (cbox a b) \<longleftrightarrow>
     (\<forall>e>0. \<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of (cbox a b) \<and> d fine p \<longrightarrow>
       norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p - i) \<le> e * content (cbox a b)))"
 proof (cases "content (cbox a b) = 0")
   case True
   have "\<And>e p. p tagged_division_of cbox a b \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x)) \<le> e * content (cbox a b)"
     unfolding sum_content_null[OF True] True by force
   moreover have "i = 0" 
     if "\<And>e. e > 0 \<Longrightarrow> \<exists>d. gauge d \<and>
               (\<forall>p. p tagged_division_of cbox a b \<and>
                    d fine p \<longrightarrow>
                    norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) \<le> e * content (cbox a b))"
     using that [of 1]
     by (force simp add: True sum_content_null[OF True] intro: fine_division_exists[of _ a b])
   ultimately show ?thesis
     unfolding has_integral_null_eq[OF True]
     by (force simp add: )
 next
   case False
   then have F: "0 < content (cbox a b)"
     using zero_less_measure_iff by blast
   let ?P = "\<lambda>e opp. \<exists>d. gauge d \<and>
     (\<forall>p. p tagged_division_of (cbox a b) \<and> d fine p \<longrightarrow> opp (norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i)) e)"
   show ?thesis
     apply (subst has_integral)
   proof safe
     fix e :: real
     assume e: "e > 0"
     { assume "\<forall>e>0. ?P e (<)"
       then show "?P (e * content (cbox a b)) (\<le>)"
         apply (rule allE [where x="e * content (cbox a b)"])
         apply (elim impE ex_forward conj_forward)
         using F e apply (auto simp add: algebra_simps)
         done }
     { assume "\<forall>e>0. ?P (e * content (cbox a b)) (\<le>)"
       then show "?P e (<)"
         apply (rule allE [where x="e/2 / content (cbox a b)"])
         apply (elim impE ex_forward conj_forward)
         using F e apply (auto simp add: algebra_simps)
         done }
   qed
 qed
 
 lemma has_integral_factor_content_real:
   "(f has_integral i) {a..b::real} \<longleftrightarrow>
     (\<forall>e>0. \<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of {a..b}  \<and> d fine p \<longrightarrow>
       norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) p - i) \<le> e * content {a..b} ))"
   unfolding box_real[symmetric]
   by (rule has_integral_factor_content)
 
 
 subsection \<open>Fundamental theorem of calculus\<close>
 
 lemma interval_bounds_real:
   fixes q b :: real
   assumes "a \<le> b"
   shows "Sup {a..b} = b"
     and "Inf {a..b} = a"
   using assms by auto
 
 theorem fundamental_theorem_of_calculus:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "a \<le> b" 
       and vecd: "\<And>x. x \<in> {a..b} \<Longrightarrow> (f has_vector_derivative f' x) (at x within {a..b})"
   shows "(f' has_integral (f b - f a)) {a..b}"
   unfolding has_integral_factor_content box_real[symmetric]
 proof safe
   fix e :: real
   assume "e > 0"
   then have "\<forall>x. \<exists>d>0. x \<in> {a..b} \<longrightarrow>
          (\<forall>y\<in>{a..b}. norm (y-x) < d \<longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e * norm (y-x))"
     using vecd[unfolded has_vector_derivative_def has_derivative_within_alt] by blast
   then obtain d where d: "\<And>x. 0 < d x"
                  "\<And>x y. \<lbrakk>x \<in> {a..b}; y \<in> {a..b}; norm (y-x) < d x\<rbrakk>
                         \<Longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e * norm (y-x)"
     by metis  
   show "\<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of (cbox a b) \<and> d fine p \<longrightarrow>
     norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f' x) - (f b - f a)) \<le> e * content (cbox a b))"
   proof (rule exI, safe)
     show "gauge (\<lambda>x. ball x (d x))"
       using d(1) gauge_ball_dependent by blast
   next
     fix p
     assume ptag: "p tagged_division_of cbox a b" and finep: "(\<lambda>x. ball x (d x)) fine p"
     have ba: "b - a = (\<Sum>(x,K)\<in>p. Sup K - Inf K)" "f b - f a = (\<Sum>(x,K)\<in>p. f(Sup K) - f(Inf K))"
       using additive_tagged_division_1[where f= "\<lambda>x. x"] additive_tagged_division_1[where f= f]
             \<open>a \<le> b\<close> ptag by auto
     have "norm (\<Sum>(x, K) \<in> p. (content K *\<^sub>R f' x) - (f (Sup K) - f (Inf K)))
           \<le> (\<Sum>n\<in>p. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))"
     proof (rule sum_norm_le,safe)
       fix x K
       assume "(x, K) \<in> p"
       then have "x \<in> K" and kab: "K \<subseteq> cbox a b"
         using ptag by blast+
       then obtain u v where k: "K = cbox u v" and "x \<in> K" and kab: "K \<subseteq> cbox a b"
         using ptag \<open>(x, K) \<in> p\<close> by auto 
       have "u \<le> v"
         using \<open>x \<in> K\<close> unfolding k by auto
       have ball: "\<forall>y\<in>K. y \<in> ball x (d x)"
         using finep \<open>(x, K) \<in> p\<close> by blast
       have "u \<in> K" "v \<in> K"
         by (simp_all add: \<open>u \<le> v\<close> k)
       have "norm ((v - u) *\<^sub>R f' x - (f v - f u)) = norm (f u - f x - (u - x) *\<^sub>R f' x - (f v - f x - (v - x) *\<^sub>R f' x))"
         by (auto simp add: algebra_simps)
       also have "... \<le> norm (f u - f x - (u - x) *\<^sub>R f' x) + norm (f v - f x - (v - x) *\<^sub>R f' x)"
         by (rule norm_triangle_ineq4)
       finally have "norm ((v - u) *\<^sub>R f' x - (f v - f u)) \<le>
         norm (f u - f x - (u - x) *\<^sub>R f' x) + norm (f v - f x - (v - x) *\<^sub>R f' x)" .
       also have "\<dots> \<le> e * norm (u - x) + e * norm (v - x)"
       proof (rule add_mono)
         show "norm (f u - f x - (u - x) *\<^sub>R f' x) \<le> e * norm (u - x)"
           apply (rule d(2)[of x u])
           using \<open>x \<in> K\<close> kab \<open>u \<in> K\<close> ball dist_real_def by (auto simp add:dist_real_def)
         show "norm (f v - f x - (v - x) *\<^sub>R f' x) \<le> e * norm (v - x)"
           apply (rule d(2)[of x v])
           using \<open>x \<in> K\<close> kab \<open>v \<in> K\<close> ball dist_real_def by (auto simp add:dist_real_def)
       qed
       also have "\<dots> \<le> e * (Sup K - Inf K)"
         using \<open>x \<in> K\<close> by (auto simp: k interval_bounds_real[OF \<open>u \<le> v\<close>] field_simps)
       finally show "norm (content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) \<le> e * (Sup K - Inf K)"
         using \<open>u \<le> v\<close> by (simp add: k)
     qed
     with \<open>a \<le> b\<close> show "norm ((\<Sum>(x, K)\<in>p. content K *\<^sub>R f' x) - (f b - f a)) \<le> e * content (cbox a b)"
       by (auto simp: ba split_def sum_subtractf [symmetric] sum_distrib_left)
   qed
 qed
 
 lemma ident_has_integral:
   fixes a::real
   assumes "a \<le> b"
   shows "((\<lambda>x. x) has_integral (b\<^sup>2 - a\<^sup>2)/2) {a..b}"
 proof -
   have "((\<lambda>x. x) has_integral inverse 2 * b\<^sup>2 - inverse 2 * a\<^sup>2) {a..b}"
     apply (rule fundamental_theorem_of_calculus [OF assms])
     unfolding power2_eq_square
     by (rule derivative_eq_intros | simp)+
   then show ?thesis
     by (simp add: field_simps)
 qed
 
 lemma integral_ident [simp]:
   fixes a::real
   assumes "a \<le> b"
   shows "integral {a..b} (\<lambda>x. x) = (if a \<le> b then (b\<^sup>2 - a\<^sup>2)/2 else 0)"
   by (metis assms ident_has_integral integral_unique)
 
 lemma ident_integrable_on:
   fixes a::real
   shows "(\<lambda>x. x) integrable_on {a..b}"
 by (metis atLeastatMost_empty_iff integrable_on_def has_integral_empty ident_has_integral)
 
 lemma integral_sin [simp]:
   fixes a::real
   assumes "a \<le> b" shows "integral {a..b} sin = cos a - cos b"
 proof -
   have "(sin has_integral (- cos b - - cos a)) {a..b}"
   proof (rule fundamental_theorem_of_calculus)
     show "((\<lambda>a. - cos a) has_vector_derivative sin x) (at x within {a..b})" for x
       unfolding has_field_derivative_iff_has_vector_derivative [symmetric]
       by (rule derivative_eq_intros | force)+
   qed (use assms in auto)
   then show ?thesis
     by (simp add: integral_unique)
 qed
 
 lemma integral_cos [simp]:
   fixes a::real
   assumes "a \<le> b" shows "integral {a..b} cos = sin b - sin a"
 proof -
   have "(cos has_integral (sin b - sin a)) {a..b}"
   proof (rule fundamental_theorem_of_calculus)
     show "(sin has_vector_derivative cos x) (at x within {a..b})" for x
       unfolding has_field_derivative_iff_has_vector_derivative [symmetric]
       by (rule derivative_eq_intros | force)+
   qed (use assms in auto)
   then show ?thesis
     by (simp add: integral_unique)
 qed
 
 lemma has_integral_sin_nx: "((\<lambda>x. sin(real_of_int n * x)) has_integral 0) {-pi..pi}"
 proof (cases "n = 0")
   case False
   have "((\<lambda>x. sin (n * x)) has_integral (- cos (n * pi)/n - - cos (n * - pi)/n)) {-pi..pi}"
   proof (rule fundamental_theorem_of_calculus)
     show "((\<lambda>x. - cos (n * x) / n) has_vector_derivative sin (n * a)) (at a within {-pi..pi})"
       if "a \<in> {-pi..pi}" for a :: real
       using that False
       apply (simp only: has_vector_derivative_def)
       apply (rule derivative_eq_intros | force)+
       done
   qed auto
   then show ?thesis
     by simp
 qed auto
 
 lemma integral_sin_nx:
    "integral {-pi..pi} (\<lambda>x. sin(x * real_of_int n)) = 0"
   using has_integral_sin_nx [of n] by (force simp: mult.commute)
 
 lemma has_integral_cos_nx:
   "((\<lambda>x. cos(real_of_int n * x)) has_integral (if n = 0 then 2 * pi else 0)) {-pi..pi}"
 proof (cases "n = 0")
   case True
   then show ?thesis
     using has_integral_const_real [of "1::real" "-pi" pi] by auto
 next
   case False
   have "((\<lambda>x. cos (n * x)) has_integral (sin (n * pi)/n - sin (n * - pi)/n)) {-pi..pi}"
   proof (rule fundamental_theorem_of_calculus)
     show "((\<lambda>x. sin (n * x) / n) has_vector_derivative cos (n * x)) (at x within {-pi..pi})"
       if "x \<in> {-pi..pi}"
       for x :: real
       using that False
       apply (simp only: has_vector_derivative_def)
       apply (rule derivative_eq_intros | force)+
       done
   qed auto
   with False show ?thesis
     by (simp add: mult.commute)
 qed
 
 lemma integral_cos_nx:
    "integral {-pi..pi} (\<lambda>x. cos(x * real_of_int n)) = (if n = 0 then 2 * pi else 0)"
   using has_integral_cos_nx [of n] by (force simp: mult.commute)
 
 
 subsection \<open>Taylor series expansion\<close>
 
 lemma mvt_integral:
   fixes f::"'a::real_normed_vector\<Rightarrow>'b::banach"
   assumes f'[derivative_intros]:
     "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative f' x) (at x within S)"
   assumes line_in: "\<And>t. t \<in> {0..1} \<Longrightarrow> x + t *\<^sub>R y \<in> S"
   shows "f (x + y) - f x = integral {0..1} (\<lambda>t. f' (x + t *\<^sub>R y) y)" (is ?th1)
 proof -
   from assms have subset: "(\<lambda>xa. x + xa *\<^sub>R y) ` {0..1} \<subseteq> S" by auto
   note [derivative_intros] =
     has_derivative_subset[OF _ subset]
     has_derivative_in_compose[where f="(\<lambda>xa. x + xa *\<^sub>R y)" and g = f]
   note [continuous_intros] =
     continuous_on_compose2[where f="(\<lambda>xa. x + xa *\<^sub>R y)"]
     continuous_on_subset[OF _ subset]
   have "\<And>t. t \<in> {0..1} \<Longrightarrow>
     ((\<lambda>t. f (x + t *\<^sub>R y)) has_vector_derivative f' (x + t *\<^sub>R y) y)
     (at t within {0..1})"
     using assms
     by (auto simp: has_vector_derivative_def
         linear_cmul[OF has_derivative_linear[OF f'], symmetric]
       intro!: derivative_eq_intros)
   from fundamental_theorem_of_calculus[rule_format, OF _ this]
   show ?th1
     by (auto intro!: integral_unique[symmetric])
 qed
 
 lemma (in bounded_bilinear) sum_prod_derivatives_has_vector_derivative:
   assumes "p>0"
   and f0: "Df 0 = f"
   and Df: "\<And>m t. m < p \<Longrightarrow> a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (Df m has_vector_derivative Df (Suc m) t) (at t within {a..b})"
   and g0: "Dg 0 = g"
   and Dg: "\<And>m t. m < p \<Longrightarrow> a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (Dg m has_vector_derivative Dg (Suc m) t) (at t within {a..b})"
   and ivl: "a \<le> t" "t \<le> b"
   shows "((\<lambda>t. \<Sum>i<p. (-1)^i *\<^sub>R prod (Df i t) (Dg (p - Suc i) t))
     has_vector_derivative
       prod (f t) (Dg p t) - (-1)^p *\<^sub>R prod (Df p t) (g t))
     (at t within {a..b})"
   using assms
 proof cases
   assume p: "p \<noteq> 1"
   define p' where "p' = p - 2"
   from assms p have p': "{..<p} = {..Suc p'}" "p = Suc (Suc p')"
     by (auto simp: p'_def)
   have *: "\<And>i. i \<le> p' \<Longrightarrow> Suc (Suc p' - i) = (Suc (Suc p') - i)"
     by auto
   let ?f = "\<lambda>i. (-1) ^ i *\<^sub>R (prod (Df i t) (Dg ((p - i)) t))"
   have "(\<Sum>i<p. (-1) ^ i *\<^sub>R (prod (Df i t) (Dg (Suc (p - Suc i)) t) +
     prod (Df (Suc i) t) (Dg (p - Suc i) t))) =
     (\<Sum>i\<le>(Suc p'). ?f i - ?f (Suc i))"
     by (auto simp: algebra_simps p'(2) numeral_2_eq_2 * lessThan_Suc_atMost)
   also note sum_telescope
   finally
   have "(\<Sum>i<p. (-1) ^ i *\<^sub>R (prod (Df i t) (Dg (Suc (p - Suc i)) t) +
     prod (Df (Suc i) t) (Dg (p - Suc i) t)))
     = prod (f t) (Dg p t) - (- 1) ^ p *\<^sub>R prod (Df p t) (g t)"
     unfolding p'[symmetric]
     by (simp add: assms)
   thus ?thesis
     using assms
     by (auto intro!: derivative_eq_intros has_vector_derivative)
 qed (auto intro!: derivative_eq_intros has_vector_derivative)
 
 lemma
   fixes f::"real\<Rightarrow>'a::banach"
   assumes "p>0"
   and f0: "Df 0 = f"
   and Df: "\<And>m t. m < p \<Longrightarrow> a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (Df m has_vector_derivative Df (Suc m) t) (at t within {a..b})"
   and ivl: "a \<le> b"
   defines "i \<equiv> \<lambda>x. ((b - x) ^ (p - 1) / fact (p - 1)) *\<^sub>R Df p x"
   shows Taylor_has_integral:
     "(i has_integral f b - (\<Sum>i<p. ((b-a) ^ i / fact i) *\<^sub>R Df i a)) {a..b}"
   and Taylor_integral:
     "f b = (\<Sum>i<p. ((b-a) ^ i / fact i) *\<^sub>R Df i a) + integral {a..b} i"
   and Taylor_integrable:
     "i integrable_on {a..b}"
 proof goal_cases
   case 1
   interpret bounded_bilinear "scaleR::real\<Rightarrow>'a\<Rightarrow>'a"
     by (rule bounded_bilinear_scaleR)
   define g where "g s = (b - s)^(p - 1)/fact (p - 1)" for s
   define Dg where [abs_def]:
     "Dg n s = (if n < p then (-1)^n * (b - s)^(p - 1 - n) / fact (p - 1 - n) else 0)" for n s
   have g0: "Dg 0 = g"
     using \<open>p > 0\<close>
     by (auto simp add: Dg_def field_split_simps g_def split: if_split_asm)
   {
     fix m
     assume "p > Suc m"
     hence "p - Suc m = Suc (p - Suc (Suc m))"
       by auto
     hence "real (p - Suc m) * fact (p - Suc (Suc m)) = fact (p - Suc m)"
       by auto
   } note fact_eq = this
   have Dg: "\<And>m t. m < p \<Longrightarrow> a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (Dg m has_vector_derivative Dg (Suc m) t) (at t within {a..b})"
     unfolding Dg_def
     by (auto intro!: derivative_eq_intros simp: has_vector_derivative_def fact_eq field_split_simps)
   let ?sum = "\<lambda>t. \<Sum>i<p. (- 1) ^ i *\<^sub>R Dg i t *\<^sub>R Df (p - Suc i) t"
   from sum_prod_derivatives_has_vector_derivative[of _ Dg _ _ _ Df,
       OF \<open>p > 0\<close> g0 Dg f0 Df]
   have deriv: "\<And>t. a \<le> t \<Longrightarrow> t \<le> b \<Longrightarrow>
     (?sum has_vector_derivative
       g t *\<^sub>R Df p t - (- 1) ^ p *\<^sub>R Dg p t *\<^sub>R f t) (at t within {a..b})"
     by auto
   from fundamental_theorem_of_calculus[rule_format, OF \<open>a \<le> b\<close> deriv]
   have "(i has_integral ?sum b - ?sum a) {a..b}"
     using atLeastatMost_empty'[simp del]
     by (simp add: i_def g_def Dg_def)
   also
   have one: "(- 1) ^ p' * (- 1) ^ p' = (1::real)"
     and "{..<p} \<inter> {i. p = Suc i} = {p - 1}"
     for p'
     using \<open>p > 0\<close>
     by (auto simp: power_mult_distrib[symmetric])
   then have "?sum b = f b"
     using Suc_pred'[OF \<open>p > 0\<close>]
     by (simp add: diff_eq_eq Dg_def power_0_left le_Suc_eq if_distrib
         if_distribR sum.If_cases f0)
   also
   have "{..<p} = (\<lambda>x. p - x - 1) ` {..<p}"
   proof safe
     fix x
     assume "x < p"
     thus "x \<in> (\<lambda>x. p - x - 1) ` {..<p}"
       by (auto intro!: image_eqI[where x = "p - x - 1"])
   qed simp
   from _ this
   have "?sum a = (\<Sum>i<p. ((b-a) ^ i / fact i) *\<^sub>R Df i a)"
     by (rule sum.reindex_cong) (auto simp add: inj_on_def Dg_def one)
   finally show c: ?case .
   case 2 show ?case using c integral_unique
     by (metis (lifting) add.commute diff_eq_eq integral_unique)
   case 3 show ?case using c by force
 qed
 
 
 subsection \<open>Only need trivial subintervals if the interval itself is trivial\<close>
 
 proposition division_of_nontrivial:
   fixes \<D> :: "'a::euclidean_space set set"
   assumes sdiv: "\<D> division_of (cbox a b)"
      and cont0: "content (cbox a b) \<noteq> 0"
   shows "{k. k \<in> \<D> \<and> content k \<noteq> 0} division_of (cbox a b)"
   using sdiv
 proof (induction "card \<D>" arbitrary: \<D> rule: less_induct)
   case less
   note \<D> = division_ofD[OF less.prems]
   {
     presume *: "{k \<in> \<D>. content k \<noteq> 0} \<noteq> \<D> \<Longrightarrow> ?case"
     then show ?case
       using less.prems by fastforce
   }
   assume noteq: "{k \<in> \<D>. content k \<noteq> 0} \<noteq> \<D>"
   then obtain K c d where "K \<in> \<D>" and contk: "content K = 0" and keq: "K = cbox c d"
     using \<D>(4) by blast 
   then have "card \<D> > 0"
     unfolding card_gt_0_iff using less by auto
   then have card: "card (\<D> - {K}) < card \<D>"
     using less \<open>K \<in> \<D>\<close> by (simp add: \<D>(1))
   have closed: "closed (\<Union>(\<D> - {K}))"
     using less.prems by auto
   have "x islimpt \<Union>(\<D> - {K})" if "x \<in> K" for x 
     unfolding islimpt_approachable
   proof (intro allI impI)
     fix e::real
     assume "e > 0"
     obtain i where i: "c\<bullet>i = d\<bullet>i" "i\<in>Basis"
       using contk \<D>(3) [OF \<open>K \<in> \<D>\<close>] unfolding box_ne_empty keq
       by (meson content_eq_0 dual_order.antisym)
     then have xi: "x\<bullet>i = d\<bullet>i"
       using \<open>x \<in> K\<close> unfolding keq mem_box by (metis antisym)
     define y where "y = (\<Sum>j\<in>Basis. (if j = i then if c\<bullet>i \<le> (a\<bullet>i + b\<bullet>i)/2 then c\<bullet>i +
       min e (b\<bullet>i - c\<bullet>i)/2 else c\<bullet>i - min e (c\<bullet>i - a\<bullet>i)/2 else x\<bullet>j) *\<^sub>R j)"
     show "\<exists>x'\<in>\<Union>(\<D> - {K}). x' \<noteq> x \<and> dist x' x < e"
     proof (intro bexI conjI)
       have "d \<in> cbox c d"
         using \<D>(3)[OF \<open>K \<in> \<D>\<close>] by (simp add: box_ne_empty(1) keq mem_box(2))
       then have "d \<in> cbox a b"
         using \<D>(2)[OF \<open>K \<in> \<D>\<close>] by (auto simp: keq)
       then have di: "a \<bullet> i \<le> d \<bullet> i \<and> d \<bullet> i \<le> b \<bullet> i"
         using \<open>i \<in> Basis\<close> mem_box(2) by blast
       then have xyi: "y\<bullet>i \<noteq> x\<bullet>i"
         unfolding y_def i xi using \<open>e > 0\<close> cont0 \<open>i \<in> Basis\<close>
         by (auto simp: content_eq_0 elim!: ballE[of _ _ i])
       then show "y \<noteq> x"
         unfolding euclidean_eq_iff[where 'a='a] using i by auto
       have "norm (y-x) \<le> (\<Sum>b\<in>Basis. \<bar>(y - x) \<bullet> b\<bar>)"
         by (rule norm_le_l1)
       also have "... = \<bar>(y - x) \<bullet> i\<bar> + (\<Sum>b \<in> Basis - {i}. \<bar>(y - x) \<bullet> b\<bar>)"
         by (meson finite_Basis i(2) sum.remove)
       also have "... <  e + sum (\<lambda>i. 0) Basis"
       proof (rule add_less_le_mono)
         show "\<bar>(y-x) \<bullet> i\<bar> < e"
           using di \<open>e > 0\<close> y_def i xi by (auto simp: inner_simps)
         show "(\<Sum>i\<in>Basis - {i}. \<bar>(y-x) \<bullet> i\<bar>) \<le> (\<Sum>i\<in>Basis. 0)"
           unfolding y_def by (auto simp: inner_simps)
       qed 
       finally have "norm (y-x) < e + sum (\<lambda>i. 0) Basis" .
       then show "dist y x < e"
         unfolding dist_norm by auto
       have "y \<notin> K"
         unfolding keq mem_box using i(1) i(2) xi xyi by fastforce
       moreover have "y \<in> \<Union>\<D>"
         using subsetD[OF \<D>(2)[OF \<open>K \<in> \<D>\<close>] \<open>x \<in> K\<close>] \<open>e > 0\<close> di i
         by (auto simp: \<D> mem_box y_def field_simps elim!: ballE[of _ _ i])
       ultimately show "y \<in> \<Union>(\<D> - {K})" by auto
     qed
   qed
   then have "K \<subseteq> \<Union>(\<D> - {K})"
     using closed closed_limpt by blast
   then have "\<Union>(\<D> - {K}) = cbox a b"
     unfolding \<D>(6)[symmetric] by auto
   then have "\<D> - {K} division_of cbox a b"
     by (metis Diff_subset less.prems division_of_subset \<D>(6))
   then have "{ka \<in> \<D> - {K}. content ka \<noteq> 0} division_of (cbox a b)"
     using card less.hyps by blast
   moreover have "{ka \<in> \<D> - {K}. content ka \<noteq> 0} = {K \<in> \<D>. content K \<noteq> 0}"
     using contk by auto
   ultimately show ?case by auto
 qed
 
 
 subsection \<open>Integrability on subintervals\<close>
 
 lemma operative_integrableI:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "0 \<le> e"
   shows "operative conj True (\<lambda>i. f integrable_on i)"
 proof -
   interpret comm_monoid conj True
     by standard auto
   have 1: "\<And>a b. box a b = {} \<Longrightarrow> f integrable_on cbox a b"
     by (simp add: content_eq_0_interior integrable_on_null)
   have 2: "\<And>a b c k.
        \<lbrakk>k \<in> Basis;
         f integrable_on cbox a b \<inter> {x. x \<bullet> k \<le> c};
         f integrable_on cbox a b \<inter> {x. c \<le> x \<bullet> k}\<rbrakk>
        \<Longrightarrow> f integrable_on cbox a b"
     unfolding integrable_on_def by (auto intro!: has_integral_split)
   show ?thesis
     apply standard
     using 1 2 by blast+
 qed
 
 lemma integrable_subinterval:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on cbox a b"
     and cd: "cbox c d \<subseteq> cbox a b"
   shows "f integrable_on cbox c d"
 proof -
   interpret operative conj True "\<lambda>i. f integrable_on i"
     using order_refl by (rule operative_integrableI)
   show ?thesis
   proof (cases "cbox c d = {}")
     case True
     then show ?thesis
       using division [symmetric] f by (auto simp: comm_monoid_set_F_and)
   next
     case False
     then show ?thesis
       by (metis cd comm_monoid_set_F_and division division_of_finite f partial_division_extend_1)
   qed
 qed
 
 lemma integrable_subinterval_real:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "f integrable_on {a..b}"
     and "{c..d} \<subseteq> {a..b}"
   shows "f integrable_on {c..d}"
   by (metis assms box_real(2) integrable_subinterval)
 
 subsection \<open>Combining adjacent intervals in 1 dimension\<close>
 
 lemma has_integral_combine:
   fixes a b c :: real and j :: "'a::banach"
   assumes "a \<le> c"
       and "c \<le> b"
       and ac: "(f has_integral i) {a..c}"
       and cb: "(f has_integral j) {c..b}"
   shows "(f has_integral (i + j)) {a..b}"
 proof -
   interpret operative_real "lift_option plus" "Some 0"
     "\<lambda>i. if f integrable_on i then Some (integral i f) else None"
     using operative_integralI by (rule operative_realI)
   from \<open>a \<le> c\<close> \<open>c \<le> b\<close> ac cb coalesce_less_eq
   have *: "lift_option (+)
              (if f integrable_on {a..c} then Some (integral {a..c} f) else None)
              (if f integrable_on {c..b} then Some (integral {c..b} f) else None) =
             (if f integrable_on {a..b} then Some (integral {a..b} f) else None)"
     by (auto simp: split: if_split_asm)
   then have "f integrable_on cbox a b"
     using ac cb by (auto split: if_split_asm)
   with *
   show ?thesis
     using ac cb by (auto simp add: integrable_on_def integral_unique split: if_split_asm)
 qed
 
 lemma integral_combine:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "a \<le> c"
     and "c \<le> b"
     and ab: "f integrable_on {a..b}"
   shows "integral {a..c} f + integral {c..b} f = integral {a..b} f"
 proof -
   have "(f has_integral integral {a..c} f) {a..c}"
     using ab \<open>c \<le> b\<close> integrable_subinterval_real by fastforce
   moreover
   have "(f has_integral integral {c..b} f) {c..b}"
     using ab \<open>a \<le> c\<close> integrable_subinterval_real by fastforce
   ultimately have "(f has_integral integral {a..c} f + integral {c..b} f) {a..b}"
     using \<open>a \<le> c\<close> \<open>c \<le> b\<close> has_integral_combine by blast
   then show ?thesis
     by (simp add: has_integral_integrable_integral)
 qed
 
 lemma integrable_combine:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "a \<le> c"
     and "c \<le> b"
     and "f integrable_on {a..c}"
     and "f integrable_on {c..b}"
   shows "f integrable_on {a..b}"
   using assms
   unfolding integrable_on_def
   by (auto intro!: has_integral_combine)
 
 lemma integral_minus_sets:
   fixes f::"real \<Rightarrow> 'a::banach"
   shows "c \<le> a \<Longrightarrow> c \<le> b \<Longrightarrow> f integrable_on {c .. max a b} \<Longrightarrow>
     integral {c .. a} f - integral {c .. b} f =
     (if a \<le> b then - integral {a .. b} f else integral {b .. a} f)"
   using integral_combine[of c a b f]  integral_combine[of c b a f]
   by (auto simp: algebra_simps max_def)
 
 lemma integral_minus_sets':
   fixes f::"real \<Rightarrow> 'a::banach"
   shows "c \<ge> a \<Longrightarrow> c \<ge> b \<Longrightarrow> f integrable_on {min a b .. c} \<Longrightarrow>
     integral {a .. c} f - integral {b .. c} f =
     (if a \<le> b then integral {a .. b} f else - integral {b .. a} f)"
   using integral_combine[of b a c f] integral_combine[of a b c f]
   by (auto simp: algebra_simps min_def)
 
 subsection \<open>Reduce integrability to "local" integrability\<close>
 
 lemma integrable_on_little_subintervals:
   fixes f :: "'b::euclidean_space \<Rightarrow> 'a::banach"
   assumes "\<forall>x\<in>cbox a b. \<exists>d>0. \<forall>u v. x \<in> cbox u v \<and> cbox u v \<subseteq> ball x d \<and> cbox u v \<subseteq> cbox a b \<longrightarrow>
     f integrable_on cbox u v"
   shows "f integrable_on cbox a b"
 proof -
   interpret operative conj True "\<lambda>i. f integrable_on i"
     using order_refl by (rule operative_integrableI)
   have "\<forall>x. \<exists>d>0. x\<in>cbox a b \<longrightarrow> (\<forall>u v. x \<in> cbox u v \<and> cbox u v \<subseteq> ball x d \<and> cbox u v \<subseteq> cbox a b \<longrightarrow>
     f integrable_on cbox u v)"
     using assms by (metis zero_less_one)
   then obtain d where d: "\<And>x. 0 < d x"
      "\<And>x u v. \<lbrakk>x \<in> cbox a b; x \<in> cbox u v; cbox u v \<subseteq> ball x (d x); cbox u v \<subseteq> cbox a b\<rbrakk> 
                \<Longrightarrow> f integrable_on cbox u v"
     by metis
   obtain p where p: "p tagged_division_of cbox a b" "(\<lambda>x. ball x (d x)) fine p"
     using fine_division_exists[OF gauge_ball_dependent,of d a b] d(1) by blast 
   then have sndp: "snd ` p division_of cbox a b"
     by (metis division_of_tagged_division)
   have "f integrable_on k" if "(x, k) \<in> p" for x k
     using tagged_division_ofD(2-4)[OF p(1) that] fineD[OF p(2) that] d[of x] by auto
   then show ?thesis
     unfolding division [symmetric, OF sndp] comm_monoid_set_F_and
     by auto
 qed
 
 
 subsection \<open>Second FTC or existence of antiderivative\<close>
 
 lemma integrable_const[intro]: "(\<lambda>x. c) integrable_on cbox a b"
   unfolding integrable_on_def by blast
 
 lemma integral_has_vector_derivative_continuous_at:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on {a..b}"
      and x: "x \<in> {a..b} - S"
      and "finite S"
      and fx: "continuous (at x within ({a..b} - S)) f"
  shows "((\<lambda>u. integral {a..u} f) has_vector_derivative f x) (at x within ({a..b} - S))"
 proof -
   let ?I = "\<lambda>a b. integral {a..b} f"
   { fix e::real
     assume "e > 0"
     obtain d where "d>0" and d: "\<And>x'. \<lbrakk>x' \<in> {a..b} - S; \<bar>x' - x\<bar> < d\<rbrakk> \<Longrightarrow> norm(f x' - f x) \<le> e"
       using \<open>e>0\<close> fx by (auto simp: continuous_within_eps_delta dist_norm less_imp_le)
     have "norm (integral {a..y} f - integral {a..x} f - (y-x) *\<^sub>R f x) \<le> e * \<bar>y - x\<bar>"
            if y: "y \<in> {a..b} - S" and yx: "\<bar>y - x\<bar> < d" for y
     proof (cases "y < x")
       case False
       have "f integrable_on {a..y}"
         using f y by (simp add: integrable_subinterval_real)
       then have Idiff: "?I a y - ?I a x = ?I x y"
         using False x by (simp add: algebra_simps integral_combine)
       have fux_int: "((\<lambda>u. f u - f x) has_integral integral {x..y} f - (y-x) *\<^sub>R f x) {x..y}"
         apply (rule has_integral_diff)
         using x y apply (auto intro: integrable_integral [OF integrable_subinterval_real [OF f]])
         using has_integral_const_real [of "f x" x y] False
         apply simp
         done
       have "\<And>xa. y - x < d \<Longrightarrow> (\<And>x'. a \<le> x' \<and> x' \<le> b \<and> x' \<notin> S \<Longrightarrow> \<bar>x' - x\<bar> < d \<Longrightarrow> norm (f x' - f x) \<le> e) \<Longrightarrow> 0 < e \<Longrightarrow> xa \<notin> S \<Longrightarrow> a \<le> x \<Longrightarrow> x \<notin> S \<Longrightarrow> y \<le> b \<Longrightarrow> y \<notin> S \<Longrightarrow> x \<le> xa \<Longrightarrow> xa \<le> y \<Longrightarrow> norm (f xa - f x) \<le> e"
         using assms by auto
       show ?thesis
         using False
         apply (simp add: abs_eq_content del: content_real_if measure_lborel_Icc)
         apply (rule has_integral_bound_real[where f="(\<lambda>u. f u - f x)"])
         using yx False d x y \<open>e>0\<close> assms by (auto simp: Idiff fux_int)
     next
       case True
       have "f integrable_on {a..x}"
         using f x by (simp add: integrable_subinterval_real)
       then have Idiff: "?I a x - ?I a y = ?I y x"
         using True x y by (simp add: algebra_simps integral_combine)
       have fux_int: "((\<lambda>u. f u - f x) has_integral integral {y..x} f - (x - y) *\<^sub>R f x) {y..x}"
         apply (rule has_integral_diff)
         using x y apply (auto intro: integrable_integral [OF integrable_subinterval_real [OF f]])
         using has_integral_const_real [of "f x" y x] True
         apply simp
         done
       have "norm (integral {a..x} f - integral {a..y} f - (x - y) *\<^sub>R f x) \<le> e * \<bar>y - x\<bar>"
         using True
         apply (simp add: abs_eq_content del: content_real_if measure_lborel_Icc)
         apply (rule has_integral_bound_real[where f="(\<lambda>u. f u - f x)"])
         using yx True d x y \<open>e>0\<close> assms by (auto simp: Idiff fux_int)
       then show ?thesis
         by (simp add: algebra_simps norm_minus_commute)
     qed
     then have "\<exists>d>0. \<forall>y\<in>{a..b} - S. \<bar>y - x\<bar> < d \<longrightarrow> norm (integral {a..y} f - integral {a..x} f - (y-x) *\<^sub>R f x) \<le> e * \<bar>y - x\<bar>"
       using \<open>d>0\<close> by blast
   }
   then show ?thesis
     by (simp add: has_vector_derivative_def has_derivative_within_alt bounded_linear_scaleR_left)
 qed
 
 
 lemma integral_has_vector_derivative:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "continuous_on {a..b} f"
     and "x \<in> {a..b}"
   shows "((\<lambda>u. integral {a..u} f) has_vector_derivative f(x)) (at x within {a..b})"
 using assms integral_has_vector_derivative_continuous_at [OF integrable_continuous_real]
   by (fastforce simp: continuous_on_eq_continuous_within)
 
 lemma integral_has_real_derivative:
   assumes "continuous_on {a..b} g"
   assumes "t \<in> {a..b}"
   shows "((\<lambda>x. integral {a..x} g) has_real_derivative g t) (at t within {a..b})"
   using integral_has_vector_derivative[of a b g t] assms
   by (auto simp: has_field_derivative_iff_has_vector_derivative)
 
 lemma antiderivative_continuous:
   fixes q b :: real
   assumes "continuous_on {a..b} f"
   obtains g where "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_vector_derivative (f x::_::banach)) (at x within {a..b})"
   using integral_has_vector_derivative[OF assms] by auto
 
 subsection \<open>Combined fundamental theorem of calculus\<close>
 
 lemma antiderivative_integral_continuous:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "continuous_on {a..b} f"
   obtains g where "\<forall>u\<in>{a..b}. \<forall>v \<in> {a..b}. u \<le> v \<longrightarrow> (f has_integral (g v - g u)) {u..v}"
 proof -
   obtain g 
     where g: "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_vector_derivative f x) (at x within {a..b})" 
     using  antiderivative_continuous[OF assms] by metis
   have "(f has_integral g v - g u) {u..v}" if "u \<in> {a..b}" "v \<in> {a..b}" "u \<le> v" for u v
   proof -
     have "\<And>x. x \<in> cbox u v \<Longrightarrow> (g has_vector_derivative f x) (at x within cbox u v)"
       by (metis atLeastAtMost_iff atLeastatMost_subset_iff box_real(2) g
           has_vector_derivative_within_subset subsetCE that(1,2))
     then show ?thesis
       by (metis box_real(2) that(3) fundamental_theorem_of_calculus)
   qed
   then show ?thesis
     using that by blast
 qed
 
 
 subsection \<open>General "twiddling" for interval-to-interval function image\<close>
 
 lemma has_integral_twiddle:
   assumes "0 < r"
     and hg: "\<And>x. h(g x) = x"
     and gh: "\<And>x. g(h x) = x"
     and contg: "\<And>x. continuous (at x) g"
     and g: "\<And>u v. \<exists>w z. g ` cbox u v = cbox w z"
     and h: "\<And>u v. \<exists>w z. h ` cbox u v = cbox w z"
     and r: "\<And>u v. content(g ` cbox u v) = r * content (cbox u v)"
     and intfi: "(f has_integral i) (cbox a b)"
   shows "((\<lambda>x. f(g x)) has_integral (1 / r) *\<^sub>R i) (h ` cbox a b)"
 proof (cases "cbox a b = {}")
   case True
   then show ?thesis 
     using intfi by auto
 next
   case False
   obtain w z where wz: "h ` cbox a b = cbox w z"
     using h by blast
   have inj: "inj g" "inj h"
     using hg gh injI by metis+
   from h obtain ha hb where h_eq: "h ` cbox a b = cbox ha hb" by blast
   have "\<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of h ` cbox a b \<and> d fine p 
               \<longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f (g x)) - (1 / r) *\<^sub>R i) < e)"
     if "e > 0" for e
   proof -
     have "e * r > 0" using that \<open>0 < r\<close> by simp
     with intfi[unfolded has_integral]
     obtain d where "gauge d"
                and d: "\<And>p. p tagged_division_of cbox a b \<and> d fine p 
                         \<Longrightarrow> norm ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f x) - i) < e * r" 
       by metis
     define d' where "d' x = g -` d (g x)" for x
     show ?thesis
     proof (rule_tac x=d' in exI, safe)
       show "gauge d'"
         using \<open>gauge d\<close> continuous_open_vimage[OF _ contg] by (auto simp: gauge_def d'_def)
     next
       fix p
       assume ptag: "p tagged_division_of h ` cbox a b" and finep: "d' fine p"
       note p = tagged_division_ofD[OF ptag]
       have gab: "g y \<in> cbox a b" if "y \<in> K" "(x, K) \<in> p" for x y K
         by (metis hg inj(2) inj_image_mem_iff p(3) subsetCE that that)
       have gimp: "(\<lambda>(x,K). (g x, g ` K)) ` p tagged_division_of (cbox a b) \<and> 
                   d fine (\<lambda>(x, k). (g x, g ` k)) ` p"
         unfolding tagged_division_of
       proof safe
         show "finite ((\<lambda>(x, k). (g x, g ` k)) ` p)"
           using ptag by auto
         show "d fine (\<lambda>(x, k). (g x, g ` k)) ` p"
           using finep unfolding fine_def d'_def by auto
       next
         fix x k
         assume xk: "(x, k) \<in> p"
         show "g x \<in> g ` k"
           using p(2)[OF xk] by auto
         show "\<exists>u v. g ` k = cbox u v"
           using p(4)[OF xk] using assms(5-6) by auto
         fix x' K' u
         assume xk': "(x', K') \<in> p" and u: "u \<in> interior (g ` k)" "u \<in> interior (g ` K')"
         have "interior k \<inter> interior K' \<noteq> {}"
         proof 
           assume "interior k \<inter> interior K' = {}"
           moreover have "u \<in> g ` (interior k \<inter> interior K')"
             using interior_image_subset[OF \<open>inj g\<close> contg] u
             unfolding image_Int[OF inj(1)] by blast
           ultimately show False by blast
         qed
         then have same: "(x, k) = (x', K')"
           using ptag xk' xk by blast
         then show "g x = g x'"
           by auto
         show "g u \<in> g ` K'"if "u \<in> k" for u
           using that same by auto
         show "g u \<in> g ` k"if "u \<in> K'" for u
           using that same by auto
       next
         fix x
         assume "x \<in> cbox a b"
         then have "h x \<in>  \<Union>{k. \<exists>x. (x, k) \<in> p}"
           using p(6) by auto
         then obtain X y where "h x \<in> X" "(y, X) \<in> p" by blast
         then show "x \<in> \<Union>{k. \<exists>x. (x, k) \<in> (\<lambda>(x, k). (g x, g ` k)) ` p}"
           apply clarsimp
           by (metis (no_types, lifting) assms(3) image_eqI pair_imageI)
       qed (use gab in auto)
       have *: "inj_on (\<lambda>(x, k). (g x, g ` k)) p"
         using inj(1) unfolding inj_on_def by fastforce
       have "(\<Sum>(x, k)\<in>(\<lambda>(x, k). (g x, g ` k)) ` p. content k *\<^sub>R f x) - i = r *\<^sub>R (\<Sum>(x, k)\<in>p. content k *\<^sub>R f (g x)) - i" (is "?l = _")
         using r
         apply (simp only: algebra_simps add_left_cancel scaleR_right.sum)
         apply (subst sum.reindex_bij_betw[symmetric, where h="\<lambda>(x, k). (g x, g ` k)" and S=p])
          apply (auto intro!: * sum.cong simp: bij_betw_def dest!: p(4))
         done
       also have "\<dots> = r *\<^sub>R ((\<Sum>(x, k)\<in>p. content k *\<^sub>R f (g x)) - (1 / r) *\<^sub>R i)" (is "_ = ?r")
         using \<open>0 < r\<close> by (auto simp: scaleR_diff_right)
       finally have eq: "?l = ?r" .
       show "norm ((\<Sum>(x,K)\<in>p. content K *\<^sub>R f (g x)) - (1 / r) *\<^sub>R i) < e"
         using d[OF gimp] \<open>0 < r\<close> by (auto simp add: eq)
     qed
   qed
   then show ?thesis
     by (auto simp: h_eq has_integral)
 qed
 
 
 subsection \<open>Special case of a basic affine transformation\<close>
 
 lemma AE_lborel_inner_neq:
   assumes k: "k \<in> Basis"
   shows "AE x in lborel. x \<bullet> k \<noteq> c"
 proof -
   interpret finite_product_sigma_finite "\<lambda>_. lborel" Basis
     proof qed simp
 
   have "emeasure lborel {x\<in>space lborel. x \<bullet> k = c} = emeasure (\<Pi>\<^sub>M j::'a\<in>Basis. lborel) (\<Pi>\<^sub>E j\<in>Basis. if j = k then {c} else UNIV)"
     using k
     by (auto simp add: lborel_eq[where 'a='a] emeasure_distr intro!: arg_cong2[where f=emeasure])
        (auto simp: space_PiM PiE_iff extensional_def split: if_split_asm)
   also have "\<dots> = (\<Prod>j\<in>Basis. emeasure lborel (if j = k then {c} else UNIV))"
     by (intro measure_times) auto
   also have "\<dots> = 0"
     by (intro prod_zero bexI[OF _ k]) auto
   finally show ?thesis
     by (subst AE_iff_measurable[OF _ refl]) auto
 qed
 
 lemma content_image_stretch_interval:
   fixes m :: "'a::euclidean_space \<Rightarrow> real"
   defines "s f x \<equiv> (\<Sum>k::'a\<in>Basis. (f k * (x\<bullet>k)) *\<^sub>R k)"
   shows "content (s m ` cbox a b) = \<bar>\<Prod>k\<in>Basis. m k\<bar> * content (cbox a b)"
 proof cases
   have s[measurable]: "s f \<in> borel \<rightarrow>\<^sub>M borel" for f
     by (auto simp: s_def[abs_def])
   assume m: "\<forall>k\<in>Basis. m k \<noteq> 0"
   then have s_comp_s: "s (\<lambda>k. 1 / m k) \<circ> s m = id" "s m \<circ> s (\<lambda>k. 1 / m k) = id"
     by (auto simp: s_def[abs_def] fun_eq_iff euclidean_representation)
   then have "inv (s (\<lambda>k. 1 / m k)) = s m" "bij (s (\<lambda>k. 1 / m k))"
     by (auto intro: inv_unique_comp o_bij)
   then have eq: "s m ` cbox a b = s (\<lambda>k. 1 / m k) -` cbox a b"
     using bij_vimage_eq_inv_image[OF \<open>bij (s (\<lambda>k. 1 / m k))\<close>, of "cbox a b"] by auto
   show ?thesis
     using m unfolding eq measure_def
     by (subst lborel_affine_euclidean[where c=m and t=0])
        (simp_all add: emeasure_density measurable_sets_borel[OF s] abs_prod nn_integral_cmult
                       s_def[symmetric] emeasure_distr vimage_comp s_comp_s enn2real_mult prod_nonneg)
 next
   assume "\<not> (\<forall>k\<in>Basis. m k \<noteq> 0)"
   then obtain k where k: "k \<in> Basis" "m k = 0" by auto
   then have [simp]: "(\<Prod>k\<in>Basis. m k) = 0"
     by (intro prod_zero) auto
   have "emeasure lborel {x\<in>space lborel. x \<in> s m ` cbox a b} = 0"
   proof (rule emeasure_eq_0_AE)
     show "AE x in lborel. x \<notin> s m ` cbox a b"
       using AE_lborel_inner_neq[OF \<open>k\<in>Basis\<close>]
     proof eventually_elim
       show "x \<bullet> k \<noteq> 0 \<Longrightarrow> x \<notin> s m ` cbox a b " for x
         using k by (auto simp: s_def[abs_def] cbox_def)
     qed
   qed
   then show ?thesis
     by (simp add: measure_def)
 qed
 
 lemma interval_image_affinity_interval:
   "\<exists>u v. (\<lambda>x. m *\<^sub>R (x::'a::euclidean_space) + c) ` cbox a b = cbox u v"
   unfolding image_affinity_cbox
   by auto
 
 lemma content_image_affinity_cbox:
   "content((\<lambda>x::'a::euclidean_space. m *\<^sub>R x + c) ` cbox a b) =
     \<bar>m\<bar> ^ DIM('a) * content (cbox a b)" (is "?l = ?r")
 proof (cases "cbox a b = {}")
   case True then show ?thesis by simp
 next
   case False
   show ?thesis
   proof (cases "m \<ge> 0")
     case True
     with \<open>cbox a b \<noteq> {}\<close> have "cbox (m *\<^sub>R a + c) (m *\<^sub>R b + c) \<noteq> {}"
       unfolding box_ne_empty
       apply (intro ballI)
       apply (erule_tac x=i in ballE)
       apply (auto simp: inner_simps mult_left_mono)
       done
     moreover from True have *: "\<And>i. (m *\<^sub>R b + c) \<bullet> i - (m *\<^sub>R a + c) \<bullet> i = m *\<^sub>R (b-a) \<bullet> i"
       by (simp add: inner_simps field_simps)
     ultimately show ?thesis
       by (simp add: image_affinity_cbox True content_cbox'
         prod.distrib inner_diff_left)
   next
     case False
     with \<open>cbox a b \<noteq> {}\<close> have "cbox (m *\<^sub>R b + c) (m *\<^sub>R a + c) \<noteq> {}"
       unfolding box_ne_empty
       apply (intro ballI)
       apply (erule_tac x=i in ballE)
       apply (auto simp: inner_simps mult_left_mono)
       done
     moreover from False have *: "\<And>i. (m *\<^sub>R a + c) \<bullet> i - (m *\<^sub>R b + c) \<bullet> i = (-m) *\<^sub>R (b-a) \<bullet> i"
       by (simp add: inner_simps field_simps)
     ultimately show ?thesis using False
       by (simp add: image_affinity_cbox content_cbox'
         prod.distrib[symmetric] inner_diff_left flip: prod_constant)
   qed
 qed
 
 lemma has_integral_affinity:
   fixes a :: "'a::euclidean_space"
   assumes "(f has_integral i) (cbox a b)"
       and "m \<noteq> 0"
   shows "((\<lambda>x. f(m *\<^sub>R x + c)) has_integral ((1 / (\<bar>m\<bar> ^ DIM('a))) *\<^sub>R i)) ((\<lambda>x. (1 / m) *\<^sub>R x + -((1 / m) *\<^sub>R c)) ` cbox a b)"
   apply (rule has_integral_twiddle)
   using assms
   apply (safe intro!: interval_image_affinity_interval content_image_affinity_cbox)
   apply (rule zero_less_power)
   unfolding scaleR_right_distrib
   apply auto
   done
 
 lemma integrable_affinity:
   assumes "f integrable_on cbox a b"
     and "m \<noteq> 0"
   shows "(\<lambda>x. f(m *\<^sub>R x + c)) integrable_on ((\<lambda>x. (1 / m) *\<^sub>R x + -((1/m) *\<^sub>R c)) ` cbox a b)"
   using assms
   unfolding integrable_on_def
   apply safe
   apply (drule has_integral_affinity)
   apply auto
   done
 
 lemmas has_integral_affinity01 = has_integral_affinity [of _ _ 0 "1::real", simplified]
 
 lemma integrable_on_affinity:
   assumes "m \<noteq> 0" "f integrable_on (cbox a b)"
   shows   "(\<lambda>x. f (m *\<^sub>R x + c)) integrable_on ((\<lambda>x. (1 / m) *\<^sub>R x - ((1 / m) *\<^sub>R c)) ` cbox a b)"
 proof -
   from assms obtain I where "(f has_integral I) (cbox a b)"
     by (auto simp: integrable_on_def)
   from has_integral_affinity[OF this assms(1), of c] show ?thesis
     by (auto simp: integrable_on_def)
 qed
 
 lemma has_integral_cmul_iff:
   assumes "c \<noteq> 0"
   shows   "((\<lambda>x. c *\<^sub>R f x) has_integral (c *\<^sub>R I)) A \<longleftrightarrow> (f has_integral I) A"
   using assms has_integral_cmul[of f I A c]
         has_integral_cmul[of "\<lambda>x. c *\<^sub>R f x" "c *\<^sub>R I" A "inverse c"] by (auto simp: field_simps)
 
 lemma has_integral_affinity':
   fixes a :: "'a::euclidean_space"
   assumes "(f has_integral i) (cbox a b)" and "m > 0"
   shows "((\<lambda>x. f(m *\<^sub>R x + c)) has_integral (i /\<^sub>R m ^ DIM('a)))
            (cbox ((a - c) /\<^sub>R m) ((b - c) /\<^sub>R m))"
 proof (cases "cbox a b = {}")
   case True
   hence "(cbox ((a - c) /\<^sub>R m) ((b - c) /\<^sub>R m)) = {}"
     using \<open>m > 0\<close> unfolding box_eq_empty by (auto simp: algebra_simps)
   with True and assms show ?thesis by simp
 next
   case False
   have "((\<lambda>x. f (m *\<^sub>R x + c)) has_integral (1 / \<bar>m\<bar> ^ DIM('a)) *\<^sub>R i)
           ((\<lambda>x. (1 / m) *\<^sub>R x + - ((1 / m) *\<^sub>R c)) ` cbox a b)"
     using assms by (intro has_integral_affinity) auto
   also have "((\<lambda>x. (1 / m) *\<^sub>R x + - ((1 / m) *\<^sub>R c)) ` cbox a b) =
                ((\<lambda>x.  - ((1 / m) *\<^sub>R c) + x) ` (\<lambda>x. (1 / m) *\<^sub>R x) ` cbox a b)"
     by (simp add: image_image algebra_simps)
   also have "(\<lambda>x. (1 / m) *\<^sub>R x) ` cbox a b = cbox ((1 / m) *\<^sub>R a) ((1 / m) *\<^sub>R b)" using \<open>m > 0\<close> False
     by (subst image_smult_cbox) simp_all
   also have "(\<lambda>x. - ((1 / m) *\<^sub>R c) + x) ` \<dots> = cbox ((a - c) /\<^sub>R m) ((b - c) /\<^sub>R m)"
     by (subst cbox_translation [symmetric]) (simp add: field_simps vector_add_divide_simps)
   finally show ?thesis using \<open>m > 0\<close> by (simp add: field_simps)
 qed
 
 lemma has_integral_affinity_iff:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: real_normed_vector"
   assumes "m > 0"
   shows   "((\<lambda>x. f (m *\<^sub>R x + c)) has_integral (I /\<^sub>R m ^ DIM('a)))
                (cbox ((a - c) /\<^sub>R m) ((b - c) /\<^sub>R m)) \<longleftrightarrow>
            (f has_integral I) (cbox a b)" (is "?lhs = ?rhs")
 proof
   assume ?lhs
   from has_integral_affinity'[OF this, of "1 / m" "-c /\<^sub>R m"] and \<open>m > 0\<close>
     show ?rhs by (simp add: vector_add_divide_simps) (simp add: field_simps)
 next
   assume ?rhs
   from has_integral_affinity'[OF this, of m c] and \<open>m > 0\<close>
   show ?lhs by simp
 qed
 
 
 subsection \<open>Special case of stretching coordinate axes separately\<close>
 
 lemma has_integral_stretch:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "(f has_integral i) (cbox a b)"
     and "\<forall>k\<in>Basis. m k \<noteq> 0"
   shows "((\<lambda>x. f (\<Sum>k\<in>Basis. (m k * (x\<bullet>k))*\<^sub>R k)) has_integral
          ((1/ \<bar>prod m Basis\<bar>) *\<^sub>R i)) ((\<lambda>x. (\<Sum>k\<in>Basis. (1 / m k * (x\<bullet>k))*\<^sub>R k)) ` cbox a b)"
   apply (rule has_integral_twiddle[where f=f])
   unfolding zero_less_abs_iff content_image_stretch_interval
   unfolding image_stretch_interval empty_as_interval euclidean_eq_iff[where 'a='a]
   using assms
   by auto
 
 lemma has_integral_stretch_real:
   fixes f :: "real \<Rightarrow> 'b::real_normed_vector"
   assumes "(f has_integral i) {a..b}" and "m \<noteq> 0"
   shows "((\<lambda>x. f (m * x)) has_integral (1 / \<bar>m\<bar>) *\<^sub>R i) ((\<lambda>x. x / m) ` {a..b})"
   using has_integral_stretch [of f i a b "\<lambda>b. m"] assms by simp
 
 lemma integrable_stretch:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
   assumes "f integrable_on cbox a b"
     and "\<forall>k\<in>Basis. m k \<noteq> 0"
   shows "(\<lambda>x::'a. f (\<Sum>k\<in>Basis. (m k * (x\<bullet>k))*\<^sub>R k)) integrable_on
     ((\<lambda>x. \<Sum>k\<in>Basis. (1 / m k * (x\<bullet>k))*\<^sub>R k) ` cbox a b)"
   using assms unfolding integrable_on_def
   by (force dest: has_integral_stretch)
 
 lemma vec_lambda_eq_sum:
   shows "(\<chi> k. f k (x $ k)) = (\<Sum>k\<in>Basis. (f (axis_index k) (x \<bullet> k)) *\<^sub>R k)"
     apply (simp add: Basis_vec_def cart_eq_inner_axis UNION_singleton_eq_range sum.reindex axis_eq_axis inj_on_def)
     apply (simp add: vec_eq_iff axis_def if_distrib cong: if_cong)
     done
 
 lemma has_integral_stretch_cart:
   fixes m :: "'n::finite \<Rightarrow> real"
   assumes f: "(f has_integral i) (cbox a b)" and m: "\<And>k. m k \<noteq> 0"
   shows "((\<lambda>x. f(\<chi> k. m k * x$k)) has_integral i /\<^sub>R \<bar>prod m UNIV\<bar>)
             ((\<lambda>x. \<chi> k. x$k / m k) ` (cbox a b))"
 proof -
   have *: "\<forall>k:: real^'n \<in> Basis. m (axis_index k) \<noteq> 0"
     using axis_index by (simp add: m)
   have eqp: "(\<Prod>k:: real^'n \<in> Basis. m (axis_index k)) = prod m UNIV"
     by (simp add: Basis_vec_def UNION_singleton_eq_range prod.reindex axis_eq_axis inj_on_def)
   show ?thesis
     using has_integral_stretch [OF f *] vec_lambda_eq_sum [where f="\<lambda>i x. m i * x"] vec_lambda_eq_sum [where f="\<lambda>i x. x / m i"]
     by (simp add: field_simps eqp)
 qed
 
 lemma image_stretch_interval_cart:
   fixes m :: "'n::finite \<Rightarrow> real"
   shows "(\<lambda>x. \<chi> k. m k * x$k) ` cbox a b =
             (if cbox a b = {} then {}
             else cbox (\<chi> k. min (m k * a$k) (m k * b$k)) (\<chi> k. max (m k * a$k) (m k * b$k)))"
 proof -
   have *: "(\<Sum>k\<in>Basis. min (m (axis_index k) * (a \<bullet> k)) (m (axis_index k) * (b \<bullet> k)) *\<^sub>R k)
            = (\<chi> k. min (m k * a $ k) (m k * b $ k))"
           "(\<Sum>k\<in>Basis. max (m (axis_index k) * (a \<bullet> k)) (m (axis_index k) * (b \<bullet> k)) *\<^sub>R k)
            = (\<chi> k. max (m k * a $ k) (m k * b $ k))"
     apply (simp_all add: Basis_vec_def cart_eq_inner_axis UNION_singleton_eq_range sum.reindex axis_eq_axis inj_on_def)
     apply (simp_all add: vec_eq_iff axis_def if_distrib cong: if_cong)
     done
   show ?thesis
     by (simp add: vec_lambda_eq_sum [where f="\<lambda>i x. m i * x"] image_stretch_interval eq_cbox *)
 qed
 
 
 subsection \<open>even more special cases\<close>
 
 lemma uminus_interval_vector[simp]:
   fixes a b :: "'a::euclidean_space"
   shows "uminus ` cbox a b = cbox (-b) (-a)"
   apply safe
    apply (simp add: mem_box(2))
   apply (rule_tac x="-x" in image_eqI)
    apply (auto simp add: mem_box)
   done
 
 lemma has_integral_reflect_lemma[intro]:
   assumes "(f has_integral i) (cbox a b)"
   shows "((\<lambda>x. f(-x)) has_integral i) (cbox (-b) (-a))"
   using has_integral_affinity[OF assms, of "-1" 0]
   by auto
 
 lemma has_integral_reflect_lemma_real[intro]:
   assumes "(f has_integral i) {a..b::real}"
   shows "((\<lambda>x. f(-x)) has_integral i) {-b .. -a}"
   using assms
   unfolding box_real[symmetric]
   by (rule has_integral_reflect_lemma)
 
 lemma has_integral_reflect[simp]:
   "((\<lambda>x. f (-x)) has_integral i) (cbox (-b) (-a)) \<longleftrightarrow> (f has_integral i) (cbox a b)"
   by (auto dest: has_integral_reflect_lemma)
 
 lemma has_integral_reflect_real[simp]:
   fixes a b::real
   shows "((\<lambda>x. f (-x)) has_integral i) {-b..-a} \<longleftrightarrow> (f has_integral i) {a..b}"
   by (metis has_integral_reflect interval_cbox)
 
 lemma integrable_reflect[simp]: "(\<lambda>x. f(-x)) integrable_on cbox (-b) (-a) \<longleftrightarrow> f integrable_on cbox a b"
   unfolding integrable_on_def by auto
 
 lemma integrable_reflect_real[simp]: "(\<lambda>x. f(-x)) integrable_on {-b .. -a} \<longleftrightarrow> f integrable_on {a..b::real}"
   unfolding box_real[symmetric]
   by (rule integrable_reflect)
 
 lemma integral_reflect[simp]: "integral (cbox (-b) (-a)) (\<lambda>x. f (-x)) = integral (cbox a b) f"
   unfolding integral_def by auto
 
 lemma integral_reflect_real[simp]: "integral {-b .. -a} (\<lambda>x. f (-x)) = integral {a..b::real} f"
   unfolding box_real[symmetric]
   by (rule integral_reflect)
 
 subsection \<open>Stronger form of FCT; quite a tedious proof\<close>
 
 lemma split_minus[simp]: "(\<lambda>(x, k). f x k) x - (\<lambda>(x, k). g x k) x = (\<lambda>(x, k). f x k - g x k) x"
   by (simp add: split_def)
 
 theorem fundamental_theorem_of_calculus_interior:
   fixes f :: "real \<Rightarrow> 'a::real_normed_vector"
   assumes "a \<le> b"
     and contf: "continuous_on {a..b} f"
     and derf: "\<And>x. x \<in> {a <..< b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
   shows "(f' has_integral (f b - f a)) {a..b}"
 proof (cases "a = b")
   case True
   then have *: "cbox a b = {b}" "f b - f a = 0"
     by (auto simp add:  order_antisym)
   with True show ?thesis by auto
 next
   case False
   with \<open>a \<le> b\<close> have ab: "a < b" by arith
   show ?thesis
     unfolding has_integral_factor_content_real
   proof (intro allI impI)
     fix e :: real
     assume e: "e > 0"
     then have eba8: "(e * (b-a)) / 8 > 0"
       using ab by (auto simp add: field_simps)
     note derf_exp = derf[unfolded has_vector_derivative_def has_derivative_at_alt]
     have bounded: "\<And>x. x \<in> {a<..<b} \<Longrightarrow> bounded_linear (\<lambda>u. u *\<^sub>R f' x)"
       using derf_exp by simp
     have "\<forall>x \<in> box a b. \<exists>d>0. \<forall>y. norm (y-x) < d \<longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e/2 * norm (y-x)"
       (is "\<forall>x \<in> box a b. ?Q x")
     proof
       fix x assume x: "x \<in> box a b"
       show "?Q x"
         apply (rule allE [where x="e/2", OF derf_exp [THEN conjunct2, of x]])
         using x e by auto
     qed
     from this [unfolded bgauge_existence_lemma]
     obtain d where d: "\<And>x. 0 < d x"
       "\<And>x y. \<lbrakk>x \<in> box a b; norm (y-x) < d x\<rbrakk>
                \<Longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e/2 * norm (y-x)"
       by metis
     have "bounded (f ` cbox a b)"
       using compact_cbox assms by (auto simp: compact_imp_bounded compact_continuous_image)
     then obtain B 
       where "0 < B" and B: "\<And>x. x \<in> f ` cbox a b \<Longrightarrow> norm x \<le> B"
       unfolding bounded_pos by metis
     obtain da where "0 < da"
       and da: "\<And>c. \<lbrakk>a \<le> c; {a..c} \<subseteq> {a..b}; {a..c} \<subseteq> ball a da\<rbrakk>
                           \<Longrightarrow> norm (content {a..c} *\<^sub>R f' a - (f c - f a)) \<le> (e * (b-a)) / 4"
     proof -
       have "continuous (at a within {a..b}) f"
         using contf continuous_on_eq_continuous_within by force
       with eba8 obtain k where "0 < k"
         and k: "\<And>x. \<lbrakk>x \<in> {a..b}; 0 < norm (x-a); norm (x-a) < k\<rbrakk> \<Longrightarrow> norm (f x - f a) < e * (b-a) / 8"
         unfolding continuous_within Lim_within dist_norm by metis
       obtain l where l: "0 < l" "norm (l *\<^sub>R f' a) \<le> e * (b-a) / 8" 
       proof (cases "f' a = 0")
         case True with ab e that show ?thesis by auto
       next
         case False
         then show ?thesis
           apply (rule_tac l="(e * (b-a)) / 8 / norm (f' a)" in that)
           using ab e apply (auto simp add: field_simps)
           done
       qed
       have "norm (content {a..c} *\<^sub>R f' a - (f c - f a)) \<le> e * (b-a) / 4"
         if "a \<le> c" "{a..c} \<subseteq> {a..b}" and bmin: "{a..c} \<subseteq> ball a (min k l)" for c
       proof -
         have minkl: "\<bar>a - x\<bar> < min k l" if "x \<in> {a..c}" for x
           using bmin dist_real_def that by auto
         then have lel: "\<bar>c - a\<bar> \<le> \<bar>l\<bar>"
           using that by force
         have "norm ((c - a) *\<^sub>R f' a - (f c - f a)) \<le> norm ((c - a) *\<^sub>R f' a) + norm (f c - f a)"
           by (rule norm_triangle_ineq4)
         also have "\<dots> \<le> e * (b-a) / 8 + e * (b-a) / 8"
         proof (rule add_mono)
           have "norm ((c - a) *\<^sub>R f' a) \<le> norm (l *\<^sub>R f' a)"
             by (auto intro: mult_right_mono [OF lel])
           also have "... \<le> e * (b-a) / 8"
             by (rule l)
           finally show "norm ((c - a) *\<^sub>R f' a) \<le> e * (b-a) / 8" .
         next
           have "norm (f c - f a) < e * (b-a) / 8"
           proof (cases "a = c")
             case True then show ?thesis
               using eba8 by auto
           next
             case False show ?thesis
               by (rule k) (use minkl \<open>a \<le> c\<close> that False in auto)
           qed
           then show "norm (f c - f a) \<le> e * (b-a) / 8" by simp
         qed
         finally show "norm (content {a..c} *\<^sub>R f' a - (f c - f a)) \<le> e * (b-a) / 4"
           unfolding content_real[OF \<open>a \<le> c\<close>] by auto
       qed
       then show ?thesis
         by (rule_tac da="min k l" in that) (auto simp: l \<open>0 < k\<close>)
     qed
     obtain db where "0 < db"
       and db: "\<And>c. \<lbrakk>c \<le> b; {c..b} \<subseteq> {a..b}; {c..b} \<subseteq> ball b db\<rbrakk>
                           \<Longrightarrow> norm (content {c..b} *\<^sub>R f' b - (f b - f c)) \<le> (e * (b-a)) / 4"
     proof -
       have "continuous (at b within {a..b}) f"
         using contf continuous_on_eq_continuous_within by force
       with eba8 obtain k
         where "0 < k"
           and k: "\<And>x. \<lbrakk>x \<in> {a..b}; 0 < norm(x-b); norm(x-b) < k\<rbrakk>
                      \<Longrightarrow> norm (f b - f x) < e * (b-a) / 8"
         unfolding continuous_within Lim_within dist_norm norm_minus_commute by metis
       obtain l where l: "0 < l" "norm (l *\<^sub>R f' b) \<le> (e * (b-a)) / 8"
       proof (cases "f' b = 0")
         case True thus ?thesis 
           using ab e that by auto
       next
         case False then show ?thesis
           apply (rule_tac l="(e * (b-a)) / 8 / norm (f' b)" in that)
           using ab e by (auto simp add: field_simps)
       qed
       have "norm (content {c..b} *\<^sub>R f' b - (f b - f c)) \<le> e * (b-a) / 4" 
         if "c \<le> b" "{c..b} \<subseteq> {a..b}" and bmin: "{c..b} \<subseteq> ball b (min k l)" for c
       proof -
         have minkl: "\<bar>b - x\<bar> < min k l" if "x \<in> {c..b}" for x
           using bmin dist_real_def that by auto
         then have lel: "\<bar>b - c\<bar> \<le> \<bar>l\<bar>"
           using that by force
         have "norm ((b - c) *\<^sub>R f' b - (f b - f c)) \<le> norm ((b - c) *\<^sub>R f' b) + norm (f b - f c)"
           by (rule norm_triangle_ineq4)
         also have "\<dots> \<le> e * (b-a) / 8 + e * (b-a) / 8"
         proof (rule add_mono)
           have "norm ((b - c) *\<^sub>R f' b) \<le> norm (l *\<^sub>R f' b)"
             by (auto intro: mult_right_mono [OF lel])
           also have "... \<le> e * (b-a) / 8"
             by (rule l)
           finally show "norm ((b - c) *\<^sub>R f' b) \<le> e * (b-a) / 8" .
         next
           have "norm (f b - f c) < e * (b-a) / 8"
           proof (cases "b = c")
             case True with eba8 show ?thesis
               by auto
           next
             case False show ?thesis
               by (rule k) (use minkl \<open>c \<le> b\<close> that False in auto)
           qed
           then show "norm (f b - f c) \<le> e * (b-a) / 8" by simp
         qed
         finally show "norm (content {c..b} *\<^sub>R f' b - (f b - f c)) \<le> e * (b-a) / 4"
           unfolding content_real[OF \<open>c \<le> b\<close>] by auto
       qed
       then show ?thesis
         by (rule_tac db="min k l" in that) (auto simp: l \<open>0 < k\<close>)
     qed
     let ?d = "(\<lambda>x. ball x (if x=a then da else if x=b then db else d x))"
     show "\<exists>d. gauge d \<and> (\<forall>p. p tagged_division_of {a..b} \<and> d fine p \<longrightarrow>
               norm ((\<Sum>(x,K)\<in>p. content K *\<^sub>R f' x) - (f b - f a)) \<le> e * content {a..b})"
     proof (rule exI, safe)
       show "gauge ?d"
         using ab \<open>db > 0\<close> \<open>da > 0\<close> d(1) by (auto intro: gauge_ball_dependent)
     next
       fix p
       assume ptag: "p tagged_division_of {a..b}" and fine: "?d fine p"
       let ?A = "{t. fst t \<in> {a, b}}"
       note p = tagged_division_ofD[OF ptag]
       have pA: "p = (p \<inter> ?A) \<union> (p - ?A)" "finite (p \<inter> ?A)" "finite (p - ?A)" "(p \<inter> ?A) \<inter> (p - ?A) = {}"
         using ptag fine by auto
       have le_xz: "\<And>w x y z::real. y \<le> z/2 \<Longrightarrow> w - x \<le> z/2 \<Longrightarrow> w + y \<le> x + z"
         by arith
       have non: False if xk: "(x,K) \<in> p" and "x \<noteq> a" "x \<noteq> b"
         and less: "e * (Sup K - Inf K)/2 < norm (content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))"
       for x K
       proof -
         obtain u v where k: "K = cbox u v"
           using p(4) xk by blast
         then have "u \<le> v" and uv: "{u, v} \<subseteq> cbox u v"
           using p(2)[OF xk] by auto
         then have result: "e * (v - u)/2 < norm ((v - u) *\<^sub>R f' x - (f v - f u))"
           using less[unfolded k box_real interval_bounds_real content_real] by auto
         then have "x \<in> box a b"
           using p(2) p(3) \<open>x \<noteq> a\<close> \<open>x \<noteq> b\<close> xk by fastforce
         with d have *: "\<And>y. norm (y-x) < d x 
                 \<Longrightarrow> norm (f y - f x - (y-x) *\<^sub>R f' x) \<le> e/2 * norm (y-x)"
           by metis
         have xd: "norm (u - x) < d x" "norm (v - x) < d x"
           using fineD[OF fine xk] \<open>x \<noteq> a\<close> \<open>x \<noteq> b\<close> uv 
           by (auto simp add: k subset_eq dist_commute dist_real_def)
         have "norm ((v - u) *\<^sub>R f' x - (f v - f u)) =
               norm ((f u - f x - (u - x) *\<^sub>R f' x) - (f v - f x - (v - x) *\<^sub>R f' x))"
           by (rule arg_cong[where f=norm]) (auto simp: scaleR_left.diff)
         also have "\<dots> \<le> e/2 * norm (u - x) + e/2 * norm (v - x)"
           by (metis norm_triangle_le_diff add_mono * xd)
         also have "\<dots> \<le> e/2 * norm (v - u)"
           using p(2)[OF xk] by (auto simp add: field_simps k)
         also have "\<dots> < norm ((v - u) *\<^sub>R f' x - (f v - f u))"
           using result by (simp add: \<open>u \<le> v\<close>)
         finally have "e * (v - u)/2 < e * (v - u)/2"
           using uv by auto
         then show False by auto
       qed
       have "norm (\<Sum>(x, K)\<in>p - ?A. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))
           \<le> (\<Sum>(x, K)\<in>p - ?A. norm (content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))))"
         by (auto intro: sum_norm_le)
       also have "... \<le> (\<Sum>n\<in>p - ?A. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k)/2)"
         using non by (fastforce intro: sum_mono)
       finally have I: "norm (\<Sum>(x, k)\<in>p - ?A.
                   content k *\<^sub>R f' x - (f (Sup k) - f (Inf k)))
              \<le> (\<Sum>n\<in>p - ?A. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))/2"
         by (simp add: sum_divide_distrib)
       have II: "norm (\<Sum>(x, k)\<in>p \<inter> ?A. content k *\<^sub>R f' x - (f (Sup k) - f (Inf k))) -
              (\<Sum>n\<in>p \<inter> ?A. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))
              \<le> (\<Sum>n\<in>p - ?A. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))/2"
       proof -
         have ge0: "0 \<le> e * (Sup k - Inf k)" if xkp: "(x, k) \<in> p \<inter> ?A" for x k
         proof -
           obtain u v where uv: "k = cbox u v"
             by (meson Int_iff xkp p(4))
           with p(2) that uv have "cbox u v \<noteq> {}"
             by blast
           then show "0 \<le> e * ((Sup k) - (Inf k))"
             unfolding uv using e by (auto simp add: field_simps)
         qed
         let ?B = "\<lambda>x. {t \<in> p. fst t = x \<and> content (snd t) \<noteq> 0}"
         let ?C = "{t \<in> p. fst t \<in> {a, b} \<and> content (snd t) \<noteq> 0}"
         have "norm (\<Sum>(x, k)\<in>p \<inter> {t. fst t \<in> {a, b}}. content k *\<^sub>R f' x - (f (Sup k) - f (Inf k))) \<le> e * (b-a)/2"
         proof -
           have *: "\<And>S f e. sum f S = sum f (p \<inter> ?C) \<Longrightarrow> norm (sum f (p \<inter> ?C)) \<le> e \<Longrightarrow> norm (sum f S) \<le> e"
             by auto
           have 1: "content K *\<^sub>R (f' x) - (f ((Sup K)) - f ((Inf K))) = 0"
             if "(x,K) \<in> p \<inter> {t. fst t \<in> {a, b}} - p \<inter> ?C" for x K
           proof -
             have xk: "(x,K) \<in> p" and k0: "content K = 0"
               using that by auto
             then obtain u v where uv: "K = cbox u v"
               using p(4) by blast
             then have "u = v"
               using xk k0 p(2) by force
             then show "content K *\<^sub>R (f' x) - (f ((Sup K)) - f ((Inf K))) = 0"
               using xk unfolding uv by auto
           qed
           have 2: "norm(\<Sum>(x,K)\<in>p \<inter> ?C. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))  \<le> e * (b-a)/2"
           proof -
             have norm_le: "norm (sum f S) \<le> e"
               if "\<And>x y. \<lbrakk>x \<in> S; y \<in> S\<rbrakk> \<Longrightarrow> x = y" "\<And>x. x \<in> S \<Longrightarrow> norm (f x) \<le> e" "e > 0"
               for S f and e :: real
             proof (cases "S = {}")
               case True
               with that show ?thesis by auto
             next
               case False then obtain x where "x \<in> S"
                 by auto
               then have "S = {x}"
                 using that(1) by auto
               then show ?thesis
                 using \<open>x \<in> S\<close> that(2) by auto
             qed
             have *: "p \<inter> ?C = ?B a \<union> ?B b"
               by blast
             then have "norm (\<Sum>(x,K)\<in>p \<inter> ?C. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) =
                        norm (\<Sum>(x,K) \<in> ?B a \<union> ?B b. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))"
               by simp
             also have "... = norm ((\<Sum>(x,K) \<in> ?B a. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) + 
                                    (\<Sum>(x,K) \<in> ?B b. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))))"
               apply (subst sum.union_disjoint)
               using p(1) ab e by auto
             also have "... \<le> e * (b - a) / 4 + e * (b - a) / 4"
             proof (rule norm_triangle_le [OF add_mono])
               have pa: "\<exists>v. k = cbox a v \<and> a \<le> v" if "(a, k) \<in> p" for k
                 using p(2) p(3) p(4) that by fastforce
               show "norm (\<Sum>(x,K) \<in> ?B a. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) \<le> e * (b - a) / 4"
               proof (intro norm_le; clarsimp)
                 fix K K'
                 assume K: "(a, K) \<in> p" "(a, K') \<in> p" and ne0: "content K \<noteq> 0" "content K' \<noteq> 0"
                 with pa obtain v v' where v: "K = cbox a v" "a \<le> v" and v': "K' = cbox a v'" "a \<le> v'"
                   by blast
                 let ?v = "min v v'"
                 have "box a ?v \<subseteq> K \<inter> K'"
                   unfolding v v' by (auto simp add: mem_box)
                 then have "interior (box a (min v v')) \<subseteq> interior K \<inter> interior K'"
                   using interior_Int interior_mono by blast
                 moreover have "(a + ?v)/2 \<in> box a ?v"
                   using ne0  unfolding v v' content_eq_0 not_le
                   by (auto simp add: mem_box)
                 ultimately have "(a + ?v)/2 \<in> interior K \<inter> interior K'"
                   unfolding interior_open[OF open_box] by auto
                 then show "K = K'"
                   using p(5)[OF K] by auto
               next
                 fix K 
                 assume K: "(a, K) \<in> p" and ne0: "content K \<noteq> 0"
                 show "norm (content c *\<^sub>R f' a - (f (Sup c) - f (Inf c))) * 4 \<le> e * (b-a)"
                   if "(a, c) \<in> p" and ne0: "content c \<noteq> 0" for c
                 proof -
                   obtain v where v: "c = cbox a v" and "a \<le> v"
                     using pa[OF \<open>(a, c) \<in> p\<close>] by metis 
                   then have "a \<in> {a..v}" "v \<le> b"
                     using p(3)[OF \<open>(a, c) \<in> p\<close>] by auto
                   moreover have "{a..v} \<subseteq> ball a da"
                     using fineD[OF \<open>?d fine p\<close> \<open>(a, c) \<in> p\<close>] by (simp add: v split: if_split_asm)
                   ultimately show ?thesis
                     unfolding v interval_bounds_real[OF \<open>a \<le> v\<close>] box_real
                     using da \<open>a \<le> v\<close> by auto
                 qed
               qed (use ab e in auto)
             next
               have pb: "\<exists>v. k = cbox v b \<and> b \<ge> v" if "(b, k) \<in> p" for k
                 using p(2) p(3) p(4) that by fastforce
               show "norm (\<Sum>(x,K) \<in> ?B b. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K))) \<le> e * (b - a) / 4"
               proof (intro norm_le; clarsimp)
                 fix K K'
                 assume K: "(b, K) \<in> p" "(b, K') \<in> p" and ne0: "content K \<noteq> 0" "content K' \<noteq> 0"
                 with pb obtain v v' where v: "K = cbox v b" "v \<le> b" and v': "K' = cbox v' b" "v' \<le> b"
                   by blast
                 let ?v = "max v v'"
                 have "box ?v b \<subseteq> K \<inter> K'"
                   unfolding v v' by (auto simp: mem_box)
                 then have "interior (box (max v v') b) \<subseteq> interior K \<inter> interior K'"
                   using interior_Int interior_mono by blast
                 moreover have " ((b + ?v)/2) \<in> box ?v b"
                   using ne0 unfolding v v' content_eq_0 not_le by (auto simp: mem_box)
                 ultimately have "((b + ?v)/2) \<in> interior K \<inter> interior K'"
                   unfolding interior_open[OF open_box] by auto
                 then show "K = K'"
                   using p(5)[OF K] by auto
               next
                 fix K 
                 assume K: "(b, K) \<in> p" and ne0: "content K \<noteq> 0"
                 show "norm (content c *\<^sub>R f' b - (f (Sup c) - f (Inf c))) * 4 \<le> e * (b-a)"
                   if "(b, c) \<in> p" and ne0: "content c \<noteq> 0" for c
                 proof -
                 obtain v where v: "c = cbox v b" and "v \<le> b"
                   using \<open>(b, c) \<in> p\<close> pb by blast
                 then have "v \<ge> a""b \<in> {v.. b}"  
                   using p(3)[OF \<open>(b, c) \<in> p\<close>] by auto
                 moreover have "{v..b} \<subseteq> ball b db"
                   using fineD[OF \<open>?d fine p\<close> \<open>(b, c) \<in> p\<close>] box_real(2) v False by force
                 ultimately show ?thesis
                   using db v by auto
                 qed
               qed (use ab e in auto)
             qed
             also have "... = e * (b-a)/2"
               by simp
             finally show "norm (\<Sum>(x,k)\<in>p \<inter> ?C.
                         content k *\<^sub>R f' x - (f (Sup k) - f (Inf k))) \<le> e * (b-a)/2" .
           qed
           show "norm (\<Sum>(x, k)\<in>p \<inter> ?A. content k *\<^sub>R f' x - (f ((Sup k)) - f ((Inf k)))) \<le> e * (b-a)/2"
             apply (rule * [OF sum.mono_neutral_right[OF pA(2)]])
             using 1 2 by (auto simp: split_paired_all)
         qed
         also have "... = (\<Sum>n\<in>p. e * (case n of (x, k) \<Rightarrow> Sup k - Inf k))/2"
           unfolding sum_distrib_left[symmetric]
           apply (subst additive_tagged_division_1[OF \<open>a \<le> b\<close> ptag])
           by auto
         finally have norm_le: "norm (\<Sum>(x,K)\<in>p \<inter> {t. fst t \<in> {a, b}}. content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))
                 \<le> (\<Sum>n\<in>p. e * (case n of (x, K) \<Rightarrow> Sup K - Inf K))/2" .
         have le2: "\<And>x s1 s2::real. 0 \<le> s1 \<Longrightarrow> x \<le> (s1 + s2)/2 \<Longrightarrow> x - s1 \<le> s2/2"
           by auto
         show ?thesis
           apply (rule le2 [OF sum_nonneg])
           using ge0 apply force
           unfolding sum.union_disjoint[OF pA(2-), symmetric] pA(1)[symmetric]
           by (metis norm_le)
       qed
       note * = additive_tagged_division_1[OF assms(1) ptag, symmetric]
       have "norm (\<Sum>(x,K)\<in>p \<inter> ?A \<union> (p - ?A). content K *\<^sub>R f' x - (f (Sup K) - f (Inf K)))
                \<le> e * (\<Sum>(x,K)\<in>p \<inter> ?A \<union> (p - ?A). Sup K - Inf K)"
         unfolding sum_distrib_left
         unfolding sum.union_disjoint[OF pA(2-)]
         using le_xz norm_triangle_le I II by blast
       then
       show "norm ((\<Sum>(x,K)\<in>p. content K *\<^sub>R f' x) - (f b - f a)) \<le> e * content {a..b}"
         by (simp only: content_real[OF \<open>a \<le> b\<close>] *[of "\<lambda>x. x"] *[of f] sum_subtractf[symmetric] split_minus pA(1) [symmetric])
     qed
   qed
 qed
 
 
 subsection \<open>Stronger form with finite number of exceptional points\<close>
 
 lemma fundamental_theorem_of_calculus_interior_strong:
  fixes f :: "real \<Rightarrow> 'a::banach"
  assumes "finite S"
    and "a \<le> b" "\<And>x. x \<in> {a <..< b} - S \<Longrightarrow> (f has_vector_derivative f'(x)) (at x)"
    and "continuous_on {a .. b} f"
  shows "(f' has_integral (f b - f a)) {a .. b}"
   using assms
 proof (induction arbitrary: a b)
 case empty
   then show ?case
     using fundamental_theorem_of_calculus_interior by force
 next
 case (insert x S)
   show ?case
   proof (cases "x \<in> {a<..<b}")
     case False then show ?thesis
       using insert by blast
   next
     case True then have "a < x" "x < b"
       by auto
     have "(f' has_integral f x - f a) {a..x}" "(f' has_integral f b - f x) {x..b}"
       using \<open>continuous_on {a..b} f\<close> \<open>a < x\<close> \<open>x < b\<close> continuous_on_subset by (force simp: intro!: insert)+
     then have "(f' has_integral f x - f a + (f b - f x)) {a..b}"
       using \<open>a < x\<close> \<open>x < b\<close> has_integral_combine less_imp_le by blast
     then show ?thesis
       by simp
   qed
 qed
 
 corollary fundamental_theorem_of_calculus_strong:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "finite S"
     and "a \<le> b"
     and vec: "\<And>x. x \<in> {a..b} - S \<Longrightarrow> (f has_vector_derivative f'(x)) (at x)"
     and "continuous_on {a..b} f"
   shows "(f' has_integral (f b - f a)) {a..b}"
   by (rule fundamental_theorem_of_calculus_interior_strong [OF \<open>finite S\<close>]) (force simp: assms)+
 
 proposition indefinite_integral_continuous_left:
   fixes f:: "real \<Rightarrow> 'a::banach"
   assumes intf: "f integrable_on {a..b}" and "a < c" "c \<le> b" "e > 0"
   obtains d where "d > 0"
     and "\<forall>t. c - d < t \<and> t \<le> c \<longrightarrow> norm (integral {a..c} f - integral {a..t} f) < e"
 proof -
   obtain w where "w > 0" and w: "\<And>t. \<lbrakk>c - w < t; t < c\<rbrakk> \<Longrightarrow> norm (f c) * norm(c - t) < e/3"
   proof (cases "f c = 0")
     case False
     hence e3: "0 < e/3 / norm (f c)" using \<open>e>0\<close> by simp
     moreover have "norm (f c) * norm (c - t) < e/3" 
       if "t < c" and "c - e/3 / norm (f c) < t" for t
     proof -
       have "norm (c - t) < e/3 / norm (f c)"
         using that by auto
       then show "norm (f c) * norm (c - t) < e/3"
         by (metis e3 mult.commute norm_not_less_zero pos_less_divide_eq zero_less_divide_iff)
     qed
     ultimately show ?thesis
       using that by auto
   next
     case True then show ?thesis
       using \<open>e > 0\<close> that by auto
   qed
 
   let ?SUM = "\<lambda>p. (\<Sum>(x,K) \<in> p. content K *\<^sub>R f x)"
   have e3: "e/3 > 0"
     using \<open>e > 0\<close> by auto
   have "f integrable_on {a..c}"
     apply (rule integrable_subinterval_real[OF intf])
     using \<open>a < c\<close> \<open>c \<le> b\<close> by auto
   then obtain d1 where "gauge d1" and d1:
     "\<And>p. \<lbrakk>p tagged_division_of {a..c}; d1 fine p\<rbrakk> \<Longrightarrow> norm (?SUM p - integral {a..c} f) < e/3"
     using integrable_integral has_integral_real e3 by metis
   define d where [abs_def]: "d x = ball x w \<inter> d1 x" for x
   have "gauge d"
     unfolding d_def using \<open>w > 0\<close> \<open>gauge d1\<close> by auto
   then obtain k where "0 < k" and k: "ball c k \<subseteq> d c"
     by (meson gauge_def open_contains_ball)
 
   let ?d = "min k (c - a)/2"
   show thesis
   proof (intro that[of ?d] allI impI, safe)
     show "?d > 0"
       using \<open>0 < k\<close> \<open>a < c\<close> by auto
   next
     fix t
     assume t: "c - ?d < t" "t \<le> c"
     show "norm (integral ({a..c}) f - integral ({a..t}) f) < e"
     proof (cases "t < c")
       case False with \<open>t \<le> c\<close> show ?thesis
         by (simp add: \<open>e > 0\<close>)
     next
       case True
       have "f integrable_on {a..t}"
         apply (rule integrable_subinterval_real[OF intf])
         using \<open>t < c\<close> \<open>c \<le> b\<close> by auto
       then obtain d2 where d2: "gauge d2"
         "\<And>p. p tagged_division_of {a..t} \<and> d2 fine p \<Longrightarrow> norm (?SUM p - integral {a..t} f) < e/3"
         using integrable_integral has_integral_real e3 by metis
       define d3 where "d3 x = (if x \<le> t then d1 x \<inter> d2 x else d1 x)" for x
       have "gauge d3"
         using \<open>gauge d1\<close> \<open>gauge d2\<close> unfolding d3_def gauge_def by auto
       then obtain p where ptag: "p tagged_division_of {a..t}" and pfine: "d3 fine p"
         by (metis box_real(2) fine_division_exists)
       note p' = tagged_division_ofD[OF ptag]
       have pt: "(x,K)\<in>p \<Longrightarrow> x \<le> t" for x K
         by (meson atLeastAtMost_iff p'(2) p'(3) subsetCE)
       with pfine have "d2 fine p"
         unfolding fine_def d3_def by fastforce
       then have d2_fin: "norm (?SUM p - integral {a..t} f) < e/3"
         using d2(2) ptag by auto
       have eqs: "{a..c} \<inter> {x. x \<le> t} = {a..t}" "{a..c} \<inter> {x. x \<ge> t} = {t..c}"
         using t by (auto simp add: field_simps)
       have "p \<union> {(c, {t..c})} tagged_division_of {a..c}"
         apply (rule tagged_division_Un_interval_real[of _ _ _ 1 "t"])
         using  \<open>t \<le> c\<close> by (auto simp: eqs ptag tagged_division_of_self_real)
       moreover
       have "d1 fine p \<union> {(c, {t..c})}"
         unfolding fine_def
       proof safe
         fix x K y
         assume "(x,K) \<in> p" and "y \<in> K" then show "y \<in> d1 x"
           by (metis Int_iff d3_def subsetD fineD pfine)
       next
         fix x assume "x \<in> {t..c}"
         then have "dist c x < k"
           using t(1) by (auto simp add: field_simps dist_real_def)
         with k show "x \<in> d1 c"
           unfolding d_def by auto
       qed  
       ultimately have d1_fin: "norm (?SUM(p \<union> {(c, {t..c})}) - integral {a..c} f) < e/3"
         using d1 by metis
       have SUMEQ: "?SUM(p \<union> {(c, {t..c})}) = (c - t) *\<^sub>R f c + ?SUM p"
       proof -
         have "?SUM(p \<union> {(c, {t..c})}) = (content{t..c} *\<^sub>R f c) + ?SUM p"
         proof (subst sum.union_disjoint)
           show "p \<inter> {(c, {t..c})} = {}"
             using \<open>t < c\<close> pt by force
         qed (use p'(1) in auto)
         also have "... = (c - t) *\<^sub>R f c + ?SUM p"
           using \<open>t \<le> c\<close> by auto
         finally show ?thesis .
       qed
       have "c - k < t"
         using \<open>k>0\<close> t(1) by (auto simp add: field_simps)
       moreover have "k \<le> w"
       proof (rule ccontr)
         assume "\<not> k \<le> w"
         then have "c + (k + w) / 2 \<notin> d c"
           by (auto simp add: field_simps not_le not_less dist_real_def d_def)
         then have "c + (k + w) / 2 \<notin> ball c k"
           using k by blast
         then show False
           using \<open>0 < w\<close> \<open>\<not> k \<le> w\<close> dist_real_def by auto
       qed
       ultimately have cwt: "c - w < t"
         by (auto simp add: field_simps)
       have eq: "integral {a..c} f - integral {a..t} f = -(((c - t) *\<^sub>R f c + ?SUM p) -
              integral {a..c} f) + (?SUM p - integral {a..t} f) + (c - t) *\<^sub>R f c"
         by auto
       have "norm (integral {a..c} f - integral {a..t} f) < e/3 + e/3 + e/3"
         unfolding eq
       proof (intro norm_triangle_lt add_strict_mono)
         show "norm (- ((c - t) *\<^sub>R f c + ?SUM p - integral {a..c} f)) < e/3"
           by (metis SUMEQ d1_fin norm_minus_cancel)
         show "norm (?SUM p - integral {a..t} f) < e/3"
           using d2_fin by blast
         show "norm ((c - t) *\<^sub>R f c) < e/3"
           using w cwt \<open>t < c\<close> by simp (simp add: field_simps)
       qed
       then show ?thesis by simp
     qed
   qed
 qed
 
 lemma indefinite_integral_continuous_right:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "f integrable_on {a..b}"
     and "a \<le> c"
     and "c < b"
     and "e > 0"
   obtains d where "0 < d"
     and "\<forall>t. c \<le> t \<and> t < c + d \<longrightarrow> norm (integral {a..c} f - integral {a..t} f) < e"
 proof -
   have intm: "(\<lambda>x. f (- x)) integrable_on {-b .. -a}" "- b < - c" "- c \<le> - a"
     using assms by auto
   from indefinite_integral_continuous_left[OF intm \<open>e>0\<close>]
   obtain d where "0 < d"
     and d: "\<And>t. \<lbrakk>- c - d < t; t \<le> -c\<rbrakk> 
              \<Longrightarrow> norm (integral {- b..- c} (\<lambda>x. f (-x)) - integral {- b..t} (\<lambda>x. f (-x))) < e"
     by metis
   let ?d = "min d (b - c)" 
   show ?thesis
   proof (intro that[of "?d"] allI impI)
     show "0 < ?d"
       using \<open>0 < d\<close> \<open>c < b\<close> by auto
     fix t :: real
     assume t: "c \<le> t \<and> t < c + ?d"
     have *: "integral {a..c} f = integral {a..b} f - integral {c..b} f"
             "integral {a..t} f = integral {a..b} f - integral {t..b} f"
       apply (simp_all only: algebra_simps)
       using assms t by (auto simp: integral_combine)
     have "(- c) - d < (- t)" "- t \<le> - c"
       using t by auto 
     from d[OF this] show "norm (integral {a..c} f - integral {a..t} f) < e"
       by (auto simp add: algebra_simps norm_minus_commute *)
   qed
 qed
 
 lemma indefinite_integral_continuous_1:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "f integrable_on {a..b}"
   shows "continuous_on {a..b} (\<lambda>x. integral {a..x} f)"
 proof -
   have "\<exists>d>0. \<forall>x'\<in>{a..b}. dist x' x < d \<longrightarrow> dist (integral {a..x'} f) (integral {a..x} f) < e" 
        if x: "x \<in> {a..b}" and "e > 0" for x e :: real
   proof (cases "a = b")
     case True
     with that show ?thesis by force
   next
     case False
     with x have "a < b" by force
     with x consider "x = a" | "x = b" | "a < x" "x < b"
       by force
     then show ?thesis 
     proof cases
       case 1 show ?thesis
         apply (rule indefinite_integral_continuous_right [OF assms _ \<open>a < b\<close> \<open>e > 0\<close>], force)
         using \<open>x = a\<close> apply (force simp: dist_norm algebra_simps)
         done
     next
       case 2 show ?thesis 
         apply (rule indefinite_integral_continuous_left [OF assms \<open>a < b\<close> _ \<open>e > 0\<close>], force)
         using \<open>x = b\<close> apply (force simp: dist_norm norm_minus_commute algebra_simps)
         done
     next
       case 3
       obtain d1 where "0 < d1" 
         and d1: "\<And>t. \<lbrakk>x - d1 < t; t \<le> x\<rbrakk> \<Longrightarrow> norm (integral {a..x} f - integral {a..t} f) < e"
         using 3 by (auto intro: indefinite_integral_continuous_left [OF assms \<open>a < x\<close> _ \<open>e > 0\<close>])
       obtain d2 where "0 < d2" 
         and d2: "\<And>t. \<lbrakk>x \<le> t; t < x + d2\<rbrakk> \<Longrightarrow> norm (integral {a..x} f - integral {a..t} f) < e"
         using 3 by (auto intro: indefinite_integral_continuous_right [OF assms _ \<open>x < b\<close> \<open>e > 0\<close>])
       show ?thesis
       proof (intro exI ballI conjI impI)
         show "0 < min d1 d2"
           using \<open>0 < d1\<close> \<open>0 < d2\<close> by simp
         show "dist (integral {a..y} f) (integral {a..x} f) < e"
              if "y \<in> {a..b}" "dist y x < min d1 d2" for y
         proof (cases "y < x")
           case True
           with that d1 show ?thesis by (auto simp: dist_commute dist_norm)
         next
           case False
           with that d2 show ?thesis
             by (auto simp: dist_commute dist_norm)
         qed
       qed
     qed
   qed
   then show ?thesis
     by (auto simp: continuous_on_iff)
 qed
 
 lemma indefinite_integral_continuous_1':
   fixes f::"real \<Rightarrow> 'a::banach"
   assumes "f integrable_on {a..b}"
   shows "continuous_on {a..b} (\<lambda>x. integral {x..b} f)"
 proof -
   have "integral {a..b} f - integral {a..x} f = integral {x..b} f" if "x \<in> {a..b}" for x
     using integral_combine[OF _ _ assms, of x] that
     by (auto simp: algebra_simps)
   with _ show ?thesis
     by (rule continuous_on_eq) (auto intro!: continuous_intros indefinite_integral_continuous_1 assms)
 qed
 
 theorem integral_has_vector_derivative':
   fixes f :: "real \<Rightarrow> 'b::banach"
   assumes "continuous_on {a..b} f"
     and "x \<in> {a..b}"
   shows "((\<lambda>u. integral {u..b} f) has_vector_derivative - f x) (at x within {a..b})"
 proof -
   have *: "integral {x..b} f = integral {a .. b} f - integral {a .. x} f" if "a \<le> x" "x \<le> b" for x
     using integral_combine[of a x b for x, OF that integrable_continuous_real[OF assms(1)]]
     by (simp add: algebra_simps)
   show ?thesis
     using \<open>x \<in> _\<close> *
     by (rule has_vector_derivative_transform)
       (auto intro!: derivative_eq_intros assms integral_has_vector_derivative)
 qed
 
 lemma integral_has_real_derivative':
   assumes "continuous_on {a..b} g"
   assumes "t \<in> {a..b}"
   shows "((\<lambda>x. integral {x..b} g) has_real_derivative -g t) (at t within {a..b})"
   using integral_has_vector_derivative'[OF assms]
   by (auto simp: has_field_derivative_iff_has_vector_derivative)
 
 
 subsection \<open>This doesn't directly involve integration, but that gives an easy proof\<close>
 
 lemma has_derivative_zero_unique_strong_interval:
   fixes f :: "real \<Rightarrow> 'a::banach"
   assumes "finite k"
     and contf: "continuous_on {a..b} f"
     and "f a = y"
     and fder: "\<And>x. x \<in> {a..b} - k \<Longrightarrow> (f has_derivative (\<lambda>h. 0)) (at x within {a..b})"
     and x: "x \<in> {a..b}"
   shows "f x = y"
 proof -
   have "a \<le> b" "a \<le> x"
     using assms by auto
   have "((\<lambda>x. 0::'a) has_integral f x - f a) {a..x}"
   proof (rule fundamental_theorem_of_calculus_interior_strong[OF \<open>finite k\<close> \<open>a \<le> x\<close>]; clarify?)
     have "{a..x} \<subseteq> {a..b}"
       using x by auto
     then show "continuous_on {a..x} f"
       by (rule continuous_on_subset[OF contf])
     show "(f has_vector_derivative 0) (at z)" if z: "z \<in> {a<..<x}" and notin: "z \<notin> k" for z
       unfolding has_vector_derivative_def
     proof (simp add: at_within_open[OF z, symmetric])
       show "(f has_derivative (\<lambda>x. 0)) (at z within {a<..<x})"
         by (rule has_derivative_within_subset [OF fder]) (use x z notin in auto)
     qed
   qed
   from has_integral_unique[OF has_integral_0 this]
   show ?thesis
     unfolding assms by auto
 qed
 
 
 subsection \<open>Generalize a bit to any convex set\<close>
 
 lemma has_derivative_zero_unique_strong_convex:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "convex S" "finite K"
     and contf: "continuous_on S f"
     and "c \<in> S" "f c = y"
     and derf: "\<And>x. x \<in> S - K \<Longrightarrow> (f has_derivative (\<lambda>h. 0)) (at x within S)"
     and "x \<in> S"
   shows "f x = y"
 proof (cases "x = c")
   case True with \<open>f c = y\<close> show ?thesis
     by blast
 next
   case False
   let ?\<phi> = "\<lambda>u. (1 - u) *\<^sub>R c + u *\<^sub>R x"
   have contf': "continuous_on {0 ..1} (f \<circ> ?\<phi>)"
   proof (rule continuous_intros continuous_on_subset[OF contf])+
     show "(\<lambda>u. (1 - u) *\<^sub>R c + u *\<^sub>R x) ` {0..1} \<subseteq> S"
       using \<open>convex S\<close> \<open>x \<in> S\<close> \<open>c \<in> S\<close> by (auto simp add: convex_alt algebra_simps)
   qed
   have "t = u" if "?\<phi> t = ?\<phi> u" for t u
   proof -
     from that have "(t - u) *\<^sub>R x = (t - u) *\<^sub>R c"
       by (auto simp add: algebra_simps)
     then show ?thesis
       using \<open>x \<noteq> c\<close> by auto
   qed
   then have eq: "(SOME t. ?\<phi> t = ?\<phi> u) = u" for u
     by blast
   then have "(?\<phi> -` K) \<subseteq> (\<lambda>z. SOME t. ?\<phi> t = z) ` K"
     by (clarsimp simp: image_iff) (metis (no_types) eq)
   then have fin: "finite (?\<phi> -` K)"
     by (rule finite_surj[OF \<open>finite K\<close>])
 
   have derf': "((\<lambda>u. f (?\<phi> u)) has_derivative (\<lambda>h. 0)) (at t within {0..1})"
                if "t \<in> {0..1} - {t. ?\<phi> t \<in> K}" for t
   proof -
     have df: "(f has_derivative (\<lambda>h. 0)) (at (?\<phi> t) within ?\<phi> ` {0..1})"
       apply (rule has_derivative_within_subset [OF derf])
       using \<open>convex S\<close> \<open>x \<in> S\<close> \<open>c \<in> S\<close> that by (auto simp add: convex_alt algebra_simps)
     have "(f \<circ> ?\<phi> has_derivative (\<lambda>x. 0) \<circ> (\<lambda>z. (0 - z *\<^sub>R c) + z *\<^sub>R x)) (at t within {0..1})"
       by (rule derivative_eq_intros df | simp)+
     then show ?thesis
       unfolding o_def .
   qed
   have "(f \<circ> ?\<phi>) 1 = y"
     apply (rule has_derivative_zero_unique_strong_interval[OF fin contf'])
     unfolding o_def using \<open>f c = y\<close> derf' by auto
   then show ?thesis
     by auto
 qed
 
 
 text \<open>Also to any open connected set with finite set of exceptions. Could
  generalize to locally convex set with limpt-free set of exceptions.\<close>
 
 lemma has_derivative_zero_unique_strong_connected:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "connected S"
     and "open S"
     and "finite K"
     and contf: "continuous_on S f"
     and "c \<in> S"
     and "f c = y"
     and derf: "\<And>x. x \<in> S - K \<Longrightarrow> (f has_derivative (\<lambda>h. 0)) (at x within S)"
     and "x \<in> S"
   shows "f x = y"
 proof -
   have "\<exists>e>0. ball x e \<subseteq> (S \<inter> f -` {f x})" if "x \<in> S" for x
   proof -
     obtain e where "0 < e" and e: "ball x e \<subseteq> S"
       using \<open>x \<in> S\<close> \<open>open S\<close> open_contains_ball by blast
     have "ball x e \<subseteq> {u \<in> S. f u \<in> {f x}}"
     proof safe
       fix y
       assume y: "y \<in> ball x e"
       then show "y \<in> S"
         using e by auto
       show "f y = f x"
       proof (rule has_derivative_zero_unique_strong_convex[OF convex_ball \<open>finite K\<close>])
         show "continuous_on (ball x e) f"
           using contf continuous_on_subset e by blast
         show "(f has_derivative (\<lambda>h. 0)) (at u within ball x e)"
              if "u \<in> ball x e - K" for u
           by (metis Diff_iff contra_subsetD derf e has_derivative_within_subset that)
       qed (use y e \<open>0 < e\<close> in auto)
     qed
     then show "\<exists>e>0. ball x e \<subseteq> (S \<inter> f -` {f x})"
       using \<open>0 < e\<close> by blast
   qed
   then have "openin (top_of_set S) (S \<inter> f -` {y})"
     by (auto intro!: open_openin_trans[OF \<open>open S\<close>] simp: open_contains_ball)
   moreover have "closedin (top_of_set S) (S \<inter> f -` {y})"
     by (force intro!: continuous_closedin_preimage [OF contf])
   ultimately have "(S \<inter> f -` {y}) = {} \<or> (S \<inter> f -` {y}) = S"
     using \<open>connected S\<close> by (simp add: connected_clopen)
   then show ?thesis
     using \<open>x \<in> S\<close> \<open>f c = y\<close> \<open>c \<in> S\<close> by auto
 qed
 
 lemma has_derivative_zero_connected_constant:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "connected S"
       and "open S"
       and "finite k"
       and "continuous_on S f"
       and "\<forall>x\<in>(S - k). (f has_derivative (\<lambda>h. 0)) (at x within S)"
     obtains c where "\<And>x. x \<in> S \<Longrightarrow> f(x) = c"
 proof (cases "S = {}")
   case True
   then show ?thesis
     by (metis empty_iff that)
 next
   case False
   then obtain c where "c \<in> S"
     by (metis equals0I)
   then show ?thesis
     by (metis has_derivative_zero_unique_strong_connected assms that)
 qed
 
 lemma DERIV_zero_connected_constant:
   fixes f :: "'a::{real_normed_field,euclidean_space} \<Rightarrow> 'a"
   assumes "connected S"
       and "open S"
       and "finite K"
       and "continuous_on S f"
       and "\<forall>x\<in>(S - K). DERIV f x :> 0"
     obtains c where "\<And>x. x \<in> S \<Longrightarrow> f(x) = c"
   using has_derivative_zero_connected_constant [OF assms(1-4)] assms
   by (metis DERIV_const has_derivative_const Diff_iff at_within_open frechet_derivative_at has_field_derivative_def)
 
 
 subsection \<open>Integrating characteristic function of an interval\<close>
 
 lemma has_integral_restrict_open_subinterval:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes intf: "(f has_integral i) (cbox c d)"
     and cb: "cbox c d \<subseteq> cbox a b"
   shows "((\<lambda>x. if x \<in> box c d then f x else 0) has_integral i) (cbox a b)"
 proof (cases "cbox c d = {}")
   case True
   then have "box c d = {}"
     by (metis bot.extremum_uniqueI box_subset_cbox)
   then show ?thesis
     using True intf by auto
 next
   case False
   then obtain p where pdiv: "p division_of cbox a b" and inp: "cbox c d \<in> p"
     using cb partial_division_extend_1 by blast
   define g where [abs_def]: "g x = (if x \<in>box c d then f x else 0)" for x
   interpret operative "lift_option plus" "Some (0 :: 'b)"
     "\<lambda>i. if g integrable_on i then Some (integral i g) else None"
     by (fact operative_integralI)
   note operat = division [OF pdiv, symmetric]
   show ?thesis
   proof (cases "(g has_integral i) (cbox a b)")
     case True then show ?thesis
       by (simp add: g_def)
   next
     case False
     have iterate:"F (\<lambda>i. if g integrable_on i then Some (integral i g) else None) (p - {cbox c d}) = Some 0"
     proof (intro neutral ballI)
       fix x
       assume x: "x \<in> p - {cbox c d}"
       then have "x \<in> p"
         by auto
       then obtain u v where uv: "x = cbox u v"
         using pdiv by blast
       have "interior x \<inter> interior (cbox c d) = {}"
         using pdiv inp x by blast 
       then have "(g has_integral 0) x"
         unfolding uv using has_integral_spike_interior[where f="\<lambda>x. 0"]
         by (metis (no_types, lifting) disjoint_iff_not_equal g_def has_integral_0_eq interior_cbox)
       then show "(if g integrable_on x then Some (integral x g) else None) = Some 0"
         by auto
     qed
     interpret comm_monoid_set "lift_option plus" "Some (0 :: 'b)"
       by (intro comm_monoid_set.intro comm_monoid_lift_option add.comm_monoid_axioms)
     have intg: "g integrable_on cbox c d"
       using integrable_spike_interior[where f=f]
       by (meson g_def has_integral_integrable intf)
     moreover have "integral (cbox c d) g = i"
     proof (rule has_integral_unique[OF has_integral_spike_interior intf])
       show "\<And>x. x \<in> box c d \<Longrightarrow> f x = g x"
         by (auto simp: g_def)
       show "(g has_integral integral (cbox c d) g) (cbox c d)"
         by (rule integrable_integral[OF intg])
     qed
     ultimately have "F (\<lambda>A. if g integrable_on A then Some (integral A g) else None) p = Some i"
       by (metis (full_types, lifting) division_of_finite inp iterate pdiv remove right_neutral)
     then
     have "(g has_integral i) (cbox a b)"
       by (metis integrable_on_def integral_unique operat option.inject option.simps(3))
     with False show ?thesis
       by blast
   qed
 qed
 
 
 lemma has_integral_restrict_closed_subinterval:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "(f has_integral i) (cbox c d)"
     and "cbox c d \<subseteq> cbox a b"
   shows "((\<lambda>x. if x \<in> cbox c d then f x else 0) has_integral i) (cbox a b)"
 proof -
   note has_integral_restrict_open_subinterval[OF assms]
   note * = has_integral_spike[OF negligible_frontier_interval _ this]
   show ?thesis
     by (rule *[of c d]) (use box_subset_cbox[of c d] in auto)
 qed
 
 lemma has_integral_restrict_closed_subintervals_eq:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "cbox c d \<subseteq> cbox a b"
   shows "((\<lambda>x. if x \<in> cbox c d then f x else 0) has_integral i) (cbox a b) \<longleftrightarrow> (f has_integral i) (cbox c d)"
   (is "?l = ?r")
 proof (cases "cbox c d = {}")
   case False
   let ?g = "\<lambda>x. if x \<in> cbox c d then f x else 0"
   show ?thesis
   proof 
     assume ?l
     then have "?g integrable_on cbox c d"
       using assms has_integral_integrable integrable_subinterval by blast
     then have "f integrable_on cbox c d"
       by (rule integrable_eq) auto
     moreover then have "i = integral (cbox c d) f"
       by (meson \<open>((\<lambda>x. if x \<in> cbox c d then f x else 0) has_integral i) (cbox a b)\<close> assms has_integral_restrict_closed_subinterval has_integral_unique integrable_integral)
     ultimately show ?r by auto
   next
     assume ?r then show ?l
       by (rule has_integral_restrict_closed_subinterval[OF _ assms])
   qed
 qed auto
 
 
 text \<open>Hence we can apply the limit process uniformly to all integrals.\<close>
 
 lemma has_integral':
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "(f has_integral i) S \<longleftrightarrow>
     (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       (\<exists>z. ((\<lambda>x. if x \<in> S then f(x) else 0) has_integral z) (cbox a b) \<and> norm(z - i) < e))"
   (is "?l \<longleftrightarrow> (\<forall>e>0. ?r e)")
 proof (cases "\<exists>a b. S = cbox a b")
   case False then show ?thesis 
     by (simp add: has_integral_alt)
 next
   case True
   then obtain a b where S: "S = cbox a b"
     by blast 
   obtain B where " 0 < B" and B: "\<And>x. x \<in> cbox a b \<Longrightarrow> norm x \<le> B"
     using bounded_cbox[unfolded bounded_pos] by blast
   show ?thesis
   proof safe
     fix e :: real
     assume ?l and "e > 0"
     have "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) (cbox c d)"
       if "ball 0 (B+1) \<subseteq> cbox c d" for c d
         unfolding S using B that
         by (force intro: \<open>?l\<close>[unfolded S] has_integral_restrict_closed_subinterval)
     then show "?r e"
       apply (rule_tac x="B+1" in exI)
       using \<open>B>0\<close> \<open>e>0\<close> by force
   next
     assume as: "\<forall>e>0. ?r e"
     then obtain C 
       where C: "\<And>a b. ball 0 C \<subseteq> cbox a b \<Longrightarrow>
                 \<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b)"
       by (meson zero_less_one)
     define c :: 'n where "c = (\<Sum>i\<in>Basis. (- max B C) *\<^sub>R i)"
     define d :: 'n where "d = (\<Sum>i\<in>Basis. max B C *\<^sub>R i)"
     have "c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i" if "norm x \<le> B" "i \<in> Basis" for x i
       using that and Basis_le_norm[OF \<open>i\<in>Basis\<close>, of x]
       by (auto simp add: field_simps sum_negf c_def d_def)
     then have c_d: "cbox a b \<subseteq> cbox c d"
       by (meson B mem_box(2) subsetI)
     have "c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i"
       if x: "norm (0 - x) < C" and i: "i \<in> Basis" for x i
         using Basis_le_norm[OF i, of x] x i by (auto simp: sum_negf c_def d_def)
       then have "ball 0 C \<subseteq> cbox c d"
         by (auto simp: mem_box dist_norm)
     with C obtain y where y: "(f has_integral y) (cbox a b)"
       using c_d has_integral_restrict_closed_subintervals_eq S by blast
     have "y = i"
     proof (rule ccontr)
       assume "y \<noteq> i"
       then have "0 < norm (y - i)"
         by auto
       from as[rule_format,OF this]
       obtain C where C: "\<And>a b. ball 0 C \<subseteq> cbox a b \<Longrightarrow> 
            \<exists>z. ((\<lambda>x. if x \<in> S then f x else 0) has_integral z) (cbox a b) \<and> norm (z-i) < norm (y-i)"
         by auto
       define c :: 'n where "c = (\<Sum>i\<in>Basis. (- max B C) *\<^sub>R i)"
       define d :: 'n where "d = (\<Sum>i\<in>Basis. max B C *\<^sub>R i)"
       have "c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i"
         if "norm x \<le> B" and "i \<in> Basis" for x i
           using that Basis_le_norm[of i x] by (auto simp add: field_simps sum_negf c_def d_def)
         then have c_d: "cbox a b \<subseteq> cbox c d"
         by (simp add: B mem_box(2) subset_eq)
       have "c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i" if "norm (0 - x) < C" and "i \<in> Basis" for x i
         using Basis_le_norm[of i x] that by (auto simp: sum_negf c_def d_def)
       then have "ball 0 C \<subseteq> cbox c d"
         by (auto simp: mem_box dist_norm)
       with C obtain z where z: "(f has_integral z) (cbox a b)" "norm (z-i) < norm (y-i)"
         using has_integral_restrict_closed_subintervals_eq[OF c_d] S by blast
       moreover then have "z = y" 
         by (blast intro: has_integral_unique[OF _ y])
       ultimately show False
         by auto
     qed
     then show ?l
       using y by (auto simp: S)
   qed
 qed
 
 lemma has_integral_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes fg: "(f has_integral i) S" "(g has_integral j) S"
     and le: "\<And>x. x \<in> S \<Longrightarrow> f x \<le> g x"
   shows "i \<le> j"
   using has_integral_component_le[OF _ fg, of 1] le  by auto
 
 lemma integral_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "f integrable_on S"
     and "g integrable_on S"
     and "\<And>x. x \<in> S \<Longrightarrow> f x \<le> g x"
   shows "integral S f \<le> integral S g"
   by (rule has_integral_le[OF assms(1,2)[unfolded has_integral_integral] assms(3)])
 
 lemma has_integral_nonneg:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "(f has_integral i) S"
     and "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f x"
   shows "0 \<le> i"
   using has_integral_component_nonneg[of 1 f i S]
   unfolding o_def
   using assms
   by auto
 
 lemma integral_nonneg:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes f: "f integrable_on S" and 0: "\<And>x. x \<in> S \<Longrightarrow> 0 \<le> f x"
   shows "0 \<le> integral S f"
   by (rule has_integral_nonneg[OF f[unfolded has_integral_integral] 0])
 
 
 text \<open>Hence a general restriction property.\<close>
 
 lemma has_integral_restrict [simp]:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   assumes "S \<subseteq> T"
   shows "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) T \<longleftrightarrow> (f has_integral i) S"
 proof -
   have *: "\<And>x. (if x \<in> T then if x \<in> S then f x else 0 else 0) =  (if x\<in>S then f x else 0)"
     using assms by auto
   show ?thesis
     apply (subst(2) has_integral')
     apply (subst has_integral')
       apply (simp add: *)
     done
 qed
 
 corollary has_integral_restrict_UNIV:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "((\<lambda>x. if x \<in> s then f x else 0) has_integral i) UNIV \<longleftrightarrow> (f has_integral i) s"
   by auto
 
 lemma has_integral_restrict_Int:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) T \<longleftrightarrow> (f has_integral i) (S \<inter> T)"
 proof -
   have "((\<lambda>x. if x \<in> T then if x \<in> S then f x else 0 else 0) has_integral i) UNIV =
         ((\<lambda>x. if x \<in> S \<inter> T then f x else 0) has_integral i) UNIV"
     by (rule has_integral_cong) auto
   then show ?thesis
     using has_integral_restrict_UNIV by fastforce
 qed
 
 lemma integral_restrict_Int:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "integral T (\<lambda>x. if x \<in> S then f x else 0) = integral (S \<inter> T) f"
   by (metis (no_types, lifting) has_integral_cong has_integral_restrict_Int integrable_integral integral_unique not_integrable_integral)
 
 lemma integrable_restrict_Int:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "(\<lambda>x. if x \<in> S then f x else 0) integrable_on T \<longleftrightarrow> f integrable_on (S \<inter> T)"
   using has_integral_restrict_Int by fastforce
 
 lemma has_integral_on_superset:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "(f has_integral i) S"
       and "\<And>x. x \<notin> S \<Longrightarrow> f x = 0"
       and "S \<subseteq> T"
     shows "(f has_integral i) T"
 proof -
   have "(\<lambda>x. if x \<in> S then f x else 0) = (\<lambda>x. if x \<in> T then f x else 0)"
     using assms by fastforce
   with f show ?thesis
     by (simp only: has_integral_restrict_UNIV [symmetric, of f])
 qed
 
 lemma integrable_on_superset:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on S"
     and "\<And>x. x \<notin> S \<Longrightarrow> f x = 0"
     and "S \<subseteq> t"
   shows "f integrable_on t"
   using assms
   unfolding integrable_on_def
   by (auto intro:has_integral_on_superset)
 
 lemma integral_restrict_UNIV:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "integral UNIV (\<lambda>x. if x \<in> S then f x else 0) = integral S f"
   by (simp add: integral_restrict_Int)
 
 lemma integrable_restrict_UNIV:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "(\<lambda>x. if x \<in> s then f x else 0) integrable_on UNIV \<longleftrightarrow> f integrable_on s"
   unfolding integrable_on_def
   by auto
 
 lemma has_integral_subset_component_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes k: "k \<in> Basis"
     and as: "S \<subseteq> T" "(f has_integral i) S" "(f has_integral j) T" "\<And>x. x\<in>T \<Longrightarrow> 0 \<le> f(x)\<bullet>k"
   shows "i\<bullet>k \<le> j\<bullet>k"
 proof -
   have "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) UNIV"
         "((\<lambda>x. if x \<in> T then f x else 0) has_integral j) UNIV"
     by (simp_all add: assms)
   then show ?thesis
     apply (rule has_integral_component_le[OF k])
     using as by auto
 qed
 
 subsection\<open>Integrals on set differences\<close>
 
 lemma has_integral_setdiff:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes S: "(f has_integral i) S" and T: "(f has_integral j) T"
     and neg: "negligible (T - S)"
   shows "(f has_integral (i - j)) (S - T)"
 proof -
   show ?thesis
     unfolding has_integral_restrict_UNIV [symmetric, of f]
   proof (rule has_integral_spike [OF neg])
     have eq: "(\<lambda>x. (if x \<in> S then f x else 0) - (if x \<in> T then f x else 0)) =
             (\<lambda>x. if x \<in> T - S then - f x else if x \<in> S - T then f x else 0)"
       by (force simp add: )
     have "((\<lambda>x. if x \<in> S then f x else 0) has_integral i) UNIV"
       "((\<lambda>x. if x \<in> T then f x else 0) has_integral j) UNIV"
       using S T has_integral_restrict_UNIV by auto
     from has_integral_diff [OF this]
     show "((\<lambda>x. if x \<in> T - S then - f x else if x \<in> S - T then f x else 0)
                    has_integral i-j) UNIV"
       by (simp add: eq)
   qed force
 qed
 
 lemma integral_setdiff:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "f integrable_on S" "f integrable_on T" "negligible(T - S)"
  shows "integral (S - T) f = integral S f - integral T f"
   by (rule integral_unique) (simp add: assms has_integral_setdiff integrable_integral)
 
 lemma integrable_setdiff:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   assumes "(f has_integral i) S" "(f has_integral j) T" "negligible (T - S)"
   shows "f integrable_on (S - T)"
   using has_integral_setdiff [OF assms]
   by (simp add: has_integral_iff)
 
 lemma negligible_setdiff [simp]: "T \<subseteq> S \<Longrightarrow> negligible (T - S)"
   by (metis Diff_eq_empty_iff negligible_empty)
 
 lemma negligible_on_intervals: "negligible s \<longleftrightarrow> (\<forall>a b. negligible(s \<inter> cbox a b))" (is "?l \<longleftrightarrow> ?r")
 proof
   assume ?r
   show ?l
     unfolding negligible_def
   proof safe
     fix a b
     show "(indicator s has_integral 0) (cbox a b)"
       apply (rule has_integral_negligible[OF \<open>?r\<close>[rule_format,of a b]])
       unfolding indicator_def
       apply auto
       done
   qed
 qed (simp add: negligible_Int)
 
 lemma negligible_translation:
   assumes "negligible S"
     shows "negligible ((+) c ` S)"
 proof -
   have inj: "inj ((+) c)"
     by simp
   show ?thesis
   using assms
   proof (clarsimp simp: negligible_def)
     fix a b
     assume "\<forall>x y. (indicator S has_integral 0) (cbox x y)"
     then have *: "(indicator S has_integral 0) (cbox (a-c) (b-c))"
       by (meson Diff_iff assms has_integral_negligible indicator_simps(2))
     have eq: "indicator ((+) c ` S) = (\<lambda>x. indicator S (x - c))"
       by (force simp add: indicator_def)
     show "(indicator ((+) c ` S) has_integral 0) (cbox a b)"
       using has_integral_affinity [OF *, of 1 "-c"]
             cbox_translation [of "c" "-c+a" "-c+b"]
       by (simp add: eq) (simp add: ac_simps)
   qed
 qed
 
 lemma negligible_translation_rev:
   assumes "negligible ((+) c ` S)"
     shows "negligible S"
 by (metis negligible_translation [OF assms, of "-c"] translation_galois)
 
 lemma has_integral_spike_set_eq:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "(f has_integral y) S \<longleftrightarrow> (f has_integral y) T"
 proof -
   have "((\<lambda>x. if x \<in> S then f x else 0) has_integral y) UNIV =
         ((\<lambda>x. if x \<in> T then f x else 0) has_integral y) UNIV"
   proof (rule has_integral_spike_eq)
     show "negligible ({x \<in> S - T. f x \<noteq> 0} \<union> {x \<in> T - S. f x \<noteq> 0})"
       by (rule negligible_Un [OF assms])
   qed auto
   then show ?thesis
     by (simp add: has_integral_restrict_UNIV)
 qed
 
 corollary integral_spike_set:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "integral S f = integral T f"
   using has_integral_spike_set_eq [OF assms]
   by (metis eq_integralD integral_unique)
 
 lemma integrable_spike_set:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on S" and neg: "negligible {x \<in> S - T. f x \<noteq> 0}" "negligible {x \<in> T - S. f x \<noteq> 0}"
   shows "f integrable_on T"
   using has_integral_spike_set_eq [OF neg] f by blast
 
 lemma integrable_spike_set_eq:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "negligible ((S - T) \<union> (T - S))"
   shows "f integrable_on S \<longleftrightarrow> f integrable_on T"
   by (blast intro: integrable_spike_set assms negligible_subset)
 
 lemma integrable_on_insert_iff: "f integrable_on (insert x X) \<longleftrightarrow> f integrable_on X"
   for f::"_ \<Rightarrow> 'a::banach"
   by (rule integrable_spike_set_eq) (auto simp: insert_Diff_if)
 
 lemma has_integral_interior:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "negligible(frontier S) \<Longrightarrow> (f has_integral y) (interior S) \<longleftrightarrow> (f has_integral y) S"
   by (rule has_integral_spike_set_eq [OF empty_imp_negligible negligible_subset])
      (use interior_subset in \<open>auto simp: frontier_def closure_def\<close>)
 
 lemma has_integral_closure:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "negligible(frontier S) \<Longrightarrow> (f has_integral y) (closure S) \<longleftrightarrow> (f has_integral y) S"
   by (rule has_integral_spike_set_eq [OF negligible_subset empty_imp_negligible]) (auto simp: closure_Un_frontier )
 
 lemma has_integral_open_interval:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "(f has_integral y) (box a b) \<longleftrightarrow> (f has_integral y) (cbox a b)"
   unfolding interior_cbox [symmetric]
   by (metis frontier_cbox has_integral_interior negligible_frontier_interval)
 
 lemma integrable_on_open_interval:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "f integrable_on box a b \<longleftrightarrow> f integrable_on cbox a b"
   by (simp add: has_integral_open_interval integrable_on_def)
 
 lemma integral_open_interval:
   fixes f :: "'a :: euclidean_space \<Rightarrow> 'b :: banach"
   shows "integral(box a b) f = integral(cbox a b) f"
   by (metis has_integral_integrable_integral has_integral_open_interval not_integrable_integral)
 
 
 subsection \<open>More lemmas that are useful later\<close>
 
 lemma has_integral_subset_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "s \<subseteq> t"
     and "(f has_integral i) s"
     and "(f has_integral j) t"
     and "\<forall>x\<in>t. 0 \<le> f x"
   shows "i \<le> j"
   using has_integral_subset_component_le[OF _ assms(1), of 1 f i j]
   using assms
   by auto
 
 lemma integral_subset_component_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
   assumes "k \<in> Basis"
     and "s \<subseteq> t"
     and "f integrable_on s"
     and "f integrable_on t"
     and "\<forall>x \<in> t. 0 \<le> f x \<bullet> k"
   shows "(integral s f)\<bullet>k \<le> (integral t f)\<bullet>k"
   apply (rule has_integral_subset_component_le)
   using assms
   apply auto
   done
 
 lemma integral_subset_le:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "s \<subseteq> t"
     and "f integrable_on s"
     and "f integrable_on t"
     and "\<forall>x \<in> t. 0 \<le> f x"
   shows "integral s f \<le> integral t f"
   apply (rule has_integral_subset_le)
   using assms
   apply auto
   done
 
 lemma has_integral_alt':
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "(f has_integral i) s \<longleftrightarrow> 
           (\<forall>a b. (\<lambda>x. if x \<in> s then f x else 0) integrable_on cbox a b) \<and>
           (\<forall>e>0. \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
             norm (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) - i) < e)"
   (is "?l = ?r")
 proof
   assume rhs: ?r
   show ?l
   proof (subst has_integral', intro allI impI)
     fix e::real
     assume "e > 0"
     from rhs[THEN conjunct2,rule_format,OF this] 
     show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
                    (\<exists>z. ((\<lambda>x. if x \<in> s then f x else 0) has_integral z)
                          (cbox a b) \<and> norm (z - i) < e)"
       apply (rule ex_forward)
       using rhs by blast
   qed
 next
   let ?\<Phi> = "\<lambda>e a b. \<exists>z. ((\<lambda>x. if x \<in> s then f x else 0) has_integral z) (cbox a b) \<and> norm (z - i) < e"
   assume ?l 
   then have lhs: "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow> ?\<Phi> e a b" if "e > 0" for e
     using that has_integral'[of f] by auto
   let ?f = "\<lambda>x. if x \<in> s then f x else 0"
   show ?r
   proof (intro conjI allI impI)
     fix a b :: 'n
     from lhs[OF zero_less_one]
     obtain B where "0 < B" and B: "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> ?\<Phi> 1 a b"
       by blast
     let ?a = "\<Sum>i\<in>Basis. min (a\<bullet>i) (-B) *\<^sub>R i::'n"
     let ?b = "\<Sum>i\<in>Basis. max (b\<bullet>i) B *\<^sub>R i::'n"
     show "?f integrable_on cbox a b"
     proof (rule integrable_subinterval[of _ ?a ?b])
       have "?a \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> ?b \<bullet> i" if "norm (0 - x) < B" "i \<in> Basis" for x i
         using Basis_le_norm[of i x] that by (auto simp add:field_simps)
       then have "ball 0 B \<subseteq> cbox ?a ?b"
         by (auto simp: mem_box dist_norm)
       then show "?f integrable_on cbox ?a ?b"
         unfolding integrable_on_def using B by blast
       show "cbox a b \<subseteq> cbox ?a ?b"
         by (force simp: mem_box)
     qed
   
     fix e :: real
     assume "e > 0"
     with lhs show "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow>
       norm (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) - i) < e"
       by (metis (no_types, lifting) has_integral_integrable_integral)
   qed
 qed
 
 
 subsection \<open>Continuity of the integral (for a 1-dimensional interval)\<close>
 
 lemma integrable_alt:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   shows "f integrable_on s \<longleftrightarrow>
     (\<forall>a b. (\<lambda>x. if x \<in> s then f x else 0) integrable_on cbox a b) \<and>
     (\<forall>e>0. \<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
     norm (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) -
       integral (cbox c d)  (\<lambda>x. if x \<in> s then f x else 0)) < e)"
   (is "?l = ?r")
 proof
   let ?F = "\<lambda>x. if x \<in> s then f x else 0"
   assume ?l
   then obtain y where intF: "\<And>a b. ?F integrable_on cbox a b"
           and y: "\<And>e. 0 < e \<Longrightarrow>
               \<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow> norm (integral (cbox a b) ?F - y) < e"
     unfolding integrable_on_def has_integral_alt'[of f] by auto
   show ?r
   proof (intro conjI allI impI intF)
     fix e::real
     assume "e > 0"
     then have "e/2 > 0"
       by auto
     obtain B where "0 < B" 
        and B: "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> norm (integral (cbox a b) ?F - y) < e/2"
       using \<open>0 < e/2\<close> y by blast
     show "\<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
                   norm (integral (cbox a b) ?F - integral (cbox c d) ?F) < e"
     proof (intro conjI exI impI allI, rule \<open>0 < B\<close>)
       fix a b c d::'n
       assume sub: "ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d"
       show "norm (integral (cbox a b) ?F - integral (cbox c d) ?F) < e"
         using sub by (auto intro: norm_triangle_half_l dest: B)
     qed
   qed
 next
   let ?F = "\<lambda>x. if x \<in> s then f x else 0"
   assume rhs: ?r
   let ?cube = "\<lambda>n. cbox (\<Sum>i\<in>Basis. - real n *\<^sub>R i::'n) (\<Sum>i\<in>Basis. real n *\<^sub>R i)"
   have "Cauchy (\<lambda>n. integral (?cube n) ?F)"
     unfolding Cauchy_def
   proof (intro allI impI)
     fix e::real
     assume "e > 0"
     with rhs obtain B where "0 < B" 
       and B: "\<And>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d 
                         \<Longrightarrow> norm (integral (cbox a b) ?F - integral (cbox c d) ?F) < e"
       by blast
     obtain N where N: "B \<le> real N"
       using real_arch_simple by blast
     have "ball 0 B \<subseteq> ?cube n" if n: "n \<ge> N" for n
     proof -
       have "sum ((*\<^sub>R) (- real n)) Basis \<bullet> i \<le> x \<bullet> i \<and>
             x \<bullet> i \<le> sum ((*\<^sub>R) (real n)) Basis \<bullet> i"
         if "norm x < B" "i \<in> Basis" for x i::'n
           using Basis_le_norm[of i x] n N that by (auto simp add: field_simps sum_negf)
       then show ?thesis
         by (auto simp: mem_box dist_norm)
     qed
     then show "\<exists>M. \<forall>m\<ge>M. \<forall>n\<ge>M. dist (integral (?cube m) ?F) (integral (?cube n) ?F) < e"
       by (fastforce simp add: dist_norm intro!: B)
   qed
   then obtain i where i: "(\<lambda>n. integral (?cube n) ?F) \<longlonglongrightarrow> i"
     using convergent_eq_Cauchy by blast
   have "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow> norm (integral (cbox a b) ?F - i) < e"
     if "e > 0" for e
   proof -
     have *: "e/2 > 0" using that by auto
     then obtain N where N: "\<And>n. N \<le> n \<Longrightarrow> norm (i - integral (?cube n) ?F) < e/2"
       using i[THEN LIMSEQ_D, simplified norm_minus_commute] by meson
     obtain B where "0 < B" 
       and B: "\<And>a b c d. \<lbrakk>ball 0 B \<subseteq> cbox a b; ball 0 B \<subseteq> cbox c d\<rbrakk> \<Longrightarrow>
                   norm (integral (cbox a b) ?F - integral (cbox c d) ?F) < e/2"
       using rhs * by meson
     let ?B = "max (real N) B"
     show ?thesis
     proof (intro exI conjI allI impI)
       show "0 < ?B"
         using \<open>B > 0\<close> by auto
       fix a b :: 'n
       assume "ball 0 ?B \<subseteq> cbox a b"
       moreover obtain n where n: "max (real N) B \<le> real n"
         using real_arch_simple by blast
       moreover have "ball 0 B \<subseteq> ?cube n"
       proof 
         fix x :: 'n
         assume x: "x \<in> ball 0 B"
         have "\<lbrakk>norm (0 - x) < B; i \<in> Basis\<rbrakk>
               \<Longrightarrow> sum ((*\<^sub>R) (-n)) Basis \<bullet> i\<le> x \<bullet> i \<and> x \<bullet> i \<le> sum ((*\<^sub>R) n) Basis \<bullet> i" for i
           using Basis_le_norm[of i x] n by (auto simp add: field_simps sum_negf)
         then show "x \<in> ?cube n"
           using x by (auto simp: mem_box dist_norm)
       qed 
       ultimately show "norm (integral (cbox a b) ?F - i) < e"
         using norm_triangle_half_l [OF B N] by force
     qed
   qed
   then show ?l unfolding integrable_on_def has_integral_alt'[of f]
     using rhs by blast
 qed
 
 lemma integrable_altD:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on s"
   shows "\<And>a b. (\<lambda>x. if x \<in> s then f x else 0) integrable_on cbox a b"
     and "\<And>e. e > 0 \<Longrightarrow> \<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
       norm (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) - integral (cbox c d)  (\<lambda>x. if x \<in> s then f x else 0)) < e"
   using assms[unfolded integrable_alt[of f]] by auto
 
 lemma integrable_alt_subset:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::banach"
   shows
      "f integrable_on S \<longleftrightarrow>
       (\<forall>a b. (\<lambda>x. if x \<in> S then f x else 0) integrable_on cbox a b) \<and>
       (\<forall>e>0. \<exists>B>0. \<forall>a b c d.
                       ball 0 B \<subseteq> cbox a b \<and> cbox a b \<subseteq> cbox c d
                       \<longrightarrow> norm(integral (cbox a b) (\<lambda>x. if x \<in> S then f x else 0) -
                                integral (cbox c d) (\<lambda>x. if x \<in> S then f x else 0)) < e)"
       (is "_ = ?rhs")
 proof -
   let ?g = "\<lambda>x. if x \<in> S then f x else 0"
   have "f integrable_on S \<longleftrightarrow>
         (\<forall>a b. ?g integrable_on cbox a b) \<and>
         (\<forall>e>0. \<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
            norm (integral (cbox a b) ?g - integral (cbox c d)  ?g) < e)"
     by (rule integrable_alt)
   also have "\<dots> = ?rhs"
   proof -
     { fix e :: "real"
       assume e: "\<And>e. e>0 \<Longrightarrow> \<exists>B>0. \<forall>a b c d. ball 0 B \<subseteq> cbox a b \<and> cbox a b \<subseteq> cbox c d \<longrightarrow>
                                    norm (integral (cbox a b) ?g - integral (cbox c d) ?g) < e"
         and "e > 0"
       obtain B where "B > 0"
         and B: "\<And>a b c d. \<lbrakk>ball 0 B \<subseteq> cbox a b; cbox a b \<subseteq> cbox c d\<rbrakk> \<Longrightarrow>
                            norm (integral (cbox a b) ?g - integral (cbox c d) ?g) < e/2"
         using \<open>e > 0\<close> e [of "e/2"] by force
       have "\<exists>B>0. \<forall>a b c d.
                ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
                norm (integral (cbox a b) ?g - integral (cbox c d) ?g) < e"
       proof (intro exI allI conjI impI)
         fix a b c d :: "'a"
         let ?\<alpha> = "\<Sum>i\<in>Basis. max (a \<bullet> i) (c \<bullet> i) *\<^sub>R i"
         let ?\<beta> = "\<Sum>i\<in>Basis. min (b \<bullet> i) (d \<bullet> i) *\<^sub>R i"
         show "norm (integral (cbox a b) ?g - integral (cbox c d) ?g) < e"
           if ball: "ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d"
         proof -
           have B': "norm (integral (cbox a b \<inter> cbox c d) ?g - integral (cbox x y) ?g) < e/2"
             if "cbox a b \<inter> cbox c d \<subseteq> cbox x y" for x y
             using B [of ?\<alpha> ?\<beta> x y] ball that by (simp add: Int_interval [symmetric])
           show ?thesis
             using B' [of a b] B' [of c d] norm_triangle_half_r by blast
         qed
       qed (use \<open>B > 0\<close> in auto)}
     then show ?thesis
       by force
   qed
   finally show ?thesis .
 qed
 
 lemma integrable_on_subcbox:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes intf: "f integrable_on S"
     and sub: "cbox a b \<subseteq> S"
   shows "f integrable_on cbox a b"
 proof -
   have "(\<lambda>x. if x \<in> S then f x else 0) integrable_on cbox a b"
     by (simp add: intf integrable_altD(1))
 then show ?thesis
   by (metis (mono_tags) sub integrable_restrict_Int le_inf_iff order_refl subset_antisym)
 qed
 
 
 subsection \<open>A straddling criterion for integrability\<close>
 
 lemma integrable_straddle_interval:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "\<And>e. e>0 \<Longrightarrow> \<exists>g h i j. (g has_integral i) (cbox a b) \<and> (h has_integral j) (cbox a b) \<and>
                             \<bar>i - j\<bar> < e \<and> (\<forall>x\<in>cbox a b. (g x) \<le> f x \<and> f x \<le> h x)"
   shows "f integrable_on cbox a b"
 proof -
   have "\<exists>d. gauge d \<and>
             (\<forall>p1 p2. p1 tagged_division_of cbox a b \<and> d fine p1 \<and>
                      p2 tagged_division_of cbox a b \<and> d fine p2 \<longrightarrow>
                      \<bar>(\<Sum>(x,K)\<in>p1. content K *\<^sub>R f x) - (\<Sum>(x,K)\<in>p2. content K *\<^sub>R f x)\<bar> < e)"
     if "e > 0" for e
   proof -
     have e: "e/3 > 0"
       using that by auto
     then obtain g h i j where ij: "\<bar>i - j\<bar> < e/3"
             and "(g has_integral i) (cbox a b)"
             and "(h has_integral j) (cbox a b)"
             and fgh: "\<And>x. x \<in> cbox a b \<Longrightarrow> g x \<le> f x \<and> f x \<le> h x"
       using assms real_norm_def by metis
     then obtain d1 d2 where "gauge d1" "gauge d2"
             and d1: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; d1 fine p\<rbrakk> \<Longrightarrow>
                           \<bar>(\<Sum>(x,K)\<in>p. content K *\<^sub>R g x) - i\<bar> < e/3"
             and d2: "\<And>p. \<lbrakk>p tagged_division_of cbox a b; d2 fine p\<rbrakk> \<Longrightarrow>
                           \<bar>(\<Sum>(x,K) \<in> p. content K *\<^sub>R h x) - j\<bar> < e/3"
       by (metis e has_integral real_norm_def)
     have "\<bar>(\<Sum>(x,K) \<in> p1. content K *\<^sub>R f x) - (\<Sum>(x,K) \<in> p2. content K *\<^sub>R f x)\<bar> < e"
       if p1: "p1 tagged_division_of cbox a b" and 11: "d1 fine p1" and 21: "d2 fine p1"
        and p2: "p2 tagged_division_of cbox a b" and 12: "d1 fine p2" and 22: "d2 fine p2" for p1 p2
     proof -
       have *: "\<And>g1 g2 h1 h2 f1 f2.
                   \<lbrakk>\<bar>g2 - i\<bar> < e/3; \<bar>g1 - i\<bar> < e/3; \<bar>h2 - j\<bar> < e/3; \<bar>h1 - j\<bar> < e/3;
                    g1 - h2 \<le> f1 - f2; f1 - f2 \<le> h1 - g2\<rbrakk>
                   \<Longrightarrow> \<bar>f1 - f2\<bar> < e"
         using \<open>e > 0\<close> ij by arith
       have 0: "(\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x) - (\<Sum>(x, k)\<in>p1. content k *\<^sub>R g x) \<ge> 0"
               "0 \<le> (\<Sum>(x, k)\<in>p2. content k *\<^sub>R h x) - (\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x)"
               "(\<Sum>(x, k)\<in>p2. content k *\<^sub>R f x) - (\<Sum>(x, k)\<in>p2. content k *\<^sub>R g x) \<ge> 0"
               "0 \<le> (\<Sum>(x, k)\<in>p1. content k *\<^sub>R h x) - (\<Sum>(x, k)\<in>p1. content k *\<^sub>R f x)"
         unfolding sum_subtractf[symmetric]
            apply (auto intro!: sum_nonneg)
            apply (meson fgh measure_nonneg mult_left_mono tag_in_interval that sum_nonneg)+
         done
       show ?thesis
       proof (rule *)
         show "\<bar>(\<Sum>(x,K) \<in> p2. content K *\<^sub>R g x) - i\<bar> < e/3"
           by (rule d1[OF p2 12])
         show "\<bar>(\<Sum>(x,K) \<in> p1. content K *\<^sub>R g x) - i\<bar> < e/3"
           by (rule d1[OF p1 11])
         show "\<bar>(\<Sum>(x,K) \<in> p2. content K *\<^sub>R h x) - j\<bar> < e/3"
           by (rule d2[OF p2 22])
         show "\<bar>(\<Sum>(x,K) \<in> p1. content K *\<^sub>R h x) - j\<bar> < e/3"
           by (rule d2[OF p1 21])
       qed (use 0 in auto)
     qed
     then show ?thesis
       by (rule_tac x="\<lambda>x. d1 x \<inter> d2 x" in exI)
         (auto simp: fine_Int intro: \<open>gauge d1\<close> \<open>gauge d2\<close> d1 d2)
   qed
   then show ?thesis
     by (simp add: integrable_Cauchy)
 qed
 
 lemma integrable_straddle:
   fixes f :: "'n::euclidean_space \<Rightarrow> real"
   assumes "\<And>e. e>0 \<Longrightarrow> \<exists>g h i j. (g has_integral i) s \<and> (h has_integral j) s \<and>
                      \<bar>i - j\<bar> < e \<and> (\<forall>x\<in>s. g x \<le> f x \<and> f x \<le> h x)"
   shows "f integrable_on s"
 proof -
   let ?fs = "(\<lambda>x. if x \<in> s then f x else 0)"
   have "?fs integrable_on cbox a b" for a b
   proof (rule integrable_straddle_interval)
     fix e::real
     assume "e > 0"
     then have *: "e/4 > 0"
       by auto
     with assms obtain g h i j where g: "(g has_integral i) s" and h: "(h has_integral j) s"
                  and ij: "\<bar>i - j\<bar> < e/4"
                  and fgh: "\<And>x. x \<in> s \<Longrightarrow> g x \<le> f x \<and> f x \<le> h x"
       by metis
     let ?gs = "(\<lambda>x. if x \<in> s then g x else 0)"
     let ?hs = "(\<lambda>x. if x \<in> s then h x else 0)"
     obtain Bg where Bg: "\<And>a b. ball 0 Bg \<subseteq> cbox a b \<Longrightarrow> \<bar>integral (cbox a b) ?gs - i\<bar> < e/4"
               and int_g: "\<And>a b. ?gs integrable_on cbox a b"
       using g * unfolding has_integral_alt' real_norm_def by meson
     obtain Bh where
           Bh: "\<And>a b. ball 0 Bh \<subseteq> cbox a b \<Longrightarrow> \<bar>integral (cbox a b) ?hs - j\<bar> < e/4"
          and int_h: "\<And>a b. ?hs integrable_on cbox a b"
       using h * unfolding has_integral_alt' real_norm_def by meson
     define c where "c = (\<Sum>i\<in>Basis. min (a\<bullet>i) (- (max Bg Bh)) *\<^sub>R i)"
     define d where "d = (\<Sum>i\<in>Basis. max (b\<bullet>i) (max Bg Bh) *\<^sub>R i)"
     have "\<lbrakk>norm (0 - x) < Bg; i \<in> Basis\<rbrakk> \<Longrightarrow> c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i" for x i
       using Basis_le_norm[of i x] unfolding c_def d_def by auto
     then have ballBg: "ball 0 Bg \<subseteq> cbox c d"
       by (auto simp: mem_box dist_norm)
     have "\<lbrakk>norm (0 - x) < Bh; i \<in> Basis\<rbrakk> \<Longrightarrow> c \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> d \<bullet> i" for x i
       using Basis_le_norm[of i x] unfolding c_def d_def by auto
     then have ballBh: "ball 0 Bh \<subseteq> cbox c d"
       by (auto simp: mem_box dist_norm)
     have ab_cd: "cbox a b \<subseteq> cbox c d"
       by (auto simp: c_def d_def subset_box_imp)
     have **: "\<And>ch cg ag ah::real. \<lbrakk>\<bar>ah - ag\<bar> \<le> \<bar>ch - cg\<bar>; \<bar>cg - i\<bar> < e/4; \<bar>ch - j\<bar> < e/4\<rbrakk>
        \<Longrightarrow> \<bar>ag - ah\<bar> < e"
       using ij by arith
     show "\<exists>g h i j. (g has_integral i) (cbox a b) \<and> (h has_integral j) (cbox a b) \<and> \<bar>i - j\<bar> < e \<and>
           (\<forall>x\<in>cbox a b. g x \<le> (if x \<in> s then f x else 0) \<and>
                         (if x \<in> s then f x else 0) \<le> h x)"
     proof (intro exI ballI conjI)
       have eq: "\<And>x f g. (if x \<in> s then f x else 0) - (if x \<in> s then g x else 0) =
                        (if x \<in> s then f x - g x else (0::real))"
         by auto
       have int_hg: "(\<lambda>x. if x \<in> s then h x - g x else 0) integrable_on cbox a b"
                    "(\<lambda>x. if x \<in> s then h x - g x else 0) integrable_on cbox c d"
         by (metis (no_types) integrable_diff g h has_integral_integrable integrable_altD(1))+
       show "(?gs has_integral integral (cbox a b) ?gs) (cbox a b)"
            "(?hs has_integral integral (cbox a b) ?hs) (cbox a b)"
         by (intro integrable_integral int_g int_h)+
       then have "integral (cbox a b) ?gs \<le> integral (cbox a b) ?hs"
         apply (rule has_integral_le)
         using fgh by force
       then have "0 \<le> integral (cbox a b) ?hs - integral (cbox a b) ?gs"
         by simp
       then have "\<bar>integral (cbox a b) ?hs - integral (cbox a b) ?gs\<bar>
               \<le> \<bar>integral (cbox c d) ?hs - integral (cbox c d) ?gs\<bar>"
         apply (simp add: integral_diff [symmetric] int_g int_h)
         apply (subst abs_of_nonneg[OF integral_nonneg[OF integrable_diff, OF int_h int_g]])
         using fgh apply (force simp: eq intro!: integral_subset_le [OF ab_cd int_hg])+
         done
       then show "\<bar>integral (cbox a b) ?gs - integral (cbox a b) ?hs\<bar> < e"
         apply (rule **)
          apply (rule Bg ballBg Bh ballBh)+
         done
       show "\<And>x. x \<in> cbox a b \<Longrightarrow> ?gs x \<le> ?fs x" "\<And>x. x \<in> cbox a b \<Longrightarrow> ?fs x \<le> ?hs x"
         using fgh by auto
     qed
   qed
   then have int_f: "?fs integrable_on cbox a b" for a b
     by simp
   have "\<exists>B>0. \<forall>a b c d.
                   ball 0 B \<subseteq> cbox a b \<and> ball 0 B \<subseteq> cbox c d \<longrightarrow>
                   abs (integral (cbox a b) ?fs - integral (cbox c d) ?fs) < e"
       if "0 < e" for e
   proof -
     have *: "e/3 > 0"
       using that by auto
     with assms obtain g h i j where g: "(g has_integral i) s" and h: "(h has_integral j) s"
                  and ij: "\<bar>i - j\<bar> < e/3"
                  and fgh: "\<And>x. x \<in> s \<Longrightarrow> g x \<le> f x \<and> f x \<le> h x"
       by metis
     let ?gs = "(\<lambda>x. if x \<in> s then g x else 0)"
     let ?hs = "(\<lambda>x. if x \<in> s then h x else 0)"
     obtain Bg where "Bg > 0"
               and Bg: "\<And>a b. ball 0 Bg \<subseteq> cbox a b \<Longrightarrow> \<bar>integral (cbox a b) ?gs - i\<bar> < e/3"
               and int_g: "\<And>a b. ?gs integrable_on cbox a b"
       using g * unfolding has_integral_alt' real_norm_def by meson
     obtain Bh where "Bh > 0"
               and Bh: "\<And>a b. ball 0 Bh \<subseteq> cbox a b \<Longrightarrow> \<bar>integral (cbox a b) ?hs - j\<bar> < e/3"
               and int_h: "\<And>a b. ?hs integrable_on cbox a b"
       using h * unfolding has_integral_alt' real_norm_def by meson
     { fix a b c d :: 'n
       assume as: "ball 0 (max Bg Bh) \<subseteq> cbox a b" "ball 0 (max Bg Bh) \<subseteq> cbox c d"
       have **: "ball 0 Bg \<subseteq> ball (0::'n) (max Bg Bh)" "ball 0 Bh \<subseteq> ball (0::'n) (max Bg Bh)"
         by auto
       have *: "\<And>ga gc ha hc fa fc. \<lbrakk>\<bar>ga - i\<bar> < e/3; \<bar>gc - i\<bar> < e/3; \<bar>ha - j\<bar> < e/3;
                      \<bar>hc - j\<bar> < e/3; ga \<le> fa; fa \<le> ha; gc \<le> fc; fc \<le> hc\<rbrakk> \<Longrightarrow>
         \<bar>fa - fc\<bar> < e"
         using ij by arith
       have "abs (integral (cbox a b) (\<lambda>x. if x \<in> s then f x else 0) - integral (cbox c d)
         (\<lambda>x. if x \<in> s then f x else 0)) < e"
       proof (rule *)
         show "\<bar>integral (cbox a b) ?gs - i\<bar> < e/3"
           using "**" Bg as by blast
         show "\<bar>integral (cbox c d) ?gs - i\<bar> < e/3"
           using "**" Bg as by blast
         show "\<bar>integral (cbox a b) ?hs - j\<bar> < e/3"
           using "**" Bh as by blast
         show "\<bar>integral (cbox c d) ?hs - j\<bar> < e/3"
           using "**" Bh as by blast
       qed (use int_f int_g int_h fgh in \<open>simp_all add: integral_le\<close>)
     }
     then show ?thesis
       apply (rule_tac x="max Bg Bh" in exI)
         using \<open>Bg > 0\<close> by auto
   qed
   then show ?thesis
     unfolding integrable_alt[of f] real_norm_def by (blast intro: int_f)
 qed
 
 
 subsection \<open>Adding integrals over several sets\<close>
 
 lemma has_integral_Un:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "(f has_integral i) S" "(f has_integral j) T"
     and neg: "negligible (S \<inter> T)"
   shows "(f has_integral (i + j)) (S \<union> T)"
   unfolding has_integral_restrict_UNIV[symmetric, of f]
 proof (rule has_integral_spike[OF neg])
   let ?f = "\<lambda>x. (if x \<in> S then f x else 0) + (if x \<in> T then f x else 0)"
   show "(?f has_integral i + j) UNIV"
     by (simp add: f has_integral_add)
 qed auto
 
 lemma integral_Un [simp]:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on S" "f integrable_on T" "negligible (S \<inter> T)"
   shows "integral (S \<union> T) f = integral S f + integral T f"
   by (simp add: has_integral_Un assms integrable_integral integral_unique)
 
 lemma integrable_Un:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b :: banach"
   assumes "negligible (A \<inter> B)" "f integrable_on A" "f integrable_on B"
   shows   "f integrable_on (A \<union> B)"
 proof -
   from assms obtain y z where "(f has_integral y) A" "(f has_integral z) B"
      by (auto simp: integrable_on_def)
   from has_integral_Un[OF this assms(1)] show ?thesis by (auto simp: integrable_on_def)
 qed
 
 lemma integrable_Un':
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b :: banach"
   assumes "f integrable_on A" "f integrable_on B" "negligible (A \<inter> B)" "C = A \<union> B"
   shows   "f integrable_on C"
   using integrable_Un[of A B f] assms by simp
 
 lemma has_integral_Union:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes \<T>: "finite \<T>"
     and int: "\<And>S. S \<in> \<T> \<Longrightarrow> (f has_integral (i S)) S"
     and neg: "pairwise (\<lambda>S S'. negligible (S \<inter> S')) \<T>"
   shows "(f has_integral (sum i \<T>)) (\<Union>\<T>)"
 proof -
   let ?\<U> = "((\<lambda>(a,b). a \<inter> b) ` {(a,b). a \<in> \<T> \<and> b \<in> {y. y \<in> \<T> \<and> a \<noteq> y}})"
   have "((\<lambda>x. if x \<in> \<Union>\<T> then f x else 0) has_integral sum i \<T>) UNIV"
   proof (rule has_integral_spike)
     show "negligible (\<Union>?\<U>)"
     proof (rule negligible_Union)
       have "finite (\<T> \<times> \<T>)"
         by (simp add: \<T>)
       moreover have "{(a, b). a \<in> \<T> \<and> b \<in> {y \<in> \<T>. a \<noteq> y}} \<subseteq> \<T> \<times> \<T>"
         by auto
       ultimately show "finite ?\<U>"
         by (blast intro: finite_subset[of _ "\<T> \<times> \<T>"])
       show "\<And>t. t \<in> ?\<U> \<Longrightarrow> negligible t"
         using neg unfolding pairwise_def by auto
     qed
   next
     show "(if x \<in> \<Union>\<T> then f x else 0) = (\<Sum>A\<in>\<T>. if x \<in> A then f x else 0)"
       if "x \<in> UNIV - (\<Union>?\<U>)" for x
     proof clarsimp
       fix S assume "S \<in> \<T>" "x \<in> S"
       moreover then have "\<forall>b\<in>\<T>. x \<in> b \<longleftrightarrow> b = S"
         using that by blast
       ultimately show "f x = (\<Sum>A\<in>\<T>. if x \<in> A then f x else 0)"
         by (simp add: sum.delta[OF \<T>])
     qed
   next
     show "((\<lambda>x. \<Sum>A\<in>\<T>. if x \<in> A then f x else 0) has_integral (\<Sum>A\<in>\<T>. i A)) UNIV"
       apply (rule has_integral_sum [OF \<T>])
       using int by (simp add: has_integral_restrict_UNIV)
   qed
   then show ?thesis
     using has_integral_restrict_UNIV by blast
 qed
 
 
 text \<open>In particular adding integrals over a division, maybe not of an interval.\<close>
 
 lemma has_integral_combine_division:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "\<D> division_of S"
     and "\<And>k. k \<in> \<D> \<Longrightarrow> (f has_integral (i k)) k"
   shows "(f has_integral (sum i \<D>)) S"
 proof -
   note \<D> = division_ofD[OF assms(1)]
   have neg: "negligible (S \<inter> s')" if "S \<in> \<D>" "s' \<in> \<D>" "S \<noteq> s'" for S s'
   proof -
     obtain a c b \<D> where obt: "S = cbox a b" "s' = cbox c \<D>"
       by (meson \<open>S \<in> \<D>\<close> \<open>s' \<in> \<D>\<close> \<D>(4))
     from \<D>(5)[OF that] show ?thesis
       unfolding obt interior_cbox
       by (metis (no_types, lifting) Diff_empty Int_interval box_Int_box negligible_frontier_interval)
   qed
   show ?thesis
     unfolding \<D>(6)[symmetric]
     by (auto intro: \<D> neg assms has_integral_Union pairwiseI)
 qed
 
 lemma integral_combine_division_bottomup:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "\<D> division_of S" "\<And>k. k \<in> \<D> \<Longrightarrow> f integrable_on k"
   shows "integral S f = sum (\<lambda>i. integral i f) \<D>"
   apply (rule integral_unique)
   by (meson assms has_integral_combine_division has_integral_integrable_integral)
 
 lemma has_integral_combine_division_topdown:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on S"
     and \<D>: "\<D> division_of K"
     and "K \<subseteq> S"
   shows "(f has_integral (sum (\<lambda>i. integral i f) \<D>)) K"
 proof -
   have "f integrable_on L" if "L \<in> \<D>" for L
   proof -
     have "L \<subseteq> S"
       using \<open>K \<subseteq> S\<close> \<D> that by blast
     then show "f integrable_on L"
       using that by (metis (no_types) f \<D> division_ofD(4) integrable_on_subcbox)
   qed
   then show ?thesis
     by (meson \<D> has_integral_combine_division has_integral_integrable_integral)
 qed
 
 lemma integral_combine_division_topdown:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on S"
     and "\<D> division_of S"
   shows "integral S f = sum (\<lambda>i. integral i f) \<D>"
   apply (rule integral_unique)
   apply (rule has_integral_combine_division_topdown)
   using assms
   apply auto
   done
 
 lemma integrable_combine_division:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes \<D>: "\<D> division_of S"
     and f: "\<And>i. i \<in> \<D> \<Longrightarrow> f integrable_on i"
   shows "f integrable_on S"
   using f unfolding integrable_on_def by (metis has_integral_combine_division[OF \<D>])
 
 lemma integrable_on_subdivision:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes \<D>: "\<D> division_of i"
     and f: "f integrable_on S"
     and "i \<subseteq> S"
   shows "f integrable_on i"
 proof -
   have "f integrable_on i" if "i \<in> \<D>" for i
 proof -
   have "i \<subseteq> S"
     using assms that by auto
   then show "f integrable_on i"
     using that by (metis (no_types) \<D> f division_ofD(4) integrable_on_subcbox)
 qed
   then show ?thesis
     using \<D> integrable_combine_division by blast
 qed
 
 
 subsection \<open>Also tagged divisions\<close>
 
 lemma has_integral_combine_tagged_division:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "p tagged_division_of S"
     and "\<forall>(x,k) \<in> p. (f has_integral (i k)) k"
   shows "(f has_integral (\<Sum>(x,k)\<in>p. i k)) S"
 proof -
   have *: "(f has_integral (\<Sum>k\<in>snd`p. integral k f)) S"
     using assms(2)
     apply (intro has_integral_combine_division)
     apply (auto simp: has_integral_integral[symmetric] intro: division_of_tagged_division[OF assms(1)])
     apply auto
     done
   also have "(\<Sum>k\<in>snd`p. integral k f) = (\<Sum>(x, k)\<in>p. integral k f)"
     by (intro sum.over_tagged_division_lemma[OF assms(1), symmetric] integral_null)
        (simp add: content_eq_0_interior)
   finally show ?thesis
     using assms by (auto simp add: has_integral_iff intro!: sum.cong)
 qed
 
 lemma integral_combine_tagged_division_bottomup:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "p tagged_division_of (cbox a b)"
     and "\<forall>(x,k)\<in>p. f integrable_on k"
   shows "integral (cbox a b) f = sum (\<lambda>(x,k). integral k f) p"
   apply (rule integral_unique)
   apply (rule has_integral_combine_tagged_division[OF assms(1)])
   using assms(2)
   apply auto
   done
 
 lemma has_integral_combine_tagged_division_topdown:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes f: "f integrable_on cbox a b"
     and p: "p tagged_division_of (cbox a b)"
   shows "(f has_integral (sum (\<lambda>(x,K). integral K f) p)) (cbox a b)"
 proof -
   have "(f has_integral integral K f) K" if "(x,K) \<in> p" for x K
     by (metis assms integrable_integral integrable_on_subcbox tagged_division_ofD(3,4) that)
   then show ?thesis
     by (metis assms case_prodI2 has_integral_integrable_integral integral_combine_tagged_division_bottomup)
 qed
 
 lemma integral_combine_tagged_division_topdown:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on cbox a b"
     and "p tagged_division_of (cbox a b)"
   shows "integral (cbox a b) f = sum (\<lambda>(x,k). integral k f) p"
   apply (rule integral_unique [OF has_integral_combine_tagged_division_topdown])
   using assms apply auto
   done
 
 
 subsection \<open>Henstock's lemma\<close>
 
 lemma Henstock_lemma_part1:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes intf: "f integrable_on cbox a b"
     and "e > 0"
     and "gauge d"
     and less_e: "\<And>p. \<lbrakk>p tagged_division_of (cbox a b); d fine p\<rbrakk> \<Longrightarrow>
                      norm (sum (\<lambda>(x,K). content K *\<^sub>R f x) p - integral(cbox a b) f) < e"
     and p: "p tagged_partial_division_of (cbox a b)" "d fine p"
   shows "norm (sum (\<lambda>(x,K). content K *\<^sub>R f x - integral K f) p) \<le> e" (is "?lhs \<le> e")
 proof (rule field_le_epsilon)
   fix k :: real
   assume "k > 0"
   let ?SUM = "\<lambda>p. (\<Sum>(x,K) \<in> p. content K *\<^sub>R f x)"
   note p' = tagged_partial_division_ofD[OF p(1)]
   have "\<Union>(snd ` p) \<subseteq> cbox a b"
     using p'(3) by fastforce
   then obtain q where q: "snd ` p \<subseteq> q" and qdiv: "q division_of cbox a b"
     by (meson p(1) partial_division_extend_interval partial_division_of_tagged_division)
   note q' = division_ofD[OF qdiv]
   define r where "r = q - snd ` p"
   have "snd ` p \<inter> r = {}"
     unfolding r_def by auto
   have "finite r"
     using q' unfolding r_def by auto
   have "\<exists>p. p tagged_division_of i \<and> d fine p \<and>
         norm (?SUM p - integral i f) < k / (real (card r) + 1)"
     if "i\<in>r" for i
   proof -
     have gt0: "k / (real (card r) + 1) > 0" using \<open>k > 0\<close> by simp
     have i: "i \<in> q"
       using that unfolding r_def by auto
     then obtain u v where uv: "i = cbox u v"
       using q'(4) by blast
     then have "cbox u v \<subseteq> cbox a b"
       using i q'(2) by auto  
     then have "f integrable_on cbox u v"
       by (rule integrable_subinterval[OF intf])
     with integrable_integral[OF this, unfolded has_integral[of f]]
     obtain dd where "gauge dd" and dd:
       "\<And>\<D>. \<lbrakk>\<D> tagged_division_of cbox u v; dd fine \<D>\<rbrakk> \<Longrightarrow>
     norm (?SUM \<D> - integral (cbox u v) f) < k / (real (card r) + 1)"
       using gt0 by auto
     with gauge_Int[OF \<open>gauge d\<close> \<open>gauge dd\<close>]
     obtain qq where qq: "qq tagged_division_of cbox u v" "(\<lambda>x. d x \<inter> dd x) fine qq"
       using fine_division_exists by blast
     with dd[of qq]  show ?thesis
       by (auto simp: fine_Int uv)
   qed
   then obtain qq where qq: "\<And>i. i \<in> r \<Longrightarrow> qq i tagged_division_of i \<and>
       d fine qq i \<and> norm (?SUM (qq i) - integral i f) < k / (real (card r) + 1)"
     by metis
 
   let ?p = "p \<union> \<Union>(qq ` r)"
   have "norm (?SUM ?p - integral (cbox a b) f) < e"
   proof (rule less_e)
     show "d fine ?p"
       by (metis (mono_tags, hide_lams) qq fine_Un fine_Union imageE p(2))
     note ptag = tagged_partial_division_of_Union_self[OF p(1)]
     have "p \<union> \<Union>(qq ` r) tagged_division_of \<Union>(snd ` p) \<union> \<Union>r"
     proof (rule tagged_division_Un[OF ptag tagged_division_Union [OF \<open>finite r\<close>]])
       show "\<And>i. i \<in> r \<Longrightarrow> qq i tagged_division_of i"
         using qq by auto
       show "\<And>i1 i2. \<lbrakk>i1 \<in> r; i2 \<in> r; i1 \<noteq> i2\<rbrakk> \<Longrightarrow> interior i1 \<inter> interior i2 = {}"
         by (simp add: q'(5) r_def)
       show "interior (\<Union>(snd ` p)) \<inter> interior (\<Union>r) = {}"
       proof (rule Int_interior_Union_intervals [OF \<open>finite r\<close>])
         show "open (interior (\<Union>(snd ` p)))"
           by blast
         show "\<And>T. T \<in> r \<Longrightarrow> \<exists>a b. T = cbox a b"
           by (simp add: q'(4) r_def)
         have "finite (snd ` p)"
           by (simp add: p'(1))
         then show "\<And>T. T \<in> r \<Longrightarrow> interior (\<Union>(snd ` p)) \<inter> interior T = {}"
           apply (subst Int_commute)
           apply (rule Int_interior_Union_intervals)
           using r_def q'(5) q(1) apply auto
           by (simp add: p'(4))
       qed
     qed
     moreover have "\<Union>(snd ` p) \<union> \<Union>r = cbox a b" and "{qq i |i. i \<in> r} = qq ` r"
       using qdiv q unfolding Union_Un_distrib[symmetric] r_def by auto
     ultimately show "?p tagged_division_of (cbox a b)"
       by fastforce
   qed
   then have "norm (?SUM p + (?SUM (\<Union>(qq ` r))) - integral (cbox a b) f) < e"
   proof (subst sum.union_inter_neutral[symmetric, OF \<open>finite p\<close>], safe)
     show "content L *\<^sub>R f x = 0" if "(x, L) \<in> p" "(x, L) \<in> qq K" "K \<in> r" for x K L 
     proof -
       obtain u v where uv: "L = cbox u v"
         using \<open>(x,L) \<in> p\<close> p'(4) by blast
       have "L \<subseteq> K"
         using  qq[OF that(3)] tagged_division_ofD(3) \<open>(x,L) \<in> qq K\<close> by metis
       have "L \<in> snd ` p" 
         using \<open>(x,L) \<in> p\<close> image_iff by fastforce 
       then have "L \<in> q" "K \<in> q" "L \<noteq> K"
         using that(1,3) q(1) unfolding r_def by auto
       with q'(5) have "interior L = {}"
         using interior_mono[OF \<open>L \<subseteq> K\<close>] by blast
       then show "content L *\<^sub>R f x = 0"
         unfolding uv content_eq_0_interior[symmetric] by auto
     qed
     show "finite (\<Union>(qq ` r))"
       by (meson finite_UN qq \<open>finite r\<close> tagged_division_of_finite)
   qed
   moreover have "content M *\<^sub>R f x = 0" 
       if x: "(x,M) \<in> qq K" "(x,M) \<in> qq L" and KL: "qq K \<noteq> qq L" and r: "K \<in> r" "L \<in> r"
     for x M K L
   proof -
     note kl = tagged_division_ofD(3,4)[OF qq[THEN conjunct1]]
     obtain u v where uv: "M = cbox u v"
       using \<open>(x, M) \<in> qq L\<close> \<open>L \<in> r\<close> kl(2) by blast
     have empty: "interior (K \<inter> L) = {}"
       by (metis DiffD1 interior_Int q'(5) r_def KL r)
     have "interior M = {}"
       by (metis (no_types, lifting) Int_assoc empty inf.absorb_iff2 interior_Int kl(1) subset_empty x r)
     then show "content M *\<^sub>R f x = 0"
       unfolding uv content_eq_0_interior[symmetric]
       by auto
   qed 
   ultimately have "norm (?SUM p + sum ?SUM (qq ` r) - integral (cbox a b) f) < e"
     apply (subst (asm) sum.Union_comp)
     using qq by (force simp: split_paired_all)+
   moreover have "content M *\<^sub>R f x = 0" 
        if "K \<in> r" "L \<in> r" "K \<noteq> L" "qq K = qq L" "(x, M) \<in> qq K" for K L x M
     using tagged_division_ofD(6) qq that by (metis (no_types, lifting)) 
   ultimately have less_e: "norm (?SUM p + sum (?SUM \<circ> qq) r - integral (cbox a b) f) < e"
     apply (subst (asm) sum.reindex_nontrivial [OF \<open>finite r\<close>])
      apply (auto simp: split_paired_all sum.neutral)
     done
   have norm_le: "norm (cp - ip) \<le> e + k"
                   if "norm ((cp + cr) - i) < e" "norm (cr - ir) < k" "ip + ir = i"
                   for ir ip i cr cp::'a
   proof -
     from that show ?thesis
       using norm_triangle_le[of "cp + cr - i" "- (cr - ir)"]
       unfolding that(3)[symmetric] norm_minus_cancel
       by (auto simp add: algebra_simps)
   qed
 
   have "?lhs =  norm (?SUM p - (\<Sum>(x, k)\<in>p. integral k f))"
     unfolding split_def sum_subtractf ..
   also have "\<dots> \<le> e + k"
   proof (rule norm_le[OF less_e])
     have lessk: "k * real (card r) / (1 + real (card r)) < k"
       using \<open>k>0\<close> by (auto simp add: field_simps)
     have "norm (sum (?SUM \<circ> qq) r - (\<Sum>k\<in>r. integral k f)) \<le> (\<Sum>x\<in>r. k / (real (card r) + 1))"
       unfolding sum_subtractf[symmetric] by (force dest: qq intro!: sum_norm_le)
     also have "... < k"
       by (simp add: lessk add.commute mult.commute)
     finally show "norm (sum (?SUM \<circ> qq) r - (\<Sum>k\<in>r. integral k f)) < k" .
   next
     from q(1) have [simp]: "snd ` p \<union> q = q" by auto
     have "integral l f = 0"
       if inp: "(x, l) \<in> p" "(y, m) \<in> p" and ne: "(x, l) \<noteq> (y, m)" and "l = m" for x l y m
     proof -
       obtain u v where uv: "l = cbox u v"
         using inp p'(4) by blast
       have "content (cbox u v) = 0"
         unfolding content_eq_0_interior using that p(1) uv by auto
       then show ?thesis
         using uv by blast
     qed
     then have "(\<Sum>(x, k)\<in>p. integral k f) = (\<Sum>k\<in>snd ` p. integral k f)"
       apply (subst sum.reindex_nontrivial [OF \<open>finite p\<close>])
       unfolding split_paired_all split_def by auto
     then show "(\<Sum>(x, k)\<in>p. integral k f) + (\<Sum>k\<in>r. integral k f) = integral (cbox a b) f"
       unfolding integral_combine_division_topdown[OF intf qdiv] r_def
       using q'(1) p'(1) sum.union_disjoint [of "snd ` p" "q - snd ` p", symmetric]
         by simp
   qed
   finally show "?lhs \<le> e + k" .
 qed
 
 lemma Henstock_lemma_part2:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
   assumes fed: "f integrable_on cbox a b" "e > 0" "gauge d"
     and less_e: "\<And>\<D>. \<lbrakk>\<D> tagged_division_of (cbox a b); d fine \<D>\<rbrakk> \<Longrightarrow>
                      norm (sum (\<lambda>(x,k). content k *\<^sub>R f x) \<D> - integral (cbox a b) f) < e"
     and tag: "p tagged_partial_division_of (cbox a b)"
     and "d fine p"
   shows "sum (\<lambda>(x,k). norm (content k *\<^sub>R f x - integral k f)) p \<le> 2 * real (DIM('n)) * e"
 proof -
   have "finite p"
     using tag by blast
   then show ?thesis
     unfolding split_def
   proof (rule sum_norm_allsubsets_bound)
     fix Q
     assume Q: "Q \<subseteq> p"
     then have fine: "d fine Q"
       by (simp add: \<open>d fine p\<close> fine_subset)
     show "norm (\<Sum>x\<in>Q. content (snd x) *\<^sub>R f (fst x) - integral (snd x) f) \<le> e"
       apply (rule Henstock_lemma_part1[OF fed less_e, unfolded split_def])
       using Q tag tagged_partial_division_subset apply (force simp add: fine)+
       done
   qed
 qed
 
 lemma Henstock_lemma:
   fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
   assumes intf: "f integrable_on cbox a b"
     and "e > 0"
   obtains \<gamma> where "gauge \<gamma>"
     and "\<And>p. \<lbrakk>p tagged_partial_division_of (cbox a b); \<gamma> fine p\<rbrakk> \<Longrightarrow>
              sum (\<lambda>(x,k). norm(content k *\<^sub>R f x - integral k f)) p < e"
 proof -
   have *: "e/(2 * (real DIM('n) + 1)) > 0" using \<open>e > 0\<close> by simp
   with integrable_integral[OF intf, unfolded has_integral]
   obtain \<gamma> where "gauge \<gamma>"
     and \<gamma>: "\<And>\<D>. \<lbrakk>\<D> tagged_division_of cbox a b; \<gamma> fine \<D>\<rbrakk> \<Longrightarrow>
          norm ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f x) - integral (cbox a b) f)
          < e/(2 * (real DIM('n) + 1))"
     by metis
   show thesis
   proof (rule that [OF \<open>gauge \<gamma>\<close>])
     fix p
     assume p: "p tagged_partial_division_of cbox a b" "\<gamma> fine p"
     have "(\<Sum>(x,K)\<in>p. norm (content K *\<^sub>R f x - integral K f)) 
           \<le> 2 * real DIM('n) * (e/(2 * (real DIM('n) + 1)))"
       using Henstock_lemma_part2[OF intf * \<open>gauge \<gamma>\<close> \<gamma> p] by metis
     also have "... < e"
       using \<open>e > 0\<close> by (auto simp add: field_simps)
     finally
     show "(\<Sum>(x,K)\<in>p. norm (content K *\<^sub>R f x - integral K f)) < e" .
   qed
 qed
 
 
 subsection \<open>Monotone convergence (bounded interval first)\<close>
 
 lemma bounded_increasing_convergent:
   fixes f :: "nat \<Rightarrow> real"
   shows "\<lbrakk>bounded (range f); \<And>n. f n \<le> f (Suc n)\<rbrakk> \<Longrightarrow> \<exists>l. f \<longlonglongrightarrow> l"
   using Bseq_mono_convergent[of f] incseq_Suc_iff[of f]
   by (auto simp: image_def Bseq_eq_bounded convergent_def incseq_def)
 
 lemma monotone_convergence_interval:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real"
   assumes intf: "\<And>k. (f k) integrable_on cbox a b"
     and le: "\<And>k x. x \<in> cbox a b \<Longrightarrow> (f k x) \<le> f (Suc k) x"
     and fg: "\<And>x. x \<in> cbox a b \<Longrightarrow> ((\<lambda>k. f k x) \<longlongrightarrow> g x) sequentially"
     and bou: "bounded (range (\<lambda>k. integral (cbox a b) (f k)))"
   shows "g integrable_on cbox a b \<and> ((\<lambda>k. integral (cbox a b) (f k)) \<longlongrightarrow> integral (cbox a b) g) sequentially"
 proof (cases "content (cbox a b) = 0")
   case True then show ?thesis
     by auto
 next
   case False
   have fg1: "(f k x) \<le> (g x)" if x: "x \<in> cbox a b" for x k
   proof -
     have "\<forall>\<^sub>F j in sequentially. f k x \<le> f j x"
       apply (rule eventually_sequentiallyI [of k])
       using le x apply (force intro: transitive_stepwise_le)
       done
     then show "f k x \<le> g x"
       using tendsto_lowerbound [OF fg] x trivial_limit_sequentially by blast
   qed
   have int_inc: "\<And>n. integral (cbox a b) (f n) \<le> integral (cbox a b) (f (Suc n))"
     by (metis integral_le intf le)
   then obtain i where i: "(\<lambda>k. integral (cbox a b) (f k)) \<longlonglongrightarrow> i"
     using bounded_increasing_convergent bou by blast
   have "\<And>k. \<forall>\<^sub>F x in sequentially. integral (cbox a b) (f k) \<le> integral (cbox a b) (f x)"
     unfolding eventually_sequentially
     by (force intro: transitive_stepwise_le int_inc)
   then have i': "\<And>k. (integral(cbox a b) (f k)) \<le> i"
     using tendsto_le [OF trivial_limit_sequentially i] by blast
   have "(g has_integral i) (cbox a b)"
     unfolding has_integral real_norm_def
   proof clarify
     fix e::real
     assume e: "e > 0"
     have "\<And>k. (\<exists>\<gamma>. gauge \<gamma> \<and> (\<forall>\<D>. \<D> tagged_division_of (cbox a b) \<and> \<gamma> fine \<D> \<longrightarrow>
       abs ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f k x) - integral (cbox a b) (f k)) < e/2 ^ (k + 2)))"
       using intf e by (auto simp: has_integral_integral has_integral)
     then obtain c where c: "\<And>x. gauge (c x)"
           "\<And>x \<D>. \<lbrakk>\<D> tagged_division_of cbox a b; c x fine \<D>\<rbrakk> \<Longrightarrow>
               abs ((\<Sum>(u,K)\<in>\<D>. content K *\<^sub>R f x u) - integral (cbox a b) (f x))
               < e/2 ^ (x + 2)"
       by metis
 
     have "\<exists>r. \<forall>k\<ge>r. 0 \<le> i - (integral (cbox a b) (f k)) \<and> i - (integral (cbox a b) (f k)) < e/4"
     proof -
       have "e/4 > 0"
         using e by auto
       show ?thesis
         using LIMSEQ_D [OF i \<open>e/4 > 0\<close>] i' by auto
     qed
     then obtain r where r: "\<And>k. r \<le> k \<Longrightarrow> 0 \<le> i - integral (cbox a b) (f k)"
                        "\<And>k. r \<le> k \<Longrightarrow> i - integral (cbox a b) (f k) < e/4" 
       by metis
     have "\<exists>n\<ge>r. \<forall>k\<ge>n. 0 \<le> (g x) - (f k x) \<and> (g x) - (f k x) < e/(4 * content(cbox a b))"
       if "x \<in> cbox a b" for x
     proof -
       have "e/(4 * content (cbox a b)) > 0"
         by (simp add: False content_lt_nz e)
       with fg that LIMSEQ_D
       obtain N where "\<forall>n\<ge>N. norm (f n x - g x) < e/(4 * content (cbox a b))"
         by metis
       then show "\<exists>n\<ge>r.
             \<forall>k\<ge>n.
                0 \<le> g x - f k x \<and>
                g x - f k x
                < e/(4 * content (cbox a b))"
         apply (rule_tac x="N + r" in exI)
         using fg1[OF that] apply (auto simp add: field_simps)
         done
     qed
     then obtain m where r_le_m: "\<And>x. x \<in> cbox a b \<Longrightarrow> r \<le> m x"
        and m: "\<And>x k. \<lbrakk>x \<in> cbox a b; m x \<le> k\<rbrakk>
                      \<Longrightarrow> 0 \<le> g x - f k x \<and> g x - f k x < e/(4 * content (cbox a b))"
       by metis
     define d where "d x = c (m x) x" for x
     show "\<exists>\<gamma>. gauge \<gamma> \<and>
              (\<forall>\<D>. \<D> tagged_division_of cbox a b \<and>
                   \<gamma> fine \<D> \<longrightarrow> abs ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R g x) - i) < e)"
     proof (rule exI, safe)
       show "gauge d"
         using c(1) unfolding gauge_def d_def by auto
     next
       fix \<D>
       assume ptag: "\<D> tagged_division_of (cbox a b)" and "d fine \<D>"
       note p'=tagged_division_ofD[OF ptag]
       obtain s where s: "\<And>x. x \<in> \<D> \<Longrightarrow> m (fst x) \<le> s"
         by (metis finite_imageI finite_nat_set_iff_bounded_le p'(1) rev_image_eqI)
       have *: "\<bar>a - d\<bar> < e" if "\<bar>a - b\<bar> \<le> e/4" "\<bar>b - c\<bar> < e/2" "\<bar>c - d\<bar> < e/4" for a b c d
         using that norm_triangle_lt[of "a - b" "b - c" "3* e/4"]
           norm_triangle_lt[of "a - b + (b - c)" "c - d" e]
         by (auto simp add: algebra_simps)
       show "\<bar>(\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R g x) - i\<bar> < e"
       proof (rule *)
         have "\<bar>(\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R g x) - (\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f (m x) x)\<bar> 
               \<le> (\<Sum>i\<in>\<D>. \<bar>(case i of (x, K) \<Rightarrow> content K *\<^sub>R g x) - (case i of (x, K) \<Rightarrow> content K *\<^sub>R f (m x) x)\<bar>)"
           by (metis (mono_tags) sum_subtractf sum_abs) 
         also have "... \<le> (\<Sum>(x, k)\<in>\<D>. content k * (e/(4 * content (cbox a b))))"
         proof (rule sum_mono, simp add: split_paired_all)
           fix x K
           assume xk: "(x,K) \<in> \<D>"
           with ptag have x: "x \<in> cbox a b"
             by blast
           then have "abs (content K * (g x - f (m x) x)) \<le> content K * (e/(4 * content (cbox a b)))"
             by (metis m[OF x] mult_nonneg_nonneg abs_of_nonneg less_eq_real_def measure_nonneg mult_left_mono order_refl)
           then show "\<bar>content K * g x - content K * f (m x) x\<bar> \<le> content K * e/(4 * content (cbox a b))"
             by (simp add: algebra_simps)
         qed
         also have "... = (e/(4 * content (cbox a b))) * (\<Sum>(x, k)\<in>\<D>. content k)"
           by (simp add: sum_distrib_left sum_divide_distrib split_def mult.commute)
         also have "... \<le> e/4"
           by (metis False additive_content_tagged_division [OF ptag] nonzero_mult_divide_mult_cancel_right order_refl times_divide_eq_left)
         finally show "\<bar>(\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R g x) - (\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f (m x) x)\<bar> \<le> e/4" .
 
       next
         have "norm ((\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f (m x) x) - (\<Sum>(x,K)\<in>\<D>. integral K (f (m x))))
               \<le> norm (\<Sum>j = 0..s. \<Sum>(x,K)\<in>{xk \<in> \<D>. m (fst xk) = j}. content K *\<^sub>R f (m x) x - integral K (f (m x)))"
           apply (subst sum.group)
           using s by (auto simp: sum_subtractf split_def p'(1))
         also have "\<dots> < e/2"
         proof -
           have "norm (\<Sum>j = 0..s. \<Sum>(x, k)\<in>{xk \<in> \<D>. m (fst xk) = j}. content k *\<^sub>R f (m x) x - integral k (f (m x)))
                 \<le> (\<Sum>i = 0..s. e/2 ^ (i + 2))"
           proof (rule sum_norm_le)
             fix t
             assume "t \<in> {0..s}"
             have "norm (\<Sum>(x,k)\<in>{xk \<in> \<D>. m (fst xk) = t}. content k *\<^sub>R f (m x) x - integral k (f (m x))) =
                   norm (\<Sum>(x,k)\<in>{xk \<in> \<D>. m (fst xk) = t}. content k *\<^sub>R f t x - integral k (f t))"
               by (force intro!: sum.cong arg_cong[where f=norm])
             also have "... \<le> e/2 ^ (t + 2)"
             proof (rule Henstock_lemma_part1 [OF intf])
               show "{xk \<in> \<D>. m (fst xk) = t} tagged_partial_division_of cbox a b"
                 apply (rule tagged_partial_division_subset[of \<D>])
                 using ptag by (auto simp: tagged_division_of_def)
               show "c t fine {xk \<in> \<D>. m (fst xk) = t}"
                 using \<open>d fine \<D>\<close> by (auto simp: fine_def d_def)
             qed (use c e in auto)
             finally show "norm (\<Sum>(x,K)\<in>{xk \<in> \<D>. m (fst xk) = t}. content K *\<^sub>R f (m x) x -
                                 integral K (f (m x))) \<le> e/2 ^ (t + 2)" .
           qed
           also have "... = (e/2/2) * (\<Sum>i = 0..s. (1/2) ^ i)"
             by (simp add: sum_distrib_left field_simps)
           also have "\<dots> < e/2"
             by (simp add: sum_gp mult_strict_left_mono[OF _ e])
           finally show "norm (\<Sum>j = 0..s. \<Sum>(x, k)\<in>{xk \<in> \<D>.
             m (fst xk) = j}. content k *\<^sub>R f (m x) x - integral k (f (m x))) < e/2" .
         qed 
         finally show "\<bar>(\<Sum>(x,K)\<in>\<D>. content K *\<^sub>R f (m x) x) - (\<Sum>(x,K)\<in>\<D>. integral K (f (m x)))\<bar> < e/2"
           by simp
       next
         have comb: "integral (cbox a b) (f y) = (\<Sum>(x, k)\<in>\<D>. integral k (f y))" for y
           using integral_combine_tagged_division_topdown[OF intf ptag] by metis
         have f_le: "\<And>y m n. \<lbrakk>y \<in> cbox a b; n\<ge>m\<rbrakk> \<Longrightarrow> f m y \<le> f n y"
           using le by (auto intro: transitive_stepwise_le)        
         have "(\<Sum>(x, k)\<in>\<D>. integral k (f r)) \<le> (\<Sum>(x, K)\<in>\<D>. integral K (f (m x)))"
         proof (rule sum_mono, simp add: split_paired_all)
           fix x K
           assume xK: "(x, K) \<in> \<D>"
           show "integral K (f r) \<le> integral K (f (m x))"
           proof (rule integral_le)
             show "f r integrable_on K"
               by (metis integrable_on_subcbox intf p'(3) p'(4) xK)
             show "f (m x) integrable_on K"
               by (metis elementary_interval integrable_on_subdivision intf p'(3) p'(4) xK)
             show "f r y \<le> f (m x) y" if "y \<in> K" for y
               using that r_le_m[of x] p'(2-3)[OF xK] f_le by auto
           qed
         qed
         moreover have "(\<Sum>(x, K)\<in>\<D>. integral K (f (m x))) \<le> (\<Sum>(x, k)\<in>\<D>. integral k (f s))"
         proof (rule sum_mono, simp add: split_paired_all)
           fix x K
           assume xK: "(x, K) \<in> \<D>"
           show "integral K (f (m x)) \<le> integral K (f s)"
           proof (rule integral_le)
             show "f (m x) integrable_on K"
               by (metis elementary_interval integrable_on_subdivision intf p'(3) p'(4) xK)
             show "f s integrable_on K"
               by (metis integrable_on_subcbox intf p'(3) p'(4) xK)
             show "f (m x) y \<le> f s y" if "y \<in> K" for y
               using that s xK f_le p'(3) by fastforce
           qed
         qed
         moreover have "0 \<le> i - integral (cbox a b) (f r)" "i - integral (cbox a b) (f r) < e/4"
           using r by auto
         ultimately show "\<bar>(\<Sum>(x,K)\<in>\<D>. integral K (f (m x))) - i\<bar> < e/4"
           using comb i'[of s] by auto
       qed
     qed
   qed 
   with i integral_unique show ?thesis
     by blast
 qed
 
 lemma monotone_convergence_increasing:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real"
   assumes int_f: "\<And>k. (f k) integrable_on S"
     and "\<And>k x. x \<in> S \<Longrightarrow> (f k x) \<le> (f (Suc k) x)"
     and fg: "\<And>x. x \<in> S \<Longrightarrow> ((\<lambda>k. f k x) \<longlongrightarrow> g x) sequentially"
     and bou: "bounded (range (\<lambda>k. integral S (f k)))"
   shows "g integrable_on S \<and> ((\<lambda>k. integral S (f k)) \<longlongrightarrow> integral S g) sequentially"
 proof -
   have lem: "g integrable_on S \<and> ((\<lambda>k. integral S (f k)) \<longlongrightarrow> integral S g) sequentially"
     if f0: "\<And>k x. x \<in> S \<Longrightarrow> 0 \<le> f k x"
     and int_f: "\<And>k. (f k) integrable_on S"
     and le: "\<And>k x. x \<in> S \<Longrightarrow> f k x \<le> f (Suc k) x"
     and lim: "\<And>x. x \<in> S \<Longrightarrow> ((\<lambda>k. f k x) \<longlongrightarrow> g x) sequentially"
     and bou: "bounded (range(\<lambda>k. integral S (f k)))"
     for f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real" and g S
   proof -
     have fg: "(f k x) \<le> (g x)" if "x \<in> S" for x k
       apply (rule tendsto_lowerbound [OF lim [OF that]])
       apply (rule eventually_sequentiallyI [of k])
       using le  by (force intro: transitive_stepwise_le that)+
     obtain i where i: "(\<lambda>k. integral S (f k)) \<longlonglongrightarrow> i"
       using bounded_increasing_convergent [OF bou] le int_f integral_le by blast
     have i': "(integral S (f k)) \<le> i" for k
     proof -
       have "\<And>k. \<And>x. x \<in> S \<Longrightarrow> \<forall>n\<ge>k. f k x \<le> f n x"
         using le  by (force intro: transitive_stepwise_le)
       then show ?thesis
         using tendsto_lowerbound [OF i eventually_sequentiallyI trivial_limit_sequentially]
         by (meson int_f integral_le)
     qed
 
     let ?f = "(\<lambda>k x. if x \<in> S then f k x else 0)"
     let ?g = "(\<lambda>x. if x \<in> S then g x else 0)"
     have int: "?f k integrable_on cbox a b" for a b k
       by (simp add: int_f integrable_altD(1))
     have int': "\<And>k a b. f k integrable_on cbox a b \<inter> S"
       using int by (simp add: Int_commute integrable_restrict_Int) 
     have g: "?g integrable_on cbox a b \<and>
              (\<lambda>k. integral (cbox a b) (?f k)) \<longlonglongrightarrow> integral (cbox a b) ?g" for a b
     proof (rule monotone_convergence_interval)
       have "norm (integral (cbox a b) (?f k)) \<le> norm (integral S (f k))" for k
       proof -
         have "0 \<le> integral (cbox a b) (?f k)"
           by (metis (no_types) integral_nonneg Int_iff f0 inf_commute integral_restrict_Int int')
         moreover have "0 \<le> integral S (f k)"
           by (simp add: integral_nonneg f0 int_f)
         moreover have "integral (S \<inter> cbox a b) (f k) \<le> integral S (f k)"
           by (metis f0 inf_commute int' int_f integral_subset_le le_inf_iff order_refl)
         ultimately show ?thesis
           by (simp add: integral_restrict_Int)
       qed
       moreover obtain B where "\<And>x. x \<in> range (\<lambda>k. integral S (f k)) \<Longrightarrow> norm x \<le> B"
         using bou unfolding bounded_iff by blast
       ultimately show "bounded (range (\<lambda>k. integral (cbox a b) (?f k)))"
         unfolding bounded_iff by (blast intro: order_trans)
     qed (use int le lim in auto)
     moreover have "\<exists>B>0. \<forall>a b. ball 0 B \<subseteq> cbox a b \<longrightarrow> norm (integral (cbox a b) ?g - i) < e"
       if "0 < e" for e
     proof -
       have "e/4>0"
         using that by auto
       with LIMSEQ_D [OF i] obtain N where N: "\<And>n. n \<ge> N \<Longrightarrow> norm (integral S (f n) - i) < e/4"
         by metis
       with int_f[of N, unfolded has_integral_integral has_integral_alt'[of "f N"]] 
       obtain B where "0 < B" and B: 
         "\<And>a b. ball 0 B \<subseteq> cbox a b \<Longrightarrow> norm (integral (cbox a b) (?f N) - integral S (f N)) < e/4"
         by (meson \<open>0 < e/4\<close>)
       have "norm (integral (cbox a b) ?g - i) < e" if  ab: "ball 0 B \<subseteq> cbox a b" for a b
       proof -
         obtain M where M: "\<And>n. n \<ge> M \<Longrightarrow> abs (integral (cbox a b) (?f n) - integral (cbox a b) ?g) < e/2"
           using \<open>e > 0\<close> g by (fastforce simp add: dest!: LIMSEQ_D [where r = "e/2"])
         have *: "\<And>\<alpha> \<beta> g. \<lbrakk>\<bar>\<alpha> - i\<bar> < e/2; \<bar>\<beta> - g\<bar> < e/2; \<alpha> \<le> \<beta>; \<beta> \<le> i\<rbrakk> \<Longrightarrow> \<bar>g - i\<bar> < e"
           unfolding real_inner_1_right by arith
         show "norm (integral (cbox a b) ?g - i) < e"
           unfolding real_norm_def
         proof (rule *)
           show "\<bar>integral (cbox a b) (?f N) - i\<bar> < e/2"
           proof (rule abs_triangle_half_l)
             show "\<bar>integral (cbox a b) (?f N) - integral S (f N)\<bar> < e/2/2"
               using B[OF ab] by simp
             show "abs (i - integral S (f N)) < e/2/2"
               using N by (simp add: abs_minus_commute)
           qed
           show "\<bar>integral (cbox a b) (?f (M + N)) - integral (cbox a b) ?g\<bar> < e/2"
             by (metis le_add1 M[of "M + N"])
           show "integral (cbox a b) (?f N) \<le> integral (cbox a b) (?f (M + N))"
           proof (intro ballI integral_le[OF int int])
             fix x assume "x \<in> cbox a b"
             have "(f m x) \<le> (f n x)" if "x \<in> S" "n \<ge> m" for m n
               apply (rule transitive_stepwise_le [OF \<open>n \<ge> m\<close> order_refl])
               using dual_order.trans apply blast
               by (simp add: le \<open>x \<in> S\<close>)
             then show "(?f N)x \<le> (?f (M+N))x"
               by auto
           qed
           have "integral (cbox a b \<inter> S) (f (M + N)) \<le> integral S (f (M + N))"
             by (metis Int_lower1 f0 inf_commute int' int_f integral_subset_le)
           then have "integral (cbox a b) (?f (M + N)) \<le> integral S (f (M + N))"
             by (metis (no_types) inf_commute integral_restrict_Int)
           also have "... \<le> i"
             using i'[of "M + N"] by auto
           finally show "integral (cbox a b) (?f (M + N)) \<le> i" .
         qed
       qed
       then show ?thesis
         using \<open>0 < B\<close> by blast
     qed
     ultimately have "(g has_integral i) S"
       unfolding has_integral_alt' by auto
     then show ?thesis
       using has_integral_integrable_integral i integral_unique by metis
   qed
 
   have sub: "\<And>k. integral S (\<lambda>x. f k x - f 0 x) = integral S (f k) - integral S (f 0)"
     by (simp add: integral_diff int_f)
   have *: "\<And>x m n. x \<in> S \<Longrightarrow> n\<ge>m \<Longrightarrow> f m x \<le> f n x"
     using assms(2) by (force intro: transitive_stepwise_le)
   have gf: "(\<lambda>x. g x - f 0 x) integrable_on S \<and> ((\<lambda>k. integral S (\<lambda>x. f (Suc k) x - f 0 x)) \<longlongrightarrow>
     integral S (\<lambda>x. g x - f 0 x)) sequentially"
   proof (rule lem)
     show "\<And>k. (\<lambda>x. f (Suc k) x - f 0 x) integrable_on S"
       by (simp add: integrable_diff int_f)
     show "(\<lambda>k. f (Suc k) x - f 0 x) \<longlonglongrightarrow> g x - f 0 x" if "x \<in> S" for x
     proof -
       have "(\<lambda>n. f (Suc n) x) \<longlonglongrightarrow> g x"
         using LIMSEQ_ignore_initial_segment[OF fg[OF \<open>x \<in> S\<close>], of 1] by simp
       then show ?thesis
         by (simp add: tendsto_diff)
     qed
     show "bounded (range (\<lambda>k. integral S (\<lambda>x. f (Suc k) x - f 0 x)))"
     proof -
       obtain B where B: "\<And>k. norm (integral S (f k)) \<le> B"
         using  bou by (auto simp: bounded_iff)
       then have "norm (integral S (\<lambda>x. f (Suc k) x - f 0 x))
               \<le> B + norm (integral S (f 0))" for k
         unfolding sub by (meson add_le_cancel_right norm_triangle_le_diff)
       then show ?thesis
         unfolding bounded_iff by blast
     qed
   qed (use * in auto)
   then have "(\<lambda>x. integral S (\<lambda>xa. f (Suc x) xa - f 0 xa) + integral S (f 0))
              \<longlonglongrightarrow> integral S (\<lambda>x. g x - f 0 x) + integral S (f 0)"
     by (auto simp add: tendsto_add)
   moreover have "(\<lambda>x. g x - f 0 x + f 0 x) integrable_on S"
     using gf integrable_add int_f [of 0] by metis
   ultimately show ?thesis
     by (simp add: integral_diff int_f LIMSEQ_imp_Suc sub)
 qed
 
 lemma has_integral_monotone_convergence_increasing:
   fixes f :: "nat \<Rightarrow> 'a::euclidean_space \<Rightarrow> real"
   assumes f: "\<And>k. (f k has_integral x k) s"
   assumes "\<And>k x. x \<in> s \<Longrightarrow> f k x \<le> f (Suc k) x"
   assumes "\<And>x. x \<in> s \<Longrightarrow> (\<lambda>k. f k x) \<longlonglongrightarrow> g x"
   assumes "x \<longlonglongrightarrow> x'"
   shows "(g has_integral x') s"
 proof -
   have x_eq: "x = (\<lambda>i. integral s (f i))"
     by (simp add: integral_unique[OF f])
   then have x: "range(\<lambda>k. integral s (f k)) = range x"
     by auto
   have *: "g integrable_on s \<and> (\<lambda>k. integral s (f k)) \<longlonglongrightarrow> integral s g"
   proof (intro monotone_convergence_increasing allI ballI assms)
     show "bounded (range(\<lambda>k. integral s (f k)))"
       using x convergent_imp_bounded assms by metis
   qed (use f in auto)
   then have "integral s g = x'"
     by (intro LIMSEQ_unique[OF _ \<open>x \<longlonglongrightarrow> x'\<close>]) (simp add: x_eq)
   with * show ?thesis
     by (simp add: has_integral_integral)
 qed
 
 lemma monotone_convergence_decreasing:
   fixes f :: "nat \<Rightarrow> 'n::euclidean_space \<Rightarrow> real"
   assumes intf: "\<And>k. (f k) integrable_on S"
     and le: "\<And>k x. x \<in> S \<Longrightarrow> f (Suc k) x \<le> f k x"
     and fg: "\<And>x. x \<in> S \<Longrightarrow> ((\<lambda>k. f k x) \<longlongrightarrow> g x) sequentially"
     and bou: "bounded (range(\<lambda>k. integral S (f k)))"
   shows "g integrable_on S \<and> (\<lambda>k. integral S (f k)) \<longlonglongrightarrow> integral S g"
 proof -
   have *: "range(\<lambda>k. integral S (\<lambda>x. - f k x)) = (*\<^sub>R) (- 1) ` (range(\<lambda>k. integral S (f k)))"
     by force
   have "(\<lambda>x. - g x) integrable_on S \<and> (\<lambda>k. integral S (\<lambda>x. - f k x)) \<longlonglongrightarrow> integral S (\<lambda>x. - g x)"
   proof (rule monotone_convergence_increasing)
     show "\<And>k. (\<lambda>x. - f k x) integrable_on S"
       by (blast intro: integrable_neg intf)
     show "\<And>k x. x \<in> S \<Longrightarrow> - f k x \<le> - f (Suc k) x"
       by (simp add: le)
     show "\<And>x. x \<in> S \<Longrightarrow> (\<lambda>k. - f k x) \<longlonglongrightarrow> - g x"
       by (simp add: fg tendsto_minus)
     show "bounded (range(\<lambda>k. integral S (\<lambda>x. - f k x)))"
       using "*" bou bounded_scaling by auto
   qed
   then show ?thesis
     by (force dest: integrable_neg tendsto_minus)
 qed
 
 lemma integral_norm_bound_integral:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   assumes int_f: "f integrable_on S"
     and int_g: "g integrable_on S"
     and le_g: "\<And>x. x \<in> S \<Longrightarrow> norm (f x) \<le> g x"
   shows "norm (integral S f) \<le> integral S g"
 proof -
   have norm: "norm \<eta> \<le> y + e"
     if "norm \<zeta> \<le> x" and "\<bar>x - y\<bar> < e/2" and "norm (\<zeta> - \<eta>) < e/2"
     for e x y and \<zeta> \<eta> :: 'a
   proof -
     have "norm (\<eta> - \<zeta>) < e/2"
       by (metis norm_minus_commute that(3))
     moreover have "x \<le> y + e/2"
       using that(2) by linarith
     ultimately show ?thesis
       using that(1) le_less_trans[OF norm_triangle_sub[of \<eta> \<zeta>]] by (auto simp: less_imp_le)
   qed
   have lem: "norm (integral(cbox a b) f) \<le> integral (cbox a b) g"
     if f: "f integrable_on cbox a b"
     and g: "g integrable_on cbox a b"
     and nle: "\<And>x. x \<in> cbox a b \<Longrightarrow> norm (f x) \<le> g x"
     for f :: "'n \<Rightarrow> 'a" and g a b
   proof (rule field_le_epsilon)
     fix e :: real
     assume "e > 0"
     then have e: "e/2 > 0"
       by auto
     with integrable_integral[OF f,unfolded has_integral[of f]]
     obtain \<gamma> where \<gamma>: "gauge \<gamma>"
               "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> \<gamma> fine \<D> 
            \<Longrightarrow> norm ((\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R f x) - integral (cbox a b) f) < e/2"
       by meson 
     moreover
     from integrable_integral[OF g,unfolded has_integral[of g]] e
     obtain \<delta> where \<delta>: "gauge \<delta>"
               "\<And>\<D>. \<D> tagged_division_of cbox a b \<and> \<delta> fine \<D> 
            \<Longrightarrow> norm ((\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R g x) - integral (cbox a b) g) < e/2"
       by meson
     ultimately have "gauge (\<lambda>x. \<gamma> x \<inter> \<delta> x)"
       using gauge_Int by blast
     with fine_division_exists obtain \<D> 
       where p: "\<D> tagged_division_of cbox a b" "(\<lambda>x. \<gamma> x \<inter> \<delta> x) fine \<D>" 
       by metis
     have "\<gamma> fine \<D>" "\<delta> fine \<D>"
       using fine_Int p(2) by blast+
     show "norm (integral (cbox a b) f) \<le> integral (cbox a b) g + e"
     proof (rule norm)
       have "norm (content K *\<^sub>R f x) \<le> content K *\<^sub>R g x" if  "(x, K) \<in> \<D>" for x K
       proof-
         have K: "x \<in> K" "K \<subseteq> cbox a b"
           using \<open>(x, K) \<in> \<D>\<close> p(1) by blast+
         obtain u v where  "K = cbox u v"
           using \<open>(x, K) \<in> \<D>\<close> p(1) by blast
         moreover have "content K * norm (f x) \<le> content K * g x"
           by (metis K subsetD dual_order.antisym measure_nonneg mult_zero_left nle not_le real_mult_le_cancel_iff2)
         then show ?thesis
           by simp
       qed
       then show "norm (\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R f x) \<le> (\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R g x)"
         by (simp add: sum_norm_le split_def)
       show "norm ((\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R f x) - integral (cbox a b) f) < e/2"
         using \<open>\<gamma> fine \<D>\<close> \<gamma> p(1) by simp
       show "\<bar>(\<Sum>(x, k)\<in>\<D>. content k *\<^sub>R g x) - integral (cbox a b) g\<bar> < e/2"
         using \<open>\<delta> fine \<D>\<close> \<delta> p(1) by simp
     qed
   qed
   show ?thesis
   proof (rule field_le_epsilon)
     fix e :: real
     assume "e > 0"
     then have e: "e/2 > 0"
       by auto
     let ?f = "(\<lambda>x. if x \<in> S then f x else 0)"
     let ?g = "(\<lambda>x. if x \<in> S then g x else 0)"
     have f: "?f integrable_on cbox a b" and g: "?g integrable_on cbox a b" for a b
       using int_f int_g integrable_altD by auto
     obtain Bf where "0 < Bf"
       and Bf: "\<And>a b. ball 0 Bf \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?f has_integral z) (cbox a b) \<and> norm (z - integral S f) < e/2"
       using integrable_integral [OF int_f,unfolded has_integral'[of f]] e that by blast
     obtain Bg where "0 < Bg"
       and Bg: "\<And>a b. ball 0 Bg \<subseteq> cbox a b \<Longrightarrow>
         \<exists>z. (?g has_integral z) (cbox a b) \<and> norm (z - integral S g) < e/2"
       using integrable_integral [OF int_g,unfolded has_integral'[of g]] e that by blast
     obtain a b::'n where ab: "ball 0 Bf \<union> ball 0 Bg \<subseteq> cbox a b"
       using ball_max_Un  by (metis bounded_ball bounded_subset_cbox_symmetric)
     have "ball 0 Bf \<subseteq> cbox a b"
       using ab by auto
     with Bf obtain z where int_fz: "(?f has_integral z) (cbox a b)" and z: "norm (z - integral S f) < e/2"
       by meson
     have "ball 0 Bg \<subseteq> cbox a b"
       using ab by auto
     with Bg obtain w where int_gw: "(?g has_integral w) (cbox a b)" and w: "norm (w - integral S g) < e/2"
       by meson
     show "norm (integral S f) \<le> integral S g + e"
     proof (rule norm)
       show "norm (integral (cbox a b) ?f) \<le> integral (cbox a b) ?g"
         by (simp add: le_g lem[OF f g, of a b])
       show "\<bar>integral (cbox a b) ?g - integral S g\<bar> < e/2"
         using int_gw integral_unique w by auto
       show "norm (integral (cbox a b) ?f - integral S f) < e/2"
         using int_fz integral_unique z by blast
     qed
   qed
 qed
 
 lemma continuous_on_imp_absolutely_integrable_on:
   fixes f::"real \<Rightarrow> 'a::banach"
   shows "continuous_on {a..b} f \<Longrightarrow>
     norm (integral {a..b} f) \<le> integral {a..b} (\<lambda>x. norm (f x))"
   by (intro integral_norm_bound_integral integrable_continuous_real continuous_on_norm) auto
 
 lemma integral_bound:
   fixes f::"real \<Rightarrow> 'a::banach"
   assumes "a \<le> b"
   assumes "continuous_on {a .. b} f"
   assumes "\<And>t. t \<in> {a .. b} \<Longrightarrow> norm (f t) \<le> B"
   shows "norm (integral {a .. b} f) \<le> B * (b - a)"
 proof -
   note continuous_on_imp_absolutely_integrable_on[OF assms(2)]
   also have "integral {a..b} (\<lambda>x. norm (f x)) \<le> integral {a..b} (\<lambda>_. B)"
     by (rule integral_le)
       (auto intro!: integrable_continuous_real continuous_intros assms)
   also have "\<dots> = B * (b - a)" using assms by simp
   finally show ?thesis .
 qed
 
 lemma integral_norm_bound_integral_component:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   fixes g :: "'n \<Rightarrow> 'b::euclidean_space"
   assumes f: "f integrable_on S" and g: "g integrable_on S"
     and fg: "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> (g x)\<bullet>k"
   shows "norm (integral S f) \<le> (integral S g)\<bullet>k"
 proof -
   have "norm (integral S f) \<le> integral S ((\<lambda>x. x \<bullet> k) \<circ> g)"
     apply (rule integral_norm_bound_integral[OF f integrable_linear[OF g]])
     apply (simp add: bounded_linear_inner_left)
     apply (metis fg o_def)
     done
   then show ?thesis
     unfolding o_def integral_component_eq[OF g] .
 qed
 
 lemma has_integral_norm_bound_integral_component:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
   fixes g :: "'n \<Rightarrow> 'b::euclidean_space"
   assumes f: "(f has_integral i) S"
     and g: "(g has_integral j) S"
     and "\<And>x. x \<in> S \<Longrightarrow> norm (f x) \<le> (g x)\<bullet>k"
   shows "norm i \<le> j\<bullet>k"
   using integral_norm_bound_integral_component[of f S g k] 
   unfolding integral_unique[OF f] integral_unique[OF g]
   using assms
   by auto
 
 
 lemma uniformly_convergent_improper_integral:
   fixes f :: "'b \<Rightarrow> real \<Rightarrow> 'a :: {banach}"
   assumes deriv: "\<And>x. x \<ge> a \<Longrightarrow> (G has_field_derivative g x) (at x within {a..})"
   assumes integrable: "\<And>a' b x. x \<in> A \<Longrightarrow> a' \<ge> a \<Longrightarrow> b \<ge> a' \<Longrightarrow> f x integrable_on {a'..b}"
   assumes G: "convergent G"
   assumes le: "\<And>y x. y \<in> A \<Longrightarrow> x \<ge> a \<Longrightarrow> norm (f y x) \<le> g x"
   shows   "uniformly_convergent_on A (\<lambda>b x. integral {a..b} (f x))"
 proof (intro Cauchy_uniformly_convergent uniformly_Cauchy_onI', goal_cases)
   case (1 \<epsilon>)
   from G have "Cauchy G"
     by (auto intro!: convergent_Cauchy)
   with 1 obtain M where M: "dist (G (real m)) (G (real n)) < \<epsilon>" if "m \<ge> M" "n \<ge> M" for m n
     by (force simp: Cauchy_def)
   define M' where "M' = max (nat \<lceil>a\<rceil>) M"
 
   show ?case
   proof (rule exI[of _ M'], safe, goal_cases)
     case (1 x m n)
     have M': "M' \<ge> a" "M' \<ge> M" unfolding M'_def by linarith+
     have int_g: "(g has_integral (G (real n) - G (real m))) {real m..real n}"
       using 1 M' by (intro fundamental_theorem_of_calculus) 
                     (auto simp: has_field_derivative_iff_has_vector_derivative [symmetric] 
                           intro!: DERIV_subset[OF deriv])
     have int_f: "f x integrable_on {a'..real n}" if "a' \<ge> a" for a'
       using that 1 by (cases "a' \<le> real n") (auto intro: integrable)
 
     have "dist (integral {a..real m} (f x)) (integral {a..real n} (f x)) =
             norm (integral {a..real n} (f x) - integral {a..real m} (f x))"
       by (simp add: dist_norm norm_minus_commute)
     also have "integral {a..real m} (f x) + integral {real m..real n} (f x) = 
                  integral {a..real n} (f x)"
       using M' and 1 by (intro integral_combine int_f) auto
     hence "integral {a..real n} (f x) - integral {a..real m} (f x) = 
              integral {real m..real n} (f x)"
       by (simp add: algebra_simps)
     also have "norm \<dots> \<le> integral {real m..real n} g"
       using le 1 M' int_f int_g by (intro integral_norm_bound_integral) auto 
     also from int_g have "integral {real m..real n} g = G (real n) - G (real m)"
       by (simp add: has_integral_iff)
     also have "\<dots> \<le> dist (G m) (G n)" 
       by (simp add: dist_norm)
     also from 1 and M' have "\<dots> < \<epsilon>"
       by (intro M) auto
     finally show ?case .
   qed
 qed
 
 lemma uniformly_convergent_improper_integral':
   fixes f :: "'b \<Rightarrow> real \<Rightarrow> 'a :: {banach, real_normed_algebra}"
   assumes deriv: "\<And>x. x \<ge> a \<Longrightarrow> (G has_field_derivative g x) (at x within {a..})"
   assumes integrable: "\<And>a' b x. x \<in> A \<Longrightarrow> a' \<ge> a \<Longrightarrow> b \<ge> a' \<Longrightarrow> f x integrable_on {a'..b}"
   assumes G: "convergent G"
   assumes le: "eventually (\<lambda>x. \<forall>y\<in>A. norm (f y x) \<le> g x) at_top"
   shows   "uniformly_convergent_on A (\<lambda>b x. integral {a..b} (f x))"
 proof -
   from le obtain a'' where le: "\<And>y x. y \<in> A \<Longrightarrow> x \<ge> a'' \<Longrightarrow> norm (f y x) \<le> g x"
     by (auto simp: eventually_at_top_linorder)
   define a' where "a' = max a a''"
 
   have "uniformly_convergent_on A (\<lambda>b x. integral {a'..real b} (f x))"
   proof (rule uniformly_convergent_improper_integral)
     fix t assume t: "t \<ge> a'"
     hence "(G has_field_derivative g t) (at t within {a..})"
       by (intro deriv) (auto simp: a'_def)
     moreover have "{a'..} \<subseteq> {a..}" unfolding a'_def by auto
     ultimately show "(G has_field_derivative g t) (at t within {a'..})"
       by (rule DERIV_subset)
   qed (insert le, auto simp: a'_def intro: integrable G)
   hence "uniformly_convergent_on A (\<lambda>b x. integral {a..a'} (f x) + integral {a'..real b} (f x))" 
     (is ?P) by (intro uniformly_convergent_add) auto
   also have "eventually (\<lambda>x. \<forall>y\<in>A. integral {a..a'} (f y) + integral {a'..x} (f y) =
                    integral {a..x} (f y)) sequentially"
     by (intro eventually_mono [OF eventually_ge_at_top[of "nat \<lceil>a'\<rceil>"]] ballI integral_combine)
        (auto simp: a'_def intro: integrable)
   hence "?P \<longleftrightarrow> ?thesis"
     by (intro uniformly_convergent_cong) simp_all
   finally show ?thesis .
 qed
 
 subsection \<open>differentiation under the integral sign\<close>
 
 lemma integral_continuous_on_param:
   fixes f::"'a::topological_space \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::banach"
   assumes cont_fx: "continuous_on (U \<times> cbox a b) (\<lambda>(x, t). f x t)"
   shows "continuous_on U (\<lambda>x. integral (cbox a b) (f x))"
 proof cases
   assume "content (cbox a b) \<noteq> 0"
   then have ne: "cbox a b \<noteq> {}" by auto
 
   note [continuous_intros] =
     continuous_on_compose2[OF cont_fx, where f="\<lambda>y. Pair x y" for x,
       unfolded split_beta fst_conv snd_conv]
 
   show ?thesis
     unfolding continuous_on_def
   proof (safe intro!: tendstoI)
     fix e'::real and x
     assume "e' > 0"
     define e where "e = e' / (content (cbox a b) + 1)"
     have "e > 0" using \<open>e' > 0\<close> by (auto simp: e_def intro!: divide_pos_pos add_nonneg_pos)
     assume "x \<in> U"
     from continuous_on_prod_compactE[OF cont_fx compact_cbox \<open>x \<in> U\<close> \<open>0 < e\<close>]
     obtain X0 where X0: "x \<in> X0" "open X0"
       and fx_bound: "\<And>y t. y \<in> X0 \<inter> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow> norm (f y t - f x t) \<le> e"
       unfolding split_beta fst_conv snd_conv dist_norm
       by metis
     have "\<forall>\<^sub>F y in at x within U. y \<in> X0 \<inter> U"
       using X0(1) X0(2) eventually_at_topological by auto
     then show "\<forall>\<^sub>F y in at x within U. dist (integral (cbox a b) (f y)) (integral (cbox a b) (f x)) < e'"
     proof eventually_elim
       case (elim y)
       have "dist (integral (cbox a b) (f y)) (integral (cbox a b) (f x)) =
         norm (integral (cbox a b) (\<lambda>t. f y t - f x t))"
         using elim \<open>x \<in> U\<close>
         unfolding dist_norm
         by (subst integral_diff)
            (auto intro!: integrable_continuous continuous_intros)
       also have "\<dots> \<le> e * content (cbox a b)"
         using elim \<open>x \<in> U\<close>
         by (intro integrable_bound)
            (auto intro!: fx_bound \<open>x \<in> U \<close> less_imp_le[OF \<open>0 < e\<close>]
               integrable_continuous continuous_intros)
       also have "\<dots> < e'"
         using \<open>0 < e'\<close> \<open>e > 0\<close>
         by (auto simp: e_def field_split_simps)
       finally show "dist (integral (cbox a b) (f y)) (integral (cbox a b) (f x)) < e'" .
     qed
   qed
 qed (auto intro!: continuous_on_const)
 
 lemma leibniz_rule:
   fixes f::"'a::banach \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::banach"
   assumes fx: "\<And>x t. x \<in> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow>
     ((\<lambda>x. f x t) has_derivative blinfun_apply (fx x t)) (at x within U)"
   assumes integrable_f2: "\<And>x. x \<in> U \<Longrightarrow> f x integrable_on cbox a b"
   assumes cont_fx: "continuous_on (U \<times> (cbox a b)) (\<lambda>(x, t). fx x t)"
   assumes [intro]: "x0 \<in> U"
   assumes "convex U"
   shows
     "((\<lambda>x. integral (cbox a b) (f x)) has_derivative integral (cbox a b) (fx x0)) (at x0 within U)"
     (is "(?F has_derivative ?dF) _")
 proof cases
   assume "content (cbox a b) \<noteq> 0"
   then have ne: "cbox a b \<noteq> {}" by auto
   note [continuous_intros] =
     continuous_on_compose2[OF cont_fx, where f="\<lambda>y. Pair x y" for x,
       unfolded split_beta fst_conv snd_conv]
   show ?thesis
   proof (intro has_derivativeI bounded_linear_scaleR_left tendstoI, fold norm_conv_dist)
     have cont_f1: "\<And>t. t \<in> cbox a b \<Longrightarrow> continuous_on U (\<lambda>x. f x t)"
       by (auto simp: continuous_on_eq_continuous_within intro!: has_derivative_continuous fx)
     note [continuous_intros] = continuous_on_compose2[OF cont_f1]
     fix e'::real
     assume "e' > 0"
     define e where "e = e' / (content (cbox a b) + 1)"
     have "e > 0" using \<open>e' > 0\<close> by (auto simp: e_def intro!: divide_pos_pos add_nonneg_pos)
     from continuous_on_prod_compactE[OF cont_fx compact_cbox \<open>x0 \<in> U\<close> \<open>e > 0\<close>]
     obtain X0 where X0: "x0 \<in> X0" "open X0"
       and fx_bound: "\<And>x t. x \<in> X0 \<inter> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow> norm (fx x t - fx x0 t) \<le> e"
       unfolding split_beta fst_conv snd_conv
       by (metis dist_norm)
 
     note eventually_closed_segment[OF \<open>open X0\<close> \<open>x0 \<in> X0\<close>, of U]
     moreover
     have "\<forall>\<^sub>F x in at x0 within U. x \<in> X0"
       using \<open>open X0\<close> \<open>x0 \<in> X0\<close> eventually_at_topological by blast
     moreover have "\<forall>\<^sub>F x in at x0 within U. x \<noteq> x0"
       by (auto simp: eventually_at_filter)
     moreover have "\<forall>\<^sub>F x in at x0 within U. x \<in> U"
       by (auto simp: eventually_at_filter)
     ultimately
     show "\<forall>\<^sub>F x in at x0 within U. norm ((?F x - ?F x0 - ?dF (x - x0)) /\<^sub>R norm (x - x0)) < e'"
     proof eventually_elim
       case (elim x)
       from elim have "0 < norm (x - x0)" by simp
       have "closed_segment x0 x \<subseteq> U"
         by (rule \<open>convex U\<close>[unfolded convex_contains_segment, rule_format, OF \<open>x0 \<in> U\<close> \<open>x \<in> U\<close>])
       from elim have [intro]: "x \<in> U" by auto
       have "?F x - ?F x0 - ?dF (x - x0) =
         integral (cbox a b) (\<lambda>y. f x y - f x0 y - fx x0 y (x - x0))"
         (is "_ = ?id")
         using \<open>x \<noteq> x0\<close>
         by (subst blinfun_apply_integral integral_diff,
             auto intro!: integrable_diff integrable_f2 continuous_intros
               intro: integrable_continuous)+
       also
       {
         fix t assume t: "t \<in> (cbox a b)"
         have seg: "\<And>t. t \<in> {0..1} \<Longrightarrow> x0 + t *\<^sub>R (x - x0) \<in> X0 \<inter> U"
           using \<open>closed_segment x0 x \<subseteq> U\<close>
             \<open>closed_segment x0 x \<subseteq> X0\<close>
           by (force simp: closed_segment_def algebra_simps)
         from t have deriv:
           "((\<lambda>x. f x t) has_derivative (fx y t)) (at y within X0 \<inter> U)"
           if "y \<in> X0 \<inter> U" for y
           unfolding has_vector_derivative_def[symmetric]
           using that \<open>x \<in> X0\<close>
           by (intro has_derivative_within_subset[OF fx]) auto
         have "\<And>x. x \<in> X0 \<inter> U \<Longrightarrow> onorm (blinfun_apply (fx x t) - (fx x0 t)) \<le> e"
           using fx_bound t
           by (auto simp add: norm_blinfun_def fun_diff_def blinfun.bilinear_simps[symmetric])
         from differentiable_bound_linearization[OF seg deriv this] X0
         have "norm (f x t - f x0 t - fx x0 t (x - x0)) \<le> e * norm (x - x0)"
           by (auto simp add: ac_simps)
       }
       then have "norm ?id \<le> integral (cbox a b) (\<lambda>_. e * norm (x - x0))"
         by (intro integral_norm_bound_integral)
           (auto intro!: continuous_intros integrable_diff integrable_f2
             intro: integrable_continuous)
       also have "\<dots> = content (cbox a b) * e * norm (x - x0)"
         by simp
       also have "\<dots> < e' * norm (x - x0)"
         using \<open>e' > 0\<close>
         apply (intro mult_strict_right_mono[OF _ \<open>0 < norm (x - x0)\<close>])
         apply (simp add: divide_simps e_def not_less)
         done
       finally have "norm (?F x - ?F x0 - ?dF (x - x0)) < e' * norm (x - x0)" .
       then show ?case
         by (auto simp: divide_simps)
     qed
   qed (rule blinfun.bounded_linear_right)
 qed (auto intro!: derivative_eq_intros simp: blinfun.bilinear_simps)
 
 lemma has_vector_derivative_eq_has_derivative_blinfun:
   "(f has_vector_derivative f') (at x within U) \<longleftrightarrow>
     (f has_derivative blinfun_scaleR_left f') (at x within U)"
   by (simp add: has_vector_derivative_def)
 
 lemma leibniz_rule_vector_derivative:
   fixes f::"real \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::banach"
   assumes fx: "\<And>x t. x \<in> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow>
       ((\<lambda>x. f x t) has_vector_derivative (fx x t)) (at x within U)"
   assumes integrable_f2: "\<And>x. x \<in> U \<Longrightarrow> (f x) integrable_on cbox a b"
   assumes cont_fx: "continuous_on (U \<times> cbox a b) (\<lambda>(x, t). fx x t)"
   assumes U: "x0 \<in> U" "convex U"
   shows "((\<lambda>x. integral (cbox a b) (f x)) has_vector_derivative integral (cbox a b) (fx x0))
       (at x0 within U)"
 proof -
   note [continuous_intros] =
     continuous_on_compose2[OF cont_fx, where f="\<lambda>y. Pair x y" for x,
       unfolded split_beta fst_conv snd_conv]
   have *: "blinfun_scaleR_left (integral (cbox a b) (fx x0)) =
     integral (cbox a b) (\<lambda>t. blinfun_scaleR_left (fx x0 t))"
     by (subst integral_linear[symmetric])
        (auto simp: has_vector_derivative_def o_def
          intro!: integrable_continuous U continuous_intros bounded_linear_intros)
   show ?thesis
     unfolding has_vector_derivative_eq_has_derivative_blinfun
     apply (rule has_derivative_eq_rhs)
     apply (rule leibniz_rule[OF _ integrable_f2 _ U, where fx="\<lambda>x t. blinfun_scaleR_left (fx x t)"])
     using fx cont_fx
     apply (auto simp: has_vector_derivative_def * split_beta intro!: continuous_intros)
     done
 qed
 
 lemma has_field_derivative_eq_has_derivative_blinfun:
   "(f has_field_derivative f') (at x within U) \<longleftrightarrow> (f has_derivative blinfun_mult_right f') (at x within U)"
   by (simp add: has_field_derivative_def)
 
 lemma leibniz_rule_field_derivative:
   fixes f::"'a::{real_normed_field, banach} \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'a"
   assumes fx: "\<And>x t. x \<in> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow> ((\<lambda>x. f x t) has_field_derivative fx x t) (at x within U)"
   assumes integrable_f2: "\<And>x. x \<in> U \<Longrightarrow> (f x) integrable_on cbox a b"
   assumes cont_fx: "continuous_on (U \<times> (cbox a b)) (\<lambda>(x, t). fx x t)"
   assumes U: "x0 \<in> U" "convex U"
   shows "((\<lambda>x. integral (cbox a b) (f x)) has_field_derivative integral (cbox a b) (fx x0)) (at x0 within U)"
 proof -
   note [continuous_intros] =
     continuous_on_compose2[OF cont_fx, where f="\<lambda>y. Pair x y" for x,
       unfolded split_beta fst_conv snd_conv]
   have *: "blinfun_mult_right (integral (cbox a b) (fx x0)) =
     integral (cbox a b) (\<lambda>t. blinfun_mult_right (fx x0 t))"
     by (subst integral_linear[symmetric])
       (auto simp: has_vector_derivative_def o_def
         intro!: integrable_continuous U continuous_intros bounded_linear_intros)
   show ?thesis
     unfolding has_field_derivative_eq_has_derivative_blinfun
     apply (rule has_derivative_eq_rhs)
     apply (rule leibniz_rule[OF _ integrable_f2 _ U, where fx="\<lambda>x t. blinfun_mult_right (fx x t)"])
     using fx cont_fx
     apply (auto simp: has_field_derivative_def * split_beta intro!: continuous_intros)
     done
 qed
 
 lemma leibniz_rule_field_differentiable:
   fixes f::"'a::{real_normed_field, banach} \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'a"
   assumes "\<And>x t. x \<in> U \<Longrightarrow> t \<in> cbox a b \<Longrightarrow> ((\<lambda>x. f x t) has_field_derivative fx x t) (at x within U)"
   assumes "\<And>x. x \<in> U \<Longrightarrow> (f x) integrable_on cbox a b"
   assumes "continuous_on (U \<times> (cbox a b)) (\<lambda>(x, t). fx x t)"
   assumes "x0 \<in> U" "convex U"
   shows "(\<lambda>x. integral (cbox a b) (f x)) field_differentiable at x0 within U"
   using leibniz_rule_field_derivative[OF assms] by (auto simp: field_differentiable_def)
 
 
 subsection \<open>Exchange uniform limit and integral\<close>
 
 lemma uniform_limit_integral_cbox:
   fixes f::"'a \<Rightarrow> 'b::euclidean_space \<Rightarrow> 'c::banach"
   assumes u: "uniform_limit (cbox a b) f g F"
   assumes c: "\<And>n. continuous_on (cbox a b) (f n)"
   assumes [simp]: "F \<noteq> bot"
   obtains I J where
     "\<And>n. (f n has_integral I n) (cbox a b)"
     "(g has_integral J) (cbox a b)"
     "(I \<longlongrightarrow> J) F"
 proof -
   have fi[simp]: "f n integrable_on (cbox a b)" for n
     by (auto intro!: integrable_continuous assms)
   then obtain I where I: "\<And>n. (f n has_integral I n) (cbox a b)"
     by atomize_elim (auto simp: integrable_on_def intro!: choice)
 
   moreover
   have gi[simp]: "g integrable_on (cbox a b)"
     by (auto intro!: integrable_continuous uniform_limit_theorem[OF _ u] eventuallyI c)
   then obtain J where J: "(g has_integral J) (cbox a b)"
     by blast
 
   moreover
   have "(I \<longlongrightarrow> J) F"
   proof cases
     assume "content (cbox a b) = 0"
     hence "I = (\<lambda>_. 0)" "J = 0"
       by (auto intro!: has_integral_unique I J)
     thus ?thesis by simp
   next
     assume content_nonzero: "content (cbox a b) \<noteq> 0"
     show ?thesis
     proof (rule tendstoI)
       fix e::real
       assume "e > 0"
       define e' where "e' = e/2"
       with \<open>e > 0\<close> have "e' > 0" by simp
       then have "\<forall>\<^sub>F n in F. \<forall>x\<in>cbox a b. norm (f n x - g x) < e' / content (cbox a b)"
         using u content_nonzero by (auto simp: uniform_limit_iff dist_norm zero_less_measure_iff)
       then show "\<forall>\<^sub>F n in F. dist (I n) J < e"
       proof eventually_elim
         case (elim n)
         have "I n = integral (cbox a b) (f n)"
             "J = integral (cbox a b) g"
           using I[of n] J by (simp_all add: integral_unique)
         then have "dist (I n) J = norm (integral (cbox a b) (\<lambda>x. f n x - g x))"
           by (simp add: integral_diff dist_norm)
         also have "\<dots> \<le> integral (cbox a b) (\<lambda>x. (e' / content (cbox a b)))"
           using elim
           by (intro integral_norm_bound_integral) (auto intro!: integrable_diff)
         also have "\<dots> < e"
           using \<open>0 < e\<close>
           by (simp add: e'_def)
         finally show ?case .
       qed
     qed
   qed
   ultimately show ?thesis ..
 qed
 
 lemma uniform_limit_integral:
   fixes f::"'a \<Rightarrow> 'b::ordered_euclidean_space \<Rightarrow> 'c::banach"
   assumes u: "uniform_limit {a..b} f g F"
   assumes c: "\<And>n. continuous_on {a..b} (f n)"
   assumes [simp]: "F \<noteq> bot"
   obtains I J where
     "\<And>n. (f n has_integral I n) {a..b}"
     "(g has_integral J) {a..b}"
     "(I \<longlongrightarrow> J) F"
   by (metis interval_cbox assms uniform_limit_integral_cbox)
 
 
 subsection \<open>Integration by parts\<close>
 
 lemma integration_by_parts_interior_strong:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes bilinear: "bounded_bilinear (prod)"
   assumes s: "finite s" and le: "a \<le> b"
   assumes cont [continuous_intros]: "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes deriv: "\<And>x. x\<in>{a<..<b} - s \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
                  "\<And>x. x\<in>{a<..<b} - s \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes int: "((\<lambda>x. prod (f x) (g' x)) has_integral
                   (prod (f b) (g b) - prod (f a) (g a) - y)) {a..b}"
   shows   "((\<lambda>x. prod (f' x) (g x)) has_integral y) {a..b}"
 proof -
   interpret bounded_bilinear prod by fact
   have "((\<lambda>x. prod (f x) (g' x) + prod (f' x) (g x)) has_integral
           (prod (f b) (g b) - prod (f a) (g a))) {a..b}"
     using deriv by (intro fundamental_theorem_of_calculus_interior_strong[OF s le])
                    (auto intro!: continuous_intros continuous_on has_vector_derivative)
   from has_integral_diff[OF this int] show ?thesis by (simp add: algebra_simps)
 qed
 
 lemma integration_by_parts_interior:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes "bounded_bilinear (prod)" "a \<le> b"
           "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes "\<And>x. x\<in>{a<..<b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
           "\<And>x. x\<in>{a<..<b} \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes "((\<lambda>x. prod (f x) (g' x)) has_integral (prod (f b) (g b) - prod (f a) (g a) - y)) {a..b}"
   shows   "((\<lambda>x. prod (f' x) (g x)) has_integral y) {a..b}"
   by (rule integration_by_parts_interior_strong[of _ "{}" _ _ f g f' g']) (insert assms, simp_all)
 
 lemma integration_by_parts:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes "bounded_bilinear (prod)" "a \<le> b"
           "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes "\<And>x. x\<in>{a..b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
           "\<And>x. x\<in>{a..b} \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes "((\<lambda>x. prod (f x) (g' x)) has_integral (prod (f b) (g b) - prod (f a) (g a) - y)) {a..b}"
   shows   "((\<lambda>x. prod (f' x) (g x)) has_integral y) {a..b}"
   by (rule integration_by_parts_interior[of _ _ _ f g f' g']) (insert assms, simp_all)
 
 lemma integrable_by_parts_interior_strong:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes bilinear: "bounded_bilinear (prod)"
   assumes s: "finite s" and le: "a \<le> b"
   assumes cont [continuous_intros]: "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes deriv: "\<And>x. x\<in>{a<..<b} - s \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
                  "\<And>x. x\<in>{a<..<b} - s \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes int: "(\<lambda>x. prod (f x) (g' x)) integrable_on {a..b}"
   shows   "(\<lambda>x. prod (f' x) (g x)) integrable_on {a..b}"
 proof -
   from int obtain I where "((\<lambda>x. prod (f x) (g' x)) has_integral I) {a..b}"
     unfolding integrable_on_def by blast
   hence "((\<lambda>x. prod (f x) (g' x)) has_integral (prod (f b) (g b) - prod (f a) (g a) -
            (prod (f b) (g b) - prod (f a) (g a) - I))) {a..b}" by simp
   from integration_by_parts_interior_strong[OF assms(1-7) this]
     show ?thesis unfolding integrable_on_def by blast
 qed
 
 lemma integrable_by_parts_interior:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes "bounded_bilinear (prod)" "a \<le> b"
           "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes "\<And>x. x\<in>{a<..<b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
           "\<And>x. x\<in>{a<..<b} \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes "(\<lambda>x. prod (f x) (g' x)) integrable_on {a..b}"
   shows   "(\<lambda>x. prod (f' x) (g x)) integrable_on {a..b}"
   by (rule integrable_by_parts_interior_strong[of _ "{}" _ _ f g f' g']) (insert assms, simp_all)
 
 lemma integrable_by_parts:
   fixes prod :: "_ \<Rightarrow> _ \<Rightarrow> 'b :: banach"
   assumes "bounded_bilinear (prod)" "a \<le> b"
           "continuous_on {a..b} f" "continuous_on {a..b} g"
   assumes "\<And>x. x\<in>{a..b} \<Longrightarrow> (f has_vector_derivative f' x) (at x)"
           "\<And>x. x\<in>{a..b} \<Longrightarrow> (g has_vector_derivative g' x) (at x)"
   assumes "(\<lambda>x. prod (f x) (g' x)) integrable_on {a..b}"
   shows   "(\<lambda>x. prod (f' x) (g x)) integrable_on {a..b}"
   by (rule integrable_by_parts_interior_strong[of _ "{}" _ _ f g f' g']) (insert assms, simp_all)
 
 
 subsection \<open>Integration by substitution\<close>
 
 lemma has_integral_substitution_general:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space" and g :: "real \<Rightarrow> real"
   assumes s: "finite s" and le: "a \<le> b"
       and subset: "g ` {a..b} \<subseteq> {c..d}"
       and f [continuous_intros]: "continuous_on {c..d} f"
       and g [continuous_intros]: "continuous_on {a..b} g"
       and deriv [derivative_intros]:
               "\<And>x. x \<in> {a..b} - s \<Longrightarrow> (g has_field_derivative g' x) (at x within {a..b})"
     shows "((\<lambda>x. g' x *\<^sub>R f (g x)) has_integral (integral {g a..g b} f - integral {g b..g a} f)) {a..b}"
 proof -
   let ?F = "\<lambda>x. integral {c..g x} f"
   have cont_int: "continuous_on {a..b} ?F"
     by (rule continuous_on_compose2[OF _ g subset] indefinite_integral_continuous_1
           f integrable_continuous_real)+
   have deriv: "(((\<lambda>x. integral {c..x} f) \<circ> g) has_vector_derivative g' x *\<^sub>R f (g x))
                  (at x within {a..b})" if "x \<in> {a..b} - s" for x
   proof (rule has_vector_derivative_eq_rhs [OF vector_diff_chain_within refl])
     show "(g has_vector_derivative g' x) (at x within {a..b})"
       using deriv has_field_derivative_iff_has_vector_derivative that by blast
     show "((\<lambda>x. integral {c..x} f) has_vector_derivative f (g x)) 
           (at (g x) within g ` {a..b})"
       using that le subset
       by (blast intro: has_vector_derivative_within_subset integral_has_vector_derivative f)
   qed
   have deriv: "(?F has_vector_derivative g' x *\<^sub>R f (g x))
                   (at x)" if "x \<in> {a..b} - (s \<union> {a,b})" for x
     using deriv[of x] that by (simp add: at_within_Icc_at o_def)
   have "((\<lambda>x. g' x *\<^sub>R f (g x)) has_integral (?F b - ?F a)) {a..b}"
     using le cont_int s deriv cont_int
     by (intro fundamental_theorem_of_calculus_interior_strong[of "s \<union> {a,b}"]) simp_all
   also
   from subset have "g x \<in> {c..d}" if "x \<in> {a..b}" for x using that by blast
   from this[of a] this[of b] le have cd: "c \<le> g a" "g b \<le> d" "c \<le> g b" "g a \<le> d" by auto
   have "integral {c..g b} f - integral {c..g a} f = integral {g a..g b} f - integral {g b..g a} f"
   proof cases
     assume "g a \<le> g b"
     note le = le this
     from cd have "integral {c..g a} f + integral {g a..g b} f = integral {c..g b} f"
       by (intro integral_combine integrable_continuous_real continuous_on_subset[OF f] le) simp_all
     with le show ?thesis
       by (cases "g a = g b") (simp_all add: algebra_simps)
   next
     assume less: "\<not>g a \<le> g b"
     then have "g a \<ge> g b" by simp
     note le = le this
     from cd have "integral {c..g b} f + integral {g b..g a} f = integral {c..g a} f"
       by (intro integral_combine integrable_continuous_real continuous_on_subset[OF f] le) simp_all
     with less show ?thesis
       by (simp_all add: algebra_simps)
   qed
   finally show ?thesis .
 qed
 
 lemma has_integral_substitution_strong:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space" and g :: "real \<Rightarrow> real"
   assumes s: "finite s" and le: "a \<le> b" "g a \<le> g b"
     and subset: "g ` {a..b} \<subseteq> {c..d}"
     and f [continuous_intros]: "continuous_on {c..d} f"
     and g [continuous_intros]: "continuous_on {a..b} g"
     and deriv [derivative_intros]:
     "\<And>x. x \<in> {a..b} - s \<Longrightarrow> (g has_field_derivative g' x) (at x within {a..b})"
   shows "((\<lambda>x. g' x *\<^sub>R f (g x)) has_integral (integral {g a..g b} f)) {a..b}"
   using has_integral_substitution_general[OF s le(1) subset f g deriv] le(2)
   by (cases "g a = g b") auto
 
 lemma has_integral_substitution:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space" and g :: "real \<Rightarrow> real"
   assumes "a \<le> b" "g a \<le> g b" "g ` {a..b} \<subseteq> {c..d}"
       and "continuous_on {c..d} f"
       and "\<And>x. x \<in> {a..b} \<Longrightarrow> (g has_field_derivative g' x) (at x within {a..b})"
     shows "((\<lambda>x. g' x *\<^sub>R f (g x)) has_integral (integral {g a..g b} f)) {a..b}"
   by (intro has_integral_substitution_strong[of "{}" a b g c d] assms)
      (auto intro: DERIV_continuous_on assms)
 
 lemma integral_shift:
   fixes f :: "real \<Rightarrow> 'a::euclidean_space"
   assumes cont: "continuous_on {a + c..b + c} f"
   shows "integral {a..b} (f \<circ> (\<lambda>x. x + c)) = integral {a + c..b + c} f"
 proof (cases "a \<le> b")
   case True
   have "((\<lambda>x. 1 *\<^sub>R f (x + c)) has_integral integral {a+c..b+c} f) {a..b}"
     using True cont
     by (intro has_integral_substitution[where c = "a + c" and d = "b + c"])
        (auto intro!: derivative_eq_intros)
   thus ?thesis by (simp add: has_integral_iff o_def)
 qed auto
 
 
 subsection \<open>Compute a double integral using iterated integrals and switching the order of integration\<close>
 
 lemma continuous_on_imp_integrable_on_Pair1:
   fixes f :: "_ \<Rightarrow> 'b::banach"
   assumes con: "continuous_on (cbox (a,c) (b,d)) f" and x: "x \<in> cbox a b"
   shows "(\<lambda>y. f (x, y)) integrable_on (cbox c d)"
 proof -
   have "f \<circ> (\<lambda>y. (x, y)) integrable_on (cbox c d)"
     apply (rule integrable_continuous)
     apply (rule continuous_on_compose [OF _ continuous_on_subset [OF con]])
     using x
     apply (auto intro: continuous_on_Pair continuous_on_const continuous_on_id continuous_on_subset con)
     done
   then show ?thesis
     by (simp add: o_def)
 qed
 
 lemma integral_integrable_2dim:
   fixes f :: "('a::euclidean_space * 'b::euclidean_space) \<Rightarrow> 'c::banach"
   assumes "continuous_on (cbox (a,c) (b,d)) f"
     shows "(\<lambda>x. integral (cbox c d) (\<lambda>y. f (x,y))) integrable_on cbox a b"
 proof (cases "content(cbox c d) = 0")
 case True
   then show ?thesis
     by (simp add: True integrable_const)
 next
   case False
   have uc: "uniformly_continuous_on (cbox (a,c) (b,d)) f"
     by (simp add: assms compact_cbox compact_uniformly_continuous)
   { fix x::'a and e::real
     assume x: "x \<in> cbox a b" and e: "0 < e"
     then have e2_gt: "0 < e/2 / content (cbox c d)" and e2_less: "e/2 / content (cbox c d) * content (cbox c d) < e"
       by (auto simp: False content_lt_nz e)
     then obtain dd
     where dd: "\<And>x x'. \<lbrakk>x\<in>cbox (a, c) (b, d); x'\<in>cbox (a, c) (b, d); norm (x' - x) < dd\<rbrakk>
                        \<Longrightarrow> norm (f x' - f x) \<le> e/(2 * content (cbox c d))"  "dd>0"
       using uc [unfolded uniformly_continuous_on_def, THEN spec, of "e/(2 * content (cbox c d))"]
       by (auto simp: dist_norm intro: less_imp_le)
     have "\<exists>delta>0. \<forall>x'\<in>cbox a b. norm (x' - x) < delta \<longrightarrow> norm (integral (cbox c d) (\<lambda>u. f (x', u) - f (x, u))) < e"
       apply (rule_tac x=dd in exI)
       using dd e2_gt assms x
       apply clarify
       apply (rule le_less_trans [OF _ e2_less])
       apply (rule integrable_bound)
       apply (auto intro: integrable_diff continuous_on_imp_integrable_on_Pair1)
       done
   } note * = this
   show ?thesis
     apply (rule integrable_continuous)
     apply (simp add: * continuous_on_iff dist_norm integral_diff [symmetric] continuous_on_imp_integrable_on_Pair1 [OF assms])
     done
 qed
 
 lemma integral_split:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::{real_normed_vector,complete_space}"
   assumes f: "f integrable_on (cbox a b)"
       and k: "k \<in> Basis"
   shows "integral (cbox a b) f =
            integral (cbox a b \<inter> {x. x\<bullet>k \<le> c}) f +
            integral (cbox a b \<inter> {x. x\<bullet>k \<ge> c}) f"
   apply (rule integral_unique [OF has_integral_split [where c=c]])
   using k f
   apply (auto simp: has_integral_integral [symmetric])
   done
 
 lemma integral_swap_operativeI:
   fixes f :: "('a::euclidean_space * 'b::euclidean_space) \<Rightarrow> 'c::banach"
   assumes f: "continuous_on s f" and e: "0 < e"
     shows "operative conj True
            (\<lambda>k. \<forall>a b c d.
                 cbox (a,c) (b,d) \<subseteq> k \<and> cbox (a,c) (b,d) \<subseteq> s
                 \<longrightarrow> norm(integral (cbox (a,c) (b,d)) f -
                          integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f((x,y)))))
                     \<le> e * content (cbox (a,c) (b,d)))"
 proof (standard, auto)
   fix a::'a and c::'b and b::'a and d::'b and u::'a and v::'a and w::'b and z::'b
   assume *: "box (a, c) (b, d) = {}"
      and cb1: "cbox (u, w) (v, z) \<subseteq> cbox (a, c) (b, d)"
      and cb2: "cbox (u, w) (v, z) \<subseteq> s"
   then have c0: "content (cbox (a, c) (b, d)) = 0"
     using * unfolding content_eq_0_interior by simp
   have c0': "content (cbox (u, w) (v, z)) = 0"
     by (fact content_0_subset [OF c0 cb1])
   show "norm (integral (cbox (u,w) (v,z)) f - integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))))
           \<le> e * content (cbox (u,w) (v,z))"
     using content_cbox_pair_eq0_D [OF c0']
     by (force simp add: c0')
 next
   fix a::'a and c::'b and b::'a and d::'b
   and M::real and i::'a and j::'b
   and u::'a and v::'a and w::'b and z::'b
   assume ij: "(i,j) \<in> Basis"
      and n1: "\<forall>a' b' c' d'.
                 cbox (a',c') (b',d') \<subseteq> cbox (a,c) (b,d) \<and>
                 cbox (a',c') (b',d') \<subseteq> {x. x \<bullet> (i,j) \<le> M} \<and> cbox (a',c') (b',d') \<subseteq> s \<longrightarrow>
                 norm (integral (cbox (a',c') (b',d')) f - integral (cbox a' b') (\<lambda>x. integral (cbox c' d') (\<lambda>y. f (x,y))))
                 \<le> e * content (cbox (a',c') (b',d'))"
      and n2: "\<forall>a' b' c' d'.
                 cbox (a',c') (b',d') \<subseteq> cbox (a,c) (b,d) \<and>
                 cbox (a',c') (b',d') \<subseteq> {x. M \<le> x \<bullet> (i,j)} \<and> cbox (a',c') (b',d') \<subseteq> s \<longrightarrow>
                 norm (integral (cbox (a',c') (b',d')) f - integral (cbox a' b') (\<lambda>x. integral (cbox c' d') (\<lambda>y. f (x,y))))
                 \<le> e * content (cbox (a',c') (b',d'))"
      and subs: "cbox (u,w) (v,z) \<subseteq> cbox (a,c) (b,d)"  "cbox (u,w) (v,z) \<subseteq> s"
   have fcont: "continuous_on (cbox (u, w) (v, z)) f"
     using assms(1) continuous_on_subset  subs(2) by blast
   then have fint: "f integrable_on cbox (u, w) (v, z)"
     by (metis integrable_continuous)
   consider "i \<in> Basis" "j=0" | "j \<in> Basis" "i=0"  using ij
     by (auto simp: Euclidean_Space.Basis_prod_def)
   then show "norm (integral (cbox (u,w) (v,z)) f - integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x,y))))
              \<le> e * content (cbox (u,w) (v,z))" (is ?normle)
   proof cases
     case 1
     then have e: "e * content (cbox (u, w) (v, z)) =
                   e * (content (cbox u v \<inter> {x. x \<bullet> i \<le> M}) * content (cbox w z)) +
                   e * (content (cbox u v \<inter> {x. M \<le> x \<bullet> i}) * content (cbox w z))"
       by (simp add: content_split [where c=M] content_Pair algebra_simps)
     have *: "integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))) =
                 integral (cbox u v \<inter> {x. x \<bullet> i \<le> M}) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))) +
                 integral (cbox u v \<inter> {x. M \<le> x \<bullet> i}) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y)))"
       using 1 f subs integral_integrable_2dim continuous_on_subset
       by (blast intro: integral_split)
     show ?normle
       apply (rule norm_diff2 [OF integral_split [where c=M, OF fint ij] * e])
       using 1 subs
       apply (simp_all add: cbox_Pair_eq setcomp_dot1 [of "\<lambda>u. M\<le>u"] setcomp_dot1 [of "\<lambda>u. u\<le>M"] Sigma_Int_Paircomp1)
       apply (simp_all add: interval_split ij)
       apply (simp_all add: cbox_Pair_eq [symmetric] content_Pair [symmetric])
       apply (force simp add: interval_split [symmetric] intro!: n1 [rule_format])
       apply (force simp add: interval_split [symmetric] intro!: n2 [rule_format])
       done
   next
     case 2
     then have e: "e * content (cbox (u, w) (v, z)) =
                   e * (content (cbox u v) * content (cbox w z \<inter> {x. x \<bullet> j \<le> M})) +
                   e * (content (cbox u v) * content (cbox w z \<inter> {x. M \<le> x \<bullet> j}))"
       by (simp add: content_split [where c=M] content_Pair algebra_simps)
     have "(\<lambda>x. integral (cbox w z \<inter> {x. x \<bullet> j \<le> M}) (\<lambda>y. f (x, y))) integrable_on cbox u v"
                 "(\<lambda>x. integral (cbox w z \<inter> {x. M \<le> x \<bullet> j}) (\<lambda>y. f (x, y))) integrable_on cbox u v"
       using 2 subs
       apply (simp_all add: interval_split)
       apply (rule_tac [!] integral_integrable_2dim [OF continuous_on_subset [OF f]])
       apply (auto simp: cbox_Pair_eq interval_split [symmetric])
       done
     with 2 have *: "integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))) =
                    integral (cbox u v) (\<lambda>x. integral (cbox w z \<inter> {x. x \<bullet> j \<le> M}) (\<lambda>y. f (x, y))) +
                    integral (cbox u v) (\<lambda>x. integral (cbox w z \<inter> {x. M \<le> x \<bullet> j}) (\<lambda>y. f (x, y)))"
       by (simp add: integral_add [symmetric] integral_split [symmetric]
                     continuous_on_imp_integrable_on_Pair1 [OF fcont] cong: integral_cong)
     show ?normle
       apply (rule norm_diff2 [OF integral_split [where c=M, OF fint ij] * e])
       using 2 subs
       apply (simp_all add: cbox_Pair_eq setcomp_dot2 [of "\<lambda>u. M\<le>u"] setcomp_dot2 [of "\<lambda>u. u\<le>M"] Sigma_Int_Paircomp2)
       apply (simp_all add: interval_split ij)
       apply (simp_all add: cbox_Pair_eq [symmetric] content_Pair [symmetric])
       apply (force simp add: interval_split [symmetric] intro!: n1 [rule_format])
       apply (force simp add: interval_split [symmetric] intro!: n2 [rule_format])
       done
   qed
 qed
 
 lemma integral_Pair_const:
     "integral (cbox (a,c) (b,d)) (\<lambda>x. k) =
      integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. k))"
   by (simp add: content_Pair)
 
 lemma integral_prod_continuous:
   fixes f :: "('a::euclidean_space * 'b::euclidean_space) \<Rightarrow> 'c::banach"
   assumes "continuous_on (cbox (a, c) (b, d)) f" (is "continuous_on ?CBOX f")
     shows "integral (cbox (a, c) (b, d)) f = integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x, y)))"
 proof (cases "content ?CBOX = 0")
   case True
   then show ?thesis
     by (auto simp: content_Pair)
 next
   case False
   then have cbp: "content ?CBOX > 0"
     using content_lt_nz by blast
   have "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x,y)))) = 0"
   proof (rule dense_eq0_I, simp)
     fix e :: real 
     assume "0 < e"
     with \<open>content ?CBOX > 0\<close> have "0 < e/content ?CBOX"
       by simp
     have f_int_acbd: "f integrable_on ?CBOX"
       by (rule integrable_continuous [OF assms])
     { fix p
       assume p: "p division_of ?CBOX"
       then have "finite p"
         by blast
       define e' where "e' = e/content ?CBOX"
       with \<open>0 < e\<close> \<open>0 < e/content ?CBOX\<close>
       have "0 < e'"
         by simp
       interpret operative conj True
            "\<lambda>k. \<forall>a' b' c' d'.
                 cbox (a', c') (b', d') \<subseteq> k \<and> cbox (a', c') (b', d') \<subseteq> ?CBOX
                 \<longrightarrow> norm (integral (cbox (a', c') (b', d')) f -
                          integral (cbox a' b') (\<lambda>x. integral (cbox c' d') (\<lambda>y. f ((x, y)))))
                     \<le> e' * content (cbox (a', c') (b', d'))"
         using assms \<open>0 < e'\<close> by (rule integral_swap_operativeI)
       have "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x, y))))
           \<le> e' * content ?CBOX"
         if "\<And>t u v w z. t \<in> p \<Longrightarrow> cbox (u, w) (v, z) \<subseteq> t \<Longrightarrow> cbox (u, w) (v, z) \<subseteq> ?CBOX
           \<Longrightarrow> norm (integral (cbox (u, w) (v, z)) f -
               integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))))
               \<le> e' * content (cbox (u, w) (v, z))"
         using that division [of p "(a, c)" "(b, d)"] p \<open>finite p\<close> by (auto simp add: comm_monoid_set_F_and)
       with False have "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x, y))))
           \<le> e"
         if "\<And>t u v w z. t \<in> p \<Longrightarrow> cbox (u, w) (v, z) \<subseteq> t \<Longrightarrow> cbox (u, w) (v, z) \<subseteq> ?CBOX
           \<Longrightarrow> norm (integral (cbox (u, w) (v, z)) f -
               integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))))
               \<le> e * content (cbox (u, w) (v, z)) / content ?CBOX"
         using that by (simp add: e'_def)
     } note op_acbd = this
     { fix k::real and \<D> and u::'a and v w and z::'b and t1 t2 l
       assume k: "0 < k"
          and nf: "\<And>x y u v.
                   \<lbrakk>x \<in> cbox a b; y \<in> cbox c d; u \<in> cbox a b; v\<in>cbox c d; norm (u-x, v-y) < k\<rbrakk>
                   \<Longrightarrow> norm (f(u,v) - f(x,y)) < e/(2 * (content ?CBOX))"
          and p_acbd: "\<D> tagged_division_of cbox (a,c) (b,d)"
          and fine: "(\<lambda>x. ball x k) fine \<D>"  "((t1,t2), l) \<in> \<D>"
          and uwvz_sub: "cbox (u,w) (v,z) \<subseteq> l" "cbox (u,w) (v,z) \<subseteq> cbox (a,c) (b,d)"
       have t: "t1 \<in> cbox a b" "t2 \<in> cbox c d"
         by (meson fine p_acbd cbox_Pair_iff tag_in_interval)+
       have ls: "l \<subseteq> ball (t1,t2) k"
         using fine by (simp add: fine_def Ball_def)
       { fix x1 x2
         assume xuvwz: "x1 \<in> cbox u v" "x2 \<in> cbox w z"
         then have x: "x1 \<in> cbox a b" "x2 \<in> cbox c d"
           using uwvz_sub by auto
         have "norm (x1 - t1, x2 - t2) = norm (t1 - x1, t2 - x2)"
           by (simp add: norm_Pair norm_minus_commute)
         also have "norm (t1 - x1, t2 - x2) < k"
           using xuvwz ls uwvz_sub unfolding ball_def
           by (force simp add: cbox_Pair_eq dist_norm )
         finally have "norm (f (x1,x2) - f (t1,t2)) \<le> e/content ?CBOX/2"
           using nf [OF t x]  by simp
       } note nf' = this
       have f_int_uwvz: "f integrable_on cbox (u,w) (v,z)"
         using f_int_acbd uwvz_sub integrable_on_subcbox by blast
       have f_int_uv: "\<And>x. x \<in> cbox u v \<Longrightarrow> (\<lambda>y. f (x,y)) integrable_on cbox w z"
         using assms continuous_on_subset uwvz_sub
         by (blast intro: continuous_on_imp_integrable_on_Pair1)
       have 1: "norm (integral (cbox (u,w) (v,z)) f - integral (cbox (u,w) (v,z)) (\<lambda>x. f (t1,t2)))
          \<le> e * content (cbox (u,w) (v,z)) / content ?CBOX/2"
         apply (simp only: integral_diff [symmetric] f_int_uwvz integrable_const)
         apply (rule order_trans [OF integrable_bound [of "e/content ?CBOX/2"]])
         using cbp \<open>0 < e/content ?CBOX\<close> nf'
         apply (auto simp: integrable_diff f_int_uwvz integrable_const)
         done
       have int_integrable: "(\<lambda>x. integral (cbox w z) (\<lambda>y. f (x, y))) integrable_on cbox u v"
         using assms integral_integrable_2dim continuous_on_subset uwvz_sub(2) by blast
       have normint_wz:
          "\<And>x. x \<in> cbox u v \<Longrightarrow>
                norm (integral (cbox w z) (\<lambda>y. f (x, y)) - integral (cbox w z) (\<lambda>y. f (t1, t2)))
                \<le> e * content (cbox w z) / content (cbox (a, c) (b, d))/2"
         apply (simp only: integral_diff [symmetric] f_int_uv integrable_const)
         apply (rule order_trans [OF integrable_bound [of "e/content ?CBOX/2"]])
         using cbp \<open>0 < e/content ?CBOX\<close> nf'
         apply (auto simp: integrable_diff f_int_uv integrable_const)
         done
       have "norm (integral (cbox u v)
                (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x,y)) - integral (cbox w z) (\<lambda>y. f (t1,t2))))
             \<le> e * content (cbox w z) / content ?CBOX/2 * content (cbox u v)"
         apply (rule integrable_bound [OF _ _ normint_wz])
         using cbp \<open>0 < e/content ?CBOX\<close>
         apply (auto simp: field_split_simps integrable_diff int_integrable integrable_const)
         done
       also have "... \<le> e * content (cbox (u,w) (v,z)) / content ?CBOX/2"
         by (simp add: content_Pair field_split_simps)
       finally have 2: "norm (integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x,y))) -
                       integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (t1,t2))))
                 \<le> e * content (cbox (u,w) (v,z)) / content ?CBOX/2"
         by (simp only: integral_diff [symmetric] int_integrable integrable_const)
       have norm_xx: "\<lbrakk>x' = y'; norm(x - x') \<le> e/2; norm(y - y') \<le> e/2\<rbrakk> \<Longrightarrow> norm(x - y) \<le> e" for x::'c and y x' y' e
         using norm_triangle_mono [of "x-y'" "e/2" "y'-y" "e/2"] field_sum_of_halves
         by (simp add: norm_minus_commute)
       have "norm (integral (cbox (u,w) (v,z)) f - integral (cbox u v) (\<lambda>x. integral (cbox w z) (\<lambda>y. f (x,y))))
             \<le> e * content (cbox (u,w) (v,z)) / content ?CBOX"
         by (rule norm_xx [OF integral_Pair_const 1 2])
     } note * = this
     have "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x,y)))) \<le> e" 
       if "\<forall>x\<in>?CBOX. \<forall>x'\<in>?CBOX. norm (x' - x) < k \<longrightarrow> norm (f x' - f x) < e /(2 * content (?CBOX))" "0 < k" for k
     proof -
       obtain p where ptag: "p tagged_division_of cbox (a, c) (b, d)" 
                  and fine: "(\<lambda>x. ball x k) fine p"
         using fine_division_exists \<open>0 < k\<close> by blast
       show ?thesis
         apply (rule op_acbd [OF division_of_tagged_division [OF ptag]])
         using that fine ptag \<open>0 < k\<close> by (auto simp: *)
     qed
     then show "norm (integral ?CBOX f - integral (cbox a b) (\<lambda>x. integral (cbox c d) (\<lambda>y. f (x,y)))) \<le> e"
       using compact_uniformly_continuous [OF assms compact_cbox]
       apply (simp add: uniformly_continuous_on_def dist_norm)
       apply (drule_tac x="e/2 / content?CBOX" in spec)
       using cbp \<open>0 < e\<close> by (auto simp: zero_less_mult_iff)
   qed
   then show ?thesis
     by simp
 qed
 
 lemma integral_swap_2dim:
   fixes f :: "['a::euclidean_space, 'b::euclidean_space] \<Rightarrow> 'c::banach"
   assumes "continuous_on (cbox (a,c) (b,d)) (\<lambda>(x,y). f x y)"
     shows "integral (cbox (a, c) (b, d)) (\<lambda>(x, y). f x y) = integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)"
 proof -
   have "((\<lambda>(x, y). f x y) has_integral integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)) (prod.swap ` (cbox (c, a) (d, b)))"
     apply (rule has_integral_twiddle [of 1 prod.swap prod.swap "\<lambda>(x,y). f y x" "integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)", simplified])
     apply (force simp: isCont_swap content_Pair has_integral_integral [symmetric] integrable_continuous swap_continuous assms)+
     done
  then show ?thesis
    by force
 qed
 
 theorem integral_swap_continuous:
   fixes f :: "['a::euclidean_space, 'b::euclidean_space] \<Rightarrow> 'c::banach"
   assumes "continuous_on (cbox (a,c) (b,d)) (\<lambda>(x,y). f x y)"
     shows "integral (cbox a b) (\<lambda>x. integral (cbox c d) (f x)) =
            integral (cbox c d) (\<lambda>y. integral (cbox a b) (\<lambda>x. f x y))"
 proof -
   have "integral (cbox a b) (\<lambda>x. integral (cbox c d) (f x)) = integral (cbox (a, c) (b, d)) (\<lambda>(x, y). f x y)"
     using integral_prod_continuous [OF assms] by auto
   also have "... = integral (cbox (c, a) (d, b)) (\<lambda>(x, y). f y x)"
     by (rule integral_swap_2dim [OF assms])
   also have "... = integral (cbox c d) (\<lambda>y. integral (cbox a b) (\<lambda>x. f x y))"
     using integral_prod_continuous [OF swap_continuous] assms
     by auto
   finally show ?thesis .
 qed
 
 
 subsection \<open>Definite integrals for exponential and power function\<close>
 
 lemma has_integral_exp_minus_to_infinity:
   assumes a: "a > 0"
   shows   "((\<lambda>x::real. exp (-a*x)) has_integral exp (-a*c)/a) {c..}"
 proof -
   define f where "f = (\<lambda>k x. if x \<in> {c..real k} then exp (-a*x) else 0)"
   {
     fix k :: nat assume k: "of_nat k \<ge> c"
     from k a
       have "((\<lambda>x. exp (-a*x)) has_integral (-exp (-a*real k)/a - (-exp (-a*c)/a))) {c..real k}"
       by (intro fundamental_theorem_of_calculus)
          (auto intro!: derivative_eq_intros
                simp: has_field_derivative_iff_has_vector_derivative [symmetric])
     hence "(f k has_integral (exp (-a*c)/a - exp (-a*real k)/a)) {c..}" unfolding f_def
       by (subst has_integral_restrict) simp_all
   } note has_integral_f = this
 
   have [simp]: "f k = (\<lambda>_. 0)" if "of_nat k < c" for k using that by (auto simp: fun_eq_iff f_def)
   have integral_f: "integral {c..} (f k) =
                       (if real k \<ge> c then exp (-a*c)/a - exp (-a*real k)/a else 0)"
     for k using integral_unique[OF has_integral_f[of k]] by simp
 
   have A: "(\<lambda>x. exp (-a*x)) integrable_on {c..} \<and>
              (\<lambda>k. integral {c..} (f k)) \<longlonglongrightarrow> integral {c..} (\<lambda>x. exp (-a*x))"
   proof (intro monotone_convergence_increasing allI ballI)
     fix k ::nat
     have "(\<lambda>x. exp (-a*x)) integrable_on {c..of_real k}" (is ?P)
       unfolding f_def by (auto intro!: continuous_intros integrable_continuous_real)
     hence  "(f k) integrable_on {c..of_real k}"
       by (rule integrable_eq) (simp add: f_def)
     then show "f k integrable_on {c..}"
       by (rule integrable_on_superset) (auto simp: f_def)
   next
     fix x assume x: "x \<in> {c..}"
     have "sequentially \<le> principal {nat \<lceil>x\<rceil>..}" unfolding at_top_def by (simp add: Inf_lower)
     also have "{nat \<lceil>x\<rceil>..} \<subseteq> {k. x \<le> real k}" by auto
     also have "inf (principal \<dots>) (principal {k. \<not>x \<le> real k}) =
                  principal ({k. x \<le> real k} \<inter> {k. \<not>x \<le> real k})" by simp
     also have "{k. x \<le> real k} \<inter> {k. \<not>x \<le> real k} = {}" by blast
     finally have "inf sequentially (principal {k. \<not>x \<le> real k}) = bot"
       by (simp add: inf.coboundedI1 bot_unique)
     with x show "(\<lambda>k. f k x) \<longlonglongrightarrow> exp (-a*x)" unfolding f_def
       by (intro filterlim_If) auto
   next
     have "\<bar>integral {c..} (f k)\<bar> \<le> exp (-a*c)/a" for k
     proof (cases "c > of_nat k")
       case False
       hence "abs (integral {c..} (f k)) = abs (exp (- (a * c)) / a - exp (- (a * real k)) / a)"
         by (simp add: integral_f)
       also have "abs (exp (- (a * c)) / a - exp (- (a * real k)) / a) =
                    exp (- (a * c)) / a - exp (- (a * real k)) / a"
         using False a by (intro abs_of_nonneg) (simp_all add: field_simps)
       also have "\<dots> \<le> exp (- a * c) / a" using a by simp
       finally show ?thesis .
     qed (insert a, simp_all add: integral_f)
     thus "bounded (range(\<lambda>k. integral {c..} (f k)))"
       by (intro boundedI[of _ "exp (-a*c)/a"]) auto
   qed (auto simp: f_def)
   have "(\<lambda>k. exp (-a*c)/a - exp (-a * of_nat k)/a) \<longlonglongrightarrow> exp (-a*c)/a - 0/a"
     by (intro tendsto_intros filterlim_compose[OF exp_at_bot]
         filterlim_tendsto_neg_mult_at_bot[OF tendsto_const] filterlim_real_sequentially)+
       (insert a, simp_all)
   moreover
   from eventually_gt_at_top[of "nat \<lceil>c\<rceil>"] have "eventually (\<lambda>k. of_nat k > c) sequentially"
     by eventually_elim linarith
   hence "eventually (\<lambda>k. exp (-a*c)/a - exp (-a * of_nat k)/a = integral {c..} (f k)) sequentially"
     by eventually_elim (simp add: integral_f) 
   ultimately have "(\<lambda>k. integral {c..} (f k)) \<longlonglongrightarrow> exp (-a*c)/a - 0/a"
     by (rule Lim_transform_eventually)
   from LIMSEQ_unique[OF conjunct2[OF A] this]
   have "integral {c..} (\<lambda>x. exp (-a*x)) = exp (-a*c)/a" by simp
   with conjunct1[OF A] show ?thesis
     by (simp add: has_integral_integral)
 qed
 
 lemma integrable_on_exp_minus_to_infinity: "a > 0 \<Longrightarrow> (\<lambda>x. exp (-a*x) :: real) integrable_on {c..}"
   using has_integral_exp_minus_to_infinity[of a c] unfolding integrable_on_def by blast
 
 lemma has_integral_powr_from_0:
   assumes a: "a > (-1::real)" and c: "c \<ge> 0"
   shows   "((\<lambda>x. x powr a) has_integral (c powr (a+1) / (a+1))) {0..c}"
 proof (cases "c = 0")
   case False
   define f where "f = (\<lambda>k x. if x \<in> {inverse (of_nat (Suc k))..c} then x powr a else 0)"
   define F where "F = (\<lambda>k. if inverse (of_nat (Suc k)) \<le> c then
                              c powr (a+1)/(a+1) - inverse (real (Suc k)) powr (a+1)/(a+1) else 0)"
   {
     fix k :: nat
     have "(f k has_integral F k) {0..c}"
     proof (cases "inverse (of_nat (Suc k)) \<le> c")
       case True
       {
         fix x assume x: "x \<ge> inverse (1 + real k)"
         have "0 < inverse (1 + real k)" by simp
         also note x
         finally have "x > 0" .
       } note x = this
       hence "((\<lambda>x. x powr a) has_integral c powr (a + 1) / (a + 1) -
                inverse (real (Suc k)) powr (a + 1) / (a + 1)) {inverse (real (Suc k))..c}"
         using True a by (intro fundamental_theorem_of_calculus)
            (auto intro!: derivative_eq_intros continuous_on_powr' continuous_on_const
               simp: has_field_derivative_iff_has_vector_derivative [symmetric])
       with True show ?thesis unfolding f_def F_def by (subst has_integral_restrict) simp_all
     next
       case False
       thus ?thesis unfolding f_def F_def by (subst has_integral_restrict) auto
     qed
   } note has_integral_f = this
   have integral_f: "integral {0..c} (f k) = F k" for k
     using has_integral_f[of k] by (rule integral_unique)
 
   have A: "(\<lambda>x. x powr a) integrable_on {0..c} \<and>
            (\<lambda>k. integral {0..c} (f k)) \<longlonglongrightarrow> integral {0..c} (\<lambda>x. x powr a)"
   proof (intro monotone_convergence_increasing ballI allI)
     fix k from has_integral_f[of k] show "f k integrable_on {0..c}"
       by (auto simp: integrable_on_def)
   next
     fix k :: nat and x :: real
     {
       assume x: "inverse (real (Suc k)) \<le> x"
       have "inverse (real (Suc (Suc k))) \<le> inverse (real (Suc k))" by (simp add: field_simps)
       also note x
       finally have "inverse (real (Suc (Suc k))) \<le> x" .
     }
     thus "f k x \<le> f (Suc k) x" by (auto simp: f_def simp del: of_nat_Suc)
   next
     fix x assume x: "x \<in> {0..c}"
     show "(\<lambda>k. f k x) \<longlonglongrightarrow> x powr a"
     proof (cases "x = 0")
       case False
       with x have "x > 0" by simp
       from order_tendstoD(2)[OF LIMSEQ_inverse_real_of_nat this]
         have "eventually (\<lambda>k. x powr a = f k x) sequentially"
         by eventually_elim (insert x, simp add: f_def)
       moreover have "(\<lambda>_. x powr a) \<longlonglongrightarrow> x powr a" by simp
       ultimately show ?thesis by (blast intro: Lim_transform_eventually)
     qed (simp_all add: f_def)
   next
     {
       fix k
       from a have "F k \<le> c powr (a + 1) / (a + 1)"
         by (auto simp add: F_def divide_simps)
       also from a have "F k \<ge> 0"
         by (auto simp: F_def divide_simps simp del: of_nat_Suc intro!: powr_mono2)
       hence "F k = abs (F k)" by simp
       finally have "abs (F k) \<le>  c powr (a + 1) / (a + 1)" .
     }
     thus "bounded (range(\<lambda>k. integral {0..c} (f k)))"
       by (intro boundedI[of _ "c powr (a+1) / (a+1)"]) (auto simp: integral_f)
   qed
 
   from False c have "c > 0" by simp
   from order_tendstoD(2)[OF LIMSEQ_inverse_real_of_nat this]
     have "eventually (\<lambda>k. c powr (a + 1) / (a + 1) - inverse (real (Suc k)) powr (a+1) / (a+1) =
             integral {0..c} (f k)) sequentially"
     by eventually_elim (simp add: integral_f F_def)
   moreover have "(\<lambda>k. c powr (a + 1) / (a + 1) - inverse (real (Suc k)) powr (a + 1) / (a + 1))
                    \<longlonglongrightarrow> c powr (a + 1) / (a + 1) - 0 powr (a + 1) / (a + 1)"
     using a by (intro tendsto_intros LIMSEQ_inverse_real_of_nat) auto
   hence "(\<lambda>k. c powr (a + 1) / (a + 1) - inverse (real (Suc k)) powr (a + 1) / (a + 1))
           \<longlonglongrightarrow> c powr (a + 1) / (a + 1)" by simp
   ultimately have "(\<lambda>k. integral {0..c} (f k)) \<longlonglongrightarrow> c powr (a+1) / (a+1)"
     by (blast intro: Lim_transform_eventually)
   with A have "integral {0..c} (\<lambda>x. x powr a) = c powr (a+1) / (a+1)"
     by (blast intro: LIMSEQ_unique)
   with A show ?thesis by (simp add: has_integral_integral)
 qed (simp_all add: has_integral_refl)
 
 lemma integrable_on_powr_from_0:
   assumes a: "a > (-1::real)" and c: "c \<ge> 0"
   shows   "(\<lambda>x. x powr a) integrable_on {0..c}"
   using has_integral_powr_from_0[OF assms] unfolding integrable_on_def by blast
 
 lemma has_integral_powr_to_inf:
   fixes a e :: real
   assumes "e < -1" "a > 0"
   shows   "((\<lambda>x. x powr e) has_integral -(a powr (e + 1)) / (e + 1)) {a..}"
 proof -
   define f :: "nat \<Rightarrow> real \<Rightarrow> real" where "f = (\<lambda>n x. if x \<in> {a..n} then x powr e else 0)"
   define F where "F = (\<lambda>x. x powr (e + 1) / (e + 1))"
 
   have has_integral_f: "(f n has_integral (F n - F a)) {a..}"
     if n: "n \<ge> a" for n :: nat
   proof -
     from n assms have "((\<lambda>x. x powr e) has_integral (F n - F a)) {a..n}"
       by (intro fundamental_theorem_of_calculus) (auto intro!: derivative_eq_intros
             simp: has_field_derivative_iff_has_vector_derivative [symmetric] F_def)
     hence "(f n has_integral (F n - F a)) {a..n}"
       by (rule has_integral_eq [rotated]) (simp add: f_def)
     thus "(f n has_integral (F n - F a)) {a..}"
       by (rule has_integral_on_superset) (auto simp: f_def)
   qed
   have integral_f: "integral {a..} (f n) = (if n \<ge> a then F n - F a else 0)" for n :: nat
   proof (cases "n \<ge> a")
     case True
     with has_integral_f[OF this] show ?thesis by (simp add: integral_unique)
   next
     case False
     have "(f n has_integral 0) {a}" by (rule has_integral_refl)
     hence "(f n has_integral 0) {a..}"
       by (rule has_integral_on_superset) (insert False, simp_all add: f_def)
     with False show ?thesis by (simp add: integral_unique)
   qed
 
   have *: "(\<lambda>x. x powr e) integrable_on {a..} \<and>
            (\<lambda>n. integral {a..} (f n)) \<longlonglongrightarrow> integral {a..} (\<lambda>x. x powr e)"
   proof (intro monotone_convergence_increasing allI ballI)
     fix n :: nat
     from assms have "(\<lambda>x. x powr e) integrable_on {a..n}"
       by (auto intro!: integrable_continuous_real continuous_intros)
     hence "f n integrable_on {a..n}"
       by (rule integrable_eq) (auto simp: f_def)
     thus "f n integrable_on {a..}"
       by (rule integrable_on_superset) (auto simp: f_def)
   next
     fix n :: nat and x :: real
     show "f n x \<le> f (Suc n) x" by (auto simp: f_def)
   next
     fix x :: real assume x: "x \<in> {a..}"
     from filterlim_real_sequentially
       have "eventually (\<lambda>n. real n \<ge> x) at_top"
       by (simp add: filterlim_at_top)
     with x have "eventually (\<lambda>n. f n x = x powr e) at_top"
       by (auto elim!: eventually_mono simp: f_def)
     thus "(\<lambda>n. f n x) \<longlonglongrightarrow> x powr e" by (simp add: tendsto_eventually)
   next
     have "norm (integral {a..} (f n)) \<le> -F a" for n :: nat
     proof (cases "n \<ge> a")
       case True
       with assms have "a powr (e + 1) \<ge> n powr (e + 1)"
         by (intro powr_mono2') simp_all
       with assms show ?thesis by (auto simp: divide_simps F_def integral_f)
     qed (insert assms, simp add: integral_f F_def field_split_simps)
     thus "bounded (range(\<lambda>k. integral {a..} (f k)))"
       unfolding bounded_iff by (intro exI[of _ "-F a"]) auto
   qed
 
   from filterlim_real_sequentially
     have "eventually (\<lambda>n. real n \<ge> a) at_top"
     by (simp add: filterlim_at_top)
   hence "eventually (\<lambda>n. F n - F a = integral {a..} (f n)) at_top"
     by eventually_elim (simp add: integral_f)
   moreover have "(\<lambda>n. F n - F a) \<longlonglongrightarrow> 0 / (e + 1) - F a" unfolding F_def
     by (insert assms, (rule tendsto_intros filterlim_compose[OF tendsto_neg_powr]
           filterlim_ident filterlim_real_sequentially | simp)+)
   hence "(\<lambda>n. F n - F a) \<longlonglongrightarrow> -F a" by simp
   ultimately have "(\<lambda>n. integral {a..} (f n)) \<longlonglongrightarrow> -F a" by (blast intro: Lim_transform_eventually)
   from conjunct2[OF *] and this
     have "integral {a..} (\<lambda>x. x powr e) = -F a" by (rule LIMSEQ_unique)
   with conjunct1[OF *] show ?thesis
     by (simp add: has_integral_integral F_def)
 qed
 
 lemma has_integral_inverse_power_to_inf:
   fixes a :: real and n :: nat
   assumes "n > 1" "a > 0"
   shows   "((\<lambda>x. 1 / x ^ n) has_integral 1 / (real (n - 1) * a ^ (n - 1))) {a..}"
 proof -
   from assms have "real_of_int (-int n) < -1" by simp
   note has_integral_powr_to_inf[OF this \<open>a > 0\<close>]
   also have "- (a powr (real_of_int (- int n) + 1)) / (real_of_int (- int n) + 1) =
                  1 / (real (n - 1) * a powr (real (n - 1)))" using assms
     by (simp add: field_split_simps powr_add [symmetric] of_nat_diff)
   also from assms have "a powr (real (n - 1)) = a ^ (n - 1)"
     by (intro powr_realpow)
   finally show ?thesis
     by (rule has_integral_eq [rotated])
        (insert assms, simp_all add: powr_minus powr_realpow field_split_simps)
 qed
 
 subsubsection \<open>Adaption to ordered Euclidean spaces and the Cartesian Euclidean space\<close>
 
 lemma integral_component_eq_cart[simp]:
   fixes f :: "'n::euclidean_space \<Rightarrow> real^'m"
   assumes "f integrable_on s"
   shows "integral s (\<lambda>x. f x $ k) = integral s f $ k"
   using integral_linear[OF assms(1) bounded_linear_vec_nth,unfolded o_def] .
 
 lemma content_closed_interval:
   fixes a :: "'a::ordered_euclidean_space"
   assumes "a \<le> b"
   shows "content {a..b} = (\<Prod>i\<in>Basis. b\<bullet>i - a\<bullet>i)"
   using content_cbox[of a b] assms by (simp add: cbox_interval eucl_le[where 'a='a])
 
 lemma integrable_const_ivl[intro]:
   fixes a::"'a::ordered_euclidean_space"
   shows "(\<lambda>x. c) integrable_on {a..b}"
   unfolding cbox_interval[symmetric] by (rule integrable_const)
 
 lemma integrable_on_subinterval:
   fixes f :: "'n::ordered_euclidean_space \<Rightarrow> 'a::banach"
   assumes "f integrable_on S" "{a..b} \<subseteq> S"
   shows "f integrable_on {a..b}"
   using integrable_on_subcbox[of f S a b] assms by (simp add: cbox_interval)
 
 end
diff --git a/src/HOL/Analysis/Lebesgue_Measure.thy b/src/HOL/Analysis/Lebesgue_Measure.thy
--- a/src/HOL/Analysis/Lebesgue_Measure.thy
+++ b/src/HOL/Analysis/Lebesgue_Measure.thy
@@ -1,1813 +1,1841 @@
 (*  Title:      HOL/Analysis/Lebesgue_Measure.thy
     Author:     Johannes Hölzl, TU München
     Author:     Robert Himmelmann, TU München
     Author:     Jeremy Avigad
     Author:     Luke Serafin
 *)
 
 section \<open>Lebesgue Measure\<close>
 
 theory Lebesgue_Measure
 imports
   Finite_Product_Measure
   Caratheodory
   Complete_Measure
   Summation_Tests
   Regularity
 begin
 
 lemma measure_eqI_lessThan:
   fixes M N :: "real measure"
   assumes sets: "sets M = sets borel" "sets N = sets borel"
   assumes fin: "\<And>x. emeasure M {x <..} < \<infinity>"
   assumes "\<And>x. emeasure M {x <..} = emeasure N {x <..}"
   shows "M = N"
 proof (rule measure_eqI_generator_eq_countable)
   let ?LT = "\<lambda>a::real. {a <..}" let ?E = "range ?LT"
   show "Int_stable ?E"
     by (auto simp: Int_stable_def lessThan_Int_lessThan)
 
   show "?E \<subseteq> Pow UNIV" "sets M = sigma_sets UNIV ?E" "sets N = sigma_sets UNIV ?E"
     unfolding sets borel_Ioi by auto
 
   show "?LT`Rats \<subseteq> ?E" "(\<Union>i\<in>Rats. ?LT i) = UNIV" "\<And>a. a \<in> ?LT`Rats \<Longrightarrow> emeasure M a \<noteq> \<infinity>"
     using fin by (auto intro: Rats_no_bot_less simp: less_top)
 qed (auto intro: assms countable_rat)
 
 subsection \<open>Measures defined by monotonous functions\<close>
 
 text \<open>
   Every right-continuous and nondecreasing function gives rise to a measure on the reals:
 \<close>
 
 definition\<^marker>\<open>tag important\<close> interval_measure :: "(real \<Rightarrow> real) \<Rightarrow> real measure" where
   "interval_measure F =
      extend_measure UNIV {(a, b). a \<le> b} (\<lambda>(a, b). {a<..b}) (\<lambda>(a, b). ennreal (F b - F a))"
 
 lemma\<^marker>\<open>tag important\<close> emeasure_interval_measure_Ioc:
   assumes "a \<le> b"
   assumes mono_F: "\<And>x y. x \<le> y \<Longrightarrow> F x \<le> F y"
   assumes right_cont_F : "\<And>a. continuous (at_right a) F"
   shows "emeasure (interval_measure F) {a<..b} = F b - F a"
 proof (rule extend_measure_caratheodory_pair[OF interval_measure_def \<open>a \<le> b\<close>])
   show "semiring_of_sets UNIV {{a<..b} |a b :: real. a \<le> b}"
   proof (unfold_locales, safe)
     fix a b c d :: real assume *: "a \<le> b" "c \<le> d"
     then show "\<exists>C\<subseteq>{{a<..b} |a b. a \<le> b}. finite C \<and> disjoint C \<and> {a<..b} - {c<..d} = \<Union>C"
     proof cases
       let ?C = "{{a<..b}}"
       assume "b < c \<or> d \<le> a \<or> d \<le> c"
       with * have "?C \<subseteq> {{a<..b} |a b. a \<le> b} \<and> finite ?C \<and> disjoint ?C \<and> {a<..b} - {c<..d} = \<Union>?C"
         by (auto simp add: disjoint_def)
       thus ?thesis ..
     next
       let ?C = "{{a<..c}, {d<..b}}"
       assume "\<not> (b < c \<or> d \<le> a \<or> d \<le> c)"
       with * have "?C \<subseteq> {{a<..b} |a b. a \<le> b} \<and> finite ?C \<and> disjoint ?C \<and> {a<..b} - {c<..d} = \<Union>?C"
         by (auto simp add: disjoint_def Ioc_inj) (metis linear)+
       thus ?thesis ..
     qed
   qed (auto simp: Ioc_inj, metis linear)
 next
   fix l r :: "nat \<Rightarrow> real" and a b :: real
   assume l_r[simp]: "\<And>n. l n \<le> r n" and "a \<le> b" and disj: "disjoint_family (\<lambda>n. {l n<..r n})"
   assume lr_eq_ab: "(\<Union>i. {l i<..r i}) = {a<..b}"
 
   have [intro, simp]: "\<And>a b. a \<le> b \<Longrightarrow> F a \<le> F b"
     by (auto intro!: l_r mono_F)
 
   { fix S :: "nat set" assume "finite S"
     moreover note \<open>a \<le> b\<close>
     moreover have "\<And>i. i \<in> S \<Longrightarrow> {l i <.. r i} \<subseteq> {a <.. b}"
       unfolding lr_eq_ab[symmetric] by auto
     ultimately have "(\<Sum>i\<in>S. F (r i) - F (l i)) \<le> F b - F a"
     proof (induction S arbitrary: a rule: finite_psubset_induct)
       case (psubset S)
       show ?case
       proof cases
         assume "\<exists>i\<in>S. l i < r i"
         with \<open>finite S\<close> have "Min (l ` {i\<in>S. l i < r i}) \<in> l ` {i\<in>S. l i < r i}"
           by (intro Min_in) auto
         then obtain m where m: "m \<in> S" "l m < r m" "l m = Min (l ` {i\<in>S. l i < r i})"
           by fastforce
 
         have "(\<Sum>i\<in>S. F (r i) - F (l i)) = (F (r m) - F (l m)) + (\<Sum>i\<in>S - {m}. F (r i) - F (l i))"
           using m psubset by (intro sum.remove) auto
         also have "(\<Sum>i\<in>S - {m}. F (r i) - F (l i)) \<le> F b - F (r m)"
         proof (intro psubset.IH)
           show "S - {m} \<subset> S"
             using \<open>m\<in>S\<close> by auto
           show "r m \<le> b"
             using psubset.prems(2)[OF \<open>m\<in>S\<close>] \<open>l m < r m\<close> by auto
         next
           fix i assume "i \<in> S - {m}"
           then have i: "i \<in> S" "i \<noteq> m" by auto
           { assume i': "l i < r i" "l i < r m"
             with \<open>finite S\<close> i m have "l m \<le> l i"
               by auto
             with i' have "{l i <.. r i} \<inter> {l m <.. r m} \<noteq> {}"
               by auto
             then have False
               using disjoint_family_onD[OF disj, of i m] i by auto }
           then have "l i \<noteq> r i \<Longrightarrow> r m \<le> l i"
             unfolding not_less[symmetric] using l_r[of i] by auto
           then show "{l i <.. r i} \<subseteq> {r m <.. b}"
             using psubset.prems(2)[OF \<open>i\<in>S\<close>] by auto
         qed
         also have "F (r m) - F (l m) \<le> F (r m) - F a"
           using psubset.prems(2)[OF \<open>m \<in> S\<close>] \<open>l m < r m\<close>
           by (auto simp add: Ioc_subset_iff intro!: mono_F)
         finally show ?case
           by (auto intro: add_mono)
       qed (auto simp add: \<open>a \<le> b\<close> less_le)
     qed }
   note claim1 = this
 
   (* second key induction: a lower bound on the measures of any finite collection of Ai's
      that cover an interval {u..v} *)
 
   { fix S u v and l r :: "nat \<Rightarrow> real"
     assume "finite S" "\<And>i. i\<in>S \<Longrightarrow> l i < r i" "{u..v} \<subseteq> (\<Union>i\<in>S. {l i<..< r i})"
     then have "F v - F u \<le> (\<Sum>i\<in>S. F (r i) - F (l i))"
     proof (induction arbitrary: v u rule: finite_psubset_induct)
       case (psubset S)
       show ?case
       proof cases
         assume "S = {}" then show ?case
           using psubset by (simp add: mono_F)
       next
         assume "S \<noteq> {}"
         then obtain j where "j \<in> S"
           by auto
 
         let ?R = "r j < u \<or> l j > v \<or> (\<exists>i\<in>S-{j}. l i \<le> l j \<and> r j \<le> r i)"
         show ?case
         proof cases
           assume "?R"
           with \<open>j \<in> S\<close> psubset.prems have "{u..v} \<subseteq> (\<Union>i\<in>S-{j}. {l i<..< r i})"
             apply (auto simp: subset_eq Ball_def)
             apply (metis Diff_iff less_le_trans leD linear singletonD)
             apply (metis Diff_iff less_le_trans leD linear singletonD)
             apply (metis order_trans less_le_not_le linear)
             done
           with \<open>j \<in> S\<close> have "F v - F u \<le> (\<Sum>i\<in>S - {j}. F (r i) - F (l i))"
             by (intro psubset) auto
           also have "\<dots> \<le> (\<Sum>i\<in>S. F (r i) - F (l i))"
             using psubset.prems
             by (intro sum_mono2 psubset) (auto intro: less_imp_le)
           finally show ?thesis .
         next
           assume "\<not> ?R"
           then have j: "u \<le> r j" "l j \<le> v" "\<And>i. i \<in> S - {j} \<Longrightarrow> r i < r j \<or> l i > l j"
             by (auto simp: not_less)
           let ?S1 = "{i \<in> S. l i < l j}"
           let ?S2 = "{i \<in> S. r i > r j}"
 
           have "(\<Sum>i\<in>S. F (r i) - F (l i)) \<ge> (\<Sum>i\<in>?S1 \<union> ?S2 \<union> {j}. F (r i) - F (l i))"
             using \<open>j \<in> S\<close> \<open>finite S\<close> psubset.prems j
             by (intro sum_mono2) (auto intro: less_imp_le)
           also have "(\<Sum>i\<in>?S1 \<union> ?S2 \<union> {j}. F (r i) - F (l i)) =
             (\<Sum>i\<in>?S1. F (r i) - F (l i)) + (\<Sum>i\<in>?S2 . F (r i) - F (l i)) + (F (r j) - F (l j))"
             using psubset(1) psubset.prems(1) j
             apply (subst sum.union_disjoint)
             apply simp_all
             apply (subst sum.union_disjoint)
             apply auto
             apply (metis less_le_not_le)
             done
           also (xtrans) have "(\<Sum>i\<in>?S1. F (r i) - F (l i)) \<ge> F (l j) - F u"
             using \<open>j \<in> S\<close> \<open>finite S\<close> psubset.prems j
             apply (intro psubset.IH psubset)
             apply (auto simp: subset_eq Ball_def)
             apply (metis less_le_trans not_le)
             done
           also (xtrans) have "(\<Sum>i\<in>?S2. F (r i) - F (l i)) \<ge> F v - F (r j)"
             using \<open>j \<in> S\<close> \<open>finite S\<close> psubset.prems j
             apply (intro psubset.IH psubset)
             apply (auto simp: subset_eq Ball_def)
             apply (metis le_less_trans not_le)
             done
           finally (xtrans) show ?case
             by (auto simp: add_mono)
         qed
       qed
     qed }
   note claim2 = this
 
   (* now prove the inequality going the other way *)
   have "ennreal (F b - F a) \<le> (\<Sum>i. ennreal (F (r i) - F (l i)))"
   proof (rule ennreal_le_epsilon)
     fix epsilon :: real assume egt0: "epsilon > 0"
     have "\<forall>i. \<exists>d>0. F (r i + d) < F (r i) + epsilon / 2^(i+2)"
     proof
       fix i
       note right_cont_F [of "r i"]
       thus "\<exists>d>0. F (r i + d) < F (r i) + epsilon / 2^(i+2)"
         apply -
         apply (subst (asm) continuous_at_right_real_increasing)
         apply (rule mono_F, assumption)
         apply (drule_tac x = "epsilon / 2 ^ (i + 2)" in spec)
         apply (erule impE)
         using egt0 by (auto simp add: field_simps)
     qed
     then obtain delta where
         deltai_gt0: "\<And>i. delta i > 0" and
         deltai_prop: "\<And>i. F (r i + delta i) < F (r i) + epsilon / 2^(i+2)"
       by metis
     have "\<exists>a' > a. F a' - F a < epsilon / 2"
       apply (insert right_cont_F [of a])
       apply (subst (asm) continuous_at_right_real_increasing)
       using mono_F apply force
       apply (drule_tac x = "epsilon / 2" in spec)
       using egt0 unfolding mult.commute [of 2] by force
     then obtain a' where a'lea [arith]: "a' > a" and
       a_prop: "F a' - F a < epsilon / 2"
       by auto
     define S' where "S' = {i. l i < r i}"
     obtain S :: "nat set" where
       "S \<subseteq> S'" and finS: "finite S" and
       Sprop: "{a'..b} \<subseteq> (\<Union>i \<in> S. {l i<..<r i + delta i})"
     proof (rule compactE_image)
       show "compact {a'..b}"
         by (rule compact_Icc)
       show "\<And>i. i \<in> S' \<Longrightarrow> open ({l i<..<r i + delta i})" by auto
       have "{a'..b} \<subseteq> {a <.. b}"
         by auto
       also have "{a <.. b} = (\<Union>i\<in>S'. {l i<..r i})"
         unfolding lr_eq_ab[symmetric] by (fastforce simp add: S'_def intro: less_le_trans)
       also have "\<dots> \<subseteq> (\<Union>i \<in> S'. {l i<..<r i + delta i})"
         apply (intro UN_mono)
         apply (auto simp: S'_def)
         apply (cut_tac i=i in deltai_gt0)
         apply simp
         done
       finally show "{a'..b} \<subseteq> (\<Union>i \<in> S'. {l i<..<r i + delta i})" .
     qed
     with S'_def have Sprop2: "\<And>i. i \<in> S \<Longrightarrow> l i < r i" by auto
     from finS have "\<exists>n. \<forall>i \<in> S. i \<le> n"
       by (subst finite_nat_set_iff_bounded_le [symmetric])
     then obtain n where Sbound [rule_format]: "\<forall>i \<in> S. i \<le> n" ..
     have "F b - F a' \<le> (\<Sum>i\<in>S. F (r i + delta i) - F (l i))"
       apply (rule claim2 [rule_format])
       using finS Sprop apply auto
       apply (frule Sprop2)
       apply (subgoal_tac "delta i > 0")
       apply arith
       by (rule deltai_gt0)
     also have "... \<le> (\<Sum>i \<in> S. F(r i) - F(l i) + epsilon / 2^(i+2))"
       apply (rule sum_mono)
       apply simp
       apply (rule order_trans)
       apply (rule less_imp_le)
       apply (rule deltai_prop)
       by auto
     also have "... = (\<Sum>i \<in> S. F(r i) - F(l i)) +
         (epsilon / 4) * (\<Sum>i \<in> S. (1 / 2)^i)" (is "_ = ?t + _")
       by (subst sum.distrib) (simp add: field_simps sum_distrib_left)
     also have "... \<le> ?t + (epsilon / 4) * (\<Sum> i < Suc n. (1 / 2)^i)"
       apply (rule add_left_mono)
       apply (rule mult_left_mono)
       apply (rule sum_mono2)
       using egt0 apply auto
       by (frule Sbound, auto)
     also have "... \<le> ?t + (epsilon / 2)"
       apply (rule add_left_mono)
       apply (subst geometric_sum)
       apply auto
       apply (rule mult_left_mono)
       using egt0 apply auto
       done
     finally have aux2: "F b - F a' \<le> (\<Sum>i\<in>S. F (r i) - F (l i)) + epsilon / 2"
       by simp
 
     have "F b - F a = (F b - F a') + (F a' - F a)"
       by auto
     also have "... \<le> (F b - F a') + epsilon / 2"
       using a_prop by (intro add_left_mono) simp
     also have "... \<le> (\<Sum>i\<in>S. F (r i) - F (l i)) + epsilon / 2 + epsilon / 2"
       apply (intro add_right_mono)
       apply (rule aux2)
       done
     also have "... = (\<Sum>i\<in>S. F (r i) - F (l i)) + epsilon"
       by auto
     also have "... \<le> (\<Sum>i\<le>n. F (r i) - F (l i)) + epsilon"
       using finS Sbound Sprop by (auto intro!: add_right_mono sum_mono2)
     finally have "ennreal (F b - F a) \<le> (\<Sum>i\<le>n. ennreal (F (r i) - F (l i))) + epsilon"
       using egt0 by (simp add: sum_nonneg flip: ennreal_plus)
     then show "ennreal (F b - F a) \<le> (\<Sum>i. ennreal (F (r i) - F (l i))) + (epsilon :: real)"
       by (rule order_trans) (auto intro!: add_mono sum_le_suminf simp del: sum_ennreal)
   qed
   moreover have "(\<Sum>i. ennreal (F (r i) - F (l i))) \<le> ennreal (F b - F a)"
     using \<open>a \<le> b\<close> by (auto intro!: suminf_le_const ennreal_le_iff[THEN iffD2] claim1)
   ultimately show "(\<Sum>n. ennreal (F (r n) - F (l n))) = ennreal (F b - F a)"
     by (rule antisym[rotated])
 qed (auto simp: Ioc_inj mono_F)
 
 lemma measure_interval_measure_Ioc:
   assumes "a \<le> b" and "\<And>x y. x \<le> y \<Longrightarrow> F x \<le> F y" and "\<And>a. continuous (at_right a) F"
   shows "measure (interval_measure F) {a <.. b} = F b - F a"
   unfolding measure_def
   by (simp add: assms emeasure_interval_measure_Ioc)
 
 lemma emeasure_interval_measure_Ioc_eq:
   "(\<And>x y. x \<le> y \<Longrightarrow> F x \<le> F y) \<Longrightarrow> (\<And>a. continuous (at_right a) F) \<Longrightarrow>
     emeasure (interval_measure F) {a <.. b} = (if a \<le> b then F b - F a else 0)"
   using emeasure_interval_measure_Ioc[of a b F] by auto
 
 lemma\<^marker>\<open>tag important\<close> sets_interval_measure [simp, measurable_cong]:
     "sets (interval_measure F) = sets borel"
   apply (simp add: sets_extend_measure interval_measure_def borel_sigma_sets_Ioc)
   apply (rule sigma_sets_eqI)
   apply auto
   apply (case_tac "a \<le> ba")
   apply (auto intro: sigma_sets.Empty)
   done
 
 lemma space_interval_measure [simp]: "space (interval_measure F) = UNIV"
   by (simp add: interval_measure_def space_extend_measure)
 
 lemma emeasure_interval_measure_Icc:
   assumes "a \<le> b"
   assumes mono_F: "\<And>x y. x \<le> y \<Longrightarrow> F x \<le> F y"
   assumes cont_F : "continuous_on UNIV F"
   shows "emeasure (interval_measure F) {a .. b} = F b - F a"
 proof (rule tendsto_unique)
   { fix a b :: real assume "a \<le> b" then have "emeasure (interval_measure F) {a <.. b} = F b - F a"
       using cont_F
       by (subst emeasure_interval_measure_Ioc)
          (auto intro: mono_F continuous_within_subset simp: continuous_on_eq_continuous_within) }
   note * = this
 
   let ?F = "interval_measure F"
   show "((\<lambda>a. F b - F a) \<longlongrightarrow> emeasure ?F {a..b}) (at_left a)"
   proof (rule tendsto_at_left_sequentially)
     show "a - 1 < a" by simp
     fix X assume "\<And>n. X n < a" "incseq X" "X \<longlonglongrightarrow> a"
     with \<open>a \<le> b\<close> have "(\<lambda>n. emeasure ?F {X n<..b}) \<longlonglongrightarrow> emeasure ?F (\<Inter>n. {X n <..b})"
       apply (intro Lim_emeasure_decseq)
       apply (auto simp: decseq_def incseq_def emeasure_interval_measure_Ioc *)
       apply force
       apply (subst (asm ) *)
       apply (auto intro: less_le_trans less_imp_le)
       done
     also have "(\<Inter>n. {X n <..b}) = {a..b}"
       using \<open>\<And>n. X n < a\<close>
       apply auto
       apply (rule LIMSEQ_le_const2[OF \<open>X \<longlonglongrightarrow> a\<close>])
       apply (auto intro: less_imp_le)
       apply (auto intro: less_le_trans)
       done
     also have "(\<lambda>n. emeasure ?F {X n<..b}) = (\<lambda>n. F b - F (X n))"
       using \<open>\<And>n. X n < a\<close> \<open>a \<le> b\<close> by (subst *) (auto intro: less_imp_le less_le_trans)
     finally show "(\<lambda>n. F b - F (X n)) \<longlonglongrightarrow> emeasure ?F {a..b}" .
   qed
   show "((\<lambda>a. ennreal (F b - F a)) \<longlongrightarrow> F b - F a) (at_left a)"
     by (rule continuous_on_tendsto_compose[where g="\<lambda>x. x" and s=UNIV])
        (auto simp: continuous_on_ennreal continuous_on_diff cont_F)
 qed (rule trivial_limit_at_left_real)
 
 lemma\<^marker>\<open>tag important\<close> sigma_finite_interval_measure:
   assumes mono_F: "\<And>x y. x \<le> y \<Longrightarrow> F x \<le> F y"
   assumes right_cont_F : "\<And>a. continuous (at_right a) F"
   shows "sigma_finite_measure (interval_measure F)"
   apply unfold_locales
   apply (intro exI[of _ "(\<lambda>(a, b). {a <.. b}) ` (\<rat> \<times> \<rat>)"])
   apply (auto intro!: Rats_no_top_le Rats_no_bot_less countable_rat simp: emeasure_interval_measure_Ioc_eq[OF assms])
   done
 
 subsection \<open>Lebesgue-Borel measure\<close>
 
 definition\<^marker>\<open>tag important\<close> lborel :: "('a :: euclidean_space) measure" where
   "lborel = distr (\<Pi>\<^sub>M b\<in>Basis. interval_measure (\<lambda>x. x)) borel (\<lambda>f. \<Sum>b\<in>Basis. f b *\<^sub>R b)"
 
 abbreviation\<^marker>\<open>tag important\<close> lebesgue :: "'a::euclidean_space measure"
   where "lebesgue \<equiv> completion lborel"
 
 abbreviation\<^marker>\<open>tag important\<close> lebesgue_on :: "'a set \<Rightarrow> 'a::euclidean_space measure"
   where "lebesgue_on \<Omega> \<equiv> restrict_space (completion lborel) \<Omega>"
 
 lemma lebesgue_on_mono:
   assumes major: "AE x in lebesgue_on S. P x" and minor: "\<And>x.\<lbrakk>P x; x \<in> S\<rbrakk> \<Longrightarrow> Q x"
   shows "AE x in lebesgue_on S. Q x"
 proof -
   have "AE a in lebesgue_on S. P a \<longrightarrow> Q a"
     using minor space_restrict_space by fastforce
   then show ?thesis
     using major by auto
 qed
 
 lemma integral_eq_zero_null_sets:
   assumes "S \<in> null_sets lebesgue"
   shows "integral\<^sup>L (lebesgue_on S) f = 0"
 proof (rule integral_eq_zero_AE)
   show "AE x in lebesgue_on S. f x = 0"
     by (metis (no_types, lifting) assms AE_not_in lebesgue_on_mono null_setsD2 null_sets_restrict_space order_refl)
 qed
 
 lemma
   shows sets_lborel[simp, measurable_cong]: "sets lborel = sets borel"
     and space_lborel[simp]: "space lborel = space borel"
     and measurable_lborel1[simp]: "measurable M lborel = measurable M borel"
     and measurable_lborel2[simp]: "measurable lborel M = measurable borel M"
   by (simp_all add: lborel_def)
 
 lemma space_lebesgue_on [simp]: "space (lebesgue_on S) = S"
   by (simp add: space_restrict_space)
 
 lemma sets_lebesgue_on_refl [iff]: "S \<in> sets (lebesgue_on S)"
     by (metis inf_top.right_neutral sets.top space_borel space_completion space_lborel space_restrict_space)
 
 lemma Compl_in_sets_lebesgue: "-A \<in> sets lebesgue \<longleftrightarrow> A  \<in> sets lebesgue"
   by (metis Compl_eq_Diff_UNIV double_compl space_borel space_completion space_lborel Sigma_Algebra.sets.compl_sets)
 
 lemma measurable_lebesgue_cong:
   assumes "\<And>x. x \<in> S \<Longrightarrow> f x = g x"
   shows "f \<in> measurable (lebesgue_on S) M \<longleftrightarrow> g \<in> measurable (lebesgue_on S) M"
   by (metis (mono_tags, lifting) IntD1 assms measurable_cong_simp space_restrict_space)
 
 lemma lebesgue_on_UNIV_eq: "lebesgue_on UNIV = lebesgue"
 proof -
   have "measure_of UNIV (sets lebesgue) (emeasure lebesgue) = lebesgue"
     by (metis measure_of_of_measure space_borel space_completion space_lborel)
   then show ?thesis
     by (auto simp: restrict_space_def)
 qed
 
 lemma integral_restrict_Int:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue" "T \<in> sets lebesgue"
   shows "integral\<^sup>L (lebesgue_on T) (\<lambda>x. if x \<in> S then f x else 0) = integral\<^sup>L (lebesgue_on (S \<inter> T)) f"
 proof -
   have "(\<lambda>x. indicat_real T x *\<^sub>R (if x \<in> S then f x else 0)) = (\<lambda>x. indicat_real (S \<inter> T) x *\<^sub>R f x)"
     by (force simp: indicator_def)
   then show ?thesis
     by (simp add: assms sets.Int Bochner_Integration.integral_restrict_space)
 qed
 
 lemma integral_restrict:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<subseteq> T" "S \<in> sets lebesgue" "T \<in> sets lebesgue"
   shows "integral\<^sup>L (lebesgue_on T) (\<lambda>x. if x \<in> S then f x else 0) = integral\<^sup>L (lebesgue_on S) f"
   using integral_restrict_Int [of S T f] assms
   by (simp add: Int_absorb2)
 
 lemma integral_restrict_UNIV:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue"
   shows "integral\<^sup>L lebesgue (\<lambda>x. if x \<in> S then f x else 0) = integral\<^sup>L (lebesgue_on S) f"
   using integral_restrict_Int [of S UNIV f] assms
   by (simp add: lebesgue_on_UNIV_eq)
 
 lemma integrable_lebesgue_on_empty [iff]:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::{second_countable_topology,banach}"
   shows "integrable (lebesgue_on {}) f"
   by (simp add: integrable_restrict_space)
 
 lemma integral_lebesgue_on_empty [simp]:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::{second_countable_topology,banach}"
   shows "integral\<^sup>L (lebesgue_on {}) f = 0"
   by (simp add: Bochner_Integration.integral_empty)
 lemma has_bochner_integral_restrict_space:
   fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes \<Omega>: "\<Omega> \<inter> space M \<in> sets M"
   shows "has_bochner_integral (restrict_space M \<Omega>) f i
      \<longleftrightarrow> has_bochner_integral M (\<lambda>x. indicator \<Omega> x *\<^sub>R f x) i"
   by (simp add: integrable_restrict_space [OF assms] integral_restrict_space [OF assms] has_bochner_integral_iff)
 
 lemma integrable_restrict_UNIV:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes S: "S \<in> sets lebesgue"
   shows  "integrable lebesgue (\<lambda>x. if x \<in> S then f x else 0) \<longleftrightarrow> integrable (lebesgue_on S) f"
   using has_bochner_integral_restrict_space [of S lebesgue f] assms
   by (simp add: integrable.simps indicator_scaleR_eq_if)
 
 lemma integral_mono_lebesgue_on_AE:
   fixes f::"_ \<Rightarrow> real"
   assumes f: "integrable (lebesgue_on T) f"
     and gf: "AE x in (lebesgue_on S). g x \<le> f x"
     and f0: "AE x in (lebesgue_on T). 0 \<le> f x"
     and "S \<subseteq> T" and S: "S \<in> sets lebesgue" and T: "T \<in> sets lebesgue"
   shows "(\<integral>x. g x \<partial>(lebesgue_on S)) \<le> (\<integral>x. f x \<partial>(lebesgue_on T))"
 proof -
   have "(\<integral>x. g x \<partial>(lebesgue_on S)) = (\<integral>x. (if x \<in> S then g x else 0) \<partial>lebesgue)"
     by (simp add: Lebesgue_Measure.integral_restrict_UNIV S)
   also have "\<dots> \<le> (\<integral>x. (if x \<in> T then f x else 0) \<partial>lebesgue)"
   proof (rule Bochner_Integration.integral_mono_AE')
     show "integrable lebesgue (\<lambda>x. if x \<in> T then f x else 0)"
       by (simp add: integrable_restrict_UNIV T f)
     show "AE x in lebesgue. (if x \<in> S then g x else 0) \<le> (if x \<in> T then f x else 0)"
       using assms by (auto simp: AE_restrict_space_iff)
     show "AE x in lebesgue. 0 \<le> (if x \<in> T then f x else 0)"
       using f0 by (simp add: AE_restrict_space_iff T)
   qed
   also have "\<dots> = (\<integral>x. f x \<partial>(lebesgue_on T))"
     using Lebesgue_Measure.integral_restrict_UNIV T by blast
   finally show ?thesis .
 qed
 
 
 subsection \<open>Borel measurability\<close>
 
 lemma borel_measurable_if_I:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes f: "f \<in> borel_measurable (lebesgue_on S)" and S: "S \<in> sets lebesgue"
   shows "(\<lambda>x. if x \<in> S then f x else 0) \<in> borel_measurable lebesgue"
 proof -
   have eq: "{x. x \<notin> S} \<union> {x. f x \<in> Y} = {x. x \<notin> S} \<union> {x. f x \<in> Y} \<inter> S" for Y
     by blast
   show ?thesis
   using f S
   apply (simp add: vimage_def in_borel_measurable_borel Ball_def)
   apply (elim all_forward imp_forward asm_rl)
   apply (simp only: Collect_conj_eq Collect_disj_eq imp_conv_disj eq)
   apply (auto simp: Compl_eq [symmetric] Compl_in_sets_lebesgue sets_restrict_space_iff)
   done
 qed
 
 lemma borel_measurable_if_D:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "(\<lambda>x. if x \<in> S then f x else 0) \<in> borel_measurable lebesgue"
   shows "f \<in> borel_measurable (lebesgue_on S)"
   using assms
   apply (simp add: in_borel_measurable_borel Ball_def)
   apply (elim all_forward imp_forward asm_rl)
   apply (force simp: space_restrict_space sets_restrict_space image_iff intro: rev_bexI)
   done
 
 lemma borel_measurable_if:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue"
   shows "(\<lambda>x. if x \<in> S then f x else 0) \<in> borel_measurable lebesgue \<longleftrightarrow> f \<in> borel_measurable (lebesgue_on S)"
   using assms borel_measurable_if_D borel_measurable_if_I by blast
 
 lemma borel_measurable_if_lebesgue_on:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "S \<in> sets lebesgue" "T \<in> sets lebesgue" "S \<subseteq> T"
   shows "(\<lambda>x. if x \<in> S then f x else 0) \<in> borel_measurable (lebesgue_on T) \<longleftrightarrow> f \<in> borel_measurable (lebesgue_on S)"
     (is "?lhs = ?rhs")
 proof
   assume ?lhs then show ?rhs
     using measurable_restrict_mono [OF _ \<open>S \<subseteq> T\<close>]
     by (subst measurable_lebesgue_cong [where g = "(\<lambda>x. if x \<in> S then f x else 0)"]) auto
 next
   assume ?rhs then show ?lhs
     by (simp add: \<open>S \<in> sets lebesgue\<close> borel_measurable_if_I measurable_restrict_space1)
 qed
 
 lemma borel_measurable_vimage_halfspace_component_lt:
      "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
       (\<forall>a i. i \<in> Basis \<longrightarrow> {x \<in> S. f x \<bullet> i < a} \<in> sets (lebesgue_on S))"
   apply (rule trans [OF borel_measurable_iff_halfspace_less])
   apply (fastforce simp add: space_restrict_space)
   done
 
 lemma borel_measurable_vimage_halfspace_component_ge:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<forall>a i. i \<in> Basis \<longrightarrow> {x \<in> S. f x \<bullet> i \<ge> a} \<in> sets (lebesgue_on S))"
   apply (rule trans [OF borel_measurable_iff_halfspace_ge])
   apply (fastforce simp add: space_restrict_space)
   done
 
 lemma borel_measurable_vimage_halfspace_component_gt:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<forall>a i. i \<in> Basis \<longrightarrow> {x \<in> S. f x \<bullet> i > a} \<in> sets (lebesgue_on S))"
   apply (rule trans [OF borel_measurable_iff_halfspace_greater])
   apply (fastforce simp add: space_restrict_space)
   done
 
 lemma borel_measurable_vimage_halfspace_component_le:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<forall>a i. i \<in> Basis \<longrightarrow> {x \<in> S. f x \<bullet> i \<le> a} \<in> sets (lebesgue_on S))"
   apply (rule trans [OF borel_measurable_iff_halfspace_le])
   apply (fastforce simp add: space_restrict_space)
   done
 
 lemma
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows borel_measurable_vimage_open_interval:
          "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<forall>a b. {x \<in> S. f x \<in> box a b} \<in> sets (lebesgue_on S))" (is ?thesis1)
    and borel_measurable_vimage_open:
          "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<forall>T. open T \<longrightarrow> {x \<in> S. f x \<in> T} \<in> sets (lebesgue_on S))" (is ?thesis2)
 proof -
   have "{x \<in> S. f x \<in> box a b} \<in> sets (lebesgue_on S)" if "f \<in> borel_measurable (lebesgue_on S)" for a b
   proof -
     have "S = S \<inter> space lebesgue"
       by simp
     then have "S \<inter> (f -` box a b) \<in> sets (lebesgue_on S)"
       by (metis (no_types) box_borel in_borel_measurable_borel inf_sup_aci(1) space_restrict_space that)
     then show ?thesis
       by (simp add: Collect_conj_eq vimage_def)
   qed
   moreover
   have "{x \<in> S. f x \<in> T} \<in> sets (lebesgue_on S)"
        if T: "\<And>a b. {x \<in> S. f x \<in> box a b} \<in> sets (lebesgue_on S)" "open T" for T
   proof -
     obtain \<D> where "countable \<D>" and \<D>: "\<And>X. X \<in> \<D> \<Longrightarrow> \<exists>a b. X = box a b" "\<Union>\<D> = T"
       using open_countable_Union_open_box that \<open>open T\<close> by metis
     then have eq: "{x \<in> S. f x \<in> T} = (\<Union>U \<in> \<D>. {x \<in> S. f x \<in> U})"
       by blast
     have "{x \<in> S. f x \<in> U} \<in> sets (lebesgue_on S)" if "U \<in> \<D>" for U
       using that T \<D> by blast
     then show ?thesis
       by (auto simp: eq intro: Sigma_Algebra.sets.countable_UN' [OF \<open>countable \<D>\<close>])
   qed
   moreover
   have eq: "{x \<in> S. f x \<bullet> i < a} = {x \<in> S. f x \<in> {y. y \<bullet> i < a}}" for i a
     by auto
   have "f \<in> borel_measurable (lebesgue_on S)"
     if "\<And>T. open T \<Longrightarrow> {x \<in> S. f x \<in> T} \<in> sets (lebesgue_on S)"
     by (metis (no_types) eq borel_measurable_vimage_halfspace_component_lt open_halfspace_component_lt that)
   ultimately show "?thesis1" "?thesis2"
     by blast+
 qed
 
 lemma borel_measurable_vimage_closed:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<forall>T. closed T \<longrightarrow> {x \<in> S. f x \<in> T} \<in> sets (lebesgue_on S))"
         (is "?lhs = ?rhs")
 proof -
   have eq: "{x \<in> S. f x \<in> T} = S - {x \<in> S. f x \<in> (- T)}" for T
     by auto
   show ?thesis
     apply (simp add: borel_measurable_vimage_open, safe)
      apply (simp_all (no_asm) add: eq)
      apply (intro sets.Diff sets_lebesgue_on_refl, force simp: closed_open)
     apply (intro sets.Diff sets_lebesgue_on_refl, force simp: open_closed)
     done
 qed
 
 lemma borel_measurable_vimage_closed_interval:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<forall>a b. {x \<in> S. f x \<in> cbox a b} \<in> sets (lebesgue_on S))"
         (is "?lhs = ?rhs")
 proof
   assume ?lhs then show ?rhs
     using borel_measurable_vimage_closed by blast
 next
   assume RHS: ?rhs
   have "{x \<in> S. f x \<in> T} \<in> sets (lebesgue_on S)" if "open T" for T
   proof -
     obtain \<D> where "countable \<D>" and \<D>: "\<D> \<subseteq> Pow T" "\<And>X. X \<in> \<D> \<Longrightarrow> \<exists>a b. X = cbox a b" "\<Union>\<D> = T"
       using open_countable_Union_open_cbox that \<open>open T\<close> by metis
     then have eq: "{x \<in> S. f x \<in> T} = (\<Union>U \<in> \<D>. {x \<in> S. f x \<in> U})"
       by blast
     have "{x \<in> S. f x \<in> U} \<in> sets (lebesgue_on S)" if "U \<in> \<D>" for U
       using that \<D> by (metis RHS)
     then show ?thesis
       by (auto simp: eq intro: Sigma_Algebra.sets.countable_UN' [OF \<open>countable \<D>\<close>])
   qed
   then show ?lhs
     by (simp add: borel_measurable_vimage_open)
 qed
 
 lemma borel_measurable_vimage_borel:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f \<in> borel_measurable (lebesgue_on S) \<longleftrightarrow>
          (\<forall>T. T \<in> sets borel \<longrightarrow> {x \<in> S. f x \<in> T} \<in> sets (lebesgue_on S))"
         (is "?lhs = ?rhs")
 proof
   assume f: ?lhs
   then show ?rhs
     using measurable_sets [OF f]
       by (simp add: Collect_conj_eq inf_sup_aci(1) space_restrict_space vimage_def)
 qed (simp add: borel_measurable_vimage_open_interval)
 
 lemma lebesgue_measurable_vimage_borel:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   assumes "f \<in> borel_measurable lebesgue" "T \<in> sets borel"
   shows "{x. f x \<in> T} \<in> sets lebesgue"
   using assms borel_measurable_vimage_borel [of f UNIV] by auto
 
 lemma borel_measurable_lebesgue_preimage_borel:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
   shows "f \<in> borel_measurable lebesgue \<longleftrightarrow>
          (\<forall>T. T \<in> sets borel \<longrightarrow> {x. f x \<in> T} \<in> sets lebesgue)"
   apply (intro iffI allI impI lebesgue_measurable_vimage_borel)
     apply (auto simp: in_borel_measurable_borel vimage_def)
   done
 
 
 subsection \<^marker>\<open>tag unimportant\<close> \<open>Measurability of continuous functions\<close>
 
 lemma continuous_imp_measurable_on_sets_lebesgue:
   assumes f: "continuous_on S f" and S: "S \<in> sets lebesgue"
   shows "f \<in> borel_measurable (lebesgue_on S)"
 proof -
   have "sets (restrict_space borel S) \<subseteq> sets (lebesgue_on S)"
     by (simp add: mono_restrict_space subsetI)
   then show ?thesis
     by (simp add: borel_measurable_continuous_on_restrict [OF f] borel_measurable_subalgebra 
                   space_restrict_space)
 qed
 
 lemma id_borel_measurable_lebesgue [iff]: "id \<in> borel_measurable lebesgue"
   by (simp add: measurable_completion)
 
 lemma id_borel_measurable_lebesgue_on [iff]: "id \<in> borel_measurable (lebesgue_on S)"
   by (simp add: measurable_completion measurable_restrict_space1)
 
 context
 begin
 
 interpretation sigma_finite_measure "interval_measure (\<lambda>x. x)"
   by (rule sigma_finite_interval_measure) auto
 interpretation finite_product_sigma_finite "\<lambda>_. interval_measure (\<lambda>x. x)" Basis
   proof qed simp
 
 lemma lborel_eq_real: "lborel = interval_measure (\<lambda>x. x)"
   unfolding lborel_def Basis_real_def
   using distr_id[of "interval_measure (\<lambda>x. x)"]
   by (subst distr_component[symmetric])
      (simp_all add: distr_distr comp_def del: distr_id cong: distr_cong)
 
 lemma lborel_eq: "lborel = distr (\<Pi>\<^sub>M b\<in>Basis. lborel) borel (\<lambda>f. \<Sum>b\<in>Basis. f b *\<^sub>R b)"
   by (subst lborel_def) (simp add: lborel_eq_real)
 
 lemma nn_integral_lborel_prod:
   assumes [measurable]: "\<And>b. b \<in> Basis \<Longrightarrow> f b \<in> borel_measurable borel"
   assumes nn[simp]: "\<And>b x. b \<in> Basis \<Longrightarrow> 0 \<le> f b x"
   shows "(\<integral>\<^sup>+x. (\<Prod>b\<in>Basis. f b (x \<bullet> b)) \<partial>lborel) = (\<Prod>b\<in>Basis. (\<integral>\<^sup>+x. f b x \<partial>lborel))"
   by (simp add: lborel_def nn_integral_distr product_nn_integral_prod
                 product_nn_integral_singleton)
 
 lemma emeasure_lborel_Icc[simp]:
   fixes l u :: real
   assumes [simp]: "l \<le> u"
   shows "emeasure lborel {l .. u} = u - l"
 proof -
   have "((\<lambda>f. f 1) -` {l..u} \<inter> space (Pi\<^sub>M {1} (\<lambda>b. interval_measure (\<lambda>x. x)))) = {1::real} \<rightarrow>\<^sub>E {l..u}"
     by (auto simp: space_PiM)
   then show ?thesis
     by (simp add: lborel_def emeasure_distr emeasure_PiM emeasure_interval_measure_Icc)
 qed
 
 lemma emeasure_lborel_Icc_eq: "emeasure lborel {l .. u} = ennreal (if l \<le> u then u - l else 0)"
   by simp
 
 lemma\<^marker>\<open>tag important\<close> emeasure_lborel_cbox[simp]:
   assumes [simp]: "\<And>b. b \<in> Basis \<Longrightarrow> l \<bullet> b \<le> u \<bullet> b"
   shows "emeasure lborel (cbox l u) = (\<Prod>b\<in>Basis. (u - l) \<bullet> b)"
 proof -
   have "(\<lambda>x. \<Prod>b\<in>Basis. indicator {l\<bullet>b .. u\<bullet>b} (x \<bullet> b) :: ennreal) = indicator (cbox l u)"
     by (auto simp: fun_eq_iff cbox_def split: split_indicator)
   then have "emeasure lborel (cbox l u) = (\<integral>\<^sup>+x. (\<Prod>b\<in>Basis. indicator {l\<bullet>b .. u\<bullet>b} (x \<bullet> b)) \<partial>lborel)"
     by simp
   also have "\<dots> = (\<Prod>b\<in>Basis. (u - l) \<bullet> b)"
     by (subst nn_integral_lborel_prod) (simp_all add: prod_ennreal inner_diff_left)
   finally show ?thesis .
 qed
 
 lemma AE_lborel_singleton: "AE x in lborel::'a::euclidean_space measure. x \<noteq> c"
   using SOME_Basis AE_discrete_difference [of "{c}" lborel] emeasure_lborel_cbox [of c c]
   by (auto simp add: power_0_left)
 
 lemma emeasure_lborel_Ioo[simp]:
   assumes [simp]: "l \<le> u"
   shows "emeasure lborel {l <..< u} = ennreal (u - l)"
 proof -
   have "emeasure lborel {l <..< u} = emeasure lborel {l .. u}"
     using AE_lborel_singleton[of u] AE_lborel_singleton[of l] by (intro emeasure_eq_AE) auto
   then show ?thesis
     by simp
 qed
 
 lemma emeasure_lborel_Ioc[simp]:
   assumes [simp]: "l \<le> u"
   shows "emeasure lborel {l <.. u} = ennreal (u - l)"
 proof -
   have "emeasure lborel {l <.. u} = emeasure lborel {l .. u}"
     using AE_lborel_singleton[of u] AE_lborel_singleton[of l] by (intro emeasure_eq_AE) auto
   then show ?thesis
     by simp
 qed
 
 lemma emeasure_lborel_Ico[simp]:
   assumes [simp]: "l \<le> u"
   shows "emeasure lborel {l ..< u} = ennreal (u - l)"
 proof -
   have "emeasure lborel {l ..< u} = emeasure lborel {l .. u}"
     using AE_lborel_singleton[of u] AE_lborel_singleton[of l] by (intro emeasure_eq_AE) auto
   then show ?thesis
     by simp
 qed
 
 lemma emeasure_lborel_box[simp]:
   assumes [simp]: "\<And>b. b \<in> Basis \<Longrightarrow> l \<bullet> b \<le> u \<bullet> b"
   shows "emeasure lborel (box l u) = (\<Prod>b\<in>Basis. (u - l) \<bullet> b)"
 proof -
   have "(\<lambda>x. \<Prod>b\<in>Basis. indicator {l\<bullet>b <..< u\<bullet>b} (x \<bullet> b) :: ennreal) = indicator (box l u)"
     by (auto simp: fun_eq_iff box_def split: split_indicator)
   then have "emeasure lborel (box l u) = (\<integral>\<^sup>+x. (\<Prod>b\<in>Basis. indicator {l\<bullet>b <..< u\<bullet>b} (x \<bullet> b)) \<partial>lborel)"
     by simp
   also have "\<dots> = (\<Prod>b\<in>Basis. (u - l) \<bullet> b)"
     by (subst nn_integral_lborel_prod) (simp_all add: prod_ennreal inner_diff_left)
   finally show ?thesis .
 qed
 
 lemma emeasure_lborel_cbox_eq:
   "emeasure lborel (cbox l u) = (if \<forall>b\<in>Basis. l \<bullet> b \<le> u \<bullet> b then \<Prod>b\<in>Basis. (u - l) \<bullet> b else 0)"
   using box_eq_empty(2)[THEN iffD2, of u l] by (auto simp: not_le)
 
 lemma emeasure_lborel_box_eq:
   "emeasure lborel (box l u) = (if \<forall>b\<in>Basis. l \<bullet> b \<le> u \<bullet> b then \<Prod>b\<in>Basis. (u - l) \<bullet> b else 0)"
   using box_eq_empty(1)[THEN iffD2, of u l] by (auto simp: not_le dest!: less_imp_le) force
 
 lemma emeasure_lborel_singleton[simp]: "emeasure lborel {x} = 0"
   using emeasure_lborel_cbox[of x x] nonempty_Basis
   by (auto simp del: emeasure_lborel_cbox nonempty_Basis)
 
+lemma emeasure_lborel_cbox_finite: "emeasure lborel (cbox a b) < \<infinity>"
+  by (auto simp: emeasure_lborel_cbox_eq)
+
+lemma emeasure_lborel_box_finite: "emeasure lborel (box a b) < \<infinity>"
+  by (auto simp: emeasure_lborel_box_eq)
+
+lemma emeasure_lborel_ball_finite: "emeasure lborel (ball c r) < \<infinity>"
+proof -
+  have "bounded (ball c r)" by simp
+  from bounded_subset_cbox_symmetric[OF this] obtain a where a: "ball c r \<subseteq> cbox (-a) a"
+    by auto
+  hence "emeasure lborel (ball c r) \<le> emeasure lborel (cbox (-a) a)"
+    by (intro emeasure_mono) auto
+  also have "\<dots> < \<infinity>" by (simp add: emeasure_lborel_cbox_eq)
+  finally show ?thesis .
+qed
+
+lemma emeasure_lborel_cball_finite: "emeasure lborel (cball c r) < \<infinity>"
+proof -
+  have "bounded (cball c r)" by simp
+  from bounded_subset_cbox_symmetric[OF this] obtain a where a: "cball c r \<subseteq> cbox (-a) a"
+    by auto
+  hence "emeasure lborel (cball c r) \<le> emeasure lborel (cbox (-a) a)"
+    by (intro emeasure_mono) auto
+  also have "\<dots> < \<infinity>" by (simp add: emeasure_lborel_cbox_eq)
+  finally show ?thesis .
+qed
+
 lemma fmeasurable_cbox [iff]: "cbox a b \<in> fmeasurable lborel"
   and fmeasurable_box [iff]: "box a b \<in> fmeasurable lborel"
   by (auto simp: fmeasurable_def emeasure_lborel_box_eq emeasure_lborel_cbox_eq)
 
 lemma
   fixes l u :: real
   assumes [simp]: "l \<le> u"
   shows measure_lborel_Icc[simp]: "measure lborel {l .. u} = u - l"
     and measure_lborel_Ico[simp]: "measure lborel {l ..< u} = u - l"
     and measure_lborel_Ioc[simp]: "measure lborel {l <.. u} = u - l"
     and measure_lborel_Ioo[simp]: "measure lborel {l <..< u} = u - l"
   by (simp_all add: measure_def)
 
 lemma
   assumes [simp]: "\<And>b. b \<in> Basis \<Longrightarrow> l \<bullet> b \<le> u \<bullet> b"
   shows measure_lborel_box[simp]: "measure lborel (box l u) = (\<Prod>b\<in>Basis. (u - l) \<bullet> b)"
     and measure_lborel_cbox[simp]: "measure lborel (cbox l u) = (\<Prod>b\<in>Basis. (u - l) \<bullet> b)"
   by (simp_all add: measure_def inner_diff_left prod_nonneg)
 
 lemma measure_lborel_cbox_eq:
   "measure lborel (cbox l u) = (if \<forall>b\<in>Basis. l \<bullet> b \<le> u \<bullet> b then \<Prod>b\<in>Basis. (u - l) \<bullet> b else 0)"
   using box_eq_empty(2)[THEN iffD2, of u l] by (auto simp: not_le)
 
 lemma measure_lborel_box_eq:
   "measure lborel (box l u) = (if \<forall>b\<in>Basis. l \<bullet> b \<le> u \<bullet> b then \<Prod>b\<in>Basis. (u - l) \<bullet> b else 0)"
   using box_eq_empty(1)[THEN iffD2, of u l] by (auto simp: not_le dest!: less_imp_le) force
 
 lemma measure_lborel_singleton[simp]: "measure lborel {x} = 0"
   by (simp add: measure_def)
 
 lemma sigma_finite_lborel: "sigma_finite_measure lborel"
 proof
   show "\<exists>A::'a set set. countable A \<and> A \<subseteq> sets lborel \<and> \<Union>A = space lborel \<and> (\<forall>a\<in>A. emeasure lborel a \<noteq> \<infinity>)"
     by (intro exI[of _ "range (\<lambda>n::nat. box (- real n *\<^sub>R One) (real n *\<^sub>R One))"])
        (auto simp: emeasure_lborel_cbox_eq UN_box_eq_UNIV)
 qed
 
 end
 
 lemma emeasure_lborel_UNIV [simp]: "emeasure lborel (UNIV::'a::euclidean_space set) = \<infinity>"
 proof -
   { fix n::nat
     let ?Ba = "Basis :: 'a set"
     have "real n \<le> (2::real) ^ card ?Ba * real n"
       by (simp add: mult_le_cancel_right1)
     also
     have "... \<le> (2::real) ^ card ?Ba * real (Suc n) ^ card ?Ba"
       apply (rule mult_left_mono)
       apply (metis DIM_positive One_nat_def less_eq_Suc_le less_imp_le of_nat_le_iff of_nat_power self_le_power zero_less_Suc)
       apply (simp)
       done
     finally have "real n \<le> (2::real) ^ card ?Ba * real (Suc n) ^ card ?Ba" .
   } note [intro!] = this
   show ?thesis
     unfolding UN_box_eq_UNIV[symmetric]
     apply (subst SUP_emeasure_incseq[symmetric])
     apply (auto simp: incseq_def subset_box inner_add_left
       simp del: Sup_eq_top_iff SUP_eq_top_iff
       intro!: ennreal_SUP_eq_top)
     done
 qed
 
 lemma emeasure_lborel_countable:
   fixes A :: "'a::euclidean_space set"
   assumes "countable A"
   shows "emeasure lborel A = 0"
 proof -
   have "A \<subseteq> (\<Union>i. {from_nat_into A i})" using from_nat_into_surj assms by force
   then have "emeasure lborel A \<le> emeasure lborel (\<Union>i. {from_nat_into A i})"
     by (intro emeasure_mono) auto
   also have "emeasure lborel (\<Union>i. {from_nat_into A i}) = 0"
     by (rule emeasure_UN_eq_0) auto
   finally show ?thesis
     by (auto simp add: )
 qed
 
 lemma countable_imp_null_set_lborel: "countable A \<Longrightarrow> A \<in> null_sets lborel"
   by (simp add: null_sets_def emeasure_lborel_countable sets.countable)
 
 lemma finite_imp_null_set_lborel: "finite A \<Longrightarrow> A \<in> null_sets lborel"
   by (intro countable_imp_null_set_lborel countable_finite)
 
 lemma insert_null_sets_iff [simp]: "insert a N \<in> null_sets lebesgue \<longleftrightarrow> N \<in> null_sets lebesgue"     
     (is "?lhs = ?rhs")
 proof
   assume ?lhs then show ?rhs
     by (meson completion.complete2 subset_insertI)
 next
   assume ?rhs then show ?lhs
   by (simp add: null_sets.insert_in_sets null_setsI)
 qed
 
 lemma insert_null_sets_lebesgue_on_iff [simp]:
   assumes "a \<in> S" "S \<in> sets lebesgue"
   shows "insert a N \<in> null_sets (lebesgue_on S) \<longleftrightarrow> N \<in> null_sets (lebesgue_on S)"     
   by (simp add: assms null_sets_restrict_space)
 
 lemma lborel_neq_count_space[simp]: "lborel \<noteq> count_space (A::('a::ordered_euclidean_space) set)"
 proof
   assume asm: "lborel = count_space A"
   have "space lborel = UNIV" by simp
   hence [simp]: "A = UNIV" by (subst (asm) asm) (simp only: space_count_space)
   have "emeasure lborel {undefined::'a} = 1"
       by (subst asm, subst emeasure_count_space_finite) auto
   moreover have "emeasure lborel {undefined} \<noteq> 1" by simp
   ultimately show False by contradiction
 qed
 
 lemma mem_closed_if_AE_lebesgue_open:
   assumes "open S" "closed C"
   assumes "AE x \<in> S in lebesgue. x \<in> C"
   assumes "x \<in> S"
   shows "x \<in> C"
 proof (rule ccontr)
   assume xC: "x \<notin> C"
   with openE[of "S - C"] assms
   obtain e where e: "0 < e" "ball x e \<subseteq> S - C"
     by blast
   then obtain a b where box: "x \<in> box a b" "box a b \<subseteq> S - C"
     by (metis rational_boxes order_trans)
   then have "0 < emeasure lebesgue (box a b)"
     by (auto simp: emeasure_lborel_box_eq mem_box algebra_simps intro!: prod_pos)
   also have "\<dots> \<le> emeasure lebesgue (S - C)"
     using assms box
     by (auto intro!: emeasure_mono)
   also have "\<dots> = 0"
     using assms
     by (auto simp: eventually_ae_filter completion.complete2 set_diff_eq null_setsD1)
   finally show False by simp
 qed
 
 lemma mem_closed_if_AE_lebesgue: "closed C \<Longrightarrow> (AE x in lebesgue. x \<in> C) \<Longrightarrow> x \<in> C"
   using mem_closed_if_AE_lebesgue_open[OF open_UNIV] by simp
 
 
 subsection \<open>Affine transformation on the Lebesgue-Borel\<close>
 
 lemma\<^marker>\<open>tag important\<close> lborel_eqI:
   fixes M :: "'a::euclidean_space measure"
   assumes emeasure_eq: "\<And>l u. (\<And>b. b \<in> Basis \<Longrightarrow> l \<bullet> b \<le> u \<bullet> b) \<Longrightarrow> emeasure M (box l u) = (\<Prod>b\<in>Basis. (u - l) \<bullet> b)"
   assumes sets_eq: "sets M = sets borel"
   shows "lborel = M"
 proof (rule measure_eqI_generator_eq)
   let ?E = "range (\<lambda>(a, b). box a b::'a set)"
   show "Int_stable ?E"
     by (auto simp: Int_stable_def box_Int_box)
 
   show "?E \<subseteq> Pow UNIV" "sets lborel = sigma_sets UNIV ?E" "sets M = sigma_sets UNIV ?E"
     by (simp_all add: borel_eq_box sets_eq)
 
   let ?A = "\<lambda>n::nat. box (- (real n *\<^sub>R One)) (real n *\<^sub>R One) :: 'a set"
   show "range ?A \<subseteq> ?E" "(\<Union>i. ?A i) = UNIV"
     unfolding UN_box_eq_UNIV by auto
 
   { fix i show "emeasure lborel (?A i) \<noteq> \<infinity>" by auto }
   { fix X assume "X \<in> ?E" then show "emeasure lborel X = emeasure M X"
       apply (auto simp: emeasure_eq emeasure_lborel_box_eq)
       apply (subst box_eq_empty(1)[THEN iffD2])
       apply (auto intro: less_imp_le simp: not_le)
       done }
 qed
 
 lemma\<^marker>\<open>tag important\<close> lborel_affine_euclidean:
   fixes c :: "'a::euclidean_space \<Rightarrow> real" and t
   defines "T x \<equiv> t + (\<Sum>j\<in>Basis. (c j * (x \<bullet> j)) *\<^sub>R j)"
   assumes c: "\<And>j. j \<in> Basis \<Longrightarrow> c j \<noteq> 0"
   shows "lborel = density (distr lborel borel T) (\<lambda>_. (\<Prod>j\<in>Basis. \<bar>c j\<bar>))" (is "_ = ?D")
 proof (rule lborel_eqI)
   let ?B = "Basis :: 'a set"
   fix l u assume le: "\<And>b. b \<in> ?B \<Longrightarrow> l \<bullet> b \<le> u \<bullet> b"
   have [measurable]: "T \<in> borel \<rightarrow>\<^sub>M borel"
     by (simp add: T_def[abs_def])
   have eq: "T -` box l u = box
     (\<Sum>j\<in>Basis. (((if 0 < c j then l - t else u - t) \<bullet> j) / c j) *\<^sub>R j)
     (\<Sum>j\<in>Basis. (((if 0 < c j then u - t else l - t) \<bullet> j) / c j) *\<^sub>R j)"
     using c by (auto simp: box_def T_def field_simps inner_simps divide_less_eq)
   with le c show "emeasure ?D (box l u) = (\<Prod>b\<in>?B. (u - l) \<bullet> b)"
     by (auto simp: emeasure_density emeasure_distr nn_integral_multc emeasure_lborel_box_eq inner_simps
                    field_split_simps ennreal_mult'[symmetric] prod_nonneg prod.distrib[symmetric]
              intro!: prod.cong)
 qed simp
 
 lemma lborel_affine:
   fixes t :: "'a::euclidean_space"
   shows "c \<noteq> 0 \<Longrightarrow> lborel = density (distr lborel borel (\<lambda>x. t + c *\<^sub>R x)) (\<lambda>_. \<bar>c\<bar>^DIM('a))"
   using lborel_affine_euclidean[where c="\<lambda>_::'a. c" and t=t]
   unfolding scaleR_scaleR[symmetric] scaleR_sum_right[symmetric] euclidean_representation prod_constant by simp
 
 lemma lborel_real_affine:
   "c \<noteq> 0 \<Longrightarrow> lborel = density (distr lborel borel (\<lambda>x. t + c * x)) (\<lambda>_. ennreal (abs c))"
   using lborel_affine[of c t] by simp
 
 lemma AE_borel_affine:
   fixes P :: "real \<Rightarrow> bool"
   shows "c \<noteq> 0 \<Longrightarrow> Measurable.pred borel P \<Longrightarrow> AE x in lborel. P x \<Longrightarrow> AE x in lborel. P (t + c * x)"
   by (subst lborel_real_affine[where t="- t / c" and c="1 / c"])
      (simp_all add: AE_density AE_distr_iff field_simps)
 
 lemma nn_integral_real_affine:
   fixes c :: real assumes [measurable]: "f \<in> borel_measurable borel" and c: "c \<noteq> 0"
   shows "(\<integral>\<^sup>+x. f x \<partial>lborel) = \<bar>c\<bar> * (\<integral>\<^sup>+x. f (t + c * x) \<partial>lborel)"
   by (subst lborel_real_affine[OF c, of t])
      (simp add: nn_integral_density nn_integral_distr nn_integral_cmult)
 
 lemma lborel_integrable_real_affine:
   fixes f :: "real \<Rightarrow> 'a :: {banach, second_countable_topology}"
   assumes f: "integrable lborel f"
   shows "c \<noteq> 0 \<Longrightarrow> integrable lborel (\<lambda>x. f (t + c * x))"
   using f f[THEN borel_measurable_integrable] unfolding integrable_iff_bounded
   by (subst (asm) nn_integral_real_affine[where c=c and t=t]) (auto simp: ennreal_mult_less_top)
 
 lemma lborel_integrable_real_affine_iff:
   fixes f :: "real \<Rightarrow> 'a :: {banach, second_countable_topology}"
   shows "c \<noteq> 0 \<Longrightarrow> integrable lborel (\<lambda>x. f (t + c * x)) \<longleftrightarrow> integrable lborel f"
   using
     lborel_integrable_real_affine[of f c t]
     lborel_integrable_real_affine[of "\<lambda>x. f (t + c * x)" "1/c" "-t/c"]
   by (auto simp add: field_simps)
 
 lemma\<^marker>\<open>tag important\<close> lborel_integral_real_affine:
   fixes f :: "real \<Rightarrow> 'a :: {banach, second_countable_topology}" and c :: real
   assumes c: "c \<noteq> 0" shows "(\<integral>x. f x \<partial> lborel) = \<bar>c\<bar> *\<^sub>R (\<integral>x. f (t + c * x) \<partial>lborel)"
 proof cases
   assume f[measurable]: "integrable lborel f" then show ?thesis
     using c f f[THEN borel_measurable_integrable] f[THEN lborel_integrable_real_affine, of c t]
     by (subst lborel_real_affine[OF c, of t])
        (simp add: integral_density integral_distr)
 next
   assume "\<not> integrable lborel f" with c show ?thesis
     by (simp add: lborel_integrable_real_affine_iff not_integrable_integral_eq)
 qed
 
 lemma
   fixes c :: "'a::euclidean_space \<Rightarrow> real" and t
   assumes c: "\<And>j. j \<in> Basis \<Longrightarrow> c j \<noteq> 0"
   defines "T == (\<lambda>x. t + (\<Sum>j\<in>Basis. (c j * (x \<bullet> j)) *\<^sub>R j))"
   shows lebesgue_affine_euclidean: "lebesgue = density (distr lebesgue lebesgue T) (\<lambda>_. (\<Prod>j\<in>Basis. \<bar>c j\<bar>))" (is "_ = ?D")
     and lebesgue_affine_measurable: "T \<in> lebesgue \<rightarrow>\<^sub>M lebesgue"
 proof -
   have T_borel[measurable]: "T \<in> borel \<rightarrow>\<^sub>M borel"
     by (auto simp: T_def[abs_def])
   { fix A :: "'a set" assume A: "A \<in> sets borel"
     then have "emeasure lborel A = 0 \<longleftrightarrow> emeasure (density (distr lborel borel T) (\<lambda>_. (\<Prod>j\<in>Basis. \<bar>c j\<bar>))) A = 0"
       unfolding T_def using c by (subst lborel_affine_euclidean[symmetric]) auto
     also have "\<dots> \<longleftrightarrow> emeasure (distr lebesgue lborel T) A = 0"
       using A c by (simp add: distr_completion emeasure_density nn_integral_cmult prod_nonneg cong: distr_cong)
     finally have "emeasure lborel A = 0 \<longleftrightarrow> emeasure (distr lebesgue lborel T) A = 0" . }
   then have eq: "null_sets lborel = null_sets (distr lebesgue lborel T)"
     by (auto simp: null_sets_def)
 
   show "T \<in> lebesgue \<rightarrow>\<^sub>M lebesgue"
     by (rule completion.measurable_completion2) (auto simp: eq measurable_completion)
 
   have "lebesgue = completion (density (distr lborel borel T) (\<lambda>_. (\<Prod>j\<in>Basis. \<bar>c j\<bar>)))"
     using c by (subst lborel_affine_euclidean[of c t]) (simp_all add: T_def[abs_def])
   also have "\<dots> = density (completion (distr lebesgue lborel T)) (\<lambda>_. (\<Prod>j\<in>Basis. \<bar>c j\<bar>))"
     using c by (auto intro!: always_eventually prod_pos completion_density_eq simp: distr_completion cong: distr_cong)
   also have "\<dots> = density (distr lebesgue lebesgue T) (\<lambda>_. (\<Prod>j\<in>Basis. \<bar>c j\<bar>))"
     by (subst completion.completion_distr_eq) (auto simp: eq measurable_completion)
   finally show "lebesgue = density (distr lebesgue lebesgue T) (\<lambda>_. (\<Prod>j\<in>Basis. \<bar>c j\<bar>))" .
 qed
 
 corollary lebesgue_real_affine:
   "c \<noteq> 0 \<Longrightarrow> lebesgue = density (distr lebesgue lebesgue (\<lambda>x. t + c * x)) (\<lambda>_. ennreal (abs c))"
     using lebesgue_affine_euclidean [where c= "\<lambda>x::real. c"] by simp
 
 lemma nn_integral_real_affine_lebesgue:
   fixes c :: real assumes f[measurable]: "f \<in> borel_measurable lebesgue" and c: "c \<noteq> 0"
   shows "(\<integral>\<^sup>+x. f x \<partial>lebesgue) = ennreal\<bar>c\<bar> * (\<integral>\<^sup>+x. f(t + c * x) \<partial>lebesgue)"
 proof -
   have "(\<integral>\<^sup>+x. f x \<partial>lebesgue) = (\<integral>\<^sup>+x. f x \<partial>density (distr lebesgue lebesgue (\<lambda>x. t + c * x)) (\<lambda>x. ennreal \<bar>c\<bar>))"
     using lebesgue_real_affine c by auto
   also have "\<dots> = \<integral>\<^sup>+ x. ennreal \<bar>c\<bar> * f x \<partial>distr lebesgue lebesgue (\<lambda>x. t + c * x)"
     by (subst nn_integral_density) auto
   also have "\<dots> = ennreal \<bar>c\<bar> * integral\<^sup>N (distr lebesgue lebesgue (\<lambda>x. t + c * x)) f"
     using f measurable_distr_eq1 nn_integral_cmult by blast
   also have "\<dots> = \<bar>c\<bar> * (\<integral>\<^sup>+x. f(t + c * x) \<partial>lebesgue)"
     using lebesgue_affine_measurable[where c= "\<lambda>x::real. c"]
     by (subst nn_integral_distr) (force+)
   finally show ?thesis .
 qed
 
 lemma lebesgue_measurable_scaling[measurable]: "(*\<^sub>R) x \<in> lebesgue \<rightarrow>\<^sub>M lebesgue"
 proof cases
   assume "x = 0"
   then have "(*\<^sub>R) x = (\<lambda>x. 0::'a)"
     by (auto simp: fun_eq_iff)
   then show ?thesis by auto
 next
   assume "x \<noteq> 0" then show ?thesis
     using lebesgue_affine_measurable[of "\<lambda>_. x" 0]
     unfolding scaleR_scaleR[symmetric] scaleR_sum_right[symmetric] euclidean_representation
     by (auto simp add: ac_simps)
 qed
 
 lemma
   fixes m :: real and \<delta> :: "'a::euclidean_space"
   defines "T r d x \<equiv> r *\<^sub>R x + d"
   shows emeasure_lebesgue_affine: "emeasure lebesgue (T m \<delta> ` S) = \<bar>m\<bar> ^ DIM('a) * emeasure lebesgue S" (is ?e)
     and measure_lebesgue_affine: "measure lebesgue (T m \<delta> ` S) = \<bar>m\<bar> ^ DIM('a) * measure lebesgue S" (is ?m)
 proof -
   show ?e
   proof cases
     assume "m = 0" then show ?thesis
       by (simp add: image_constant_conv T_def[abs_def])
   next
     let ?T = "T m \<delta>" and ?T' = "T (1 / m) (- ((1/m) *\<^sub>R \<delta>))"
     assume "m \<noteq> 0"
     then have s_comp_s: "?T' \<circ> ?T = id" "?T \<circ> ?T' = id"
       by (auto simp: T_def[abs_def] fun_eq_iff scaleR_add_right scaleR_diff_right)
     then have "inv ?T' = ?T" "bij ?T'"
       by (auto intro: inv_unique_comp o_bij)
     then have eq: "T m \<delta> ` S = T (1 / m) ((-1/m) *\<^sub>R \<delta>) -` S \<inter> space lebesgue"
       using bij_vimage_eq_inv_image[OF \<open>bij ?T'\<close>, of S] by auto
 
     have trans_eq_T: "(\<lambda>x. \<delta> + (\<Sum>j\<in>Basis. (m * (x \<bullet> j)) *\<^sub>R j)) = T m \<delta>" for m \<delta>
       unfolding T_def[abs_def] scaleR_scaleR[symmetric] scaleR_sum_right[symmetric]
       by (auto simp add: euclidean_representation ac_simps)
 
     have T[measurable]: "T r d \<in> lebesgue \<rightarrow>\<^sub>M lebesgue" for r d
       using lebesgue_affine_measurable[of "\<lambda>_. r" d]
       by (cases "r = 0") (auto simp: trans_eq_T T_def[abs_def])
 
     show ?thesis
     proof cases
       assume "S \<in> sets lebesgue" with \<open>m \<noteq> 0\<close> show ?thesis
         unfolding eq
         apply (subst lebesgue_affine_euclidean[of "\<lambda>_. m" \<delta>])
         apply (simp_all add: emeasure_density trans_eq_T nn_integral_cmult emeasure_distr
                         del: space_completion emeasure_completion)
         apply (simp add: vimage_comp s_comp_s)
         done
     next
       assume "S \<notin> sets lebesgue"
       moreover have "?T ` S \<notin> sets lebesgue"
       proof
         assume "?T ` S \<in> sets lebesgue"
         then have "?T -` (?T ` S) \<inter> space lebesgue \<in> sets lebesgue"
           by (rule measurable_sets[OF T])
         also have "?T -` (?T ` S) \<inter> space lebesgue = S"
           by (simp add: vimage_comp s_comp_s eq)
         finally show False using \<open>S \<notin> sets lebesgue\<close> by auto
       qed
       ultimately show ?thesis
         by (simp add: emeasure_notin_sets)
     qed
   qed
   show ?m
     unfolding measure_def \<open>?e\<close> by (simp add: enn2real_mult prod_nonneg)
 qed
 
 lemma lebesgue_real_scale:
   assumes "c \<noteq> 0"
   shows   "lebesgue = density (distr lebesgue lebesgue (\<lambda>x. c * x)) (\<lambda>x. ennreal \<bar>c\<bar>)"
   using assms by (subst lebesgue_affine_euclidean[of "\<lambda>_. c" 0]) simp_all
 
 lemma divideR_right:
   fixes x y :: "'a::real_normed_vector"
   shows "r \<noteq> 0 \<Longrightarrow> y = x /\<^sub>R r \<longleftrightarrow> r *\<^sub>R y = x"
   using scaleR_cancel_left[of r y "x /\<^sub>R r"] by simp
 
 lemma lborel_has_bochner_integral_real_affine_iff:
   fixes x :: "'a :: {banach, second_countable_topology}"
   shows "c \<noteq> 0 \<Longrightarrow>
     has_bochner_integral lborel f x \<longleftrightarrow>
     has_bochner_integral lborel (\<lambda>x. f (t + c * x)) (x /\<^sub>R \<bar>c\<bar>)"
   unfolding has_bochner_integral_iff lborel_integrable_real_affine_iff
   by (simp_all add: lborel_integral_real_affine[symmetric] divideR_right cong: conj_cong)
 
 lemma lborel_distr_uminus: "distr lborel borel uminus = (lborel :: real measure)"
   by (subst lborel_real_affine[of "-1" 0])
      (auto simp: density_1 one_ennreal_def[symmetric])
 
 lemma lborel_distr_mult:
   assumes "(c::real) \<noteq> 0"
   shows "distr lborel borel ((*) c) = density lborel (\<lambda>_. inverse \<bar>c\<bar>)"
 proof-
   have "distr lborel borel ((*) c) = distr lborel lborel ((*) c)" by (simp cong: distr_cong)
   also from assms have "... = density lborel (\<lambda>_. inverse \<bar>c\<bar>)"
     by (subst lborel_real_affine[of "inverse c" 0]) (auto simp: o_def distr_density_distr)
   finally show ?thesis .
 qed
 
 lemma lborel_distr_mult':
   assumes "(c::real) \<noteq> 0"
   shows "lborel = density (distr lborel borel ((*) c)) (\<lambda>_. \<bar>c\<bar>)"
 proof-
   have "lborel = density lborel (\<lambda>_. 1)" by (rule density_1[symmetric])
   also from assms have "(\<lambda>_. 1 :: ennreal) = (\<lambda>_. inverse \<bar>c\<bar> * \<bar>c\<bar>)" by (intro ext) simp
   also have "density lborel ... = density (density lborel (\<lambda>_. inverse \<bar>c\<bar>)) (\<lambda>_. \<bar>c\<bar>)"
     by (subst density_density_eq) (auto simp: ennreal_mult)
   also from assms have "density lborel (\<lambda>_. inverse \<bar>c\<bar>) = distr lborel borel ((*) c)"
     by (rule lborel_distr_mult[symmetric])
   finally show ?thesis .
 qed
 
 lemma lborel_distr_plus:
   fixes c :: "'a::euclidean_space"
   shows "distr lborel borel ((+) c) = lborel"
 by (subst lborel_affine[of 1 c], auto simp: density_1)
 
 interpretation lborel: sigma_finite_measure lborel
   by (rule sigma_finite_lborel)
 
 interpretation lborel_pair: pair_sigma_finite lborel lborel ..
 
 lemma\<^marker>\<open>tag important\<close> lborel_prod:
   "lborel \<Otimes>\<^sub>M lborel = (lborel :: ('a::euclidean_space \<times> 'b::euclidean_space) measure)"
 proof (rule lborel_eqI[symmetric], clarify)
   fix la ua :: 'a and lb ub :: 'b
   assume lu: "\<And>a b. (a, b) \<in> Basis \<Longrightarrow> (la, lb) \<bullet> (a, b) \<le> (ua, ub) \<bullet> (a, b)"
   have [simp]:
     "\<And>b. b \<in> Basis \<Longrightarrow> la \<bullet> b \<le> ua \<bullet> b"
     "\<And>b. b \<in> Basis \<Longrightarrow> lb \<bullet> b \<le> ub \<bullet> b"
     "inj_on (\<lambda>u. (u, 0)) Basis" "inj_on (\<lambda>u. (0, u)) Basis"
     "(\<lambda>u. (u, 0)) ` Basis \<inter> (\<lambda>u. (0, u)) ` Basis = {}"
     "box (la, lb) (ua, ub) = box la ua \<times> box lb ub"
     using lu[of _ 0] lu[of 0] by (auto intro!: inj_onI simp add: Basis_prod_def ball_Un box_def)
   show "emeasure (lborel \<Otimes>\<^sub>M lborel) (box (la, lb) (ua, ub)) =
       ennreal (prod ((\<bullet>) ((ua, ub) - (la, lb))) Basis)"
     by (simp add: lborel.emeasure_pair_measure_Times Basis_prod_def prod.union_disjoint
                   prod.reindex ennreal_mult inner_diff_left prod_nonneg)
 qed (simp add: borel_prod[symmetric])
 
 (* FIXME: conversion in measurable prover *)
 lemma lborelD_Collect[measurable (raw)]: "{x\<in>space borel. P x} \<in> sets borel \<Longrightarrow> {x\<in>space lborel. P x} \<in> sets lborel" 
   by simp
 
 lemma lborelD[measurable (raw)]: "A \<in> sets borel \<Longrightarrow> A \<in> sets lborel"
   by simp
 
 lemma emeasure_bounded_finite:
   assumes "bounded A" shows "emeasure lborel A < \<infinity>"
 proof -
   obtain a b where "A \<subseteq> cbox a b"
     by (meson bounded_subset_cbox_symmetric \<open>bounded A\<close>)
   then have "emeasure lborel A \<le> emeasure lborel (cbox a b)"
     by (intro emeasure_mono) auto
   then show ?thesis
     by (auto simp: emeasure_lborel_cbox_eq prod_nonneg less_top[symmetric] top_unique split: if_split_asm)
 qed
 
 lemma emeasure_compact_finite: "compact A \<Longrightarrow> emeasure lborel A < \<infinity>"
   using emeasure_bounded_finite[of A] by (auto intro: compact_imp_bounded)
 
 lemma borel_integrable_compact:
   fixes f :: "'a::euclidean_space \<Rightarrow> 'b::{banach, second_countable_topology}"
   assumes "compact S" "continuous_on S f"
   shows "integrable lborel (\<lambda>x. indicator S x *\<^sub>R f x)"
 proof cases
   assume "S \<noteq> {}"
   have "continuous_on S (\<lambda>x. norm (f x))"
     using assms by (intro continuous_intros)
   from continuous_attains_sup[OF \<open>compact S\<close> \<open>S \<noteq> {}\<close> this]
   obtain M where M: "\<And>x. x \<in> S \<Longrightarrow> norm (f x) \<le> M"
     by auto
   show ?thesis
   proof (rule integrable_bound)
     show "integrable lborel (\<lambda>x. indicator S x * M)"
       using assms by (auto intro!: emeasure_compact_finite borel_compact integrable_mult_left)
     show "(\<lambda>x. indicator S x *\<^sub>R f x) \<in> borel_measurable lborel"
       using assms by (auto intro!: borel_measurable_continuous_on_indicator borel_compact)
     show "AE x in lborel. norm (indicator S x *\<^sub>R f x) \<le> norm (indicator S x * M)"
       by (auto split: split_indicator simp: abs_real_def dest!: M)
   qed
 qed simp
 
 lemma borel_integrable_atLeastAtMost:
   fixes f :: "real \<Rightarrow> real"
   assumes f: "\<And>x. a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> isCont f x"
   shows "integrable lborel (\<lambda>x. f x * indicator {a .. b} x)" (is "integrable _ ?f")
 proof -
   have "integrable lborel (\<lambda>x. indicator {a .. b} x *\<^sub>R f x)"
   proof (rule borel_integrable_compact)
     from f show "continuous_on {a..b} f"
       by (auto intro: continuous_at_imp_continuous_on)
   qed simp
   then show ?thesis
     by (auto simp: mult.commute)
 qed
 
 subsection \<open>Lebesgue measurable sets\<close>
 
 abbreviation\<^marker>\<open>tag important\<close> lmeasurable :: "'a::euclidean_space set set"
 where
   "lmeasurable \<equiv> fmeasurable lebesgue"
 
 lemma not_measurable_UNIV [simp]: "UNIV \<notin> lmeasurable"
   by (simp add: fmeasurable_def)
 
 lemma\<^marker>\<open>tag important\<close> lmeasurable_iff_integrable:
   "S \<in> lmeasurable \<longleftrightarrow> integrable lebesgue (indicator S :: 'a::euclidean_space \<Rightarrow> real)"
   by (auto simp: fmeasurable_def integrable_iff_bounded borel_measurable_indicator_iff ennreal_indicator)
 
 lemma lmeasurable_cbox [iff]: "cbox a b \<in> lmeasurable"
   and lmeasurable_box [iff]: "box a b \<in> lmeasurable"
   by (auto simp: fmeasurable_def emeasure_lborel_box_eq emeasure_lborel_cbox_eq)
 
 lemma
   fixes a::real
   shows lmeasurable_interval [iff]: "{a..b} \<in> lmeasurable" "{a<..<b} \<in> lmeasurable"
   apply (metis box_real(2) lmeasurable_cbox)
   by (metis box_real(1) lmeasurable_box)
 
 lemma fmeasurable_compact: "compact S \<Longrightarrow> S \<in> fmeasurable lborel"
   using emeasure_compact_finite[of S] by (intro fmeasurableI) (auto simp: borel_compact)
 
 lemma lmeasurable_compact: "compact S \<Longrightarrow> S \<in> lmeasurable"
   using fmeasurable_compact by (force simp: fmeasurable_def)
 
 lemma measure_frontier:
    "bounded S \<Longrightarrow> measure lebesgue (frontier S) = measure lebesgue (closure S) - measure lebesgue (interior S)"
   using closure_subset interior_subset
   by (auto simp: frontier_def fmeasurable_compact intro!: measurable_measure_Diff)
 
 lemma lmeasurable_closure:
    "bounded S \<Longrightarrow> closure S \<in> lmeasurable"
   by (simp add: lmeasurable_compact)
 
 lemma lmeasurable_frontier:
    "bounded S \<Longrightarrow> frontier S \<in> lmeasurable"
   by (simp add: compact_frontier_bounded lmeasurable_compact)
 
 lemma lmeasurable_open: "bounded S \<Longrightarrow> open S \<Longrightarrow> S \<in> lmeasurable"
   using emeasure_bounded_finite[of S] by (intro fmeasurableI) (auto simp: borel_open)
 
 lemma lmeasurable_ball [simp]: "ball a r \<in> lmeasurable"
   by (simp add: lmeasurable_open)
 
 lemma lmeasurable_cball [simp]: "cball a r \<in> lmeasurable"
   by (simp add: lmeasurable_compact)
 
 lemma lmeasurable_interior: "bounded S \<Longrightarrow> interior S \<in> lmeasurable"
   by (simp add: bounded_interior lmeasurable_open)
 
 lemma null_sets_cbox_Diff_box: "cbox a b - box a b \<in> null_sets lborel"
 proof -
   have "emeasure lborel (cbox a b - box a b) = 0"
     by (subst emeasure_Diff) (auto simp: emeasure_lborel_cbox_eq emeasure_lborel_box_eq box_subset_cbox)
   then have "cbox a b - box a b \<in> null_sets lborel"
     by (auto simp: null_sets_def)
   then show ?thesis
     by (auto dest!: AE_not_in)
 qed
 
 lemma bounded_set_imp_lmeasurable:
   assumes "bounded S" "S \<in> sets lebesgue" shows "S \<in> lmeasurable"
   by (metis assms bounded_Un emeasure_bounded_finite emeasure_completion fmeasurableI main_part_null_part_Un)
 
 lemma finite_measure_lebesgue_on: "S \<in> lmeasurable \<Longrightarrow> finite_measure (lebesgue_on S)"
   by (auto simp: finite_measureI fmeasurable_def emeasure_restrict_space)
 
 lemma integrable_const_ivl [iff]:
   fixes a::"'a::ordered_euclidean_space"
   shows "integrable (lebesgue_on {a..b}) (\<lambda>x. c)"
   by (metis cbox_interval finite_measure.integrable_const finite_measure_lebesgue_on lmeasurable_cbox)
 
 subsection\<^marker>\<open>tag unimportant\<close>\<open>Translation preserves Lebesgue measure\<close>
 
 lemma sigma_sets_image:
   assumes S: "S \<in> sigma_sets \<Omega> M" and "M \<subseteq> Pow \<Omega>" "f ` \<Omega> = \<Omega>" "inj_on f \<Omega>"
     and M: "\<And>y. y \<in> M \<Longrightarrow> f ` y \<in> M"
   shows "(f ` S) \<in> sigma_sets \<Omega> M"
   using S
 proof (induct S rule: sigma_sets.induct)
   case (Basic a) then show ?case
     by (simp add: M)
 next
   case Empty then show ?case
     by (simp add: sigma_sets.Empty)
 next
   case (Compl a)
   then have "\<Omega> - a \<subseteq> \<Omega>" "a \<subseteq> \<Omega>"
     by (auto simp: sigma_sets_into_sp [OF \<open>M \<subseteq> Pow \<Omega>\<close>])
   then show ?case
     by (auto simp: inj_on_image_set_diff [OF \<open>inj_on f \<Omega>\<close>] assms intro: Compl sigma_sets.Compl)
 next
   case (Union a) then show ?case
     by (metis image_UN sigma_sets.simps)
 qed
 
 lemma null_sets_translation:
   assumes "N \<in> null_sets lborel" shows "{x. x - a \<in> N} \<in> null_sets lborel"
 proof -
   have [simp]: "(\<lambda>x. x + a) ` N = {x. x - a \<in> N}"
     by force
   show ?thesis
     using assms emeasure_lebesgue_affine [of 1 a N] by (auto simp: null_sets_def)
 qed
 
 lemma lebesgue_sets_translation:
   fixes f :: "'a \<Rightarrow> 'a::euclidean_space"
   assumes S: "S \<in> sets lebesgue"
   shows "((\<lambda>x. a + x) ` S) \<in> sets lebesgue"
 proof -
   have im_eq: "(+) a ` A = {x. x - a \<in> A}" for A
     by force
   have "((\<lambda>x. a + x) ` S) = ((\<lambda>x. -a + x) -` S) \<inter> (space lebesgue)"
     using image_iff by fastforce
   also have "\<dots> \<in> sets lebesgue"
   proof (rule measurable_sets [OF measurableI assms])
     fix A :: "'b set"
     assume A: "A \<in> sets lebesgue"
     have vim_eq: "(\<lambda>x. x - a) -` A = (+) a ` A" for A
       by force
     have "\<exists>s n N'. (+) a ` (S \<union> N) = s \<union> n \<and> s \<in> sets borel \<and> N' \<in> null_sets lborel \<and> n \<subseteq> N'"
       if "S \<in> sets borel" and "N' \<in> null_sets lborel" and "N \<subseteq> N'" for S N N'
     proof (intro exI conjI)
       show "(+) a ` (S \<union> N) = (\<lambda>x. a + x) ` S \<union> (\<lambda>x. a + x) ` N"
         by auto
       show "(\<lambda>x. a + x) ` N' \<in> null_sets lborel"
         using that by (auto simp: null_sets_translation im_eq)
     qed (use that im_eq in auto)
     with A have "(\<lambda>x. x - a) -` A \<in> sets lebesgue"
       by (force simp: vim_eq completion_def intro!: sigma_sets_image)
     then show "(+) (- a) -` A \<inter> space lebesgue \<in> sets lebesgue"
       by (auto simp: vimage_def im_eq)
   qed auto
   finally show ?thesis .
 qed
 
 lemma measurable_translation:
    "S \<in> lmeasurable \<Longrightarrow> ((+) a ` S) \<in> lmeasurable"
   using emeasure_lebesgue_affine [of 1 a S]
   apply (auto intro: lebesgue_sets_translation simp add: fmeasurable_def cong: image_cong_simp)
   apply (simp add: ac_simps)
   done
 
 lemma measurable_translation_subtract:
    "S \<in> lmeasurable \<Longrightarrow> ((\<lambda>x. x - a) ` S) \<in> lmeasurable"
   using measurable_translation [of S "- a"] by (simp cong: image_cong_simp)
 
 lemma measure_translation:
   "measure lebesgue ((+) a ` S) = measure lebesgue S"
   using measure_lebesgue_affine [of 1 a S] by (simp add: ac_simps cong: image_cong_simp)
 
 lemma measure_translation_subtract:
   "measure lebesgue ((\<lambda>x. x - a) ` S) = measure lebesgue S"
   using measure_translation [of "- a"] by (simp cong: image_cong_simp)
 
 
 subsection \<open>A nice lemma for negligibility proofs\<close>
 
 lemma summable_iff_suminf_neq_top: "(\<And>n. f n \<ge> 0) \<Longrightarrow> \<not> summable f \<Longrightarrow> (\<Sum>i. ennreal (f i)) = top"
   by (metis summable_suminf_not_top)
 
 proposition\<^marker>\<open>tag important\<close> starlike_negligible_bounded_gmeasurable:
   fixes S :: "'a :: euclidean_space set"
   assumes S: "S \<in> sets lebesgue" and "bounded S"
       and eq1: "\<And>c x. \<lbrakk>(c *\<^sub>R x) \<in> S; 0 \<le> c; x \<in> S\<rbrakk> \<Longrightarrow> c = 1"
     shows "S \<in> null_sets lebesgue"
 proof -
   obtain M where "0 < M" "S \<subseteq> ball 0 M"
     using \<open>bounded S\<close> by (auto dest: bounded_subset_ballD)
 
   let ?f = "\<lambda>n. root DIM('a) (Suc n)"
 
   have vimage_eq_image: "(*\<^sub>R) (?f n) -` S = (*\<^sub>R) (1 / ?f n) ` S" for n
     apply safe
     subgoal for x by (rule image_eqI[of _ _ "?f n *\<^sub>R x"]) auto
     subgoal by auto
     done
 
   have eq: "(1 / ?f n) ^ DIM('a) = 1 / Suc n" for n
     by (simp add: field_simps)
 
   { fix n x assume x: "root DIM('a) (1 + real n) *\<^sub>R x \<in> S"
     have "1 * norm x \<le> root DIM('a) (1 + real n) * norm x"
       by (rule mult_mono) auto
     also have "\<dots> < M"
       using x \<open>S \<subseteq> ball 0 M\<close> by auto
     finally have "norm x < M" by simp }
   note less_M = this
 
   have "(\<Sum>n. ennreal (1 / Suc n)) = top"
     using not_summable_harmonic[where 'a=real] summable_Suc_iff[where f="\<lambda>n. 1 / (real n)"]
     by (intro summable_iff_suminf_neq_top) (auto simp add: inverse_eq_divide)
   then have "top * emeasure lebesgue S = (\<Sum>n. (1 / ?f n)^DIM('a) * emeasure lebesgue S)"
     unfolding ennreal_suminf_multc eq by simp
   also have "\<dots> = (\<Sum>n. emeasure lebesgue ((*\<^sub>R) (?f n) -` S))"
     unfolding vimage_eq_image using emeasure_lebesgue_affine[of "1 / ?f n" 0 S for n] by simp
   also have "\<dots> = emeasure lebesgue (\<Union>n. (*\<^sub>R) (?f n) -` S)"
   proof (intro suminf_emeasure)
     show "disjoint_family (\<lambda>n. (*\<^sub>R) (?f n) -` S)"
       unfolding disjoint_family_on_def
     proof safe
       fix m n :: nat and x assume "m \<noteq> n" "?f m *\<^sub>R x \<in> S" "?f n *\<^sub>R x \<in> S"
       with eq1[of "?f m / ?f n" "?f n *\<^sub>R x"] show "x \<in> {}"
         by auto
     qed
     have "(*\<^sub>R) (?f i) -` S \<in> sets lebesgue" for i
       using measurable_sets[OF lebesgue_measurable_scaling[of "?f i"] S] by auto
     then show "range (\<lambda>i. (*\<^sub>R) (?f i) -` S) \<subseteq> sets lebesgue"
       by auto
   qed
   also have "\<dots> \<le> emeasure lebesgue (ball 0 M :: 'a set)"
     using less_M by (intro emeasure_mono) auto
   also have "\<dots> < top"
     using lmeasurable_ball by (auto simp: fmeasurable_def)
   finally have "emeasure lebesgue S = 0"
     by (simp add: ennreal_top_mult split: if_split_asm)
   then show "S \<in> null_sets lebesgue"
     unfolding null_sets_def using \<open>S \<in> sets lebesgue\<close> by auto
 qed
 
 corollary starlike_negligible_compact:
   "compact S \<Longrightarrow> (\<And>c x. \<lbrakk>(c *\<^sub>R x) \<in> S; 0 \<le> c; x \<in> S\<rbrakk> \<Longrightarrow> c = 1) \<Longrightarrow> S \<in> null_sets lebesgue"
   using starlike_negligible_bounded_gmeasurable[of S] by (auto simp: compact_eq_bounded_closed)
 
 proposition outer_regular_lborel_le:
   assumes B[measurable]: "B \<in> sets borel" and "0 < (e::real)"
   obtains U where "open U" "B \<subseteq> U" and "emeasure lborel (U - B) \<le> e"
 proof -
   let ?\<mu> = "emeasure lborel"
   let ?B = "\<lambda>n::nat. ball 0 n :: 'a set"
   let ?e = "\<lambda>n. e*((1/2)^Suc n)"
   have "\<forall>n. \<exists>U. open U \<and> ?B n \<inter> B \<subseteq> U \<and> ?\<mu> (U - B) < ?e n"
   proof
     fix n :: nat
     let ?A = "density lborel (indicator (?B n))"
     have emeasure_A: "X \<in> sets borel \<Longrightarrow> emeasure ?A X = ?\<mu> (?B n \<inter> X)" for X
       by (auto simp: emeasure_density borel_measurable_indicator indicator_inter_arith[symmetric])
 
     have finite_A: "emeasure ?A (space ?A) \<noteq> \<infinity>"
       using emeasure_bounded_finite[of "?B n"] by (auto simp: emeasure_A)
     interpret A: finite_measure ?A
       by rule fact
     have "emeasure ?A B + ?e n > (INF U\<in>{U. B \<subseteq> U \<and> open U}. emeasure ?A U)"
       using \<open>0<e\<close> by (auto simp: outer_regular[OF _ finite_A B, symmetric])
     then obtain U where U: "B \<subseteq> U" "open U" and muU: "?\<mu> (?B n \<inter> B) + ?e n > ?\<mu> (?B n \<inter> U)"
       unfolding INF_less_iff by (auto simp: emeasure_A)
     moreover
     { have "?\<mu> ((?B n \<inter> U) - B) = ?\<mu> ((?B n \<inter> U) - (?B n \<inter> B))"
         using U by (intro arg_cong[where f="?\<mu>"]) auto
       also have "\<dots> = ?\<mu> (?B n \<inter> U) - ?\<mu> (?B n \<inter> B)"
         using U A.emeasure_finite[of B]
         by (intro emeasure_Diff) (auto simp del: A.emeasure_finite simp: emeasure_A)
       also have "\<dots> < ?e n"
         using U muU A.emeasure_finite[of B]
         by (subst minus_less_iff_ennreal)
           (auto simp del: A.emeasure_finite simp: emeasure_A less_top ac_simps intro!: emeasure_mono)
       finally have "?\<mu> ((?B n \<inter> U) - B) < ?e n" . }
     ultimately show "\<exists>U. open U \<and> ?B n \<inter> B \<subseteq> U \<and> ?\<mu> (U - B) < ?e n"
       by (intro exI[of _ "?B n \<inter> U"]) auto
   qed
   then obtain U
     where U: "\<And>n. open (U n)" "\<And>n. ?B n \<inter> B \<subseteq> U n" "\<And>n. ?\<mu> (U n - B) < ?e n"
     by metis
   show ?thesis
   proof
     { fix x assume "x \<in> B"
       moreover
       obtain n where "norm x < real n"
         using reals_Archimedean2 by blast
       ultimately have "x \<in> (\<Union>n. U n)"
         using U(2)[of n] by auto }
     note * = this
     then show "open (\<Union>n. U n)" "B \<subseteq> (\<Union>n. U n)"
       using U by auto
     have "?\<mu> (\<Union>n. U n - B) \<le> (\<Sum>n. ?\<mu> (U n - B))"
       using U(1) by (intro emeasure_subadditive_countably) auto
     also have "\<dots> \<le> (\<Sum>n. ennreal (?e n))"
       using U(3) by (intro suminf_le) (auto intro: less_imp_le)
     also have "\<dots> = ennreal (e * 1)"
       using \<open>0<e\<close> by (intro suminf_ennreal_eq sums_mult power_half_series) auto
     finally show "emeasure lborel ((\<Union>n. U n) - B) \<le> ennreal e"
       by simp
   qed
 qed
 
 lemma\<^marker>\<open>tag important\<close> outer_regular_lborel:
   assumes B: "B \<in> sets borel" and "0 < (e::real)"
   obtains U where "open U" "B \<subseteq> U" "emeasure lborel (U - B) < e"
 proof -
   obtain U where U: "open U" "B \<subseteq> U" and "emeasure lborel (U-B) \<le> e/2"
     using outer_regular_lborel_le [OF B, of "e/2"] \<open>e > 0\<close>
     by force
   moreover have "ennreal (e/2) < ennreal e"
     using \<open>e > 0\<close> by (simp add: ennreal_lessI)
   ultimately have "emeasure lborel (U-B) < e"
     by auto
   with U show ?thesis
     using that by auto
 qed
 
 lemma completion_upper:
   assumes A: "A \<in> sets (completion M)"
   obtains A' where "A \<subseteq> A'" "A' \<in> sets M" "A' - A \<in> null_sets (completion M)"
                    "emeasure (completion M) A = emeasure M A'"
 proof -
   from AE_notin_null_part[OF A] obtain N where N: "N \<in> null_sets M" "null_part M A \<subseteq> N"
     unfolding eventually_ae_filter using null_part_null_sets[OF A, THEN null_setsD2, THEN sets.sets_into_space] by auto
   let ?A' = "main_part M A \<union> N"
   show ?thesis
   proof
     show "A \<subseteq> ?A'"
       using \<open>null_part M A \<subseteq> N\<close> by (subst main_part_null_part_Un[symmetric, OF A]) auto
     have "main_part M A \<subseteq> A"
       using assms main_part_null_part_Un by auto
     then have "?A' - A \<subseteq> N"
       by blast
     with N show "?A' - A \<in> null_sets (completion M)"
       by (blast intro: null_sets_completionI completion.complete_measure_axioms complete_measure.complete2)
     show "emeasure (completion M) A = emeasure M (main_part M A \<union> N)"
       using A \<open>N \<in> null_sets M\<close> by (simp add: emeasure_Un_null_set)
   qed (use A N in auto)
 qed
 
 lemma sets_lebesgue_outer_open:
   fixes e::real
   assumes S: "S \<in> sets lebesgue" and "e > 0"
   obtains T where "open T" "S \<subseteq> T" "(T - S) \<in> lmeasurable" "emeasure lebesgue (T - S) < ennreal e"
 proof -
   obtain S' where S': "S \<subseteq> S'" "S' \<in> sets borel"
               and null: "S' - S \<in> null_sets lebesgue"
               and em: "emeasure lebesgue S = emeasure lborel S'"
     using completion_upper[of S lborel] S by auto
   then have f_S': "S' \<in> sets borel"
     using S by (auto simp: fmeasurable_def)
   with outer_regular_lborel[OF _ \<open>0<e\<close>]
   obtain U where U: "open U" "S' \<subseteq> U" "emeasure lborel (U - S') < e"
     by blast
   show thesis
   proof
     show "open U" "S \<subseteq> U"
       using f_S' U S' by auto
   have "(U - S) = (U - S') \<union> (S' - S)"
     using S' U by auto
   then have eq: "emeasure lebesgue (U - S) = emeasure lborel (U - S')"
     using null  by (simp add: U(1) emeasure_Un_null_set f_S' sets.Diff)
   have "(U - S) \<in> sets lebesgue"
     by (simp add: S U(1) sets.Diff)
   then show "(U - S) \<in> lmeasurable"
     unfolding fmeasurable_def using U(3) eq less_le_trans by fastforce
   with eq U show "emeasure lebesgue (U - S) < e"
     by (simp add: eq)
   qed
 qed
 
 lemma sets_lebesgue_inner_closed:
   fixes e::real
   assumes "S \<in> sets lebesgue" "e > 0"
   obtains T where "closed T" "T \<subseteq> S" "S-T \<in> lmeasurable" "emeasure lebesgue (S - T) < ennreal e"
 proof -
   have "-S \<in> sets lebesgue"
     using assms by (simp add: Compl_in_sets_lebesgue)
   then obtain T where "open T" "-S \<subseteq> T"
           and T: "(T - -S) \<in> lmeasurable" "emeasure lebesgue (T - -S) < e"
     using sets_lebesgue_outer_open assms  by blast
   show thesis
   proof
     show "closed (-T)"
       using \<open>open T\<close> by blast
     show "-T \<subseteq> S"
       using \<open>- S \<subseteq> T\<close> by auto
     show "S - ( -T) \<in> lmeasurable" "emeasure lebesgue (S - (- T)) < e"
       using T by (auto simp: Int_commute)
   qed
 qed
 
 lemma lebesgue_openin:
    "\<lbrakk>openin (top_of_set S) T; S \<in> sets lebesgue\<rbrakk> \<Longrightarrow> T \<in> sets lebesgue"
   by (metis borel_open openin_open sets.Int sets_completionI_sets sets_lborel)
 
 lemma lebesgue_closedin:
    "\<lbrakk>closedin (top_of_set S) T; S \<in> sets lebesgue\<rbrakk> \<Longrightarrow> T \<in> sets lebesgue"
   by (metis borel_closed closedin_closed sets.Int sets_completionI_sets sets_lborel)
 
 
 subsection\<open>\<open>F_sigma\<close> and \<open>G_delta\<close> sets.\<close> 
 
 \<comment> \<open>\<^url>\<open>https://en.wikipedia.org/wiki/F-sigma_set\<close>\<close>
 inductive\<^marker>\<open>tag important\<close> fsigma :: "'a::topological_space set \<Rightarrow> bool" where
   "(\<And>n::nat. closed (F n)) \<Longrightarrow> fsigma (\<Union>(F ` UNIV))"
 
 inductive\<^marker>\<open>tag important\<close> gdelta :: "'a::topological_space set \<Rightarrow> bool" where
   "(\<And>n::nat. open (F n)) \<Longrightarrow> gdelta (\<Inter>(F ` UNIV))"
 
 lemma fsigma_Union_compact:
   fixes S :: "'a::{real_normed_vector,heine_borel} set"
   shows "fsigma S \<longleftrightarrow> (\<exists>F::nat \<Rightarrow> 'a set. range F \<subseteq> Collect compact \<and> S = \<Union>(F ` UNIV))"
 proof safe
   assume "fsigma S"
   then obtain F :: "nat \<Rightarrow> 'a set" where F: "range F \<subseteq> Collect closed" "S = \<Union>(F ` UNIV)"
     by (meson fsigma.cases image_subsetI mem_Collect_eq)
   then have "\<exists>D::nat \<Rightarrow> 'a set. range D \<subseteq> Collect compact \<and> \<Union>(D ` UNIV) = F i" for i
     using closed_Union_compact_subsets [of "F i"]
     by (metis image_subsetI mem_Collect_eq range_subsetD)
   then obtain D :: "nat \<Rightarrow> nat \<Rightarrow> 'a set"
     where D: "\<And>i. range (D i) \<subseteq> Collect compact \<and> \<Union>((D i) ` UNIV) = F i"
     by metis
   let ?DD = "\<lambda>n. (\<lambda>(i,j). D i j) (prod_decode n)"
   show "\<exists>F::nat \<Rightarrow> 'a set. range F \<subseteq> Collect compact \<and> S = \<Union>(F ` UNIV)"
   proof (intro exI conjI)
     show "range ?DD \<subseteq> Collect compact"
       using D by clarsimp (metis mem_Collect_eq rangeI split_conv subsetCE surj_pair)
     show "S = \<Union> (range ?DD)"
     proof
       show "S \<subseteq> \<Union> (range ?DD)"
         using D F
         by clarsimp (metis UN_iff old.prod.case prod_decode_inverse prod_encode_eq)
       show "\<Union> (range ?DD) \<subseteq> S"
         using D F  by fastforce
     qed
   qed
 next
   fix F :: "nat \<Rightarrow> 'a set"
   assume "range F \<subseteq> Collect compact" and "S = \<Union>(F ` UNIV)"
   then show "fsigma (\<Union>(F ` UNIV))"
     by (simp add: compact_imp_closed fsigma.intros image_subset_iff)
 qed
 
 lemma gdelta_imp_fsigma: "gdelta S \<Longrightarrow> fsigma (- S)"
 proof (induction rule: gdelta.induct)
   case (1 F)
   have "- \<Inter>(F ` UNIV) = (\<Union>i. -(F i))"
     by auto
   then show ?case
     by (simp add: fsigma.intros closed_Compl 1)
 qed
 
 lemma fsigma_imp_gdelta: "fsigma S \<Longrightarrow> gdelta (- S)"
 proof (induction rule: fsigma.induct)
   case (1 F)
   have "- \<Union>(F ` UNIV) = (\<Inter>i. -(F i))"
     by auto
   then show ?case
     by (simp add: 1 gdelta.intros open_closed)
 qed
 
 lemma gdelta_complement: "gdelta(- S) \<longleftrightarrow> fsigma S"
   using fsigma_imp_gdelta gdelta_imp_fsigma by force
 
 lemma lebesgue_set_almost_fsigma:
   assumes "S \<in> sets lebesgue"
   obtains C T where "fsigma C" "T \<in> null_sets lebesgue" "C \<union> T = S" "disjnt C T"
 proof -
   { fix n::nat
     obtain T where "closed T" "T \<subseteq> S" "S-T \<in> lmeasurable" "emeasure lebesgue (S - T) < ennreal (1 / Suc n)"
       using sets_lebesgue_inner_closed [OF assms]
       by (metis of_nat_0_less_iff zero_less_Suc zero_less_divide_1_iff)
     then have "\<exists>T. closed T \<and> T \<subseteq> S \<and> S - T \<in> lmeasurable \<and> measure lebesgue (S-T) < 1 / Suc n"
       by (metis emeasure_eq_measure2 ennreal_leI not_le)
   }
   then obtain F where F: "\<And>n::nat. closed (F n) \<and> F n \<subseteq> S \<and> S - F n \<in> lmeasurable \<and> measure lebesgue (S - F n) < 1 / Suc n"
     by metis
   let ?C = "\<Union>(F ` UNIV)"
   show thesis
   proof
     show "fsigma ?C"
       using F by (simp add: fsigma.intros)
     show "(S - ?C) \<in> null_sets lebesgue"
     proof (clarsimp simp add: completion.null_sets_outer_le)
       fix e :: "real"
       assume "0 < e"
       then obtain n where n: "1 / Suc n < e"
         using nat_approx_posE by metis
       show "\<exists>T \<in> lmeasurable. S - (\<Union>x. F x) \<subseteq> T \<and> measure lebesgue T \<le> e"
       proof (intro bexI conjI)
         show "measure lebesgue (S - F n) \<le> e"
           by (meson F n less_trans not_le order.asym)
       qed (use F in auto)
     qed
     show "?C \<union> (S - ?C) = S"
       using F by blast
     show "disjnt ?C (S - ?C)"
       by (auto simp: disjnt_def)
   qed
 qed
 
 lemma lebesgue_set_almost_gdelta:
   assumes "S \<in> sets lebesgue"
   obtains C T where "gdelta C" "T \<in> null_sets lebesgue" "S \<union> T = C" "disjnt S T"
 proof -
   have "-S \<in> sets lebesgue"
     using assms Compl_in_sets_lebesgue by blast
   then obtain C T where C: "fsigma C" "T \<in> null_sets lebesgue" "C \<union> T = -S" "disjnt C T"
     using lebesgue_set_almost_fsigma by metis
   show thesis
   proof
     show "gdelta (-C)"
       by (simp add: \<open>fsigma C\<close> fsigma_imp_gdelta)
     show "S \<union> T = -C" "disjnt S T"
       using C by (auto simp: disjnt_def)
   qed (use C in auto)
 qed
 
 end
diff --git a/src/HOL/Analysis/Vitali_Covering_Theorem.thy b/src/HOL/Analysis/Vitali_Covering_Theorem.thy
--- a/src/HOL/Analysis/Vitali_Covering_Theorem.thy
+++ b/src/HOL/Analysis/Vitali_Covering_Theorem.thy
@@ -1,657 +1,658 @@
 (*  Title:      HOL/Analysis/Vitali_Covering_Theorem.thy
     Authors:    LC Paulson, based on material from HOL Light
 *)
 
 section  \<open>Vitali Covering Theorem and an Application to Negligibility\<close>
 
 theory Vitali_Covering_Theorem
-  imports Ball_Volume "HOL-Library.Permutations"
+  imports Equivalence_Lebesgue_Henstock_Integration "HOL-Library.Permutations"
 
 begin
 
 lemma stretch_Galois:
   fixes x :: "real^'n"
   shows "(\<And>k. m k \<noteq> 0) \<Longrightarrow> ((y = (\<chi> k. m k * x$k)) \<longleftrightarrow> (\<chi> k. y$k / m k) = x)"
   by auto
 
 lemma lambda_swap_Galois:
    "(x = (\<chi> i. y $ Fun.swap m n id i) \<longleftrightarrow> (\<chi> i. x $ Fun.swap m n id i) = y)"
   by (auto; simp add: pointfree_idE vec_eq_iff)
 
 lemma lambda_add_Galois:
   fixes x :: "real^'n"
   shows "m \<noteq> n \<Longrightarrow> (x = (\<chi> i. if i = m then y$m + y$n else y$i) \<longleftrightarrow> (\<chi> i. if i = m then x$m - x$n else x$i) = y)"
   by (safe; simp add: vec_eq_iff)
 
 
 lemma Vitali_covering_lemma_cballs_balls:
   fixes a :: "'a \<Rightarrow> 'b::euclidean_space"
   assumes "\<And>i. i \<in> K \<Longrightarrow> 0 < r i \<and> r i \<le> B"
   obtains C where "countable C" "C \<subseteq> K"
      "pairwise (\<lambda>i j. disjnt (cball (a i) (r i)) (cball (a j) (r j))) C"
      "\<And>i. i \<in> K \<Longrightarrow> \<exists>j. j \<in> C \<and>
                         \<not> disjnt (cball (a i) (r i)) (cball (a j) (r j)) \<and>
                         cball (a i) (r i) \<subseteq> ball (a j) (5 * r j)"
 proof (cases "K = {}")
   case True
   with that show ?thesis
     by auto
 next
   case False
   then have "B > 0"
     using assms less_le_trans by auto
   have rgt0[simp]: "\<And>i. i \<in> K \<Longrightarrow> 0 < r i"
     using assms by auto
   let ?djnt = "pairwise (\<lambda>i j. disjnt (cball (a i) (r i)) (cball (a j) (r j)))"
   have "\<exists>C. \<forall>n. (C n \<subseteq> K \<and>
              (\<forall>i \<in> C n. B/2 ^ n \<le> r i) \<and> ?djnt (C n) \<and>
              (\<forall>i \<in> K. B/2 ^ n < r i
                  \<longrightarrow> (\<exists>j. j \<in> C n \<and>
                          \<not> disjnt (cball (a i) (r i)) (cball (a j) (r j)) \<and>
                          cball (a i) (r i) \<subseteq> ball (a j) (5 * r j)))) \<and> (C n \<subseteq> C(Suc n))"
   proof (rule dependent_nat_choice, safe)
     fix C n
     define D where "D \<equiv> {i \<in> K. B/2 ^ Suc n < r i \<and> (\<forall>j\<in>C. disjnt (cball(a i)(r i)) (cball (a j) (r j)))}"
     let ?cover_ar = "\<lambda>i j. \<not> disjnt (cball (a i) (r i)) (cball (a j) (r j)) \<and>
                              cball (a i) (r i) \<subseteq> ball (a j) (5 * r j)"
     assume "C \<subseteq> K"
       and Ble: "\<forall>i\<in>C. B/2 ^ n \<le> r i"
       and djntC: "?djnt C"
       and cov_n: "\<forall>i\<in>K. B/2 ^ n < r i \<longrightarrow> (\<exists>j. j \<in> C \<and> ?cover_ar i j)"
     have *: "\<forall>C\<in>chains {C. C \<subseteq> D \<and> ?djnt C}. \<Union>C \<in> {C. C \<subseteq> D \<and> ?djnt C}"
     proof (clarsimp simp: chains_def)
       fix C
       assume C: "C \<subseteq> {C. C \<subseteq> D \<and> ?djnt C}" and "chain\<^sub>\<subseteq> C"
       show "\<Union>C \<subseteq> D \<and> ?djnt (\<Union>C)"
         unfolding pairwise_def
       proof (intro ballI conjI impI)
         show "\<Union>C \<subseteq> D"
           using C by blast
       next
         fix x y
         assume "x \<in> \<Union>C" and "y \<in> \<Union>C" and "x \<noteq> y"
         then obtain X Y where XY: "x \<in> X" "X \<in> C" "y \<in> Y" "Y \<in> C"
           by blast
         then consider "X \<subseteq> Y" | "Y \<subseteq> X"
           by (meson \<open>chain\<^sub>\<subseteq> C\<close> chain_subset_def)
         then show "disjnt (cball (a x) (r x)) (cball (a y) (r y))"
         proof cases
           case 1
           with C XY \<open>x \<noteq> y\<close> show ?thesis
             unfolding pairwise_def by blast
         next
           case 2
           with C XY \<open>x \<noteq> y\<close> show ?thesis
             unfolding pairwise_def by blast
         qed
       qed
     qed
     obtain E where "E \<subseteq> D" and djntE: "?djnt E" and maximalE: "\<And>X. \<lbrakk>X \<subseteq> D; ?djnt X; E \<subseteq> X\<rbrakk> \<Longrightarrow> X = E"
       using Zorn_Lemma [OF *] by safe blast
     show "\<exists>L. (L \<subseteq> K \<and>
                (\<forall>i\<in>L. B/2 ^ Suc n \<le> r i) \<and> ?djnt L \<and>
                (\<forall>i\<in>K. B/2 ^ Suc n < r i \<longrightarrow> (\<exists>j. j \<in> L \<and> ?cover_ar i j))) \<and> C \<subseteq> L"
     proof (intro exI conjI ballI)
       show "C \<union> E \<subseteq> K"
         using D_def \<open>C \<subseteq> K\<close> \<open>E \<subseteq> D\<close> by blast
       show "B/2 ^ Suc n \<le> r i" if i: "i \<in> C \<union> E" for i
         using i
       proof
         assume "i \<in> C"
         have "B/2 ^ Suc n \<le> B/2 ^ n"
           using \<open>B > 0\<close> by (simp add: field_split_simps)
         also have "\<dots> \<le> r i"
           using Ble \<open>i \<in> C\<close> by blast
         finally show ?thesis .
       qed (use D_def \<open>E \<subseteq> D\<close> in auto)
       show "?djnt (C \<union> E)"
         using D_def \<open>C \<subseteq> K\<close> \<open>E \<subseteq> D\<close> djntC djntE
         unfolding pairwise_def disjnt_def by blast
     next
       fix i
       assume "i \<in> K"
       show "B/2 ^ Suc n < r i \<longrightarrow> (\<exists>j. j \<in> C \<union> E \<and> ?cover_ar i j)"
       proof (cases "r i \<le> B/2^n")
         case False
         then show ?thesis
           using cov_n \<open>i \<in> K\<close> by auto
       next
         case True
         have "cball (a i) (r i) \<subseteq> ball (a j) (5 * r j)"
           if less: "B/2 ^ Suc n < r i" and j: "j \<in> C \<union> E"
             and nondis: "\<not> disjnt (cball (a i) (r i)) (cball (a j) (r j))" for j
         proof -
           obtain x where x: "dist (a i) x \<le> r i" "dist (a j) x \<le> r j"
             using nondis by (force simp: disjnt_def)
           have "dist (a i) (a j) \<le> dist (a i) x + dist x (a j)"
             by (simp add: dist_triangle)
           also have "\<dots> \<le> r i + r j"
             by (metis add_mono_thms_linordered_semiring(1) dist_commute x)
           finally have aij: "dist (a i) (a j) + r i < 5 * r j" if "r i < 2 * r j"
             using that by auto
           show ?thesis
             using j
           proof
             assume "j \<in> C"
             have "B/2^n < 2 * r j"
               using Ble True \<open>j \<in> C\<close> less by auto
             with aij True show "cball (a i) (r i) \<subseteq> ball (a j) (5 * r j)"
               by (simp add: cball_subset_ball_iff)
           next
             assume "j \<in> E"
             then have "B/2 ^ n < 2 * r j"
               using D_def \<open>E \<subseteq> D\<close> by auto
             with True have "r i < 2 * r j"
               by auto
             with aij show "cball (a i) (r i) \<subseteq> ball (a j) (5 * r j)"
               by (simp add: cball_subset_ball_iff)
           qed
         qed
       moreover have "\<exists>j. j \<in> C \<union> E \<and> \<not> disjnt (cball (a i) (r i)) (cball (a j) (r j))"
         if "B/2 ^ Suc n < r i"
       proof (rule classical)
         assume NON: "\<not> ?thesis"
         show ?thesis
         proof (cases "i \<in> D")
           case True
           have "insert i E = E"
           proof (rule maximalE)
             show "insert i E \<subseteq> D"
               by (simp add: True \<open>E \<subseteq> D\<close>)
             show "pairwise (\<lambda>i j. disjnt (cball (a i) (r i)) (cball (a j) (r j))) (insert i E)"
               using False NON by (auto simp: pairwise_insert djntE disjnt_sym)
           qed auto
           then show ?thesis
             using \<open>i \<in> K\<close> assms by fastforce
         next
           case False
           with that show ?thesis
             by (auto simp: D_def disjnt_def \<open>i \<in> K\<close>)
         qed
       qed
       ultimately
       show "B/2 ^ Suc n < r i \<longrightarrow>
             (\<exists>j. j \<in> C \<union> E \<and>
                  \<not> disjnt (cball (a i) (r i)) (cball (a j) (r j)) \<and>
                  cball (a i) (r i) \<subseteq> ball (a j) (5 * r j))"
         by blast
       qed
     qed auto
   qed (use assms in force)
   then obtain F where FK: "\<And>n. F n \<subseteq> K"
                and Fle: "\<And>n i. i \<in> F n \<Longrightarrow> B/2 ^ n \<le> r i"
                and Fdjnt:  "\<And>n. ?djnt (F n)"
                and FF:  "\<And>n i. \<lbrakk>i \<in> K; B/2 ^ n < r i\<rbrakk>
                         \<Longrightarrow> \<exists>j. j \<in> F n \<and> \<not> disjnt (cball (a i) (r i)) (cball (a j) (r j)) \<and>
                                 cball (a i) (r i) \<subseteq> ball (a j) (5 * r j)"
                and inc:  "\<And>n. F n \<subseteq> F(Suc n)"
     by (force simp: all_conj_distrib)
   show thesis
   proof
     have *: "countable I"
       if "I \<subseteq> K" and pw: "pairwise (\<lambda>i j. disjnt (cball (a i) (r i)) (cball (a j) (r j))) I" for I
     proof -
       show ?thesis
       proof (rule countable_image_inj_on [of "\<lambda>i. cball(a i)(r i)"])
         show "countable ((\<lambda>i. cball (a i) (r i)) ` I)"
         proof (rule countable_disjoint_nonempty_interior_subsets)
           show "disjoint ((\<lambda>i. cball (a i) (r i)) ` I)"
             by (auto simp: dest: pairwiseD [OF pw] intro: pairwise_imageI)
           show "\<And>S. \<lbrakk>S \<in> (\<lambda>i. cball (a i) (r i)) ` I; interior S = {}\<rbrakk> \<Longrightarrow> S = {}"
             using \<open>I \<subseteq> K\<close>
             by (auto simp: not_less [symmetric])
         qed
       next
         have "\<And>x y. \<lbrakk>x \<in> I; y \<in> I; a x = a y; r x = r y\<rbrakk> \<Longrightarrow> x = y"
           using pw \<open>I \<subseteq> K\<close> assms
           apply (clarsimp simp: pairwise_def disjnt_def)
           by (metis assms centre_in_cball subsetD empty_iff inf.idem less_eq_real_def)
         then show "inj_on (\<lambda>i. cball (a i) (r i)) I"
           using \<open>I \<subseteq> K\<close> by (fastforce simp: inj_on_def cball_eq_cball_iff dest: assms)
       qed
     qed
     show "(Union(range F)) \<subseteq> K"
       using FK by blast
     moreover show "pairwise (\<lambda>i j. disjnt (cball (a i) (r i)) (cball (a j) (r j))) (Union(range F))"
     proof (rule pairwise_chain_Union)
       show "chain\<^sub>\<subseteq> (range F)"
         unfolding chain_subset_def by clarify (meson inc lift_Suc_mono_le linear subsetCE)
     qed (use Fdjnt in blast)
     ultimately show "countable (Union(range F))"
       by (blast intro: *)
   next
     fix i assume "i \<in> K"
     then obtain n where "(1/2) ^ n < r i / B"
       using  \<open>B > 0\<close> assms real_arch_pow_inv by fastforce
     then have B2: "B/2 ^ n < r i"
       using \<open>B > 0\<close> by (simp add: field_split_simps)
     have "0 < r i" "r i \<le> B"
       by (auto simp: \<open>i \<in> K\<close> assms)
     show "\<exists>j. j \<in> (Union(range F)) \<and>
           \<not> disjnt (cball (a i) (r i)) (cball (a j) (r j)) \<and>
           cball (a i) (r i) \<subseteq> ball (a j) (5 * r j)"
       using FF [OF \<open>i \<in> K\<close> B2] by auto
   qed
 qed
 
 subsection\<open>Vitali covering theorem\<close>
 
 lemma Vitali_covering_lemma_cballs:
   fixes a :: "'a \<Rightarrow> 'b::euclidean_space"
   assumes S: "S \<subseteq> (\<Union>i\<in>K. cball (a i) (r i))"
       and r: "\<And>i. i \<in> K \<Longrightarrow> 0 < r i \<and> r i \<le> B"
   obtains C where "countable C" "C \<subseteq> K"
      "pairwise (\<lambda>i j. disjnt (cball (a i) (r i)) (cball (a j) (r j))) C"
      "S \<subseteq> (\<Union>i\<in>C. cball (a i) (5 * r i))"
 proof -
   obtain C where C: "countable C" "C \<subseteq> K"
                     "pairwise (\<lambda>i j. disjnt (cball (a i) (r i)) (cball (a j) (r j))) C"
            and cov: "\<And>i. i \<in> K \<Longrightarrow> \<exists>j. j \<in> C \<and> \<not> disjnt (cball (a i) (r i)) (cball (a j) (r j)) \<and>
                         cball (a i) (r i) \<subseteq> ball (a j) (5 * r j)"
     by (rule Vitali_covering_lemma_cballs_balls [OF r, where a=a]) (blast intro: that)+
   show ?thesis
   proof
     have "(\<Union>i\<in>K. cball (a i) (r i)) \<subseteq> (\<Union>i\<in>C. cball (a i) (5 * r i))"
       using cov subset_iff by fastforce
     with S show "S \<subseteq> (\<Union>i\<in>C. cball (a i) (5 * r i))"
       by blast
   qed (use C in auto)
 qed
 
 lemma Vitali_covering_lemma_balls:
   fixes a :: "'a \<Rightarrow> 'b::euclidean_space"
   assumes S: "S \<subseteq> (\<Union>i\<in>K. ball (a i) (r i))"
       and r: "\<And>i. i \<in> K \<Longrightarrow> 0 < r i \<and> r i \<le> B"
   obtains C where "countable C" "C \<subseteq> K"
      "pairwise (\<lambda>i j. disjnt (ball (a i) (r i)) (ball (a j) (r j))) C"
      "S \<subseteq> (\<Union>i\<in>C. ball (a i) (5 * r i))"
 proof -
   obtain C where C: "countable C" "C \<subseteq> K"
            and pw:  "pairwise (\<lambda>i j. disjnt (cball (a i) (r i)) (cball (a j) (r j))) C"
            and cov: "\<And>i. i \<in> K \<Longrightarrow> \<exists>j. j \<in> C \<and> \<not> disjnt (cball (a i) (r i)) (cball (a j) (r j)) \<and>
                         cball (a i) (r i) \<subseteq> ball (a j) (5 * r j)"
     by (rule Vitali_covering_lemma_cballs_balls [OF r, where a=a]) (blast intro: that)+
   show ?thesis
   proof
     have "(\<Union>i\<in>K. ball (a i) (r i)) \<subseteq> (\<Union>i\<in>C. ball (a i) (5 * r i))"
       using cov subset_iff
       by clarsimp (meson less_imp_le mem_ball mem_cball subset_eq)
     with S show "S \<subseteq> (\<Union>i\<in>C. ball (a i) (5 * r i))"
       by blast
     show "pairwise (\<lambda>i j. disjnt (ball (a i) (r i)) (ball (a j) (r j))) C"
       using pw
       by (clarsimp simp: pairwise_def) (meson ball_subset_cball disjnt_subset1 disjnt_subset2)
   qed (use C in auto)
 qed
 
 
 theorem Vitali_covering_theorem_cballs:
   fixes a :: "'a \<Rightarrow> 'n::euclidean_space"
   assumes r: "\<And>i. i \<in> K \<Longrightarrow> 0 < r i"
       and S: "\<And>x d. \<lbrakk>x \<in> S; 0 < d\<rbrakk>
                      \<Longrightarrow> \<exists>i. i \<in> K \<and> x \<in> cball (a i) (r i) \<and> r i < d"
   obtains C where "countable C" "C \<subseteq> K"
      "pairwise (\<lambda>i j. disjnt (cball (a i) (r i)) (cball (a j) (r j))) C"
      "negligible(S - (\<Union>i \<in> C. cball (a i) (r i)))"
 proof -
   let ?\<mu> = "measure lebesgue"
   have *: "\<exists>C. countable C \<and> C \<subseteq> K \<and>
             pairwise (\<lambda>i j. disjnt (cball (a i) (r i)) (cball (a j) (r j))) C \<and>
             negligible(S - (\<Union>i \<in> C. cball (a i) (r i)))"
     if r01: "\<And>i. i \<in> K \<Longrightarrow> 0 < r i \<and> r i \<le> 1"
        and Sd: "\<And>x d. \<lbrakk>x \<in> S; 0 < d\<rbrakk> \<Longrightarrow> \<exists>i. i \<in> K \<and> x \<in> cball (a i) (r i) \<and> r i < d"
      for K r and a :: "'a \<Rightarrow> 'n"
   proof -
     obtain C where C: "countable C" "C \<subseteq> K"
       and pwC: "pairwise (\<lambda>i j. disjnt (cball (a i) (r i)) (cball (a j) (r j))) C"
       and cov: "\<And>i. i \<in> K \<Longrightarrow> \<exists>j. j \<in> C \<and> \<not> disjnt (cball (a i) (r i)) (cball (a j) (r j)) \<and>
                         cball (a i) (r i) \<subseteq> ball (a j) (5 * r j)"
       by (rule Vitali_covering_lemma_cballs_balls [of K r 1 a]) (auto simp: r01)
     have ar_injective: "\<And>x y. \<lbrakk>x \<in> C; y \<in> C; a x = a y; r x = r y\<rbrakk> \<Longrightarrow> x = y"
       using \<open>C \<subseteq> K\<close> pwC cov
       by (force simp: pairwise_def disjnt_def)
     show ?thesis
     proof (intro exI conjI)
       show "negligible (S - (\<Union>i\<in>C. cball (a i) (r i)))"
       proof (clarsimp simp: negligible_on_intervals [of "S-T" for T])
         fix l u
         show "negligible ((S - (\<Union>i\<in>C. cball (a i) (r i))) \<inter> cbox l u)"
           unfolding negligible_outer_le
         proof (intro allI impI)
           fix e::real
           assume "e > 0"
           define D where "D \<equiv> {i \<in> C. \<not> disjnt (ball(a i) (5 * r i)) (cbox l u)}"
           then have "D \<subseteq> C"
             by auto
           have "countable D"
             unfolding D_def using \<open>countable C\<close> by simp
           have UD: "(\<Union>i\<in>D. cball (a i) (r i)) \<in> lmeasurable"
           proof (rule fmeasurableI2)
             show "cbox (l - 6 *\<^sub>R One) (u + 6 *\<^sub>R One) \<in> lmeasurable"
               by blast
             have "y \<in> cbox (l - 6 *\<^sub>R One) (u + 6 *\<^sub>R One)"
               if "i \<in> C" and x: "x \<in> cbox l u" and ai: "dist (a i) y \<le> r i" "dist (a i) x < 5 * r i"
               for i x y
             proof -
               have d6: "dist y x < 6 * r i"
                 using dist_triangle3 [of y x "a i"] that by linarith
               show ?thesis
               proof (clarsimp simp: mem_box algebra_simps)
                 fix j::'n
                 assume j: "j \<in> Basis"
                 then have xyj: "\<bar>x \<bullet> j - y \<bullet> j\<bar> \<le> dist y x"
                   by (metis Basis_le_norm dist_commute dist_norm inner_diff_left)
                 have "l \<bullet> j \<le> x \<bullet> j"
                   using \<open>j \<in> Basis\<close> mem_box \<open>x \<in> cbox l u\<close> by blast
                 also have "\<dots> \<le> y \<bullet> j + 6 * r i"
                   using d6 xyj by (auto simp: algebra_simps)
                 also have "\<dots> \<le> y \<bullet> j + 6"
                   using r01 [of i] \<open>C \<subseteq> K\<close> \<open>i \<in> C\<close> by auto
                 finally have l: "l \<bullet> j \<le> y \<bullet> j + 6" .
                 have "y \<bullet> j \<le> x \<bullet> j + 6 * r i"
                   using d6 xyj by (auto simp: algebra_simps)
                 also have "\<dots> \<le> u \<bullet> j + 6 * r i"
                   using j  x by (auto simp: mem_box)
                 also have "\<dots> \<le> u \<bullet> j + 6"
                   using r01 [of i] \<open>C \<subseteq> K\<close> \<open>i \<in> C\<close> by auto
                 finally have u: "y \<bullet> j \<le> u \<bullet> j + 6" .
                 show "l \<bullet> j \<le> y \<bullet> j + 6 \<and> y \<bullet> j \<le> u \<bullet> j + 6"
                   using l u by blast
               qed
             qed
             then show "(\<Union>i\<in>D. cball (a i) (r i)) \<subseteq> cbox (l - 6 *\<^sub>R One) (u + 6 *\<^sub>R One)"
               by (force simp: D_def disjnt_def)
             show "(\<Union>i\<in>D. cball (a i) (r i)) \<in> sets lebesgue"
               using \<open>countable D\<close> by auto
           qed
           obtain D1 where "D1 \<subseteq> D" "finite D1"
             and measD1: "?\<mu> (\<Union>i\<in>D. cball (a i) (r i)) - e / 5 ^ DIM('n) < ?\<mu> (\<Union>i\<in>D1. cball (a i) (r i))"
           proof (rule measure_countable_Union_approachable [where e = "e / 5 ^ (DIM('n))"])
             show "countable ((\<lambda>i. cball (a i) (r i)) ` D)"
               using \<open>countable D\<close> by auto
             show "\<And>d. d \<in> (\<lambda>i. cball (a i) (r i)) ` D \<Longrightarrow> d \<in> lmeasurable"
               by auto
             show "\<And>D'. \<lbrakk>D' \<subseteq> (\<lambda>i. cball (a i) (r i)) ` D; finite D'\<rbrakk> \<Longrightarrow> ?\<mu> (\<Union>D') \<le> ?\<mu> (\<Union>i\<in>D. cball (a i) (r i))"
               by (fastforce simp add: intro!: measure_mono_fmeasurable UD)
           qed (use \<open>e > 0\<close> in \<open>auto dest: finite_subset_image\<close>)
           show "\<exists>T. (S - (\<Union>i\<in>C. cball (a i) (r i))) \<inter>
                     cbox l u \<subseteq> T \<and> T \<in> lmeasurable \<and> ?\<mu> T \<le> e"
           proof (intro exI conjI)
             show "(S - (\<Union>i\<in>C. cball (a i) (r i))) \<inter> cbox l u \<subseteq> (\<Union>i\<in>D - D1. ball (a i) (5 * r i))"
             proof clarify
               fix x
               assume x: "x \<in> cbox l u" "x \<in> S" "x \<notin> (\<Union>i\<in>C. cball (a i) (r i))"
               have "closed (\<Union>i\<in>D1. cball (a i) (r i))"
                 using \<open>finite D1\<close> by blast
               moreover have "x \<notin> (\<Union>j\<in>D1. cball (a j) (r j))"
                 using x \<open>D1 \<subseteq> D\<close> unfolding D_def by blast
               ultimately obtain q where "q > 0" and q: "ball x q \<subseteq> - (\<Union>i\<in>D1. cball (a i) (r i))"
                 by (metis (no_types, lifting) ComplI open_contains_ball closed_def)
               obtain i where "i \<in> K" and xi: "x \<in> cball (a i) (r i)" and ri: "r i < q/2"
                 using Sd [OF \<open>x \<in> S\<close>] \<open>q > 0\<close> half_gt_zero by blast
               then obtain j where "j \<in> C"
                              and nondisj: "\<not> disjnt (cball (a i) (r i)) (cball (a j) (r j))"
                              and sub5j:  "cball (a i) (r i) \<subseteq> ball (a j) (5 * r j)"
                 using cov [OF \<open>i \<in> K\<close>] by metis
               show "x \<in> (\<Union>i\<in>D - D1. ball (a i) (5 * r i))"
               proof
                 show "j \<in> D - D1"
                 proof
                   show "j \<in> D"
                     using \<open>j \<in> C\<close> sub5j \<open>x \<in> cbox l u\<close> xi by (auto simp: D_def disjnt_def)
                   obtain y where yi: "dist (a i) y \<le> r i" and yj: "dist (a j) y \<le> r j"
                     using disjnt_def nondisj by fastforce
                   have "dist x y \<le> r i + r i"
                     by (metis add_mono dist_commute dist_triangle_le mem_cball xi yi)
                   also have "\<dots> < q"
                     using ri by linarith
                   finally have "y \<in> ball x q"
                     by simp
                   with yj q show "j \<notin> D1"
                     by (auto simp: disjoint_UN_iff)
                 qed
                 show "x \<in> ball (a j) (5 * r j)"
                   using xi sub5j by blast
               qed
             qed
             have 3: "?\<mu> (\<Union>i\<in>D2. ball (a i) (5 * r i)) \<le> e"
               if D2: "D2 \<subseteq> D - D1" and "finite D2" for D2
             proof -
               have rgt0: "0 < r i" if "i \<in> D2" for i
                 using \<open>C \<subseteq> K\<close> D_def \<open>i \<in> D2\<close> D2 r01
                 by (simp add: subset_iff)
               then have inj: "inj_on (\<lambda>i. ball (a i) (5 * r i)) D2"
                 using \<open>C \<subseteq> K\<close> D2 by (fastforce simp: inj_on_def D_def ball_eq_ball_iff intro: ar_injective)
               have "?\<mu> (\<Union>i\<in>D2. ball (a i) (5 * r i)) \<le> sum (?\<mu>) ((\<lambda>i. ball (a i) (5 * r i)) ` D2)"
                 using that by (force intro: measure_Union_le)
               also have "\<dots>  = (\<Sum>i\<in>D2. ?\<mu> (ball (a i) (5 * r i)))"
                 by (simp add: comm_monoid_add_class.sum.reindex [OF inj])
               also have "\<dots> = (\<Sum>i\<in>D2. 5 ^ DIM('n) * ?\<mu> (ball (a i) (r i)))"
               proof (rule sum.cong [OF refl])
-                fix i
-                assume "i \<in> D2"
-                show "?\<mu> (ball (a i) (5 * r i)) = 5 ^ DIM('n) * ?\<mu> (ball (a i) (r i))"
-                  using rgt0 [OF \<open>i \<in> D2\<close>] by (simp add: content_ball)
+                fix i assume "i \<in> D2"
+                thus "?\<mu> (ball (a i) (5 * r i)) = 5 ^ DIM('n) * ?\<mu> (ball (a i) (r i))"
+                  using content_ball_conv_unit_ball[of "5 * r i" "a i"]
+                        content_ball_conv_unit_ball[of "r i" "a i"] rgt0[of i] by auto
               qed
               also have "\<dots> = (\<Sum>i\<in>D2. ?\<mu> (ball (a i) (r i))) * 5 ^ DIM('n)"
                 by (simp add: sum_distrib_left mult.commute)
               finally have "?\<mu> (\<Union>i\<in>D2. ball (a i) (5 * r i)) \<le> (\<Sum>i\<in>D2. ?\<mu> (ball (a i) (r i))) * 5 ^ DIM('n)" .
               moreover have "(\<Sum>i\<in>D2. ?\<mu> (ball (a i) (r i))) \<le> e / 5 ^ DIM('n)"
               proof -
                 have D12_dis: "((\<Union>x\<in>D1. cball (a x) (r x)) \<inter> (\<Union>x\<in>D2. cball (a x) (r x))) \<le> {}"
                 proof clarify
                   fix w d1 d2
                   assume "d1 \<in> D1" "w d1 d2 \<in> cball (a d1) (r d1)" "d2 \<in> D2" "w d1 d2 \<in> cball (a d2) (r d2)"
                   then show "w d1 d2 \<in> {}"
                     by (metis DiffE disjnt_iff subsetCE D2 \<open>D1 \<subseteq> D\<close> \<open>D \<subseteq> C\<close> pairwiseD [OF pwC, of d1 d2])
                 qed
                 have inj: "inj_on (\<lambda>i. cball (a i) (r i)) D2"
                   using rgt0 D2 \<open>D \<subseteq> C\<close> by (force simp: inj_on_def cball_eq_cball_iff intro!: ar_injective)
                 have ds: "disjoint ((\<lambda>i. cball (a i) (r i)) ` D2)"
                   using D2 \<open>D \<subseteq> C\<close> by (auto intro: pairwiseI pairwiseD [OF pwC])
                 have "(\<Sum>i\<in>D2. ?\<mu> (ball (a i) (r i))) = (\<Sum>i\<in>D2. ?\<mu> (cball (a i) (r i)))"
-                  using rgt0 by (simp add: content_ball content_cball less_eq_real_def)
+                  by (simp add: content_cball_conv_ball)
                 also have "\<dots> = sum ?\<mu> ((\<lambda>i. cball (a i) (r i)) ` D2)"
                   by (simp add: comm_monoid_add_class.sum.reindex [OF inj])
                 also have "\<dots> = ?\<mu> (\<Union>i\<in>D2. cball (a i) (r i))"
                   by (auto intro: measure_Union' [symmetric] ds simp add: \<open>finite D2\<close>)
                 finally have "?\<mu> (\<Union>i\<in>D1. cball (a i) (r i)) + (\<Sum>i\<in>D2. ?\<mu> (ball (a i) (r i))) =
                               ?\<mu> (\<Union>i\<in>D1. cball (a i) (r i)) + ?\<mu> (\<Union>i\<in>D2. cball (a i) (r i))"
                   by simp
                 also have "\<dots> = ?\<mu> (\<Union>i \<in> D1 \<union> D2. cball (a i) (r i))"
                   using D12_dis by (simp add: measure_Un3 \<open>finite D1\<close> \<open>finite D2\<close> fmeasurable.finite_UN)
                 also have "\<dots> \<le> ?\<mu> (\<Union>i\<in>D. cball (a i) (r i))"
                   using D2 \<open>D1 \<subseteq> D\<close> by (fastforce intro!: measure_mono_fmeasurable [OF _ _ UD] \<open>finite D1\<close> \<open>finite D2\<close>)
                 finally have "?\<mu> (\<Union>i\<in>D1. cball (a i) (r i)) + (\<Sum>i\<in>D2. ?\<mu> (ball (a i) (r i))) \<le> ?\<mu> (\<Union>i\<in>D. cball (a i) (r i))" .
                 with measD1 show ?thesis
                   by simp
               qed
                 ultimately show ?thesis
                   by (simp add: field_split_simps)
             qed
             have co: "countable (D - D1)"
               by (simp add: \<open>countable D\<close>)
             show "(\<Union>i\<in>D - D1. ball (a i) (5 * r i)) \<in> lmeasurable"
               using \<open>e > 0\<close> by (auto simp: fmeasurable_UN_bound [OF co _ 3])
             show "?\<mu> (\<Union>i\<in>D - D1. ball (a i) (5 * r i)) \<le> e"
               using \<open>e > 0\<close> by (auto simp: measure_UN_bound [OF co _ 3])
           qed
         qed
       qed
     qed (use C pwC in auto)
   qed
   define K' where "K' \<equiv> {i \<in> K. r i \<le> 1}"
   have 1: "\<And>i. i \<in> K' \<Longrightarrow> 0 < r i \<and> r i \<le> 1"
     using K'_def r by auto
   have 2: "\<exists>i. i \<in> K' \<and> x \<in> cball (a i) (r i) \<and> r i < d"
     if "x \<in> S \<and> 0 < d" for x d
     using that by (auto simp: K'_def dest!: S [where d = "min d 1"])
   have "K' \<subseteq> K"
     using K'_def by auto
   then show thesis
     using * [OF 1 2] that by fastforce
 qed
 
 
 theorem Vitali_covering_theorem_balls:
   fixes a :: "'a \<Rightarrow> 'b::euclidean_space"
   assumes S: "\<And>x d. \<lbrakk>x \<in> S; 0 < d\<rbrakk> \<Longrightarrow> \<exists>i. i \<in> K \<and> x \<in> ball (a i) (r i) \<and> r i < d"
   obtains C where "countable C" "C \<subseteq> K"
      "pairwise (\<lambda>i j. disjnt (ball (a i) (r i)) (ball (a j) (r j))) C"
      "negligible(S - (\<Union>i \<in> C. ball (a i) (r i)))"
 proof -
   have 1: "\<exists>i. i \<in> {i \<in> K. 0 < r i} \<and> x \<in> cball (a i) (r i) \<and> r i < d"
          if xd: "x \<in> S" "d > 0" for x d
     by (metis (mono_tags, lifting) assms ball_eq_empty less_eq_real_def mem_Collect_eq mem_ball mem_cball not_le xd(1) xd(2))
   obtain C where C: "countable C" "C \<subseteq> K"
              and pw: "pairwise (\<lambda>i j. disjnt (cball (a i) (r i)) (cball (a j) (r j))) C"
              and neg: "negligible(S - (\<Union>i \<in> C. cball (a i) (r i)))"
     by (rule Vitali_covering_theorem_cballs [of "{i \<in> K. 0 < r i}" r S a, OF _ 1]) auto
   show thesis
   proof
     show "pairwise (\<lambda>i j. disjnt (ball (a i) (r i)) (ball (a j) (r j))) C"
       apply (rule pairwise_mono [OF pw])
       apply (auto simp: disjnt_def)
       by (meson disjoint_iff_not_equal less_imp_le mem_cball)
     have "negligible (\<Union>i\<in>C. sphere (a i) (r i))"
       by (auto intro: negligible_sphere \<open>countable C\<close>)
     then have "negligible (S - (\<Union>i \<in> C. cball(a i)(r i)) \<union> (\<Union>i \<in> C. sphere (a i) (r i)))"
       by (rule negligible_Un [OF neg])
     then show "negligible (S - (\<Union>i\<in>C. ball (a i) (r i)))"
       by (rule negligible_subset) force
   qed (use C in auto)
 qed
 
 
 lemma negligible_eq_zero_density_alt:
      "negligible S \<longleftrightarrow>
       (\<forall>x \<in> S. \<forall>e > 0.
         \<exists>d U. 0 < d \<and> d \<le> e \<and> S \<inter> ball x d \<subseteq> U \<and>
               U \<in> lmeasurable \<and> measure lebesgue U < e * measure lebesgue (ball x d))"
      (is "_ = (\<forall>x \<in> S. \<forall>e > 0. ?Q x e)")
 proof (intro iffI ballI allI impI)
   fix x and e :: real
   assume "negligible S" and "x \<in> S" and "e > 0"
   then
   show "\<exists>d U. 0 < d \<and> d \<le> e \<and> S \<inter> ball x d \<subseteq> U \<and> U \<in> lmeasurable \<and>
               measure lebesgue U < e * measure lebesgue (ball x d)"
     apply (rule_tac x=e in exI)
     apply (rule_tac x="S \<inter> ball x e" in exI)
-    apply (auto simp: negligible_imp_measurable negligible_Int negligible_imp_measure0 zero_less_measure_iff)
+    apply (auto simp: negligible_imp_measurable negligible_Int negligible_imp_measure0 zero_less_measure_iff
+                intro: mult_pos_pos content_ball_pos)
     done
 next
   assume R [rule_format]: "\<forall>x \<in> S. \<forall>e > 0. ?Q x e"
   let ?\<mu> = "measure lebesgue"
   have "\<exists>U. openin (top_of_set S) U \<and> z \<in> U \<and> negligible U"
     if "z \<in> S" for z
   proof (intro exI conjI)
     show "openin (top_of_set S) (S \<inter> ball z 1)"
       by (simp add: openin_open_Int)
     show "z \<in> S \<inter> ball z 1"
       using \<open>z \<in> S\<close> by auto
     show "negligible (S \<inter> ball z 1)"
     proof (clarsimp simp: negligible_outer_le)
       fix e :: "real"
       assume "e > 0"
       let ?K = "{(x,d). x \<in> S \<and> 0 < d \<and> ball x d \<subseteq> ball z 1 \<and>
                      (\<exists>U. S \<inter> ball x d \<subseteq> U \<and> U \<in> lmeasurable \<and>
                          ?\<mu> U < e / ?\<mu> (ball z 1) * ?\<mu> (ball x d))}"
       obtain C where "countable C" and Csub: "C \<subseteq> ?K"
         and pwC: "pairwise (\<lambda>i j. disjnt (ball (fst i) (snd i)) (ball (fst j) (snd j))) C"
         and negC: "negligible((S \<inter> ball z 1) - (\<Union>i \<in> C. ball (fst i) (snd i)))"
       proof (rule Vitali_covering_theorem_balls [of "S \<inter> ball z 1" ?K fst snd])
         fix x and d :: "real"
         assume x: "x \<in> S \<inter> ball z 1" and "d > 0"
         obtain k where "k > 0" and k: "ball x k \<subseteq> ball z 1"
           by (meson Int_iff open_ball openE x)
         let ?\<epsilon> = "min (e / ?\<mu> (ball z 1) / 2) (min (d / 2) k)"
         obtain r U where r: "r > 0" "r \<le> ?\<epsilon>" and U: "S \<inter> ball x r \<subseteq> U" "U \<in> lmeasurable"
           and mU: "?\<mu> U < ?\<epsilon> * ?\<mu> (ball x r)"
-          using R [of x ?\<epsilon>] \<open>d > 0\<close> \<open>e > 0\<close> \<open>k > 0\<close> x by auto
+          using R [of x ?\<epsilon>] \<open>d > 0\<close> \<open>e > 0\<close> \<open>k > 0\<close> x by (auto simp: content_ball_pos)
         show "\<exists>i. i \<in> ?K \<and> x \<in> ball (fst i) (snd i) \<and> snd i < d"
         proof (rule exI [of _ "(x,r)"], simp, intro conjI exI)
           have "ball x r \<subseteq> ball x k"
             using r by (simp add: ball_subset_ball_iff)
           also have "\<dots> \<subseteq> ball z 1"
             using ball_subset_ball_iff k by auto
           finally show "ball x r \<subseteq> ball z 1" .
           have "?\<epsilon> * ?\<mu> (ball x r) \<le> e * content (ball x r) / content (ball z 1)"
-            using r \<open>e > 0\<close> by (simp add: ord_class.min_def field_split_simps)
+            using r \<open>e > 0\<close> by (simp add: ord_class.min_def field_split_simps content_ball_pos)
           with mU show "?\<mu> U < e * content (ball x r) / content (ball z 1)"
             by auto
         qed (use r U x in auto)
       qed
       have "\<exists>U. case p of (x,d) \<Rightarrow> S \<inter> ball x d \<subseteq> U \<and>
                         U \<in> lmeasurable \<and> ?\<mu> U < e / ?\<mu> (ball z 1) * ?\<mu> (ball x d)"
         if "p \<in> C" for p
         using that Csub unfolding case_prod_unfold by blast
       then obtain U where U:
                 "\<And>p. p \<in> C \<Longrightarrow>
                        case p of (x,d) \<Rightarrow> S \<inter> ball x d \<subseteq> U p \<and>
                         U p \<in> lmeasurable \<and> ?\<mu> (U p) < e / ?\<mu> (ball z 1) * ?\<mu> (ball x d)"
         by (rule that [OF someI_ex])
       let ?T = "((S \<inter> ball z 1) - (\<Union>(x,d)\<in>C. ball x d)) \<union> \<Union>(U ` C)"
       show "\<exists>T. S \<inter> ball z 1 \<subseteq> T \<and> T \<in> lmeasurable \<and> ?\<mu> T \<le> e"
       proof (intro exI conjI)
         show "S \<inter> ball z 1 \<subseteq> ?T"
           using U by fastforce
         { have Um: "U i \<in> lmeasurable" if "i \<in> C" for i
             using that U by blast
           have lee: "?\<mu> (\<Union>i\<in>I. U i) \<le> e" if "I \<subseteq> C" "finite I" for I
           proof -
             have "?\<mu> (\<Union>(x,d)\<in>I. ball x d) \<le> ?\<mu> (ball z 1)"
               apply (rule measure_mono_fmeasurable)
               using \<open>I \<subseteq> C\<close> \<open>finite I\<close> Csub by (force simp: prod.case_eq_if sets.finite_UN)+
             then have le1: "(?\<mu> (\<Union>(x,d)\<in>I. ball x d) / ?\<mu> (ball z 1)) \<le> 1"
-              by simp
+              by (simp add: content_ball_pos)
             have "?\<mu> (\<Union>i\<in>I. U i) \<le> (\<Sum>i\<in>I. ?\<mu> (U i))"
               using that U by (blast intro: measure_UNION_le)
             also have "\<dots> \<le> (\<Sum>(x,r)\<in>I. e / ?\<mu> (ball z 1) * ?\<mu> (ball x r))"
               by (rule sum_mono) (use \<open>I \<subseteq> C\<close> U in force)
             also have "\<dots> = (e / ?\<mu> (ball z 1)) * (\<Sum>(x,r)\<in>I. ?\<mu> (ball x r))"
               by (simp add: case_prod_app prod.case_distrib sum_distrib_left)
             also have "\<dots> = e * (?\<mu> (\<Union>(x,r)\<in>I. ball x r) / ?\<mu> (ball z 1))"
               apply (subst measure_UNION')
               using that pwC by (auto simp: case_prod_unfold elim: pairwise_mono)
             also have "\<dots> \<le> e"
               by (metis mult.commute mult.left_neutral real_mult_le_cancel_iff1 \<open>e > 0\<close> le1)
             finally show ?thesis .
           qed
           have "\<Union>(U ` C) \<in> lmeasurable" "?\<mu> (\<Union>(U ` C)) \<le> e"
             using \<open>e > 0\<close> Um lee
             by(auto intro!: fmeasurable_UN_bound [OF \<open>countable C\<close>] measure_UN_bound [OF \<open>countable C\<close>])
         }
         moreover have "?\<mu> ?T = ?\<mu> (\<Union>(U ` C))"
         proof (rule measure_negligible_symdiff [OF \<open>\<Union>(U ` C) \<in> lmeasurable\<close>])
           show "negligible((\<Union>(U ` C) - ?T) \<union> (?T - \<Union>(U ` C)))"
             by (force intro!: negligible_subset [OF negC])
         qed
         ultimately show "?T \<in> lmeasurable"  "?\<mu> ?T \<le> e"
           by (simp_all add: fmeasurable.Un negC negligible_imp_measurable split_def)
       qed
     qed
   qed
   with locally_negligible_alt show "negligible S"
     by metis
 qed
 
 proposition negligible_eq_zero_density:
    "negligible S \<longleftrightarrow>
     (\<forall>x\<in>S. \<forall>r>0. \<forall>e>0. \<exists>d. 0 < d \<and> d \<le> r \<and>
                    (\<exists>U. S \<inter> ball x d \<subseteq> U \<and> U \<in> lmeasurable \<and> measure lebesgue U < e * measure lebesgue (ball x d)))"
 proof -
   let ?Q = "\<lambda>x d e. \<exists>U. S \<inter> ball x d \<subseteq> U \<and> U \<in> lmeasurable \<and> measure lebesgue U < e * content (ball x d)"
   have "(\<forall>e>0. \<exists>d>0. d \<le> e \<and> ?Q x d e) = (\<forall>r>0. \<forall>e>0. \<exists>d>0. d \<le> r \<and> ?Q x d e)"
     if "x \<in> S" for x
   proof (intro iffI allI impI)
     fix r :: "real" and e :: "real"
     assume L [rule_format]: "\<forall>e>0. \<exists>d>0. d \<le> e \<and> ?Q x d e" and "r > 0" "e > 0"
     show "\<exists>d>0. d \<le> r \<and> ?Q x d e"
       using L [of "min r e"] apply (rule ex_forward)
-      using \<open>r > 0\<close> \<open>e > 0\<close>  by (auto intro: less_le_trans elim!: ex_forward)
+      using \<open>r > 0\<close> \<open>e > 0\<close>  by (auto intro: less_le_trans elim!: ex_forward simp: content_ball_pos)
   qed auto
   then show ?thesis
     by (force simp: negligible_eq_zero_density_alt)
 qed
 
 end