diff --git a/src/HOL/Fun.thy b/src/HOL/Fun.thy
--- a/src/HOL/Fun.thy
+++ b/src/HOL/Fun.thy
@@ -1,1108 +1,1120 @@
 (*  Title:      HOL/Fun.thy
     Author:     Tobias Nipkow, Cambridge University Computer Laboratory
     Author:     Andrei Popescu, TU Muenchen
     Copyright   1994, 2012
 *)
 
 section \<open>Notions about functions\<close>
 
 theory Fun
   imports Set
   keywords "functor" :: thy_goal_defn
 begin
 
 lemma apply_inverse: "f x = u \<Longrightarrow> (\<And>x. P x \<Longrightarrow> g (f x) = x) \<Longrightarrow> P x \<Longrightarrow> x = g u"
   by auto
 
 text \<open>Uniqueness, so NOT the axiom of choice.\<close>
 lemma uniq_choice: "\<forall>x. \<exists>!y. Q x y \<Longrightarrow> \<exists>f. \<forall>x. Q x (f x)"
   by (force intro: theI')
 
 lemma b_uniq_choice: "\<forall>x\<in>S. \<exists>!y. Q x y \<Longrightarrow> \<exists>f. \<forall>x\<in>S. Q x (f x)"
   by (force intro: theI')
 
 
 subsection \<open>The Identity Function \<open>id\<close>\<close>
 
 definition id :: "'a \<Rightarrow> 'a"
   where "id = (\<lambda>x. x)"
 
 lemma id_apply [simp]: "id x = x"
   by (simp add: id_def)
 
 lemma image_id [simp]: "image id = id"
   by (simp add: id_def fun_eq_iff)
 
 lemma vimage_id [simp]: "vimage id = id"
   by (simp add: id_def fun_eq_iff)
 
 lemma eq_id_iff: "(\<forall>x. f x = x) \<longleftrightarrow> f = id"
   by auto
 
 code_printing
   constant id \<rightharpoonup> (Haskell) "id"
 
 
 subsection \<open>The Composition Operator \<open>f \<circ> g\<close>\<close>
 
 definition comp :: "('b \<Rightarrow> 'c) \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> 'a \<Rightarrow> 'c"  (infixl "\<circ>" 55)
   where "f \<circ> g = (\<lambda>x. f (g x))"
 
 notation (ASCII)
   comp  (infixl "o" 55)
 
 lemma comp_apply [simp]: "(f \<circ> g) x = f (g x)"
   by (simp add: comp_def)
 
 lemma comp_assoc: "(f \<circ> g) \<circ> h = f \<circ> (g \<circ> h)"
   by (simp add: fun_eq_iff)
 
 lemma id_comp [simp]: "id \<circ> g = g"
   by (simp add: fun_eq_iff)
 
 lemma comp_id [simp]: "f \<circ> id = f"
   by (simp add: fun_eq_iff)
 
 lemma comp_eq_dest: "a \<circ> b = c \<circ> d \<Longrightarrow> a (b v) = c (d v)"
   by (simp add: fun_eq_iff)
 
 lemma comp_eq_elim: "a \<circ> b = c \<circ> d \<Longrightarrow> ((\<And>v. a (b v) = c (d v)) \<Longrightarrow> R) \<Longrightarrow> R"
   by (simp add: fun_eq_iff)
 
 lemma comp_eq_dest_lhs: "a \<circ> b = c \<Longrightarrow> a (b v) = c v"
   by clarsimp
 
 lemma comp_eq_id_dest: "a \<circ> b = id \<circ> c \<Longrightarrow> a (b v) = c v"
   by clarsimp
 
 lemma image_comp: "f ` (g ` r) = (f \<circ> g) ` r"
   by auto
 
 lemma vimage_comp: "f -` (g -` x) = (g \<circ> f) -` x"
   by auto
 
 lemma image_eq_imp_comp: "f ` A = g ` B \<Longrightarrow> (h \<circ> f) ` A = (h \<circ> g) ` B"
   by (auto simp: comp_def elim!: equalityE)
 
 lemma image_bind: "f ` (Set.bind A g) = Set.bind A ((`) f \<circ> g)"
   by (auto simp add: Set.bind_def)
 
 lemma bind_image: "Set.bind (f ` A) g = Set.bind A (g \<circ> f)"
   by (auto simp add: Set.bind_def)
 
 lemma (in group_add) minus_comp_minus [simp]: "uminus \<circ> uminus = id"
   by (simp add: fun_eq_iff)
 
 lemma (in boolean_algebra) minus_comp_minus [simp]: "uminus \<circ> uminus = id"
   by (simp add: fun_eq_iff)
 
 code_printing
   constant comp \<rightharpoonup> (SML) infixl 5 "o" and (Haskell) infixr 9 "."
 
 
 subsection \<open>The Forward Composition Operator \<open>fcomp\<close>\<close>
 
 definition fcomp :: "('a \<Rightarrow> 'b) \<Rightarrow> ('b \<Rightarrow> 'c) \<Rightarrow> 'a \<Rightarrow> 'c"  (infixl "\<circ>>" 60)
   where "f \<circ>> g = (\<lambda>x. g (f x))"
 
 lemma fcomp_apply [simp]:  "(f \<circ>> g) x = g (f x)"
   by (simp add: fcomp_def)
 
 lemma fcomp_assoc: "(f \<circ>> g) \<circ>> h = f \<circ>> (g \<circ>> h)"
   by (simp add: fcomp_def)
 
 lemma id_fcomp [simp]: "id \<circ>> g = g"
   by (simp add: fcomp_def)
 
 lemma fcomp_id [simp]: "f \<circ>> id = f"
   by (simp add: fcomp_def)
 
 lemma fcomp_comp: "fcomp f g = comp g f"
   by (simp add: ext)
 
 code_printing
   constant fcomp \<rightharpoonup> (Eval) infixl 1 "#>"
 
 no_notation fcomp (infixl "\<circ>>" 60)
 
 
 subsection \<open>Mapping functions\<close>
 
 definition map_fun :: "('c \<Rightarrow> 'a) \<Rightarrow> ('b \<Rightarrow> 'd) \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> 'c \<Rightarrow> 'd"
   where "map_fun f g h = g \<circ> h \<circ> f"
 
 lemma map_fun_apply [simp]: "map_fun f g h x = g (h (f x))"
   by (simp add: map_fun_def)
 
 
 subsection \<open>Injectivity and Bijectivity\<close>
 
 definition inj_on :: "('a \<Rightarrow> 'b) \<Rightarrow> 'a set \<Rightarrow> bool"  \<comment> \<open>injective\<close>
   where "inj_on f A \<longleftrightarrow> (\<forall>x\<in>A. \<forall>y\<in>A. f x = f y \<longrightarrow> x = y)"
 
 definition bij_betw :: "('a \<Rightarrow> 'b) \<Rightarrow> 'a set \<Rightarrow> 'b set \<Rightarrow> bool"  \<comment> \<open>bijective\<close>
   where "bij_betw f A B \<longleftrightarrow> inj_on f A \<and> f ` A = B"
 
 text \<open>
   A common special case: functions injective, surjective or bijective over
   the entire domain type.
 \<close>
 
 abbreviation inj :: "('a \<Rightarrow> 'b) \<Rightarrow> bool"
   where "inj f \<equiv> inj_on f UNIV"
 
 abbreviation surj :: "('a \<Rightarrow> 'b) \<Rightarrow> bool"
   where "surj f \<equiv> range f = UNIV"
 
 translations \<comment> \<open>The negated case:\<close>
   "\<not> CONST surj f" \<leftharpoondown> "CONST range f \<noteq> CONST UNIV"
 
 abbreviation bij :: "('a \<Rightarrow> 'b) \<Rightarrow> bool"
   where "bij f \<equiv> bij_betw f UNIV UNIV"
 
 lemma inj_def: "inj f \<longleftrightarrow> (\<forall>x y. f x = f y \<longrightarrow> x = y)"
   unfolding inj_on_def by blast
 
 lemma injI: "(\<And>x y. f x = f y \<Longrightarrow> x = y) \<Longrightarrow> inj f"
   unfolding inj_def by blast
 
 theorem range_ex1_eq: "inj f \<Longrightarrow> b \<in> range f \<longleftrightarrow> (\<exists>!x. b = f x)"
   unfolding inj_def by blast
 
 lemma injD: "inj f \<Longrightarrow> f x = f y \<Longrightarrow> x = y"
   by (simp add: inj_def)
 
 lemma inj_on_eq_iff: "inj_on f A \<Longrightarrow> x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> f x = f y \<longleftrightarrow> x = y"
   by (auto simp: inj_on_def)
 
 lemma inj_on_cong: "(\<And>a. a \<in> A \<Longrightarrow> f a = g a) \<Longrightarrow> inj_on f A \<longleftrightarrow> inj_on g A"
   by (auto simp: inj_on_def)
 
 lemma inj_on_strict_subset: "inj_on f B \<Longrightarrow> A \<subset> B \<Longrightarrow> f ` A \<subset> f ` B"
   unfolding inj_on_def by blast
 
 lemma inj_compose: "inj f \<Longrightarrow> inj g \<Longrightarrow> inj (f \<circ> g)"
   by (simp add: inj_def)
 
 lemma inj_fun: "inj f \<Longrightarrow> inj (\<lambda>x y. f x)"
   by (simp add: inj_def fun_eq_iff)
 
 lemma inj_eq: "inj f \<Longrightarrow> f x = f y \<longleftrightarrow> x = y"
   by (simp add: inj_on_eq_iff)
 
 lemma inj_on_iff_Uniq: "inj_on f A \<longleftrightarrow> (\<forall>x\<in>A. \<exists>\<^sub>\<le>\<^sub>1y. y\<in>A \<and> f x = f y)"
   by (auto simp: Uniq_def inj_on_def)
 
 lemma inj_on_id[simp]: "inj_on id A"
   by (simp add: inj_on_def)
 
 lemma inj_on_id2[simp]: "inj_on (\<lambda>x. x) A"
   by (simp add: inj_on_def)
 
 lemma inj_on_Int: "inj_on f A \<or> inj_on f B \<Longrightarrow> inj_on f (A \<inter> B)"
   unfolding inj_on_def by blast
 
 lemma surj_id: "surj id"
   by simp
 
 lemma bij_id[simp]: "bij id"
   by (simp add: bij_betw_def)
 
 lemma bij_uminus: "bij (uminus :: 'a \<Rightarrow> 'a::ab_group_add)"
   unfolding bij_betw_def inj_on_def
   by (force intro: minus_minus [symmetric])
 
 lemma bij_betwE: "bij_betw f A B \<Longrightarrow> \<forall>a\<in>A. f a \<in> B"
   unfolding bij_betw_def by auto
 
 lemma inj_onI [intro?]: "(\<And>x y. x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> f x = f y \<Longrightarrow> x = y) \<Longrightarrow> inj_on f A"
   by (simp add: inj_on_def)
 
 lemma inj_on_inverseI: "(\<And>x. x \<in> A \<Longrightarrow> g (f x) = x) \<Longrightarrow> inj_on f A"
   by (auto dest: arg_cong [of concl: g] simp add: inj_on_def)
 
 lemma inj_onD: "inj_on f A \<Longrightarrow> f x = f y \<Longrightarrow> x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> x = y"
   unfolding inj_on_def by blast
 
 lemma inj_on_subset:
   assumes "inj_on f A"
     and "B \<subseteq> A"
   shows "inj_on f B"
 proof (rule inj_onI)
   fix a b
   assume "a \<in> B" and "b \<in> B"
   with assms have "a \<in> A" and "b \<in> A"
     by auto
   moreover assume "f a = f b"
   ultimately show "a = b"
     using assms by (auto dest: inj_onD)
 qed
 
 lemma comp_inj_on: "inj_on f A \<Longrightarrow> inj_on g (f ` A) \<Longrightarrow> inj_on (g \<circ> f) A"
   by (simp add: comp_def inj_on_def)
 
 lemma inj_on_imageI: "inj_on (g \<circ> f) A \<Longrightarrow> inj_on g (f ` A)"
   by (auto simp add: inj_on_def)
 
 lemma inj_on_image_iff:
   "\<forall>x\<in>A. \<forall>y\<in>A. g (f x) = g (f y) \<longleftrightarrow> g x = g y \<Longrightarrow> inj_on f A \<Longrightarrow> inj_on g (f ` A) \<longleftrightarrow> inj_on g A"
   unfolding inj_on_def by blast
 
 lemma inj_on_contraD: "inj_on f A \<Longrightarrow> x \<noteq> y \<Longrightarrow> x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> f x \<noteq> f y"
   unfolding inj_on_def by blast
 
 lemma inj_singleton [simp]: "inj_on (\<lambda>x. {x}) A"
   by (simp add: inj_on_def)
 
 lemma inj_on_empty[iff]: "inj_on f {}"
   by (simp add: inj_on_def)
 
 lemma subset_inj_on: "inj_on f B \<Longrightarrow> A \<subseteq> B \<Longrightarrow> inj_on f A"
   unfolding inj_on_def by blast
 
 lemma inj_on_Un: "inj_on f (A \<union> B) \<longleftrightarrow> inj_on f A \<and> inj_on f B \<and> f ` (A - B) \<inter> f ` (B - A) = {}"
   unfolding inj_on_def by (blast intro: sym)
 
 lemma inj_on_insert [iff]: "inj_on f (insert a A) \<longleftrightarrow> inj_on f A \<and> f a \<notin> f ` (A - {a})"
   unfolding inj_on_def by (blast intro: sym)
 
 lemma inj_on_diff: "inj_on f A \<Longrightarrow> inj_on f (A - B)"
   unfolding inj_on_def by blast
 
 lemma comp_inj_on_iff: "inj_on f A \<Longrightarrow> inj_on f' (f ` A) \<longleftrightarrow> inj_on (f' \<circ> f) A"
   by (auto simp: comp_inj_on inj_on_def)
 
 lemma inj_on_imageI2: "inj_on (f' \<circ> f) A \<Longrightarrow> inj_on f A"
   by (auto simp: comp_inj_on inj_on_def)
 
 lemma inj_img_insertE:
   assumes "inj_on f A"
   assumes "x \<notin> B"
     and "insert x B = f ` A"
   obtains x' A' where "x' \<notin> A'" and "A = insert x' A'" and "x = f x'" and "B = f ` A'"
 proof -
   from assms have "x \<in> f ` A" by auto
   then obtain x' where *: "x' \<in> A" "x = f x'" by auto
   then have A: "A = insert x' (A - {x'})" by auto
   with assms * have B: "B = f ` (A - {x'})" by (auto dest: inj_on_contraD)
   have "x' \<notin> A - {x'}" by simp
   from this A \<open>x = f x'\<close> B show ?thesis ..
 qed
 
 lemma linorder_inj_onI:
   fixes A :: "'a::order set"
   assumes ne: "\<And>x y. \<lbrakk>x < y; x\<in>A; y\<in>A\<rbrakk> \<Longrightarrow> f x \<noteq> f y" and lin: "\<And>x y. \<lbrakk>x\<in>A; y\<in>A\<rbrakk> \<Longrightarrow> x\<le>y \<or> y\<le>x"
   shows "inj_on f A"
 proof (rule inj_onI)
   fix x y
   assume eq: "f x = f y" and "x\<in>A" "y\<in>A"
   then show "x = y"
     using lin [of x y] ne by (force simp: dual_order.order_iff_strict)
 qed
 
 lemma linorder_injI:
   assumes "\<And>x y::'a::linorder. x < y \<Longrightarrow> f x \<noteq> f y"
   shows "inj f"
     \<comment> \<open>Courtesy of Stephan Merz\<close>
 using assms by (auto intro: linorder_inj_onI linear)
 
 lemma inj_on_image_Pow: "inj_on f A \<Longrightarrow>inj_on (image f) (Pow A)"
   unfolding Pow_def inj_on_def by blast
 
 lemma bij_betw_image_Pow: "bij_betw f A B \<Longrightarrow> bij_betw (image f) (Pow A) (Pow B)"
   by (auto simp add: bij_betw_def inj_on_image_Pow image_Pow_surj)
 
 lemma surj_def: "surj f \<longleftrightarrow> (\<forall>y. \<exists>x. y = f x)"
   by auto
 
 lemma surjI:
   assumes "\<And>x. g (f x) = x"
   shows "surj g"
   using assms [symmetric] by auto
 
 lemma surjD: "surj f \<Longrightarrow> \<exists>x. y = f x"
   by (simp add: surj_def)
 
 lemma surjE: "surj f \<Longrightarrow> (\<And>x. y = f x \<Longrightarrow> C) \<Longrightarrow> C"
   by (simp add: surj_def) blast
 
 lemma comp_surj: "surj f \<Longrightarrow> surj g \<Longrightarrow> surj (g \<circ> f)"
   using image_comp [of g f UNIV] by simp
 
 lemma bij_betw_imageI: "inj_on f A \<Longrightarrow> f ` A = B \<Longrightarrow> bij_betw f A B"
   unfolding bij_betw_def by clarify
 
 lemma bij_betw_imp_surj_on: "bij_betw f A B \<Longrightarrow> f ` A = B"
   unfolding bij_betw_def by clarify
 
 lemma bij_betw_imp_surj: "bij_betw f A UNIV \<Longrightarrow> surj f"
   unfolding bij_betw_def by auto
 
 lemma bij_betw_empty1: "bij_betw f {} A \<Longrightarrow> A = {}"
   unfolding bij_betw_def by blast
 
 lemma bij_betw_empty2: "bij_betw f A {} \<Longrightarrow> A = {}"
   unfolding bij_betw_def by blast
 
 lemma inj_on_imp_bij_betw: "inj_on f A \<Longrightarrow> bij_betw f A (f ` A)"
   unfolding bij_betw_def by simp
 
 lemma bij_betw_apply: "\<lbrakk>bij_betw f A B; a \<in> A\<rbrakk> \<Longrightarrow> f a \<in> B"
   unfolding bij_betw_def by auto
 
 lemma bij_def: "bij f \<longleftrightarrow> inj f \<and> surj f"
   by (rule bij_betw_def)
 
 lemma bijI: "inj f \<Longrightarrow> surj f \<Longrightarrow> bij f"
   by (rule bij_betw_imageI)
 
 lemma bij_is_inj: "bij f \<Longrightarrow> inj f"
   by (simp add: bij_def)
 
 lemma bij_is_surj: "bij f \<Longrightarrow> surj f"
   by (simp add: bij_def)
 
 lemma bij_betw_imp_inj_on: "bij_betw f A B \<Longrightarrow> inj_on f A"
   by (simp add: bij_betw_def)
 
 lemma bij_betw_trans: "bij_betw f A B \<Longrightarrow> bij_betw g B C \<Longrightarrow> bij_betw (g \<circ> f) A C"
   by (auto simp add:bij_betw_def comp_inj_on)
 
 lemma bij_comp: "bij f \<Longrightarrow> bij g \<Longrightarrow> bij (g \<circ> f)"
   by (rule bij_betw_trans)
 
 lemma bij_betw_comp_iff: "bij_betw f A A' \<Longrightarrow> bij_betw f' A' A'' \<longleftrightarrow> bij_betw (f' \<circ> f) A A''"
   by (auto simp add: bij_betw_def inj_on_def)
 
 lemma bij_betw_comp_iff2:
   assumes bij: "bij_betw f' A' A''"
     and img: "f ` A \<le> A'"
   shows "bij_betw f A A' \<longleftrightarrow> bij_betw (f' \<circ> f) A A''"
   using assms
 proof (auto simp add: bij_betw_comp_iff)
   assume *: "bij_betw (f' \<circ> f) A A''"
   then show "bij_betw f A A'"
     using img
   proof (auto simp add: bij_betw_def)
     assume "inj_on (f' \<circ> f) A"
     then show "inj_on f A"
       using inj_on_imageI2 by blast
   next
     fix a'
     assume **: "a' \<in> A'"
     with bij have "f' a' \<in> A''"
       unfolding bij_betw_def by auto
     with * obtain a where 1: "a \<in> A \<and> f' (f a) = f' a'"
       unfolding bij_betw_def by force
     with img have "f a \<in> A'" by auto
     with bij ** 1 have "f a = a'"
       unfolding bij_betw_def inj_on_def by auto
     with 1 show "a' \<in> f ` A" by auto
   qed
 qed
 
 lemma bij_betw_inv:
   assumes "bij_betw f A B"
   shows "\<exists>g. bij_betw g B A"
 proof -
   have i: "inj_on f A" and s: "f ` A = B"
     using assms by (auto simp: bij_betw_def)
   let ?P = "\<lambda>b a. a \<in> A \<and> f a = b"
   let ?g = "\<lambda>b. The (?P b)"
   have g: "?g b = a" if P: "?P b a" for a b
   proof -
     from that s have ex1: "\<exists>a. ?P b a" by blast
     then have uex1: "\<exists>!a. ?P b a" by (blast dest:inj_onD[OF i])
     then show ?thesis
       using the1_equality[OF uex1, OF P] P by simp
   qed
   have "inj_on ?g B"
   proof (rule inj_onI)
     fix x y
     assume "x \<in> B" "y \<in> B" "?g x = ?g y"
     from s \<open>x \<in> B\<close> obtain a1 where a1: "?P x a1" by blast
     from s \<open>y \<in> B\<close> obtain a2 where a2: "?P y a2" by blast
     from g [OF a1] a1 g [OF a2] a2 \<open>?g x = ?g y\<close> show "x = y" by simp
   qed
   moreover have "?g ` B = A"
   proof (auto simp: image_def)
     fix b
     assume "b \<in> B"
     with s obtain a where P: "?P b a" by blast
     with g[OF P] show "?g b \<in> A" by auto
   next
     fix a
     assume "a \<in> A"
     with s obtain b where P: "?P b a" by blast
     with s have "b \<in> B" by blast
     with g[OF P] show "\<exists>b\<in>B. a = ?g b" by blast
   qed
   ultimately show ?thesis
     by (auto simp: bij_betw_def)
 qed
 
 lemma bij_betw_cong: "(\<And>a. a \<in> A \<Longrightarrow> f a = g a) \<Longrightarrow> bij_betw f A A' = bij_betw g A A'"
   unfolding bij_betw_def inj_on_def by safe force+  (* somewhat slow *)
 
 lemma bij_betw_id[intro, simp]: "bij_betw id A A"
   unfolding bij_betw_def id_def by auto
 
 lemma bij_betw_id_iff: "bij_betw id A B \<longleftrightarrow> A = B"
   by (auto simp add: bij_betw_def)
 
 lemma bij_betw_combine:
   "bij_betw f A B \<Longrightarrow> bij_betw f C D \<Longrightarrow> B \<inter> D = {} \<Longrightarrow> bij_betw f (A \<union> C) (B \<union> D)"
   unfolding bij_betw_def inj_on_Un image_Un by auto
 
 lemma bij_betw_subset: "bij_betw f A A' \<Longrightarrow> B \<subseteq> A \<Longrightarrow> f ` B = B' \<Longrightarrow> bij_betw f B B'"
   by (auto simp add: bij_betw_def inj_on_def)
 
 lemma bij_pointE:
   assumes "bij f"
   obtains x where "y = f x" and "\<And>x'. y = f x' \<Longrightarrow> x' = x"
 proof -
   from assms have "inj f" by (rule bij_is_inj)
   moreover from assms have "surj f" by (rule bij_is_surj)
   then have "y \<in> range f" by simp
   ultimately have "\<exists>!x. y = f x" by (simp add: range_ex1_eq)
   with that show thesis by blast
 qed
 
 lemma bij_iff: \<^marker>\<open>contributor \<open>Amine Chaieb\<close>\<close>
   \<open>bij f \<longleftrightarrow> (\<forall>x. \<exists>!y. f y = x)\<close>  (is \<open>?P \<longleftrightarrow> ?Q\<close>)
 proof
   assume ?P
   then have \<open>inj f\<close> \<open>surj f\<close>
     by (simp_all add: bij_def)
   show ?Q
   proof
     fix y
     from \<open>surj f\<close> obtain x where \<open>y = f x\<close>
       by (auto simp add: surj_def)
     with \<open>inj f\<close> show \<open>\<exists>!x. f x = y\<close>
       by (auto simp add: inj_def)
   qed
 next
   assume ?Q
   then have \<open>inj f\<close>
     by (auto simp add: inj_def)
   moreover have \<open>\<exists>x. y = f x\<close> for y
   proof -
     from \<open>?Q\<close> obtain x where \<open>f x = y\<close>
       by blast
     then have \<open>y = f x\<close>
       by simp
     then show ?thesis ..
   qed
   then have \<open>surj f\<close>
     by (auto simp add: surj_def)
   ultimately show ?P
     by (rule bijI)
 qed
 
 lemma surj_image_vimage_eq: "surj f \<Longrightarrow> f ` (f -` A) = A"
   by simp
 
 lemma surj_vimage_empty:
   assumes "surj f"
   shows "f -` A = {} \<longleftrightarrow> A = {}"
   using surj_image_vimage_eq [OF \<open>surj f\<close>, of A]
   by (intro iffI) fastforce+
 
 lemma inj_vimage_image_eq: "inj f \<Longrightarrow> f -` (f ` A) = A"
   unfolding inj_def by blast
 
 lemma vimage_subsetD: "surj f \<Longrightarrow> f -` B \<subseteq> A \<Longrightarrow> B \<subseteq> f ` A"
   by (blast intro: sym)
 
 lemma vimage_subsetI: "inj f \<Longrightarrow> B \<subseteq> f ` A \<Longrightarrow> f -` B \<subseteq> A"
   unfolding inj_def by blast
 
 lemma vimage_subset_eq: "bij f \<Longrightarrow> f -` B \<subseteq> A \<longleftrightarrow> B \<subseteq> f ` A"
   unfolding bij_def by (blast del: subsetI intro: vimage_subsetI vimage_subsetD)
 
 lemma inj_on_image_eq_iff: "inj_on f C \<Longrightarrow> A \<subseteq> C \<Longrightarrow> B \<subseteq> C \<Longrightarrow> f ` A = f ` B \<longleftrightarrow> A = B"
   by (fastforce simp: inj_on_def)
 
 lemma inj_on_Un_image_eq_iff: "inj_on f (A \<union> B) \<Longrightarrow> f ` A = f ` B \<longleftrightarrow> A = B"
   by (erule inj_on_image_eq_iff) simp_all
 
 lemma inj_on_image_Int: "inj_on f C \<Longrightarrow> A \<subseteq> C \<Longrightarrow> B \<subseteq> C \<Longrightarrow> f ` (A \<inter> B) = f ` A \<inter> f ` B"
   unfolding inj_on_def by blast
 
 lemma inj_on_image_set_diff: "inj_on f C \<Longrightarrow> A - B \<subseteq> C \<Longrightarrow> B \<subseteq> C \<Longrightarrow> f ` (A - B) = f ` A - f ` B"
   unfolding inj_on_def by blast
 
 lemma image_Int: "inj f \<Longrightarrow> f ` (A \<inter> B) = f ` A \<inter> f ` B"
   unfolding inj_def by blast
 
 lemma image_set_diff: "inj f \<Longrightarrow> f ` (A - B) = f ` A - f ` B"
   unfolding inj_def by blast
 
 lemma inj_on_image_mem_iff: "inj_on f B \<Longrightarrow> a \<in> B \<Longrightarrow> A \<subseteq> B \<Longrightarrow> f a \<in> f ` A \<longleftrightarrow> a \<in> A"
   by (auto simp: inj_on_def)
 
 lemma inj_image_mem_iff: "inj f \<Longrightarrow> f a \<in> f ` A \<longleftrightarrow> a \<in> A"
   by (blast dest: injD)
 
 lemma inj_image_subset_iff: "inj f \<Longrightarrow> f ` A \<subseteq> f ` B \<longleftrightarrow> A \<subseteq> B"
   by (blast dest: injD)
 
 lemma inj_image_eq_iff: "inj f \<Longrightarrow> f ` A = f ` B \<longleftrightarrow> A = B"
   by (blast dest: injD)
 
 lemma surj_Compl_image_subset: "surj f \<Longrightarrow> - (f ` A) \<subseteq> f ` (- A)"
   by auto
 
 lemma inj_image_Compl_subset: "inj f \<Longrightarrow> f ` (- A) \<subseteq> - (f ` A)"
   by (auto simp: inj_def)
 
 lemma bij_image_Compl_eq: "bij f \<Longrightarrow> f ` (- A) = - (f ` A)"
   by (simp add: bij_def inj_image_Compl_subset surj_Compl_image_subset equalityI)
 
 lemma inj_vimage_singleton: "inj f \<Longrightarrow> f -` {a} \<subseteq> {THE x. f x = a}"
   \<comment> \<open>The inverse image of a singleton under an injective function is included in a singleton.\<close>
   by (simp add: inj_def) (blast intro: the_equality [symmetric])
 
 lemma inj_on_vimage_singleton: "inj_on f A \<Longrightarrow> f -` {a} \<inter> A \<subseteq> {THE x. x \<in> A \<and> f x = a}"
   by (auto simp add: inj_on_def intro: the_equality [symmetric])
 
 lemma (in ordered_ab_group_add) inj_uminus[simp, intro]: "inj_on uminus A"
   by (auto intro!: inj_onI)
 
 lemma (in linorder) strict_mono_imp_inj_on: "strict_mono f \<Longrightarrow> inj_on f A"
   by (auto intro!: inj_onI dest: strict_mono_eq)
 
 lemma bij_betw_byWitness:
   assumes left: "\<forall>a \<in> A. f' (f a) = a"
     and right: "\<forall>a' \<in> A'. f (f' a') = a'"
     and "f ` A \<subseteq> A'"
     and img2: "f' ` A' \<subseteq> A"
   shows "bij_betw f A A'"
   using assms
   unfolding bij_betw_def inj_on_def
 proof safe
   fix a b
   assume "a \<in> A" "b \<in> A"
   with left have "a = f' (f a) \<and> b = f' (f b)" by simp
   moreover assume "f a = f b"
   ultimately show "a = b" by simp
 next
   fix a' assume *: "a' \<in> A'"
   with img2 have "f' a' \<in> A" by blast
   moreover from * right have "a' = f (f' a')" by simp
   ultimately show "a' \<in> f ` A" by blast
 qed
 
 corollary notIn_Un_bij_betw:
   assumes "b \<notin> A"
     and "f b \<notin> A'"
     and "bij_betw f A A'"
   shows "bij_betw f (A \<union> {b}) (A' \<union> {f b})"
 proof -
   have "bij_betw f {b} {f b}"
     unfolding bij_betw_def inj_on_def by simp
   with assms show ?thesis
     using bij_betw_combine[of f A A' "{b}" "{f b}"] by blast
 qed
 
 lemma notIn_Un_bij_betw3:
   assumes "b \<notin> A"
     and "f b \<notin> A'"
   shows "bij_betw f A A' = bij_betw f (A \<union> {b}) (A' \<union> {f b})"
 proof
   assume "bij_betw f A A'"
   then show "bij_betw f (A \<union> {b}) (A' \<union> {f b})"
     using assms notIn_Un_bij_betw [of b A f A'] by blast
 next
   assume *: "bij_betw f (A \<union> {b}) (A' \<union> {f b})"
   have "f ` A = A'"
   proof auto
     fix a
     assume **: "a \<in> A"
     then have "f a \<in> A' \<union> {f b}"
       using * unfolding bij_betw_def by blast
     moreover
     have False if "f a = f b"
     proof -
       have "a = b"
         using * ** that unfolding bij_betw_def inj_on_def by blast
       with \<open>b \<notin> A\<close> ** show ?thesis by blast
     qed
     ultimately show "f a \<in> A'" by blast
   next
     fix a'
     assume **: "a' \<in> A'"
     then have "a' \<in> f ` (A \<union> {b})"
       using * by (auto simp add: bij_betw_def)
     then obtain a where 1: "a \<in> A \<union> {b} \<and> f a = a'" by blast
     moreover
     have False if "a = b" using 1 ** \<open>f b \<notin> A'\<close> that by blast
     ultimately have "a \<in> A" by blast
     with 1 show "a' \<in> f ` A" by blast
   qed
   then show "bij_betw f A A'"
     using * bij_betw_subset[of f "A \<union> {b}" _ A] by blast
 qed
 
 lemma inj_on_disjoint_Un:
   assumes "inj_on f A" and "inj_on g B" 
   and "f ` A \<inter> g ` B = {}"
   shows "inj_on (\<lambda>x. if x \<in> A then f x else g x) (A \<union> B)"
   using assms by (simp add: inj_on_def disjoint_iff) (blast)
 
 lemma bij_betw_disjoint_Un:
   assumes "bij_betw f A C" and "bij_betw g B D" 
   and "A \<inter> B = {}"
   and "C \<inter> D = {}"
   shows "bij_betw (\<lambda>x. if x \<in> A then f x else g x) (A \<union> B) (C \<union> D)"
   using assms by (auto simp: inj_on_disjoint_Un bij_betw_def)
 
 subsubsection \<open>Important examples\<close>
 
 context cancel_semigroup_add
 begin
 
 lemma inj_on_add [simp]:
   "inj_on ((+) a) A"
   by (rule inj_onI) simp
 
 lemma inj_add_left:
   \<open>inj ((+) a)\<close>
   by simp
 
 lemma inj_on_add' [simp]:
   "inj_on (\<lambda>b. b + a) A"
   by (rule inj_onI) simp
 
 lemma bij_betw_add [simp]:
   "bij_betw ((+) a) A B \<longleftrightarrow> (+) a ` A = B"
   by (simp add: bij_betw_def)
 
 end
 
 context ab_group_add
 begin
 
 lemma surj_plus [simp]:
   "surj ((+) a)"
   by (auto intro!: range_eqI [of b "(+) a" "b - a" for b]) (simp add: algebra_simps)
 
 lemma inj_diff_right [simp]:
   \<open>inj (\<lambda>b. b - a)\<close>
 proof -
   have \<open>inj ((+) (- a))\<close>
     by (fact inj_add_left)
   also have \<open>(+) (- a) = (\<lambda>b. b - a)\<close>
     by (simp add: fun_eq_iff)
   finally show ?thesis .
 qed
 
 lemma surj_diff_right [simp]:
   "surj (\<lambda>x. x - a)"
   using surj_plus [of "- a"] by (simp cong: image_cong_simp)
 
 lemma translation_Compl:
   "(+) a ` (- t) = - ((+) a ` t)"
 proof (rule set_eqI)
   fix b
   show "b \<in> (+) a ` (- t) \<longleftrightarrow> b \<in> - (+) a ` t"
     by (auto simp: image_iff algebra_simps intro!: bexI [of _ "b - a"])
 qed
 
 lemma translation_subtract_Compl:
   "(\<lambda>x. x - a) ` (- t) = - ((\<lambda>x. x - a) ` t)"
   using translation_Compl [of "- a" t] by (simp cong: image_cong_simp)
 
 lemma translation_diff:
   "(+) a ` (s - t) = ((+) a ` s) - ((+) a ` t)"
   by auto
 
 lemma translation_subtract_diff:
   "(\<lambda>x. x - a) ` (s - t) = ((\<lambda>x. x - a) ` s) - ((\<lambda>x. x - a) ` t)"
   using translation_diff [of "- a"] by (simp cong: image_cong_simp)
 
 lemma translation_Int:
   "(+) a ` (s \<inter> t) = ((+) a ` s) \<inter> ((+) a ` t)"
   by auto
 
 lemma translation_subtract_Int:
   "(\<lambda>x. x - a) ` (s \<inter> t) = ((\<lambda>x. x - a) ` s) \<inter> ((\<lambda>x. x - a) ` t)"
   using translation_Int [of " -a"] by (simp cong: image_cong_simp)
 
 end
 
 
 subsection \<open>Function Updating\<close>
 
 definition fun_upd :: "('a \<Rightarrow> 'b) \<Rightarrow> 'a \<Rightarrow> 'b \<Rightarrow> ('a \<Rightarrow> 'b)"
   where "fun_upd f a b = (\<lambda>x. if x = a then b else f x)"
 
 nonterminal updbinds and updbind
 
 syntax
   "_updbind" :: "'a \<Rightarrow> 'a \<Rightarrow> updbind"             ("(2_ :=/ _)")
   ""         :: "updbind \<Rightarrow> updbinds"             ("_")
   "_updbinds":: "updbind \<Rightarrow> updbinds \<Rightarrow> updbinds" ("_,/ _")
   "_Update"  :: "'a \<Rightarrow> updbinds \<Rightarrow> 'a"            ("_/'((_)')" [1000, 0] 900)
 
 translations
   "_Update f (_updbinds b bs)" \<rightleftharpoons> "_Update (_Update f b) bs"
   "f(x:=y)" \<rightleftharpoons> "CONST fun_upd f x y"
 
 (* Hint: to define the sum of two functions (or maps), use case_sum.
          A nice infix syntax could be defined by
 notation
   case_sum  (infixr "'(+')"80)
 *)
 
 lemma fun_upd_idem_iff: "f(x:=y) = f \<longleftrightarrow> f x = y"
   unfolding fun_upd_def
   apply safe
    apply (erule subst)
    apply (rule_tac [2] ext)
    apply auto
   done
 
 lemma fun_upd_idem: "f x = y \<Longrightarrow> f(x := y) = f"
   by (simp only: fun_upd_idem_iff)
 
 lemma fun_upd_triv [iff]: "f(x := f x) = f"
   by (simp only: fun_upd_idem)
 
 lemma fun_upd_apply [simp]: "(f(x := y)) z = (if z = x then y else f z)"
   by (simp add: fun_upd_def)
 
 (* fun_upd_apply supersedes these two, but they are useful
    if fun_upd_apply is intentionally removed from the simpset *)
 lemma fun_upd_same: "(f(x := y)) x = y"
   by simp
 
 lemma fun_upd_other: "z \<noteq> x \<Longrightarrow> (f(x := y)) z = f z"
   by simp
 
 lemma fun_upd_upd [simp]: "f(x := y, x := z) = f(x := z)"
   by (simp add: fun_eq_iff)
 
 lemma fun_upd_twist: "a \<noteq> c \<Longrightarrow> (m(a := b))(c := d) = (m(c := d))(a := b)"
   by auto
 
 lemma inj_on_fun_updI: "inj_on f A \<Longrightarrow> y \<notin> f ` A \<Longrightarrow> inj_on (f(x := y)) A"
   by (auto simp: inj_on_def)
 
 lemma fun_upd_image: "f(x := y) ` A = (if x \<in> A then insert y (f ` (A - {x})) else f ` A)"
   by auto
 
 lemma fun_upd_comp: "f \<circ> (g(x := y)) = (f \<circ> g)(x := f y)"
   by auto
 
 lemma fun_upd_eqD: "f(x := y) = g(x := z) \<Longrightarrow> y = z"
   by (simp add: fun_eq_iff split: if_split_asm)
 
 
 subsection \<open>\<open>override_on\<close>\<close>
 
 definition override_on :: "('a \<Rightarrow> 'b) \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> 'a set \<Rightarrow> 'a \<Rightarrow> 'b"
   where "override_on f g A = (\<lambda>a. if a \<in> A then g a else f a)"
 
 lemma override_on_emptyset[simp]: "override_on f g {} = f"
   by (simp add: override_on_def)
 
 lemma override_on_apply_notin[simp]: "a \<notin> A \<Longrightarrow> (override_on f g A) a = f a"
   by (simp add: override_on_def)
 
 lemma override_on_apply_in[simp]: "a \<in> A \<Longrightarrow> (override_on f g A) a = g a"
   by (simp add: override_on_def)
 
 lemma override_on_insert: "override_on f g (insert x X) = (override_on f g X)(x:=g x)"
   by (simp add: override_on_def fun_eq_iff)
 
 lemma override_on_insert': "override_on f g (insert x X) = (override_on (f(x:=g x)) g X)"
   by (simp add: override_on_def fun_eq_iff)
 
 
 subsection \<open>\<open>swap\<close>\<close>
 
 definition swap :: "'a \<Rightarrow> 'a \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> ('a \<Rightarrow> 'b)"
   where "swap a b f = f (a := f b, b:= f a)"
 
 lemma swap_apply [simp]:
   "swap a b f a = f b"
   "swap a b f b = f a"
   "c \<noteq> a \<Longrightarrow> c \<noteq> b \<Longrightarrow> swap a b f c = f c"
   by (simp_all add: swap_def)
 
 lemma swap_self [simp]: "swap a a f = f"
   by (simp add: swap_def)
 
 lemma swap_commute: "swap a b f = swap b a f"
   by (simp add: fun_upd_def swap_def fun_eq_iff)
 
 lemma swap_nilpotent [simp]: "swap a b (swap a b f) = f"
   by (rule ext) (simp add: fun_upd_def swap_def)
 
 lemma swap_comp_involutory [simp]: "swap a b \<circ> swap a b = id"
   by (rule ext) simp
 
 lemma swap_triple:
   assumes "a \<noteq> c" and "b \<noteq> c"
   shows "swap a b (swap b c (swap a b f)) = swap a c f"
   using assms by (simp add: fun_eq_iff swap_def)
 
 lemma comp_swap: "f \<circ> swap a b g = swap a b (f \<circ> g)"
   by (rule ext) (simp add: fun_upd_def swap_def)
 
 lemma swap_image_eq [simp]:
   assumes "a \<in> A" "b \<in> A"
   shows "swap a b f ` A = f ` A"
 proof -
   have subset: "\<And>f. swap a b f ` A \<subseteq> f ` A"
     using assms by (auto simp: image_iff swap_def)
   then have "swap a b (swap a b f) ` A \<subseteq> (swap a b f) ` A" .
   with subset[of f] show ?thesis by auto
 qed
 
 lemma inj_on_imp_inj_on_swap: "inj_on f A \<Longrightarrow> a \<in> A \<Longrightarrow> b \<in> A \<Longrightarrow> inj_on (swap a b f) A"
   by (auto simp add: inj_on_def swap_def)
 
 lemma inj_on_swap_iff [simp]:
   assumes A: "a \<in> A" "b \<in> A"
   shows "inj_on (swap a b f) A \<longleftrightarrow> inj_on f A"
 proof
   assume "inj_on (swap a b f) A"
   with A have "inj_on (swap a b (swap a b f)) A"
     by (iprover intro: inj_on_imp_inj_on_swap)
   then show "inj_on f A" by simp
 next
   assume "inj_on f A"
   with A show "inj_on (swap a b f) A"
     by (iprover intro: inj_on_imp_inj_on_swap)
 qed
 
 lemma surj_imp_surj_swap: "surj f \<Longrightarrow> surj (swap a b f)"
   by simp
 
 lemma surj_swap_iff [simp]: "surj (swap a b f) \<longleftrightarrow> surj f"
   by simp
 
 lemma bij_betw_swap_iff [simp]: "x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> bij_betw (swap x y f) A B \<longleftrightarrow> bij_betw f A B"
   by (auto simp: bij_betw_def)
 
 lemma bij_swap_iff [simp]: "bij (swap a b f) \<longleftrightarrow> bij f"
   by simp
 
+subsection \<open>Transpositions\<close>
+
+lemma swap_id_idempotent [simp]: "Fun.swap a b id \<circ> Fun.swap a b id = id"
+  by (rule ext) (auto simp add: Fun.swap_def)
+
+lemma swap_id_eq: "Fun.swap a b id x = (if x = a then b else if x = b then a else x)"
+  by (simp add: Fun.swap_def)
+
+lemma bij_swap_compose_bij:
+  \<open>bij (Fun.swap a b id \<circ> p)\<close> if \<open>bij p\<close>
+  using that by (rule bij_comp) simp
+
 hide_const (open) swap
 
 
 subsection \<open>Inversion of injective functions\<close>
 
 definition the_inv_into :: "'a set \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> ('b \<Rightarrow> 'a)"
   where "the_inv_into A f = (\<lambda>x. THE y. y \<in> A \<and> f y = x)"
 
 lemma the_inv_into_f_f: "inj_on f A \<Longrightarrow> x \<in> A \<Longrightarrow> the_inv_into A f (f x) = x"
   unfolding the_inv_into_def inj_on_def by blast
 
 lemma f_the_inv_into_f: "inj_on f A \<Longrightarrow> y \<in> f ` A  \<Longrightarrow> f (the_inv_into A f y) = y"
   unfolding the_inv_into_def
   by (rule the1I2; blast dest: inj_onD)
 
 lemma f_the_inv_into_f_bij_betw:
   "bij_betw f A B \<Longrightarrow> (bij_betw f A B \<Longrightarrow> x \<in> B) \<Longrightarrow> f (the_inv_into A f x) = x"
   unfolding bij_betw_def by (blast intro: f_the_inv_into_f)
 
 lemma the_inv_into_into: "inj_on f A \<Longrightarrow> x \<in> f ` A \<Longrightarrow> A \<subseteq> B \<Longrightarrow> the_inv_into A f x \<in> B"
   unfolding the_inv_into_def
   by (rule the1I2; blast dest: inj_onD)
 
 lemma the_inv_into_onto [simp]: "inj_on f A \<Longrightarrow> the_inv_into A f ` (f ` A) = A"
   by (fast intro: the_inv_into_into the_inv_into_f_f [symmetric])
 
 lemma the_inv_into_f_eq: "inj_on f A \<Longrightarrow> f x = y \<Longrightarrow> x \<in> A \<Longrightarrow> the_inv_into A f y = x"
   by (force simp add: the_inv_into_f_f)
 
 lemma the_inv_into_comp:
   "inj_on f (g ` A) \<Longrightarrow> inj_on g A \<Longrightarrow> x \<in> f ` g ` A \<Longrightarrow>
     the_inv_into A (f \<circ> g) x = (the_inv_into A g \<circ> the_inv_into (g ` A) f) x"
   apply (rule the_inv_into_f_eq)
     apply (fast intro: comp_inj_on)
    apply (simp add: f_the_inv_into_f the_inv_into_into)
   apply (simp add: the_inv_into_into)
   done
 
 lemma inj_on_the_inv_into: "inj_on f A \<Longrightarrow> inj_on (the_inv_into A f) (f ` A)"
   by (auto intro: inj_onI simp: the_inv_into_f_f)
 
 lemma bij_betw_the_inv_into: "bij_betw f A B \<Longrightarrow> bij_betw (the_inv_into A f) B A"
   by (auto simp add: bij_betw_def inj_on_the_inv_into the_inv_into_into)
 
 lemma bij_betw_iff_bijections:
   "bij_betw f A B \<longleftrightarrow> (\<exists>g. (\<forall>x \<in> A. f x \<in> B \<and> g(f x) = x) \<and> (\<forall>y \<in> B. g y \<in> A \<and> f(g y) = y))"
   (is "?lhs = ?rhs")
 proof
   assume L: ?lhs
   then show ?rhs
     apply (rule_tac x="the_inv_into A f" in exI)
     apply (auto simp: bij_betw_def f_the_inv_into_f the_inv_into_f_f the_inv_into_into)
     done
 qed (force intro: bij_betw_byWitness)
 
 abbreviation the_inv :: "('a \<Rightarrow> 'b) \<Rightarrow> ('b \<Rightarrow> 'a)"
   where "the_inv f \<equiv> the_inv_into UNIV f"
 
 lemma the_inv_f_f: "the_inv f (f x) = x" if "inj f"
   using that UNIV_I by (rule the_inv_into_f_f)
 
 
 subsection \<open>Cantor's Paradox\<close>
 
 theorem Cantors_paradox: "\<nexists>f. f ` A = Pow A"
 proof
   assume "\<exists>f. f ` A = Pow A"
   then obtain f where f: "f ` A = Pow A" ..
   let ?X = "{a \<in> A. a \<notin> f a}"
   have "?X \<in> Pow A" by blast
   then have "?X \<in> f ` A" by (simp only: f)
   then obtain x where "x \<in> A" and "f x = ?X" by blast
   then show False by blast
 qed
 
 subsection \<open>Monotonic functions over a set\<close>
 
 definition "mono_on f A \<equiv> \<forall>r s. r \<in> A \<and> s \<in> A \<and> r \<le> s \<longrightarrow> f r \<le> f s"
 
 lemma mono_onI:
   "(\<And>r s. r \<in> A \<Longrightarrow> s \<in> A \<Longrightarrow> r \<le> s \<Longrightarrow> f r \<le> f s) \<Longrightarrow> mono_on f A"
   unfolding mono_on_def by simp
 
 lemma mono_onD:
   "\<lbrakk>mono_on f A; r \<in> A; s \<in> A; r \<le> s\<rbrakk> \<Longrightarrow> f r \<le> f s"
   unfolding mono_on_def by simp
 
 lemma mono_imp_mono_on: "mono f \<Longrightarrow> mono_on f A"
   unfolding mono_def mono_on_def by auto
 
 lemma mono_on_subset: "mono_on f A \<Longrightarrow> B \<subseteq> A \<Longrightarrow> mono_on f B"
   unfolding mono_on_def by auto
 
 definition "strict_mono_on f A \<equiv> \<forall>r s. r \<in> A \<and> s \<in> A \<and> r < s \<longrightarrow> f r < f s"
 
 lemma strict_mono_onI:
   "(\<And>r s. r \<in> A \<Longrightarrow> s \<in> A \<Longrightarrow> r < s \<Longrightarrow> f r < f s) \<Longrightarrow> strict_mono_on f A"
   unfolding strict_mono_on_def by simp
 
 lemma strict_mono_onD:
   "\<lbrakk>strict_mono_on f A; r \<in> A; s \<in> A; r < s\<rbrakk> \<Longrightarrow> f r < f s"
   unfolding strict_mono_on_def by simp
 
 lemma mono_on_greaterD:
   assumes "mono_on g A" "x \<in> A" "y \<in> A" "g x > (g (y::_::linorder) :: _ :: linorder)"
   shows "x > y"
 proof (rule ccontr)
   assume "\<not>x > y"
   hence "x \<le> y" by (simp add: not_less)
   from assms(1-3) and this have "g x \<le> g y" by (rule mono_onD)
   with assms(4) show False by simp
 qed
 
 lemma strict_mono_inv:
   fixes f :: "('a::linorder) \<Rightarrow> ('b::linorder)"
   assumes "strict_mono f" and "surj f" and inv: "\<And>x. g (f x) = x"
   shows "strict_mono g"
 proof
   fix x y :: 'b assume "x < y"
   from \<open>surj f\<close> obtain x' y' where [simp]: "x = f x'" "y = f y'" by blast
   with \<open>x < y\<close> and \<open>strict_mono f\<close> have "x' < y'" by (simp add: strict_mono_less)
   with inv show "g x < g y" by simp
 qed
 
 lemma strict_mono_on_imp_inj_on:
   assumes "strict_mono_on (f :: (_ :: linorder) \<Rightarrow> (_ :: preorder)) A"
   shows "inj_on f A"
 proof (rule inj_onI)
   fix x y assume "x \<in> A" "y \<in> A" "f x = f y"
   thus "x = y"
     by (cases x y rule: linorder_cases)
        (auto dest: strict_mono_onD[OF assms, of x y] strict_mono_onD[OF assms, of y x])
 qed
 
 lemma strict_mono_on_leD:
   assumes "strict_mono_on (f :: (_ :: linorder) \<Rightarrow> _ :: preorder) A" "x \<in> A" "y \<in> A" "x \<le> y"
   shows "f x \<le> f y"
 proof (insert le_less_linear[of y x], elim disjE)
   assume "x < y"
   with assms have "f x < f y" by (rule_tac strict_mono_onD[OF assms(1)]) simp_all
   thus ?thesis by (rule less_imp_le)
 qed (insert assms, simp)
 
 lemma strict_mono_on_eqD:
   fixes f :: "(_ :: linorder) \<Rightarrow> (_ :: preorder)"
   assumes "strict_mono_on f A" "f x = f y" "x \<in> A" "y \<in> A"
   shows "y = x"
   using assms by (rule_tac linorder_cases[of x y]) (auto dest: strict_mono_onD)
 
 lemma strict_mono_on_imp_mono_on:
   "strict_mono_on (f :: (_ :: linorder) \<Rightarrow> _ :: preorder) A \<Longrightarrow> mono_on f A"
   by (rule mono_onI, rule strict_mono_on_leD)
 
 
 subsection \<open>Setup\<close>
 
 subsubsection \<open>Proof tools\<close>
 
 text \<open>Simplify terms of the form \<open>f(\<dots>,x:=y,\<dots>,x:=z,\<dots>)\<close> to \<open>f(\<dots>,x:=z,\<dots>)\<close>\<close>
 
 simproc_setup fun_upd2 ("f(v := w, x := y)") = \<open>fn _ =>
   let
     fun gen_fun_upd NONE T _ _ = NONE
       | gen_fun_upd (SOME f) T x y = SOME (Const (\<^const_name>\<open>fun_upd\<close>, T) $ f $ x $ y)
     fun dest_fun_T1 (Type (_, T :: Ts)) = T
     fun find_double (t as Const (\<^const_name>\<open>fun_upd\<close>,T) $ f $ x $ y) =
       let
         fun find (Const (\<^const_name>\<open>fun_upd\<close>,T) $ g $ v $ w) =
               if v aconv x then SOME g else gen_fun_upd (find g) T v w
           | find t = NONE
       in (dest_fun_T1 T, gen_fun_upd (find f) T x y) end
 
     val ss = simpset_of \<^context>
 
     fun proc ctxt ct =
       let
         val t = Thm.term_of ct
       in
         (case find_double t of
           (T, NONE) => NONE
         | (T, SOME rhs) =>
             SOME (Goal.prove ctxt [] [] (Logic.mk_equals (t, rhs))
               (fn _ =>
                 resolve_tac ctxt [eq_reflection] 1 THEN
                 resolve_tac ctxt @{thms ext} 1 THEN
                 simp_tac (put_simpset ss ctxt) 1)))
       end
   in proc end
 \<close>
 
 
 subsubsection \<open>Functorial structure of types\<close>
 
 ML_file \<open>Tools/functor.ML\<close>
 
 functor map_fun: map_fun
   by (simp_all add: fun_eq_iff)
 
 functor vimage
   by (simp_all add: fun_eq_iff vimage_comp)
 
 
 text \<open>Legacy theorem names\<close>
 
 lemmas o_def = comp_def
 lemmas o_apply = comp_apply
 lemmas o_assoc = comp_assoc [symmetric]
 lemmas id_o = id_comp
 lemmas o_id = comp_id
 lemmas o_eq_dest = comp_eq_dest
 lemmas o_eq_elim = comp_eq_elim
 lemmas o_eq_dest_lhs = comp_eq_dest_lhs
 lemmas o_eq_id_dest = comp_eq_id_dest
 
 end
diff --git a/src/HOL/Hilbert_Choice.thy b/src/HOL/Hilbert_Choice.thy
--- a/src/HOL/Hilbert_Choice.thy
+++ b/src/HOL/Hilbert_Choice.thy
@@ -1,1222 +1,1231 @@
 (*  Title:      HOL/Hilbert_Choice.thy
     Author:     Lawrence C Paulson, Tobias Nipkow
     Author:     Viorel Preoteasa (Results about complete distributive lattices) 
     Copyright   2001  University of Cambridge
 *)
 
 section \<open>Hilbert's Epsilon-Operator and the Axiom of Choice\<close>
 
 theory Hilbert_Choice
   imports Wellfounded
   keywords "specification" :: thy_goal_defn
 begin
 
 subsection \<open>Hilbert's epsilon\<close>
 
 axiomatization Eps :: "('a \<Rightarrow> bool) \<Rightarrow> 'a"
   where someI: "P x \<Longrightarrow> P (Eps P)"
 
 syntax (epsilon)
   "_Eps" :: "pttrn \<Rightarrow> bool \<Rightarrow> 'a"  ("(3\<some>_./ _)" [0, 10] 10)
 syntax (input)
   "_Eps" :: "pttrn \<Rightarrow> bool \<Rightarrow> 'a"  ("(3@ _./ _)" [0, 10] 10)
 syntax
   "_Eps" :: "pttrn \<Rightarrow> bool \<Rightarrow> 'a"  ("(3SOME _./ _)" [0, 10] 10)
 translations
   "SOME x. P" \<rightleftharpoons> "CONST Eps (\<lambda>x. P)"
 
 print_translation \<open>
   [(\<^const_syntax>\<open>Eps\<close>, fn _ => fn [Abs abs] =>
       let val (x, t) = Syntax_Trans.atomic_abs_tr' abs
       in Syntax.const \<^syntax_const>\<open>_Eps\<close> $ x $ t end)]
 \<close> \<comment> \<open>to avoid eta-contraction of body\<close>
 
 definition inv_into :: "'a set \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> ('b \<Rightarrow> 'a)" where
 "inv_into A f = (\<lambda>x. SOME y. y \<in> A \<and> f y = x)"
 
 lemma inv_into_def2: "inv_into A f x = (SOME y. y \<in> A \<and> f y = x)"
 by(simp add: inv_into_def)
 
 abbreviation inv :: "('a \<Rightarrow> 'b) \<Rightarrow> ('b \<Rightarrow> 'a)" where
 "inv \<equiv> inv_into UNIV"
 
 
 subsection \<open>Hilbert's Epsilon-operator\<close>
 
 lemma Eps_cong:
   assumes "\<And>x. P x = Q x"
   shows "Eps P = Eps Q"
   using ext[of P Q, OF assms] by simp
 
 text \<open>
   Easier to use than \<open>someI\<close> if the witness comes from an
   existential formula.
 \<close>
 lemma someI_ex [elim?]: "\<exists>x. P x \<Longrightarrow> P (SOME x. P x)"
   by (elim exE someI)
 
 lemma some_eq_imp:
   assumes "Eps P = a" "P b" shows "P a"
   using assms someI_ex by force
 
 text \<open>
   Easier to use than \<open>someI\<close> because the conclusion has only one
   occurrence of \<^term>\<open>P\<close>.
 \<close>
 lemma someI2: "P a \<Longrightarrow> (\<And>x. P x \<Longrightarrow> Q x) \<Longrightarrow> Q (SOME x. P x)"
   by (blast intro: someI)
 
 text \<open>
   Easier to use than \<open>someI2\<close> if the witness comes from an
   existential formula.
 \<close>
 lemma someI2_ex: "\<exists>a. P a \<Longrightarrow> (\<And>x. P x \<Longrightarrow> Q x) \<Longrightarrow> Q (SOME x. P x)"
   by (blast intro: someI2)
 
 lemma someI2_bex: "\<exists>a\<in>A. P a \<Longrightarrow> (\<And>x. x \<in> A \<and> P x \<Longrightarrow> Q x) \<Longrightarrow> Q (SOME x. x \<in> A \<and> P x)"
   by (blast intro: someI2)
 
 lemma some_equality [intro]: "P a \<Longrightarrow> (\<And>x. P x \<Longrightarrow> x = a) \<Longrightarrow> (SOME x. P x) = a"
   by (blast intro: someI2)
 
 lemma some1_equality: "\<exists>!x. P x \<Longrightarrow> P a \<Longrightarrow> (SOME x. P x) = a"
   by blast
 
 lemma some_eq_ex: "P (SOME x. P x) \<longleftrightarrow> (\<exists>x. P x)"
   by (blast intro: someI)
 
 lemma some_in_eq: "(SOME x. x \<in> A) \<in> A \<longleftrightarrow> A \<noteq> {}"
   unfolding ex_in_conv[symmetric] by (rule some_eq_ex)
 
 lemma some_eq_trivial [simp]: "(SOME y. y = x) = x"
   by (rule some_equality) (rule refl)
 
 lemma some_sym_eq_trivial [simp]: "(SOME y. x = y) = x"
   by (iprover intro: some_equality)
 
 
 subsection \<open>Axiom of Choice, Proved Using the Description Operator\<close>
 
 lemma choice: "\<forall>x. \<exists>y. Q x y \<Longrightarrow> \<exists>f. \<forall>x. Q x (f x)"
   by (fast elim: someI)
 
 lemma bchoice: "\<forall>x\<in>S. \<exists>y. Q x y \<Longrightarrow> \<exists>f. \<forall>x\<in>S. Q x (f x)"
   by (fast elim: someI)
 
 lemma choice_iff: "(\<forall>x. \<exists>y. Q x y) \<longleftrightarrow> (\<exists>f. \<forall>x. Q x (f x))"
   by (fast elim: someI)
 
 lemma choice_iff': "(\<forall>x. P x \<longrightarrow> (\<exists>y. Q x y)) \<longleftrightarrow> (\<exists>f. \<forall>x. P x \<longrightarrow> Q x (f x))"
   by (fast elim: someI)
 
 lemma bchoice_iff: "(\<forall>x\<in>S. \<exists>y. Q x y) \<longleftrightarrow> (\<exists>f. \<forall>x\<in>S. Q x (f x))"
   by (fast elim: someI)
 
 lemma bchoice_iff': "(\<forall>x\<in>S. P x \<longrightarrow> (\<exists>y. Q x y)) \<longleftrightarrow> (\<exists>f. \<forall>x\<in>S. P x \<longrightarrow> Q x (f x))"
   by (fast elim: someI)
 
 lemma dependent_nat_choice:
   assumes 1: "\<exists>x. P 0 x"
     and 2: "\<And>x n. P n x \<Longrightarrow> \<exists>y. P (Suc n) y \<and> Q n x y"
   shows "\<exists>f. \<forall>n. P n (f n) \<and> Q n (f n) (f (Suc n))"
 proof (intro exI allI conjI)
   fix n
   define f where "f = rec_nat (SOME x. P 0 x) (\<lambda>n x. SOME y. P (Suc n) y \<and> Q n x y)"
   then have "P 0 (f 0)" "\<And>n. P n (f n) \<Longrightarrow> P (Suc n) (f (Suc n)) \<and> Q n (f n) (f (Suc n))"
     using someI_ex[OF 1] someI_ex[OF 2] by simp_all
   then show "P n (f n)" "Q n (f n) (f (Suc n))"
     by (induct n) auto
 qed
 
 lemma finite_subset_Union:
   assumes "finite A" "A \<subseteq> \<Union>\<B>"
   obtains \<F> where "finite \<F>" "\<F> \<subseteq> \<B>" "A \<subseteq> \<Union>\<F>"
 proof -
   have "\<forall>x\<in>A. \<exists>B\<in>\<B>. x\<in>B"
     using assms by blast
   then obtain f where f: "\<And>x. x \<in> A \<Longrightarrow> f x \<in> \<B> \<and> x \<in> f x"
     by (auto simp add: bchoice_iff Bex_def)
   show thesis
   proof
     show "finite (f ` A)"
       using assms by auto
   qed (use f in auto)
 qed
 
 
 subsection \<open>Function Inverse\<close>
 
 lemma inv_def: "inv f = (\<lambda>y. SOME x. f x = y)"
   by (simp add: inv_into_def)
 
 lemma inv_into_into: "x \<in> f ` A \<Longrightarrow> inv_into A f x \<in> A"
   by (simp add: inv_into_def) (fast intro: someI2)
 
 lemma inv_identity [simp]: "inv (\<lambda>a. a) = (\<lambda>a. a)"
   by (simp add: inv_def)
 
 lemma inv_id [simp]: "inv id = id"
   by (simp add: id_def)
 
 lemma inv_into_f_f [simp]: "inj_on f A \<Longrightarrow> x \<in> A \<Longrightarrow> inv_into A f (f x) = x"
   by (simp add: inv_into_def inj_on_def) (blast intro: someI2)
 
 lemma inv_f_f: "inj f \<Longrightarrow> inv f (f x) = x"
   by simp
 
 lemma f_inv_into_f: "y \<in> f`A \<Longrightarrow> f (inv_into A f y) = y"
   by (simp add: inv_into_def) (fast intro: someI2)
 
 lemma inv_into_f_eq: "inj_on f A \<Longrightarrow> x \<in> A \<Longrightarrow> f x = y \<Longrightarrow> inv_into A f y = x"
   by (erule subst) (fast intro: inv_into_f_f)
 
 lemma inv_f_eq: "inj f \<Longrightarrow> f x = y \<Longrightarrow> inv f y = x"
   by (simp add:inv_into_f_eq)
 
 lemma inj_imp_inv_eq: "inj f \<Longrightarrow> \<forall>x. f (g x) = x \<Longrightarrow> inv f = g"
   by (blast intro: inv_into_f_eq)
 
 text \<open>But is it useful?\<close>
 lemma inj_transfer:
   assumes inj: "inj f"
     and minor: "\<And>y. y \<in> range f \<Longrightarrow> P (inv f y)"
   shows "P x"
 proof -
   have "f x \<in> range f" by auto
   then have "P(inv f (f x))" by (rule minor)
   then show "P x" by (simp add: inv_into_f_f [OF inj])
 qed
 
 lemma inj_iff: "inj f \<longleftrightarrow> inv f \<circ> f = id"
   by (simp add: o_def fun_eq_iff) (blast intro: inj_on_inverseI inv_into_f_f)
 
 lemma inv_o_cancel[simp]: "inj f \<Longrightarrow> inv f \<circ> f = id"
   by (simp add: inj_iff)
 
 lemma o_inv_o_cancel[simp]: "inj f \<Longrightarrow> g \<circ> inv f \<circ> f = g"
   by (simp add: comp_assoc)
 
 lemma inv_into_image_cancel[simp]: "inj_on f A \<Longrightarrow> S \<subseteq> A \<Longrightarrow> inv_into A f ` f ` S = S"
   by (fastforce simp: image_def)
 
 lemma inj_imp_surj_inv: "inj f \<Longrightarrow> surj (inv f)"
   by (blast intro!: surjI inv_into_f_f)
 
 lemma surj_f_inv_f: "surj f \<Longrightarrow> f (inv f y) = y"
   by (simp add: f_inv_into_f)
 
 lemma bij_inv_eq_iff: "bij p \<Longrightarrow> x = inv p y \<longleftrightarrow> p x = y"
   using surj_f_inv_f[of p] by (auto simp add: bij_def)
 
 lemma inv_into_injective:
   assumes eq: "inv_into A f x = inv_into A f y"
     and x: "x \<in> f`A"
     and y: "y \<in> f`A"
   shows "x = y"
 proof -
   from eq have "f (inv_into A f x) = f (inv_into A f y)"
     by simp
   with x y show ?thesis
     by (simp add: f_inv_into_f)
 qed
 
 lemma inj_on_inv_into: "B \<subseteq> f`A \<Longrightarrow> inj_on (inv_into A f) B"
   by (blast intro: inj_onI dest: inv_into_injective injD)
 
 lemma inj_imp_bij_betw_inv: "inj f \<Longrightarrow> bij_betw (inv f) (f ` M) M"
   by (simp add: bij_betw_def image_subsetI inj_on_inv_into)
 
 lemma bij_betw_inv_into: "bij_betw f A B \<Longrightarrow> bij_betw (inv_into A f) B A"
   by (auto simp add: bij_betw_def inj_on_inv_into)
 
 lemma surj_imp_inj_inv: "surj f \<Longrightarrow> inj (inv f)"
   by (simp add: inj_on_inv_into)
 
 lemma surj_iff: "surj f \<longleftrightarrow> f \<circ> inv f = id"
   by (auto intro!: surjI simp: surj_f_inv_f fun_eq_iff[where 'b='a])
 
 lemma surj_iff_all: "surj f \<longleftrightarrow> (\<forall>x. f (inv f x) = x)"
   by (simp add: o_def surj_iff fun_eq_iff)
 
 lemma surj_imp_inv_eq:
   assumes "surj f" and gf: "\<And>x. g (f x) = x"
   shows "inv f = g"
 proof (rule ext)
   fix x
   have "g (f (inv f x)) = inv f x"
     by (rule gf)
   then show "inv f x = g x"
     by (simp add: surj_f_inv_f \<open>surj f\<close>)
 qed
 
 lemma bij_imp_bij_inv: "bij f \<Longrightarrow> bij (inv f)"
   by (simp add: bij_def inj_imp_surj_inv surj_imp_inj_inv)
 
 lemma inv_equality: "(\<And>x. g (f x) = x) \<Longrightarrow> (\<And>y. f (g y) = y) \<Longrightarrow> inv f = g"
   by (rule ext) (auto simp add: inv_into_def)
 
 lemma inv_inv_eq: "bij f \<Longrightarrow> inv (inv f) = f"
   by (rule inv_equality) (auto simp add: bij_def surj_f_inv_f)
 
 text \<open>
   \<open>bij (inv f)\<close> implies little about \<open>f\<close>. Consider \<open>f :: bool \<Rightarrow> bool\<close> such
   that \<open>f True = f False = True\<close>. Then it ia consistent with axiom \<open>someI\<close>
   that \<open>inv f\<close> could be any function at all, including the identity function.
   If \<open>inv f = id\<close> then \<open>inv f\<close> is a bijection, but \<open>inj f\<close>, \<open>surj f\<close> and \<open>inv
   (inv f) = f\<close> all fail.
 \<close>
 
 lemma inv_into_comp:
   "inj_on f (g ` A) \<Longrightarrow> inj_on g A \<Longrightarrow> x \<in> f ` g ` A \<Longrightarrow>
     inv_into A (f \<circ> g) x = (inv_into A g \<circ> inv_into (g ` A) f) x"
   by (auto simp: f_inv_into_f inv_into_into intro: inv_into_f_eq comp_inj_on)
 
 lemma o_inv_distrib: "bij f \<Longrightarrow> bij g \<Longrightarrow> inv (f \<circ> g) = inv g \<circ> inv f"
   by (rule inv_equality) (auto simp add: bij_def surj_f_inv_f)
 
 lemma image_f_inv_f: "surj f \<Longrightarrow> f ` (inv f ` A) = A"
   by (simp add: surj_f_inv_f image_comp comp_def)
 
 lemma image_inv_f_f: "inj f \<Longrightarrow> inv f ` (f ` A) = A"
   by simp
 
 lemma bij_image_Collect_eq:
   assumes "bij f"
   shows "f ` Collect P = {y. P (inv f y)}"
 proof
   show "f ` Collect P \<subseteq> {y. P (inv f y)}"
     using assms by (force simp add: bij_is_inj)
   show "{y. P (inv f y)} \<subseteq> f ` Collect P"
     using assms by (blast intro: bij_is_surj [THEN surj_f_inv_f, symmetric])
 qed
 
 lemma bij_vimage_eq_inv_image:
   assumes "bij f"
   shows "f -` A = inv f ` A"
 proof
   show "f -` A \<subseteq> inv f ` A"
     using assms by (blast intro: bij_is_inj [THEN inv_into_f_f, symmetric])
   show "inv f ` A \<subseteq> f -` A"
     using assms by (auto simp add: bij_is_surj [THEN surj_f_inv_f])
 qed
 
 lemma inv_fn_o_fn_is_id:
   fixes f::"'a \<Rightarrow> 'a"
   assumes "bij f"
   shows "((inv f)^^n) o (f^^n) = (\<lambda>x. x)"
 proof -
   have "((inv f)^^n)((f^^n) x) = x" for x n
   proof (induction n)
     case (Suc n)
     have *: "(inv f) (f y) = y" for y
       by (simp add: assms bij_is_inj)
     have "(inv f ^^ Suc n) ((f ^^ Suc n) x) = (inv f^^n) (inv f (f ((f^^n) x)))"
       by (simp add: funpow_swap1)
     also have "... = (inv f^^n) ((f^^n) x)"
       using * by auto
     also have "... = x" using Suc.IH by auto
     finally show ?case by simp
   qed (auto)
   then show ?thesis unfolding o_def by blast
 qed
 
 lemma fn_o_inv_fn_is_id:
   fixes f::"'a \<Rightarrow> 'a"
   assumes "bij f"
   shows "(f^^n) o ((inv f)^^n) = (\<lambda>x. x)"
 proof -
   have "(f^^n) (((inv f)^^n) x) = x" for x n
   proof (induction n)
     case (Suc n)
     have *: "f(inv f y) = y" for y
       using bij_inv_eq_iff[OF assms] by auto
     have "(f ^^ Suc n) ((inv f ^^ Suc n) x) = (f^^n) (f (inv f ((inv f^^n) x)))"
       by (simp add: funpow_swap1)
     also have "... = (f^^n) ((inv f^^n) x)"
       using * by auto
     also have "... = x" using Suc.IH by auto
     finally show ?case by simp
   qed (auto)
   then show ?thesis unfolding o_def by blast
 qed
 
 lemma inv_fn:
   fixes f::"'a \<Rightarrow> 'a"
   assumes "bij f"
   shows "inv (f^^n) = ((inv f)^^n)"
 proof -
   have "inv (f^^n) x = ((inv f)^^n) x" for x
   proof (rule inv_into_f_eq)
     show "inj (f ^^ n)"
       by (simp add: inj_fn[OF bij_is_inj [OF assms]])
     show "(f ^^ n) ((inv f ^^ n) x) = x"
       using fn_o_inv_fn_is_id[OF assms, THEN fun_cong] by force
   qed auto
   then show ?thesis by auto
 qed
 
 
 lemma mono_inv:
   fixes f::"'a::linorder \<Rightarrow> 'b::linorder"
   assumes "mono f" "bij f"
   shows "mono (inv f)"
 proof
   fix x y::'b assume "x \<le> y"
   from \<open>bij f\<close> obtain a b where x: "x = f a" and y: "y = f b" by(fastforce simp: bij_def surj_def)
   show "inv f x \<le> inv f y"
   proof (rule le_cases)
     assume "a \<le> b"
     thus ?thesis using  \<open>bij f\<close> x y by(simp add: bij_def inv_f_f)
   next
     assume "b \<le> a"
     hence "f b \<le> f a" by(rule monoD[OF \<open>mono f\<close>])
     hence "y \<le> x" using x y by simp
     hence "x = y" using \<open>x \<le> y\<close> by auto
     thus ?thesis by simp
   qed
 qed
 
 lemma strict_mono_inv_on_range:
   fixes f :: "'a::linorder \<Rightarrow> 'b::order"
   assumes "strict_mono f"
   shows "strict_mono_on (inv f) (range f)"
 proof (clarsimp simp: strict_mono_on_def)
   fix x y
   assume "f x < f y"
   then show "inv f (f x) < inv f (f y)"
     using assms strict_mono_imp_inj_on strict_mono_less by fastforce
 qed
 
 lemma mono_bij_Inf:
   fixes f :: "'a::complete_linorder \<Rightarrow> 'b::complete_linorder"
   assumes "mono f" "bij f"
   shows "f (Inf A) = Inf (f`A)"
 proof -
   have "surj f" using \<open>bij f\<close> by (auto simp: bij_betw_def)
   have *: "(inv f) (Inf (f`A)) \<le> Inf ((inv f)`(f`A))"
     using mono_Inf[OF mono_inv[OF assms], of "f`A"] by simp
   have "Inf (f`A) \<le> f (Inf ((inv f)`(f`A)))"
     using monoD[OF \<open>mono f\<close> *] by(simp add: surj_f_inv_f[OF \<open>surj f\<close>])
   also have "... = f(Inf A)"
     using assms by (simp add: bij_is_inj)
   finally show ?thesis using mono_Inf[OF assms(1), of A] by auto
 qed
 
 lemma finite_fun_UNIVD1:
   assumes fin: "finite (UNIV :: ('a \<Rightarrow> 'b) set)"
     and card: "card (UNIV :: 'b set) \<noteq> Suc 0"
   shows "finite (UNIV :: 'a set)"
 proof -
   let ?UNIV_b = "UNIV :: 'b set"
   from fin have "finite ?UNIV_b"
     by (rule finite_fun_UNIVD2)
   with card have "card ?UNIV_b \<ge> Suc (Suc 0)"
     by (cases "card ?UNIV_b") (auto simp: card_eq_0_iff)
   then have "card ?UNIV_b = Suc (Suc (card ?UNIV_b - Suc (Suc 0)))"
     by simp
   then obtain b1 b2 :: 'b where b1b2: "b1 \<noteq> b2"
     by (auto simp: card_Suc_eq)
   from fin have fin': "finite (range (\<lambda>f :: 'a \<Rightarrow> 'b. inv f b1))"
     by (rule finite_imageI)
   have "UNIV = range (\<lambda>f :: 'a \<Rightarrow> 'b. inv f b1)"
   proof (rule UNIV_eq_I)
     fix x :: 'a
     from b1b2 have "x = inv (\<lambda>y. if y = x then b1 else b2) b1"
       by (simp add: inv_into_def)
     then show "x \<in> range (\<lambda>f::'a \<Rightarrow> 'b. inv f b1)"
       by blast
   qed
   with fin' show ?thesis
     by simp
 qed
 
 text \<open>
   Every infinite set contains a countable subset. More precisely we
   show that a set \<open>S\<close> is infinite if and only if there exists an
   injective function from the naturals into \<open>S\<close>.
 
   The ``only if'' direction is harder because it requires the
   construction of a sequence of pairwise different elements of an
   infinite set \<open>S\<close>. The idea is to construct a sequence of
   non-empty and infinite subsets of \<open>S\<close> obtained by successively
   removing elements of \<open>S\<close>.
 \<close>
 
 lemma infinite_countable_subset:
   assumes inf: "\<not> finite S"
   shows "\<exists>f::nat \<Rightarrow> 'a. inj f \<and> range f \<subseteq> S"
   \<comment> \<open>Courtesy of Stephan Merz\<close>
 proof -
   define Sseq where "Sseq = rec_nat S (\<lambda>n T. T - {SOME e. e \<in> T})"
   define pick where "pick n = (SOME e. e \<in> Sseq n)" for n
   have *: "Sseq n \<subseteq> S" "\<not> finite (Sseq n)" for n
     by (induct n) (auto simp: Sseq_def inf)
   then have **: "\<And>n. pick n \<in> Sseq n"
     unfolding pick_def by (subst (asm) finite.simps) (auto simp add: ex_in_conv intro: someI_ex)
   with * have "range pick \<subseteq> S" by auto
   moreover have "pick n \<noteq> pick (n + Suc m)" for m n
   proof -
     have "pick n \<notin> Sseq (n + Suc m)"
       by (induct m) (auto simp add: Sseq_def pick_def)
     with ** show ?thesis by auto
   qed
   then have "inj pick"
     by (intro linorder_injI) (auto simp add: less_iff_Suc_add)
   ultimately show ?thesis by blast
 qed
 
 lemma infinite_iff_countable_subset: "\<not> finite S \<longleftrightarrow> (\<exists>f::nat \<Rightarrow> 'a. inj f \<and> range f \<subseteq> S)"
   \<comment> \<open>Courtesy of Stephan Merz\<close>
   using finite_imageD finite_subset infinite_UNIV_char_0 infinite_countable_subset by auto
 
 lemma image_inv_into_cancel:
   assumes surj: "f`A = A'"
     and sub: "B' \<subseteq> A'"
   shows "f `((inv_into A f)`B') = B'"
   using assms
 proof (auto simp: f_inv_into_f)
   let ?f' = "inv_into A f"
   fix a'
   assume *: "a' \<in> B'"
   with sub have "a' \<in> A'" by auto
   with surj have "a' = f (?f' a')"
     by (auto simp: f_inv_into_f)
   with * show "a' \<in> f ` (?f' ` B')" by blast
 qed
 
 lemma inv_into_inv_into_eq:
   assumes "bij_betw f A A'"
     and a: "a \<in> A"
   shows "inv_into A' (inv_into A f) a = f a"
 proof -
   let ?f' = "inv_into A f"
   let ?f'' = "inv_into A' ?f'"
   from assms have *: "bij_betw ?f' A' A"
     by (auto simp: bij_betw_inv_into)
   with a obtain a' where a': "a' \<in> A'" "?f' a' = a"
     unfolding bij_betw_def by force
   with a * have "?f'' a = a'"
     by (auto simp: f_inv_into_f bij_betw_def)
   moreover from assms a' have "f a = a'"
     by (auto simp: bij_betw_def)
   ultimately show "?f'' a = f a" by simp
 qed
 
 lemma inj_on_iff_surj:
   assumes "A \<noteq> {}"
   shows "(\<exists>f. inj_on f A \<and> f ` A \<subseteq> A') \<longleftrightarrow> (\<exists>g. g ` A' = A)"
 proof safe
   fix f
   assume inj: "inj_on f A" and incl: "f ` A \<subseteq> A'"
   let ?phi = "\<lambda>a' a. a \<in> A \<and> f a = a'"
   let ?csi = "\<lambda>a. a \<in> A"
   let ?g = "\<lambda>a'. if a' \<in> f ` A then (SOME a. ?phi a' a) else (SOME a. ?csi a)"
   have "?g ` A' = A"
   proof
     show "?g ` A' \<subseteq> A"
     proof clarify
       fix a'
       assume *: "a' \<in> A'"
       show "?g a' \<in> A"
       proof (cases "a' \<in> f ` A")
         case True
         then obtain a where "?phi a' a" by blast
         then have "?phi a' (SOME a. ?phi a' a)"
           using someI[of "?phi a'" a] by blast
         with True show ?thesis by auto
       next
         case False
         with assms have "?csi (SOME a. ?csi a)"
           using someI_ex[of ?csi] by blast
         with False show ?thesis by auto
       qed
     qed
   next
     show "A \<subseteq> ?g ` A'"
     proof -
       have "?g (f a) = a \<and> f a \<in> A'" if a: "a \<in> A" for a
       proof -
         let ?b = "SOME aa. ?phi (f a) aa"
         from a have "?phi (f a) a" by auto
         then have *: "?phi (f a) ?b"
           using someI[of "?phi(f a)" a] by blast
         then have "?g (f a) = ?b" using a by auto
         moreover from inj * a have "a = ?b"
           by (auto simp add: inj_on_def)
         ultimately have "?g(f a) = a" by simp
         with incl a show ?thesis by auto
       qed
       then show ?thesis by force
     qed
   qed
   then show "\<exists>g. g ` A' = A" by blast
 next
   fix g
   let ?f = "inv_into A' g"
   have "inj_on ?f (g ` A')"
     by (auto simp: inj_on_inv_into)
   moreover have "?f (g a') \<in> A'" if a': "a' \<in> A'" for a'
   proof -
     let ?phi = "\<lambda> b'. b' \<in> A' \<and> g b' = g a'"
     from a' have "?phi a'" by auto
     then have "?phi (SOME b'. ?phi b')"
       using someI[of ?phi] by blast
     then show ?thesis by (auto simp: inv_into_def)
   qed
   ultimately show "\<exists>f. inj_on f (g ` A') \<and> f ` g ` A' \<subseteq> A'"
     by auto
 qed
 
 lemma Ex_inj_on_UNION_Sigma:
   "\<exists>f. (inj_on f (\<Union>i \<in> I. A i) \<and> f ` (\<Union>i \<in> I. A i) \<subseteq> (SIGMA i : I. A i))"
 proof
   let ?phi = "\<lambda>a i. i \<in> I \<and> a \<in> A i"
   let ?sm = "\<lambda>a. SOME i. ?phi a i"
   let ?f = "\<lambda>a. (?sm a, a)"
   have "inj_on ?f (\<Union>i \<in> I. A i)"
     by (auto simp: inj_on_def)
   moreover
   have "?sm a \<in> I \<and> a \<in> A(?sm a)" if "i \<in> I" and "a \<in> A i" for i a
     using that someI[of "?phi a" i] by auto
   then have "?f ` (\<Union>i \<in> I. A i) \<subseteq> (SIGMA i : I. A i)"
     by auto
   ultimately show "inj_on ?f (\<Union>i \<in> I. A i) \<and> ?f ` (\<Union>i \<in> I. A i) \<subseteq> (SIGMA i : I. A i)"
     by auto
 qed
 
 lemma inv_unique_comp:
   assumes fg: "f \<circ> g = id"
     and gf: "g \<circ> f = id"
   shows "inv f = g"
   using fg gf inv_equality[of g f] by (auto simp add: fun_eq_iff)
 
+lemma inv_swap_id: "inv (Fun.swap a b id) = Fun.swap a b id"
+  by (rule inv_unique_comp) simp_all
+
+lemma bij_swap_comp:
+  assumes "bij p"
+  shows "Fun.swap a b id \<circ> p = Fun.swap (inv p a) (inv p b) p"
+  using surj_f_inv_f[OF bij_is_surj[OF \<open>bij p\<close>]]
+  by (simp add: fun_eq_iff Fun.swap_def bij_inv_eq_iff[OF \<open>bij p\<close>])
+
 lemma subset_image_inj:
   "S \<subseteq> f ` T \<longleftrightarrow> (\<exists>U. U \<subseteq> T \<and> inj_on f U \<and> S = f ` U)"
 proof safe
   show "\<exists>U\<subseteq>T. inj_on f U \<and> S = f ` U"
     if "S \<subseteq> f ` T"
   proof -
     from that [unfolded subset_image_iff subset_iff]
     obtain g where g: "\<And>x. x \<in> S \<Longrightarrow> g x \<in> T \<and> x = f (g x)"
       by (auto simp add: image_iff Bex_def choice_iff')
     show ?thesis
     proof (intro exI conjI)
       show "g ` S \<subseteq> T"
         by (simp add: g image_subsetI)
       show "inj_on f (g ` S)"
         using g by (auto simp: inj_on_def)
       show "S = f ` (g ` S)"
         using g image_subset_iff by auto
     qed
   qed
 qed blast
 
 
 subsection \<open>Other Consequences of Hilbert's Epsilon\<close>
 
 text \<open>Hilbert's Epsilon and the \<^term>\<open>split\<close> Operator\<close>
 
 text \<open>Looping simprule!\<close>
 lemma split_paired_Eps: "(SOME x. P x) = (SOME (a, b). P (a, b))"
   by simp
 
 lemma Eps_case_prod: "Eps (case_prod P) = (SOME xy. P (fst xy) (snd xy))"
   by (simp add: split_def)
 
 lemma Eps_case_prod_eq [simp]: "(SOME (x', y'). x = x' \<and> y = y') = (x, y)"
   by blast
 
 
 text \<open>A relation is wellfounded iff it has no infinite descending chain.\<close>
 lemma wf_iff_no_infinite_down_chain: "wf r \<longleftrightarrow> (\<nexists>f. \<forall>i. (f (Suc i), f i) \<in> r)"
   (is "_ \<longleftrightarrow> \<not> ?ex")
 proof
   assume "wf r"
   show "\<not> ?ex"
   proof
     assume ?ex
     then obtain f where f: "(f (Suc i), f i) \<in> r" for i
       by blast
     from \<open>wf r\<close> have minimal: "x \<in> Q \<Longrightarrow> \<exists>z\<in>Q. \<forall>y. (y, z) \<in> r \<longrightarrow> y \<notin> Q" for x Q
       by (auto simp: wf_eq_minimal)
     let ?Q = "{w. \<exists>i. w = f i}"
     fix n
     have "f n \<in> ?Q" by blast
     from minimal [OF this] obtain j where "(y, f j) \<in> r \<Longrightarrow> y \<notin> ?Q" for y by blast
     with this [OF \<open>(f (Suc j), f j) \<in> r\<close>] have "f (Suc j) \<notin> ?Q" by simp
     then show False by blast
   qed
 next
   assume "\<not> ?ex"
   then show "wf r"
   proof (rule contrapos_np)
     assume "\<not> wf r"
     then obtain Q x where x: "x \<in> Q" and rec: "z \<in> Q \<Longrightarrow> \<exists>y. (y, z) \<in> r \<and> y \<in> Q" for z
       by (auto simp add: wf_eq_minimal)
     obtain descend :: "nat \<Rightarrow> 'a"
       where descend_0: "descend 0 = x"
         and descend_Suc: "descend (Suc n) = (SOME y. y \<in> Q \<and> (y, descend n) \<in> r)" for n
       by (rule that [of "rec_nat x (\<lambda>_ rec. (SOME y. y \<in> Q \<and> (y, rec) \<in> r))"]) simp_all
     have descend_Q: "descend n \<in> Q" for n
     proof (induct n)
       case 0
       with x show ?case by (simp only: descend_0)
     next
       case Suc
       then show ?case by (simp only: descend_Suc) (rule someI2_ex; use rec in blast)
     qed
     have "(descend (Suc i), descend i) \<in> r" for i
       by (simp only: descend_Suc) (rule someI2_ex; use descend_Q rec in blast)
     then show "\<exists>f. \<forall>i. (f (Suc i), f i) \<in> r" by blast
   qed
 qed
 
 lemma wf_no_infinite_down_chainE:
   assumes "wf r"
   obtains k where "(f (Suc k), f k) \<notin> r"
   using assms wf_iff_no_infinite_down_chain[of r] by blast
 
 
 text \<open>A dynamically-scoped fact for TFL\<close>
 lemma tfl_some: "\<forall>P x. P x \<longrightarrow> P (Eps P)"
   by (blast intro: someI)
 
 
 subsection \<open>An aside: bounded accessible part\<close>
 
 text \<open>Finite monotone eventually stable sequences\<close>
 
 lemma finite_mono_remains_stable_implies_strict_prefix:
   fixes f :: "nat \<Rightarrow> 'a::order"
   assumes S: "finite (range f)" "mono f"
     and eq: "\<forall>n. f n = f (Suc n) \<longrightarrow> f (Suc n) = f (Suc (Suc n))"
   shows "\<exists>N. (\<forall>n\<le>N. \<forall>m\<le>N. m < n \<longrightarrow> f m < f n) \<and> (\<forall>n\<ge>N. f N = f n)"
   using assms
 proof -
   have "\<exists>n. f n = f (Suc n)"
   proof (rule ccontr)
     assume "\<not> ?thesis"
     then have "\<And>n. f n \<noteq> f (Suc n)" by auto
     with \<open>mono f\<close> have "\<And>n. f n < f (Suc n)"
       by (auto simp: le_less mono_iff_le_Suc)
     with lift_Suc_mono_less_iff[of f] have *: "\<And>n m. n < m \<Longrightarrow> f n < f m"
       by auto
     have "inj f"
     proof (intro injI)
       fix x y
       assume "f x = f y"
       then show "x = y"
         by (cases x y rule: linorder_cases) (auto dest: *)
     qed
     with \<open>finite (range f)\<close> have "finite (UNIV::nat set)"
       by (rule finite_imageD)
     then show False by simp
   qed
   then obtain n where n: "f n = f (Suc n)" ..
   define N where "N = (LEAST n. f n = f (Suc n))"
   have N: "f N = f (Suc N)"
     unfolding N_def using n by (rule LeastI)
   show ?thesis
   proof (intro exI[of _ N] conjI allI impI)
     fix n
     assume "N \<le> n"
     then have "\<And>m. N \<le> m \<Longrightarrow> m \<le> n \<Longrightarrow> f m = f N"
     proof (induct rule: dec_induct)
       case base
       then show ?case by simp
     next
       case (step n)
       then show ?case
         using eq [rule_format, of "n - 1"] N
         by (cases n) (auto simp add: le_Suc_eq)
     qed
     from this[of n] \<open>N \<le> n\<close> show "f N = f n" by auto
   next
     fix n m :: nat
     assume "m < n" "n \<le> N"
     then show "f m < f n"
     proof (induct rule: less_Suc_induct)
       case (1 i)
       then have "i < N" by simp
       then have "f i \<noteq> f (Suc i)"
         unfolding N_def by (rule not_less_Least)
       with \<open>mono f\<close> show ?case by (simp add: mono_iff_le_Suc less_le)
     next
       case 2
       then show ?case by simp
     qed
   qed
 qed
 
 lemma finite_mono_strict_prefix_implies_finite_fixpoint:
   fixes f :: "nat \<Rightarrow> 'a set"
   assumes S: "\<And>i. f i \<subseteq> S" "finite S"
     and ex: "\<exists>N. (\<forall>n\<le>N. \<forall>m\<le>N. m < n \<longrightarrow> f m \<subset> f n) \<and> (\<forall>n\<ge>N. f N = f n)"
   shows "f (card S) = (\<Union>n. f n)"
 proof -
   from ex obtain N where inj: "\<And>n m. n \<le> N \<Longrightarrow> m \<le> N \<Longrightarrow> m < n \<Longrightarrow> f m \<subset> f n"
     and eq: "\<forall>n\<ge>N. f N = f n"
     by atomize auto
   have "i \<le> N \<Longrightarrow> i \<le> card (f i)" for i
   proof (induct i)
     case 0
     then show ?case by simp
   next
     case (Suc i)
     with inj [of "Suc i" i] have "(f i) \<subset> (f (Suc i))" by auto
     moreover have "finite (f (Suc i))" using S by (rule finite_subset)
     ultimately have "card (f i) < card (f (Suc i))" by (intro psubset_card_mono)
     with Suc inj show ?case by auto
   qed
   then have "N \<le> card (f N)" by simp
   also have "\<dots> \<le> card S" using S by (intro card_mono)
   finally have \<section>: "f (card S) = f N" using eq by auto
   moreover have "\<Union> (range f) \<subseteq> f N"
   proof clarify
     fix x n
     assume "x \<in> f n"
     with eq inj [of N] show "x \<in> f N"
       by (cases "n < N") (auto simp: not_less)
   qed
   ultimately show ?thesis
     by auto
 qed
 
 
 subsection \<open>More on injections, bijections, and inverses\<close>
 
 locale bijection =
   fixes f :: "'a \<Rightarrow> 'a"
   assumes bij: "bij f"
 begin
 
 lemma bij_inv: "bij (inv f)"
   using bij by (rule bij_imp_bij_inv)
 
 lemma surj [simp]: "surj f"
   using bij by (rule bij_is_surj)
 
 lemma inj: "inj f"
   using bij by (rule bij_is_inj)
 
 lemma surj_inv [simp]: "surj (inv f)"
   using inj by (rule inj_imp_surj_inv)
 
 lemma inj_inv: "inj (inv f)"
   using surj by (rule surj_imp_inj_inv)
 
 lemma eqI: "f a = f b \<Longrightarrow> a = b"
   using inj by (rule injD)
 
 lemma eq_iff [simp]: "f a = f b \<longleftrightarrow> a = b"
   by (auto intro: eqI)
 
 lemma eq_invI: "inv f a = inv f b \<Longrightarrow> a = b"
   using inj_inv by (rule injD)
 
 lemma eq_inv_iff [simp]: "inv f a = inv f b \<longleftrightarrow> a = b"
   by (auto intro: eq_invI)
 
 lemma inv_left [simp]: "inv f (f a) = a"
   using inj by (simp add: inv_f_eq)
 
 lemma inv_comp_left [simp]: "inv f \<circ> f = id"
   by (simp add: fun_eq_iff)
 
 lemma inv_right [simp]: "f (inv f a) = a"
   using surj by (simp add: surj_f_inv_f)
 
 lemma inv_comp_right [simp]: "f \<circ> inv f = id"
   by (simp add: fun_eq_iff)
 
 lemma inv_left_eq_iff [simp]: "inv f a = b \<longleftrightarrow> f b = a"
   by auto
 
 lemma inv_right_eq_iff [simp]: "b = inv f a \<longleftrightarrow> f b = a"
   by auto
 
 end
 
 lemma infinite_imp_bij_betw:
   assumes infinite: "\<not> finite A"
   shows "\<exists>h. bij_betw h A (A - {a})"
 proof (cases "a \<in> A")
   case False
   then have "A - {a} = A" by blast
   then show ?thesis
     using bij_betw_id[of A] by auto
 next
   case True
   with infinite have "\<not> finite (A - {a})" by auto
   with infinite_iff_countable_subset[of "A - {a}"]
   obtain f :: "nat \<Rightarrow> 'a" where "inj f" and f: "f ` UNIV \<subseteq> A - {a}" by blast
   define g where "g n = (if n = 0 then a else f (Suc n))" for n
   define A' where "A' = g ` UNIV"
   have *: "\<forall>y. f y \<noteq> a" using f by blast
   have 3: "inj_on g UNIV \<and> g ` UNIV \<subseteq> A \<and> a \<in> g ` UNIV"
     using \<open>inj f\<close> f * unfolding inj_on_def g_def
     by (auto simp add: True image_subset_iff)
   then have 4: "bij_betw g UNIV A' \<and> a \<in> A' \<and> A' \<subseteq> A"
     using inj_on_imp_bij_betw[of g] by (auto simp: A'_def)
   then have 5: "bij_betw (inv g) A' UNIV"
     by (auto simp add: bij_betw_inv_into)
   from 3 obtain n where n: "g n = a" by auto
   have 6: "bij_betw g (UNIV - {n}) (A' - {a})"
     by (rule bij_betw_subset) (use 3 4 n in \<open>auto simp: image_set_diff A'_def\<close>)
   define v where "v m = (if m < n then m else Suc m)" for m
   have "m < n \<or> m = n" if "\<And>k. k < n \<or> m \<noteq> Suc k" for m
     using that [of "m-1"] by auto
   then have 7: "bij_betw v UNIV (UNIV - {n})"
     unfolding bij_betw_def inj_on_def v_def by auto
   define h' where "h' = g \<circ> v \<circ> (inv g)"
   with 5 6 7 have 8: "bij_betw h' A' (A' - {a})"
     by (auto simp add: bij_betw_trans)
   define h where "h b = (if b \<in> A' then h' b else b)" for b
   with 8 have "bij_betw h  A' (A' - {a})"
     using bij_betw_cong[of A' h] by auto
   moreover
   have "\<forall>b \<in> A - A'. h b = b" by (auto simp: h_def)
   then have "bij_betw h  (A - A') (A - A')"
     using bij_betw_cong[of "A - A'" h id] bij_betw_id[of "A - A'"] by auto
   moreover
   from 4 have "(A' \<inter> (A - A') = {} \<and> A' \<union> (A - A') = A) \<and>
     ((A' - {a}) \<inter> (A - A') = {} \<and> (A' - {a}) \<union> (A - A') = A - {a})"
     by blast
   ultimately have "bij_betw h A (A - {a})"
     using bij_betw_combine[of h A' "A' - {a}" "A - A'" "A - A'"] by simp
   then show ?thesis by blast
 qed
 
 lemma infinite_imp_bij_betw2:
   assumes "\<not> finite A"
   shows "\<exists>h. bij_betw h A (A \<union> {a})"
 proof (cases "a \<in> A")
   case True
   then have "A \<union> {a} = A" by blast
   then show ?thesis using bij_betw_id[of A] by auto
 next
   case False
   let ?A' = "A \<union> {a}"
   from False have "A = ?A' - {a}" by blast
   moreover from assms have "\<not> finite ?A'" by auto
   ultimately obtain f where "bij_betw f ?A' A"
     using infinite_imp_bij_betw[of ?A' a] by auto
   then have "bij_betw (inv_into ?A' f) A ?A'" by (rule bij_betw_inv_into)
   then show ?thesis by auto
 qed
 
 lemma bij_betw_inv_into_left: "bij_betw f A A' \<Longrightarrow> a \<in> A \<Longrightarrow> inv_into A f (f a) = a"
   unfolding bij_betw_def by clarify (rule inv_into_f_f)
 
 lemma bij_betw_inv_into_right: "bij_betw f A A' \<Longrightarrow> a' \<in> A' \<Longrightarrow> f (inv_into A f a') = a'"
   unfolding bij_betw_def using f_inv_into_f by force
 
 lemma bij_betw_inv_into_subset:
   "bij_betw f A A' \<Longrightarrow> B \<subseteq> A \<Longrightarrow> f ` B = B' \<Longrightarrow> bij_betw (inv_into A f) B' B"
   by (auto simp: bij_betw_def intro: inj_on_inv_into)
 
 
 subsection \<open>Specification package -- Hilbertized version\<close>
 
 lemma exE_some: "Ex P \<Longrightarrow> c \<equiv> Eps P \<Longrightarrow> P c"
   by (simp only: someI_ex)
 
 ML_file \<open>Tools/choice_specification.ML\<close>
 
 subsection \<open>Complete Distributive Lattices -- Properties depending on Hilbert Choice\<close>
 
 context complete_distrib_lattice
 begin
 
 lemma Sup_Inf: "\<Squnion> (Inf ` A) = \<Sqinter> (Sup ` {f ` A |f. \<forall>B\<in>A. f B \<in> B})"
 proof (rule antisym)
   show "\<Squnion> (Inf ` A) \<le> \<Sqinter> (Sup ` {f ` A |f. \<forall>B\<in>A. f B \<in> B})"
     using Inf_lower2 Sup_upper
     by (fastforce simp add: intro: Sup_least INF_greatest)
 next
   show "\<Sqinter> (Sup ` {f ` A |f. \<forall>B\<in>A. f B \<in> B}) \<le> \<Squnion> (Inf ` A)"
   proof (simp add:  Inf_Sup, rule SUP_least, simp, safe)
     fix f
     assume "\<forall>Y. (\<exists>f. Y = f ` A \<and> (\<forall>Y\<in>A. f Y \<in> Y)) \<longrightarrow> f Y \<in> Y"
     then have B: "\<And> F . (\<forall> Y \<in> A . F Y \<in> Y) \<Longrightarrow> \<exists> Z \<in> A . f (F ` A) = F Z"
       by auto
     show "\<Sqinter>(f ` {f ` A |f. \<forall>Y\<in>A. f Y \<in> Y}) \<le> \<Squnion>(Inf ` A)"
     proof (cases "\<exists> Z \<in> A . \<Sqinter>(f ` {f ` A |f. \<forall>Y\<in>A. f Y \<in> Y}) \<le> Inf Z")
       case True
       from this obtain Z where [simp]: "Z \<in> A" and A: "\<Sqinter>(f ` {f ` A |f. \<forall>Y\<in>A. f Y \<in> Y}) \<le> Inf Z"
         by blast
       have B: "... \<le> \<Squnion>(Inf ` A)"
         by (simp add: SUP_upper)
       from A and B show ?thesis
         by simp
     next
       case False
       then have X: "\<And> Z . Z \<in> A \<Longrightarrow> \<exists> x . x \<in> Z \<and> \<not> \<Sqinter>(f ` {f ` A |f. \<forall>Y\<in>A. f Y \<in> Y}) \<le> x"
         using Inf_greatest by blast
       define F where "F = (\<lambda> Z . SOME x . x \<in> Z \<and> \<not> \<Sqinter>(f ` {f ` A |f. \<forall>Y\<in>A. f Y \<in> Y}) \<le> x)"
       have C: "\<And>Y. Y \<in> A \<Longrightarrow> F Y \<in> Y"
         using X by (simp add: F_def, rule someI2_ex, auto)
       have E: "\<And>Y. Y \<in> A \<Longrightarrow> \<not> \<Sqinter>(f ` {f ` A |f. \<forall>Y\<in>A. f Y \<in> Y}) \<le> F Y"
         using X by (simp add: F_def, rule someI2_ex, auto)
       from C and B obtain  Z where D: "Z \<in> A " and Y: "f (F ` A) = F Z"
         by blast
       from E and D have W: "\<not> \<Sqinter>(f ` {f ` A |f. \<forall>Y\<in>A. f Y \<in> Y}) \<le> F Z"
         by simp
       have "\<Sqinter>(f ` {f ` A |f. \<forall>Y\<in>A. f Y \<in> Y}) \<le> f (F ` A)"
         using C by (blast intro: INF_lower)
       with W Y show ?thesis
         by simp
     qed
   qed
 qed
   
 lemma dual_complete_distrib_lattice:
   "class.complete_distrib_lattice Sup Inf sup (\<ge>) (>) inf \<top> \<bottom>"
   by (simp add: class.complete_distrib_lattice.intro [OF dual_complete_lattice] 
                 class.complete_distrib_lattice_axioms_def Sup_Inf)
 
 lemma sup_Inf: "a \<squnion> \<Sqinter>B = \<Sqinter>((\<squnion>) a ` B)"
 proof (rule antisym)
   show "a \<squnion> \<Sqinter>B \<le> \<Sqinter>((\<squnion>) a ` B)"
     using Inf_lower sup.mono by (fastforce intro: INF_greatest)
 next
   have "\<Sqinter>((\<squnion>) a ` B) \<le> \<Sqinter>(Sup ` {{f {a}, f B} |f. f {a} = a \<and> f B \<in> B})"
     by (rule INF_greatest, auto simp add: INF_lower)
   also have "... = \<Squnion>(Inf ` {{a}, B})"
     by (unfold Sup_Inf, simp)
   finally show "\<Sqinter>((\<squnion>) a ` B) \<le> a \<squnion> \<Sqinter>B"
     by simp
 qed
 
 lemma inf_Sup: "a \<sqinter> \<Squnion>B = \<Squnion>((\<sqinter>) a ` B)"
   using dual_complete_distrib_lattice
   by (rule complete_distrib_lattice.sup_Inf)
 
 lemma INF_SUP: "(\<Sqinter>y. \<Squnion>x. P x y) = (\<Squnion>f. \<Sqinter>x. P (f x) x)"
 proof (rule antisym)
   show "(SUP x. INF y. P (x y) y) \<le> (INF y. SUP x. P x y)"
     by (rule SUP_least, rule INF_greatest, rule SUP_upper2, simp_all, rule INF_lower2, simp, blast)
 next
   have "(INF y. SUP x. ((P x y))) \<le> Inf (Sup ` {{P x y | x . True} | y . True })" (is "?A \<le> ?B")
   proof (rule INF_greatest, clarsimp)
     fix y
     have "?A \<le> (SUP x. P x y)"
       by (rule INF_lower, simp)
     also have "... \<le> Sup {uu. \<exists>x. uu = P x y}"
       by (simp add: full_SetCompr_eq)
     finally show "?A \<le> Sup {uu. \<exists>x. uu = P x y}"
       by simp
   qed
   also have "... \<le>  (SUP x. INF y. P (x y) y)"
   proof (subst Inf_Sup, rule SUP_least, clarsimp)
     fix f
     assume A: "\<forall>Y. (\<exists>y. Y = {uu. \<exists>x. uu = P x y}) \<longrightarrow> f Y \<in> Y"
       
     have " \<Sqinter>(f ` {uu. \<exists>y. uu = {uu. \<exists>x. uu = P x y}}) \<le>
       (\<Sqinter>y. P (SOME x. f {P x y |x. True} = P x y) y)"
     proof (rule INF_greatest, clarsimp)
       fix y
         have "(INF x\<in>{uu. \<exists>y. uu = {uu. \<exists>x. uu = P x y}}. f x) \<le> f {uu. \<exists>x. uu = P x y}"
           by (rule INF_lower, blast)
         also have "... \<le> P (SOME x. f {uu . \<exists>x. uu = P x y} = P x y) y"
           by (rule someI2_ex) (use A in auto)
         finally show "\<Sqinter>(f ` {uu. \<exists>y. uu = {uu. \<exists>x. uu = P x y}}) \<le>
           P (SOME x. f {uu. \<exists>x. uu = P x y} = P x y) y"
           by simp
       qed
       also have "... \<le> (SUP x. INF y. P (x y) y)"
         by (rule SUP_upper, simp)
       finally show "\<Sqinter>(f ` {uu. \<exists>y. uu = {uu. \<exists>x. uu = P x y}}) \<le> (\<Squnion>x. \<Sqinter>y. P (x y) y)"
         by simp
     qed
   finally show "(INF y. SUP x. P x y) \<le> (SUP x. INF y. P (x y) y)"
     by simp
 qed
 
 lemma INF_SUP_set: "(\<Sqinter>B\<in>A. \<Squnion>(g ` B)) = (\<Squnion>B\<in>{f ` A |f. \<forall>C\<in>A. f C \<in> C}. \<Sqinter>(g ` B))"
                     (is "_ = (\<Squnion>B\<in>?F. _)")
 proof (rule antisym)
   have "\<Sqinter> ((g \<circ> f) ` A) \<le> \<Squnion> (g ` B)" if "\<And>B. B \<in> A \<Longrightarrow> f B \<in> B" "B \<in> A" for f B
     using that by (auto intro: SUP_upper2 INF_lower2)
   then show "(\<Squnion>x\<in>?F. \<Sqinter>a\<in>x. g a) \<le> (\<Sqinter>x\<in>A. \<Squnion>a\<in>x. g a)"
     by (auto intro!: SUP_least INF_greatest simp add: image_comp)
 next
   show "(\<Sqinter>x\<in>A. \<Squnion>a\<in>x. g a) \<le> (\<Squnion>x\<in>?F. \<Sqinter>a\<in>x. g a)"
   proof (cases "{} \<in> A")
     case True
     then show ?thesis 
       by (rule INF_lower2) simp_all
   next
     case False
     {fix x
       have "(\<Sqinter>x\<in>A. \<Squnion>x\<in>x. g x) \<le> (\<Squnion>u. if x \<in> A then if u \<in> x then g u else \<bottom> else \<top>)"
       proof (cases "x \<in> A")
         case True
         then show ?thesis
           by (intro INF_lower2 SUP_least SUP_upper2) auto
       qed auto
     }
     then have "(\<Sqinter>Y\<in>A. \<Squnion>a\<in>Y. g a) \<le> (\<Sqinter>Y. \<Squnion>y. if Y \<in> A then if y \<in> Y then g y else \<bottom> else \<top>)"
       by (rule INF_greatest)
     also have "... = (\<Squnion>x. \<Sqinter>Y. if Y \<in> A then if x Y \<in> Y then g (x Y) else \<bottom> else \<top>)"
       by (simp only: INF_SUP)
     also have "... \<le> (\<Squnion>x\<in>?F. \<Sqinter>a\<in>x. g a)"
     proof (rule SUP_least)
       show "(\<Sqinter>B. if B \<in> A then if x B \<in> B then g (x B) else \<bottom> else \<top>)
                \<le> (\<Squnion>x\<in>?F. \<Sqinter>x\<in>x. g x)" for x
       proof -
         define G where "G \<equiv> \<lambda>Y. if x Y \<in> Y then x Y else (SOME x. x \<in>Y)"
         have "\<forall>Y\<in>A. G Y \<in> Y"
           using False some_in_eq G_def by auto
         then have A: "G ` A \<in> ?F"
           by blast
         show "(\<Sqinter>Y. if Y \<in> A then if x Y \<in> Y then g (x Y) else \<bottom> else \<top>) \<le> (\<Squnion>x\<in>?F. \<Sqinter>x\<in>x. g x)"
           by (fastforce simp: G_def intro: SUP_upper2 [OF A] INF_greatest INF_lower2)
       qed
     qed
     finally show ?thesis by simp
   qed
 qed
 
 lemma SUP_INF: "(\<Squnion>y. \<Sqinter>x. P x y) = (\<Sqinter>x. \<Squnion>y. P (x y) y)"
   using dual_complete_distrib_lattice
   by (rule complete_distrib_lattice.INF_SUP)
 
 lemma SUP_INF_set: "(\<Squnion>x\<in>A. \<Sqinter> (g ` x)) = (\<Sqinter>x\<in>{f ` A |f. \<forall>Y\<in>A. f Y \<in> Y}. \<Squnion> (g ` x))"
   using dual_complete_distrib_lattice
   by (rule complete_distrib_lattice.INF_SUP_set)
 
 end
 
 (*properties of the former complete_distrib_lattice*)
 context complete_distrib_lattice
 begin
 
 lemma sup_INF: "a \<squnion> (\<Sqinter>b\<in>B. f b) = (\<Sqinter>b\<in>B. a \<squnion> f b)"
   by (simp add: sup_Inf image_comp)
 
 lemma inf_SUP: "a \<sqinter> (\<Squnion>b\<in>B. f b) = (\<Squnion>b\<in>B. a \<sqinter> f b)"
   by (simp add: inf_Sup image_comp)
 
 lemma Inf_sup: "\<Sqinter>B \<squnion> a = (\<Sqinter>b\<in>B. b \<squnion> a)"
   by (simp add: sup_Inf sup_commute)
 
 lemma Sup_inf: "\<Squnion>B \<sqinter> a = (\<Squnion>b\<in>B. b \<sqinter> a)"
   by (simp add: inf_Sup inf_commute)
 
 lemma INF_sup: "(\<Sqinter>b\<in>B. f b) \<squnion> a = (\<Sqinter>b\<in>B. f b \<squnion> a)"
   by (simp add: sup_INF sup_commute)
 
 lemma SUP_inf: "(\<Squnion>b\<in>B. f b) \<sqinter> a = (\<Squnion>b\<in>B. f b \<sqinter> a)"
   by (simp add: inf_SUP inf_commute)
 
 lemma Inf_sup_eq_top_iff: "(\<Sqinter>B \<squnion> a = \<top>) \<longleftrightarrow> (\<forall>b\<in>B. b \<squnion> a = \<top>)"
   by (simp only: Inf_sup INF_top_conv)
 
 lemma Sup_inf_eq_bot_iff: "(\<Squnion>B \<sqinter> a = \<bottom>) \<longleftrightarrow> (\<forall>b\<in>B. b \<sqinter> a = \<bottom>)"
   by (simp only: Sup_inf SUP_bot_conv)
 
 lemma INF_sup_distrib2: "(\<Sqinter>a\<in>A. f a) \<squnion> (\<Sqinter>b\<in>B. g b) = (\<Sqinter>a\<in>A. \<Sqinter>b\<in>B. f a \<squnion> g b)"
   by (subst INF_commute) (simp add: sup_INF INF_sup)
 
 lemma SUP_inf_distrib2: "(\<Squnion>a\<in>A. f a) \<sqinter> (\<Squnion>b\<in>B. g b) = (\<Squnion>a\<in>A. \<Squnion>b\<in>B. f a \<sqinter> g b)"
   by (subst SUP_commute) (simp add: inf_SUP SUP_inf)
 
 end
 
 context complete_boolean_algebra
 begin
 
 lemma dual_complete_boolean_algebra:
   "class.complete_boolean_algebra Sup Inf sup (\<ge>) (>) inf \<top> \<bottom> (\<lambda>x y. x \<squnion> - y) uminus"
   by (rule class.complete_boolean_algebra.intro,
       rule dual_complete_distrib_lattice,
       rule dual_boolean_algebra)
 end
 
 
 
 instantiation set :: (type) complete_distrib_lattice
 begin
 instance proof (standard, clarsimp)
   fix A :: "(('a set) set) set"
   fix x::'a
   assume A: "\<forall>\<S>\<in>A. \<exists>X\<in>\<S>. x \<in> X"
   define F where "F \<equiv> \<lambda>Y. SOME X. Y \<in> A \<and> X \<in> Y \<and> x \<in> X"
   have "(\<forall>S \<in> F ` A. x \<in> S)"
     using A unfolding F_def by (fastforce intro: someI2_ex)
   moreover have "\<forall>Y\<in>A. F Y \<in> Y"
     using A unfolding F_def by (fastforce intro: someI2_ex)
   then have "\<exists>f. F ` A  = f ` A \<and> (\<forall>Y\<in>A. f Y \<in> Y)"
     by blast
   ultimately show "\<exists>X. (\<exists>f. X = f ` A \<and> (\<forall>Y\<in>A. f Y \<in> Y)) \<and> (\<forall>S\<in>X. x \<in> S)"
     by auto
 qed
 end
 
 instance set :: (type) complete_boolean_algebra ..
 
 instantiation "fun" :: (type, complete_distrib_lattice) complete_distrib_lattice
 begin
 instance by standard (simp add: le_fun_def INF_SUP_set image_comp)
 end
 
 instance "fun" :: (type, complete_boolean_algebra) complete_boolean_algebra ..
 
 context complete_linorder
 begin
 
 subclass complete_distrib_lattice
 proof (standard, rule ccontr)
   fix A :: "'a set set"
   let ?F = "{f ` A |f. \<forall>Y\<in>A. f Y \<in> Y}"
   assume "\<not> \<Sqinter>(Sup ` A) \<le> \<Squnion>(Inf ` ?F)"
   then have C: "\<Sqinter>(Sup ` A) > \<Squnion>(Inf ` ?F)"
     by (simp add: not_le)
   show False
   proof (cases "\<exists> z . \<Sqinter>(Sup ` A) > z \<and> z > \<Squnion>(Inf ` ?F)")
     case True
     then obtain z where A: "z < \<Sqinter>(Sup ` A)" and X: "z > \<Squnion>(Inf ` ?F)"
       by blast
     then have B: "\<And>Y. Y \<in> A \<Longrightarrow> \<exists>k \<in>Y . z < k"
       using local.less_Sup_iff by(force dest: less_INF_D)
 
     define G where "G \<equiv> \<lambda>Y. SOME k . k \<in> Y \<and> z < k"
     have E: "\<And>Y. Y \<in> A \<Longrightarrow> G Y \<in> Y"
       using B unfolding G_def by (fastforce intro: someI2_ex)
     have "z \<le> Inf (G ` A)"
     proof (rule INF_greatest)
       show  "\<And>Y. Y \<in> A \<Longrightarrow> z \<le> G Y"
         using B unfolding G_def by (fastforce intro: someI2_ex)
     qed
     also have "... \<le> \<Squnion>(Inf ` ?F)"
       by (rule SUP_upper) (use E in blast)
     finally have "z \<le> \<Squnion>(Inf ` ?F)"
       by simp
 
     with X show ?thesis
       using local.not_less by blast
   next
     case False
     have B: "\<And>Y. Y \<in> A \<Longrightarrow> \<exists> k \<in>Y . \<Squnion>(Inf ` ?F) < k"
       using C local.less_Sup_iff by(force dest: less_INF_D)
     define G where "G \<equiv> \<lambda> Y . SOME k . k \<in> Y \<and> \<Squnion>(Inf ` ?F) < k"
     have E: "\<And>Y. Y \<in> A \<Longrightarrow> G Y \<in> Y"
       using B unfolding G_def by (fastforce intro: someI2_ex)
     have "\<And>Y. Y \<in> A \<Longrightarrow> \<Sqinter>(Sup ` A) \<le> G Y"
       using B False local.leI unfolding G_def by (fastforce intro: someI2_ex)
     then have "\<Sqinter>(Sup ` A) \<le> Inf (G ` A)"
       by (simp add: local.INF_greatest)
     also have "Inf (G ` A) \<le> \<Squnion>(Inf ` ?F)"
       by (rule SUP_upper) (use E in blast)
     finally have "\<Sqinter>(Sup ` A) \<le> \<Squnion>(Inf ` ?F)"
       by simp
     with C show ?thesis
       using not_less by blast
   qed
 qed
 end
 
 
 
 end
diff --git a/src/HOL/Library/Permutations.thy b/src/HOL/Library/Permutations.thy
--- a/src/HOL/Library/Permutations.thy
+++ b/src/HOL/Library/Permutations.thy
@@ -1,1499 +1,1472 @@
 (*  Title:      HOL/Library/Permutations.thy
     Author:     Amine Chaieb, University of Cambridge
 *)
 
 section \<open>Permutations, both general and specifically on finite sets.\<close>
 
 theory Permutations
   imports Multiset Disjoint_Sets
 begin
 
-subsection \<open>Transpositions\<close>
-
-lemma swap_id_idempotent [simp]: "Fun.swap a b id \<circ> Fun.swap a b id = id"
-  by (rule ext) (auto simp add: Fun.swap_def)
-
-lemma inv_swap_id: "inv (Fun.swap a b id) = Fun.swap a b id"
-  by (rule inv_unique_comp) simp_all
-
-lemma swap_id_eq: "Fun.swap a b id x = (if x = a then b else if x = b then a else x)"
-  by (simp add: Fun.swap_def)
-
-lemma bij_swap_comp:
-  assumes "bij p"
-  shows "Fun.swap a b id \<circ> p = Fun.swap (inv p a) (inv p b) p"
-  using surj_f_inv_f[OF bij_is_surj[OF \<open>bij p\<close>]]
-  by (simp add: fun_eq_iff Fun.swap_def bij_inv_eq_iff[OF \<open>bij p\<close>])
-
-lemma bij_swap_compose_bij:
-  assumes "bij p"
-  shows "bij (Fun.swap a b id \<circ> p)"
-  by (simp only: bij_swap_comp[OF \<open>bij p\<close>] bij_swap_iff \<open>bij p\<close>)
-
-
-subsection \<open>Basic consequences of the definition\<close>
+subsection \<open>Basic definition and consequences\<close>
 
 definition permutes  (infixr "permutes" 41)
   where "(p permutes S) \<longleftrightarrow> (\<forall>x. x \<notin> S \<longrightarrow> p x = x) \<and> (\<forall>y. \<exists>!x. p x = y)"
 
 lemma permutes_in_image: "p permutes S \<Longrightarrow> p x \<in> S \<longleftrightarrow> x \<in> S"
   unfolding permutes_def by metis
 
 lemma permutes_not_in: "f permutes S \<Longrightarrow> x \<notin> S \<Longrightarrow> f x = x"
   by (auto simp: permutes_def)
 
 lemma permutes_image: "p permutes S \<Longrightarrow> p ` S = S"
   unfolding permutes_def
   apply (rule set_eqI)
   apply (simp add: image_iff)
   apply metis
   done
 
 lemma permutes_inj: "p permutes S \<Longrightarrow> inj p"
   unfolding permutes_def inj_def by blast
 
 lemma permutes_inj_on: "f permutes S \<Longrightarrow> inj_on f A"
   by (auto simp: permutes_def inj_on_def)
 
 lemma permutes_surj: "p permutes s \<Longrightarrow> surj p"
   unfolding permutes_def surj_def by metis
 
 lemma permutes_bij: "p permutes s \<Longrightarrow> bij p"
   unfolding bij_def by (metis permutes_inj permutes_surj)
 
 lemma permutes_imp_bij: "p permutes S \<Longrightarrow> bij_betw p S S"
   by (metis UNIV_I bij_betw_subset permutes_bij permutes_image subsetI)
 
 lemma bij_imp_permutes: "bij_betw p S S \<Longrightarrow> (\<And>x. x \<notin> S \<Longrightarrow> p x = x) \<Longrightarrow> p permutes S"
   unfolding permutes_def bij_betw_def inj_on_def
   by auto (metis image_iff)+
 
 lemma permutes_inv_o:
   assumes permutes: "p permutes S"
   shows "p \<circ> inv p = id"
     and "inv p \<circ> p = id"
   using permutes_inj[OF permutes] permutes_surj[OF permutes]
   unfolding inj_iff[symmetric] surj_iff[symmetric] by blast+
 
 lemma permutes_inverses:
   fixes p :: "'a \<Rightarrow> 'a"
   assumes permutes: "p permutes S"
   shows "p (inv p x) = x"
     and "inv p (p x) = x"
   using permutes_inv_o[OF permutes, unfolded fun_eq_iff o_def] by auto
 
 lemma permutes_subset: "p permutes S \<Longrightarrow> S \<subseteq> T \<Longrightarrow> p permutes T"
   unfolding permutes_def by blast
 
 lemma permutes_empty[simp]: "p permutes {} \<longleftrightarrow> p = id"
   by (auto simp add: fun_eq_iff permutes_def)
 
 lemma permutes_sing[simp]: "p permutes {a} \<longleftrightarrow> p = id"
   by (simp add: fun_eq_iff permutes_def) metis  (*somewhat slow*)
 
 lemma permutes_univ: "p permutes UNIV \<longleftrightarrow> (\<forall>y. \<exists>!x. p x = y)"
   by (simp add: permutes_def)
 
 lemma permutes_inv_eq: "p permutes S \<Longrightarrow> inv p y = x \<longleftrightarrow> p x = y"
   unfolding permutes_def inv_def
   apply auto
   apply (erule allE[where x=y])
   apply (erule allE[where x=y])
   apply (rule someI_ex)
   apply blast
   apply (rule some1_equality)
   apply blast
   apply blast
   done
 
 lemma permutes_swap_id: "a \<in> S \<Longrightarrow> b \<in> S \<Longrightarrow> Fun.swap a b id permutes S"
   unfolding permutes_def Fun.swap_def fun_upd_def by auto metis
 
 lemma permutes_superset: "p permutes S \<Longrightarrow> (\<forall>x \<in> S - T. p x = x) \<Longrightarrow> p permutes T"
   by (simp add: Ball_def permutes_def) metis
 
 lemma permutes_bij_inv_into: \<^marker>\<open>contributor \<open>Lukas Bulwahn\<close>\<close>
   fixes A :: "'a set"
     and B :: "'b set"
   assumes "p permutes A"
     and "bij_betw f A B"
   shows "(\<lambda>x. if x \<in> B then f (p (inv_into A f x)) else x) permutes B"
 proof (rule bij_imp_permutes)
   from assms have "bij_betw p A A" "bij_betw f A B" "bij_betw (inv_into A f) B A"
     by (auto simp add: permutes_imp_bij bij_betw_inv_into)
   then have "bij_betw (f \<circ> p \<circ> inv_into A f) B B"
     by (simp add: bij_betw_trans)
   then show "bij_betw (\<lambda>x. if x \<in> B then f (p (inv_into A f x)) else x) B B"
     by (subst bij_betw_cong[where g="f \<circ> p \<circ> inv_into A f"]) auto
 next
   fix x
   assume "x \<notin> B"
   then show "(if x \<in> B then f (p (inv_into A f x)) else x) = x" by auto
 qed
 
 lemma permutes_image_mset: \<^marker>\<open>contributor \<open>Lukas Bulwahn\<close>\<close>
   assumes "p permutes A"
   shows "image_mset p (mset_set A) = mset_set A"
   using assms by (metis image_mset_mset_set bij_betw_imp_inj_on permutes_imp_bij permutes_image)
 
 lemma permutes_implies_image_mset_eq: \<^marker>\<open>contributor \<open>Lukas Bulwahn\<close>\<close>
   assumes "p permutes A" "\<And>x. x \<in> A \<Longrightarrow> f x = f' (p x)"
   shows "image_mset f' (mset_set A) = image_mset f (mset_set A)"
 proof -
   have "f x = f' (p x)" if "x \<in># mset_set A" for x
     using assms(2)[of x] that by (cases "finite A") auto
   with assms have "image_mset f (mset_set A) = image_mset (f' \<circ> p) (mset_set A)"
     by (auto intro!: image_mset_cong)
   also have "\<dots> = image_mset f' (image_mset p (mset_set A))"
     by (simp add: image_mset.compositionality)
   also have "\<dots> = image_mset f' (mset_set A)"
   proof -
     from assms permutes_image_mset have "image_mset p (mset_set A) = mset_set A"
       by blast
     then show ?thesis by simp
   qed
   finally show ?thesis ..
 qed
 
 
 subsection \<open>Group properties\<close>
 
 lemma permutes_id: "id permutes S"
   by (simp add: permutes_def)
 
 lemma permutes_compose: "p permutes S \<Longrightarrow> q permutes S \<Longrightarrow> q \<circ> p permutes S"
   unfolding permutes_def o_def by metis
 
 lemma permutes_inv:
   assumes "p permutes S"
   shows "inv p permutes S"
   using assms unfolding permutes_def permutes_inv_eq[OF assms] by metis
 
 lemma permutes_inv_inv:
   assumes "p permutes S"
   shows "inv (inv p) = p"
   unfolding fun_eq_iff permutes_inv_eq[OF assms] permutes_inv_eq[OF permutes_inv[OF assms]]
   by blast
 
 lemma permutes_invI:
   assumes perm: "p permutes S"
     and inv: "\<And>x. x \<in> S \<Longrightarrow> p' (p x) = x"
     and outside: "\<And>x. x \<notin> S \<Longrightarrow> p' x = x"
   shows "inv p = p'"
 proof
   show "inv p x = p' x" for x
   proof (cases "x \<in> S")
     case True
     from assms have "p' x = p' (p (inv p x))"
       by (simp add: permutes_inverses)
     also from permutes_inv[OF perm] True have "\<dots> = inv p x"
       by (subst inv) (simp_all add: permutes_in_image)
     finally show ?thesis ..
   next
     case False
     with permutes_inv[OF perm] show ?thesis
       by (simp_all add: outside permutes_not_in)
   qed
 qed
 
 lemma permutes_vimage: "f permutes A \<Longrightarrow> f -` A = A"
   by (simp add: bij_vimage_eq_inv_image permutes_bij permutes_image[OF permutes_inv])
 
 
 subsection \<open>Mapping permutations with bijections\<close>
 
 lemma bij_betw_permutations:
   assumes "bij_betw f A B"
   shows   "bij_betw (\<lambda>\<pi> x. if x \<in> B then f (\<pi> (inv_into A f x)) else x) 
              {\<pi>. \<pi> permutes A} {\<pi>. \<pi> permutes B}" (is "bij_betw ?f _ _")
 proof -
   let ?g = "(\<lambda>\<pi> x. if x \<in> A then inv_into A f (\<pi> (f x)) else x)"
   show ?thesis
   proof (rule bij_betw_byWitness [of _ ?g], goal_cases)
     case 3
     show ?case using permutes_bij_inv_into[OF _ assms] by auto
   next
     case 4
     have bij_inv: "bij_betw (inv_into A f) B A" by (intro bij_betw_inv_into assms)
     {
       fix \<pi> assume "\<pi> permutes B"
       from permutes_bij_inv_into[OF this bij_inv] and assms
         have "(\<lambda>x. if x \<in> A then inv_into A f (\<pi> (f x)) else x) permutes A"
         by (simp add: inv_into_inv_into_eq cong: if_cong)
     }
     from this show ?case by (auto simp: permutes_inv)
   next
     case 1
     thus ?case using assms
       by (auto simp: fun_eq_iff permutes_not_in permutes_in_image bij_betw_inv_into_left
                dest: bij_betwE)
   next
     case 2
     moreover have "bij_betw (inv_into A f) B A"
       by (intro bij_betw_inv_into assms)
     ultimately show ?case using assms
       by (auto simp: fun_eq_iff permutes_not_in permutes_in_image bij_betw_inv_into_right 
                dest: bij_betwE)
   qed
 qed
 
 lemma bij_betw_derangements:
   assumes "bij_betw f A B"
   shows   "bij_betw (\<lambda>\<pi> x. if x \<in> B then f (\<pi> (inv_into A f x)) else x) 
              {\<pi>. \<pi> permutes A \<and> (\<forall>x\<in>A. \<pi> x \<noteq> x)} {\<pi>. \<pi> permutes B \<and> (\<forall>x\<in>B. \<pi> x \<noteq> x)}" 
            (is "bij_betw ?f _ _")
 proof -
   let ?g = "(\<lambda>\<pi> x. if x \<in> A then inv_into A f (\<pi> (f x)) else x)"
   show ?thesis
   proof (rule bij_betw_byWitness [of _ ?g], goal_cases)
     case 3
     have "?f \<pi> x \<noteq> x" if "\<pi> permutes A" "\<And>x. x \<in> A \<Longrightarrow> \<pi> x \<noteq> x" "x \<in> B" for \<pi> x
       using that and assms by (metis bij_betwE bij_betw_imp_inj_on bij_betw_imp_surj_on
                                      inv_into_f_f inv_into_into permutes_imp_bij)
     with permutes_bij_inv_into[OF _ assms] show ?case by auto
   next
     case 4
     have bij_inv: "bij_betw (inv_into A f) B A" by (intro bij_betw_inv_into assms)
     have "?g \<pi> permutes A" if "\<pi> permutes B" for \<pi>
       using permutes_bij_inv_into[OF that bij_inv] and assms
       by (simp add: inv_into_inv_into_eq cong: if_cong)
     moreover have "?g \<pi> x \<noteq> x" if "\<pi> permutes B" "\<And>x. x \<in> B \<Longrightarrow> \<pi> x \<noteq> x" "x \<in> A" for \<pi> x
       using that and assms by (metis bij_betwE bij_betw_imp_surj_on f_inv_into_f permutes_imp_bij)
     ultimately show ?case by auto
   next
     case 1
     thus ?case using assms
       by (force simp: fun_eq_iff permutes_not_in permutes_in_image bij_betw_inv_into_left
                 dest: bij_betwE)
   next
     case 2
     moreover have "bij_betw (inv_into A f) B A"
       by (intro bij_betw_inv_into assms)
     ultimately show ?case using assms
       by (force simp: fun_eq_iff permutes_not_in permutes_in_image bij_betw_inv_into_right 
                 dest: bij_betwE)
   qed
 qed
 
 
 subsection \<open>The number of permutations on a finite set\<close>
 
 lemma permutes_insert_lemma:
   assumes "p permutes (insert a S)"
   shows "Fun.swap a (p a) id \<circ> p permutes S"
   apply (rule permutes_superset[where S = "insert a S"])
   apply (rule permutes_compose[OF assms])
   apply (rule permutes_swap_id, simp)
   using permutes_in_image[OF assms, of a]
   apply simp
   apply (auto simp add: Ball_def Fun.swap_def)
   done
 
 lemma permutes_insert: "{p. p permutes (insert a S)} =
   (\<lambda>(b, p). Fun.swap a b id \<circ> p) ` {(b, p). b \<in> insert a S \<and> p \<in> {p. p permutes S}}"
 proof -
   have "p permutes insert a S \<longleftrightarrow>
     (\<exists>b q. p = Fun.swap a b id \<circ> q \<and> b \<in> insert a S \<and> q permutes S)" for p
   proof -
     have "\<exists>b q. p = Fun.swap a b id \<circ> q \<and> b \<in> insert a S \<and> q permutes S"
       if p: "p permutes insert a S"
     proof -
       let ?b = "p a"
       let ?q = "Fun.swap a (p a) id \<circ> p"
       have *: "p = Fun.swap a ?b id \<circ> ?q"
         by (simp add: fun_eq_iff o_assoc)
       have **: "?b \<in> insert a S"
         unfolding permutes_in_image[OF p] by simp
       from permutes_insert_lemma[OF p] * ** show ?thesis
        by blast
     qed
     moreover have "p permutes insert a S"
       if bq: "p = Fun.swap a b id \<circ> q" "b \<in> insert a S" "q permutes S" for b q
     proof -
       from permutes_subset[OF bq(3), of "insert a S"] have q: "q permutes insert a S"
         by auto
       have a: "a \<in> insert a S"
         by simp
       from bq(1) permutes_compose[OF q permutes_swap_id[OF a bq(2)]] show ?thesis
         by simp
     qed
     ultimately show ?thesis by blast
   qed
   then show ?thesis by auto
 qed
 
 lemma card_permutations:
   assumes "card S = n"
     and "finite S"
   shows "card {p. p permutes S} = fact n"
   using assms(2,1)
 proof (induct arbitrary: n)
   case empty
   then show ?case by simp
 next
   case (insert x F)
   {
     fix n
     assume card_insert: "card (insert x F) = n"
     let ?xF = "{p. p permutes insert x F}"
     let ?pF = "{p. p permutes F}"
     let ?pF' = "{(b, p). b \<in> insert x F \<and> p \<in> ?pF}"
     let ?g = "(\<lambda>(b, p). Fun.swap x b id \<circ> p)"
     have xfgpF': "?xF = ?g ` ?pF'"
       by (rule permutes_insert[of x F])
     from \<open>x \<notin> F\<close> \<open>finite F\<close> card_insert have Fs: "card F = n - 1"
       by auto
     from \<open>finite F\<close> insert.hyps Fs have pFs: "card ?pF = fact (n - 1)"
       by auto
     then have "finite ?pF"
       by (auto intro: card_ge_0_finite)
     with \<open>finite F\<close> card.insert_remove have pF'f: "finite ?pF'"
       apply (simp only: Collect_case_prod Collect_mem_eq)
       apply (rule finite_cartesian_product)
       apply simp_all
       done
 
     have ginj: "inj_on ?g ?pF'"
     proof -
       {
         fix b p c q
         assume bp: "(b, p) \<in> ?pF'"
         assume cq: "(c, q) \<in> ?pF'"
         assume eq: "?g (b, p) = ?g (c, q)"
         from bp cq have pF: "p permutes F" and qF: "q permutes F"
           by auto
         from pF \<open>x \<notin> F\<close> eq have "b = ?g (b, p) x"
           by (auto simp: permutes_def Fun.swap_def fun_upd_def fun_eq_iff)
         also from qF \<open>x \<notin> F\<close> eq have "\<dots> = ?g (c, q) x"
           by (auto simp: swap_def fun_upd_def fun_eq_iff)
         also from qF \<open>x \<notin> F\<close> have "\<dots> = c"
           by (auto simp: permutes_def Fun.swap_def fun_upd_def fun_eq_iff)
         finally have "b = c" .
         then have "Fun.swap x b id = Fun.swap x c id"
           by simp
         with eq have "Fun.swap x b id \<circ> p = Fun.swap x b id \<circ> q"
           by simp
         then have "Fun.swap x b id \<circ> (Fun.swap x b id \<circ> p) = Fun.swap x b id \<circ> (Fun.swap x b id \<circ> q)"
           by simp
         then have "p = q"
           by (simp add: o_assoc)
         with \<open>b = c\<close> have "(b, p) = (c, q)"
           by simp
       }
       then show ?thesis
         unfolding inj_on_def by blast
     qed
     from \<open>x \<notin> F\<close> \<open>finite F\<close> card_insert have "n \<noteq> 0"
       by auto
     then have "\<exists>m. n = Suc m"
       by presburger
     then obtain m where n: "n = Suc m"
       by blast
     from pFs card_insert have *: "card ?xF = fact n"
       unfolding xfgpF' card_image[OF ginj]
       using \<open>finite F\<close> \<open>finite ?pF\<close>
       by (simp only: Collect_case_prod Collect_mem_eq card_cartesian_product) (simp add: n)
     from finite_imageI[OF pF'f, of ?g] have xFf: "finite ?xF"
       by (simp add: xfgpF' n)
     from * have "card ?xF = fact n"
       unfolding xFf by blast
   }
   with insert show ?case by simp
 qed
 
 lemma finite_permutations:
   assumes "finite S"
   shows "finite {p. p permutes S}"
   using card_permutations[OF refl assms] by (auto intro: card_ge_0_finite)
 
 
 subsection \<open>Permutations of index set for iterated operations\<close>
 
 lemma (in comm_monoid_set) permute:
   assumes "p permutes S"
   shows "F g S = F (g \<circ> p) S"
 proof -
   from \<open>p permutes S\<close> have "inj p"
     by (rule permutes_inj)
   then have "inj_on p S"
     by (auto intro: subset_inj_on)
   then have "F g (p ` S) = F (g \<circ> p) S"
     by (rule reindex)
   moreover from \<open>p permutes S\<close> have "p ` S = S"
     by (rule permutes_image)
   ultimately show ?thesis
     by simp
 qed
 
 
-subsection \<open>Various combinations of transpositions with 2, 1 and 0 common elements\<close>
-
-lemma swap_id_common:" a \<noteq> c \<Longrightarrow> b \<noteq> c \<Longrightarrow>
-  Fun.swap a b id \<circ> Fun.swap a c id = Fun.swap b c id \<circ> Fun.swap a b id"
-  by (simp add: fun_eq_iff Fun.swap_def)
-
-lemma swap_id_common': "a \<noteq> b \<Longrightarrow> a \<noteq> c \<Longrightarrow>
-  Fun.swap a c id \<circ> Fun.swap b c id = Fun.swap b c id \<circ> Fun.swap a b id"
-  by (simp add: fun_eq_iff Fun.swap_def)
-
-lemma swap_id_independent: "a \<noteq> c \<Longrightarrow> a \<noteq> d \<Longrightarrow> b \<noteq> c \<Longrightarrow> b \<noteq> d \<Longrightarrow>
-  Fun.swap a b id \<circ> Fun.swap c d id = Fun.swap c d id \<circ> Fun.swap a b id"
-  by (simp add: fun_eq_iff Fun.swap_def)
-
-
 subsection \<open>Permutations as transposition sequences\<close>
 
 inductive swapidseq :: "nat \<Rightarrow> ('a \<Rightarrow> 'a) \<Rightarrow> bool"
   where
     id[simp]: "swapidseq 0 id"
   | comp_Suc: "swapidseq n p \<Longrightarrow> a \<noteq> b \<Longrightarrow> swapidseq (Suc n) (Fun.swap a b id \<circ> p)"
 
 declare id[unfolded id_def, simp]
 
 definition "permutation p \<longleftrightarrow> (\<exists>n. swapidseq n p)"
 
 
 subsection \<open>Some closure properties of the set of permutations, with lengths\<close>
 
 lemma permutation_id[simp]: "permutation id"
   unfolding permutation_def by (rule exI[where x=0]) simp
 
 declare permutation_id[unfolded id_def, simp]
 
 lemma swapidseq_swap: "swapidseq (if a = b then 0 else 1) (Fun.swap a b id)"
   apply clarsimp
   using comp_Suc[of 0 id a b]
   apply simp
   done
 
 lemma permutation_swap_id: "permutation (Fun.swap a b id)"
 proof (cases "a = b")
   case True
   then show ?thesis by simp
 next
   case False
   then show ?thesis
     unfolding permutation_def
     using swapidseq_swap[of a b] by blast
 qed
 
 
 lemma swapidseq_comp_add: "swapidseq n p \<Longrightarrow> swapidseq m q \<Longrightarrow> swapidseq (n + m) (p \<circ> q)"
 proof (induct n p arbitrary: m q rule: swapidseq.induct)
   case (id m q)
   then show ?case by simp
 next
   case (comp_Suc n p a b m q)
   have eq: "Suc n + m = Suc (n + m)"
     by arith
   show ?case
     apply (simp only: eq comp_assoc)
     apply (rule swapidseq.comp_Suc)
     using comp_Suc.hyps(2)[OF comp_Suc.prems] comp_Suc.hyps(3)
      apply blast+
     done
 qed
 
 lemma permutation_compose: "permutation p \<Longrightarrow> permutation q \<Longrightarrow> permutation (p \<circ> q)"
   unfolding permutation_def using swapidseq_comp_add[of _ p _ q] by metis
 
 lemma swapidseq_endswap: "swapidseq n p \<Longrightarrow> a \<noteq> b \<Longrightarrow> swapidseq (Suc n) (p \<circ> Fun.swap a b id)"
   by (induct n p rule: swapidseq.induct)
     (use swapidseq_swap[of a b] in \<open>auto simp add: comp_assoc intro: swapidseq.comp_Suc\<close>)
 
 lemma swapidseq_inverse_exists: "swapidseq n p \<Longrightarrow> \<exists>q. swapidseq n q \<and> p \<circ> q = id \<and> q \<circ> p = id"
 proof (induct n p rule: swapidseq.induct)
   case id
   then show ?case
     by (rule exI[where x=id]) simp
 next
   case (comp_Suc n p a b)
   from comp_Suc.hyps obtain q where q: "swapidseq n q" "p \<circ> q = id" "q \<circ> p = id"
     by blast
   let ?q = "q \<circ> Fun.swap a b id"
   note H = comp_Suc.hyps
   from swapidseq_swap[of a b] H(3) have *: "swapidseq 1 (Fun.swap a b id)"
     by simp
   from swapidseq_comp_add[OF q(1) *] have **: "swapidseq (Suc n) ?q"
     by simp
   have "Fun.swap a b id \<circ> p \<circ> ?q = Fun.swap a b id \<circ> (p \<circ> q) \<circ> Fun.swap a b id"
     by (simp add: o_assoc)
   also have "\<dots> = id"
     by (simp add: q(2))
   finally have ***: "Fun.swap a b id \<circ> p \<circ> ?q = id" .
   have "?q \<circ> (Fun.swap a b id \<circ> p) = q \<circ> (Fun.swap a b id \<circ> Fun.swap a b id) \<circ> p"
     by (simp only: o_assoc)
   then have "?q \<circ> (Fun.swap a b id \<circ> p) = id"
     by (simp add: q(3))
   with ** *** show ?case
     by blast
 qed
 
 lemma swapidseq_inverse:
   assumes "swapidseq n p"
   shows "swapidseq n (inv p)"
   using swapidseq_inverse_exists[OF assms] inv_unique_comp[of p] by auto
 
 lemma permutation_inverse: "permutation p \<Longrightarrow> permutation (inv p)"
   using permutation_def swapidseq_inverse by blast
 
 
+
+subsection \<open>Various combinations of transpositions with 2, 1 and 0 common elements\<close>
+
+lemma swap_id_common:" a \<noteq> c \<Longrightarrow> b \<noteq> c \<Longrightarrow>
+  Fun.swap a b id \<circ> Fun.swap a c id = Fun.swap b c id \<circ> Fun.swap a b id"
+  by (simp add: fun_eq_iff Fun.swap_def)
+
+lemma swap_id_common': "a \<noteq> b \<Longrightarrow> a \<noteq> c \<Longrightarrow>
+  Fun.swap a c id \<circ> Fun.swap b c id = Fun.swap b c id \<circ> Fun.swap a b id"
+  by (simp add: fun_eq_iff Fun.swap_def)
+
+lemma swap_id_independent: "a \<noteq> c \<Longrightarrow> a \<noteq> d \<Longrightarrow> b \<noteq> c \<Longrightarrow> b \<noteq> d \<Longrightarrow>
+  Fun.swap a b id \<circ> Fun.swap c d id = Fun.swap c d id \<circ> Fun.swap a b id"
+  by (simp add: fun_eq_iff Fun.swap_def)
+
+
 subsection \<open>The identity map only has even transposition sequences\<close>
 
 lemma symmetry_lemma:
   assumes "\<And>a b c d. P a b c d \<Longrightarrow> P a b d c"
     and "\<And>a b c d. a \<noteq> b \<Longrightarrow> c \<noteq> d \<Longrightarrow>
       a = c \<and> b = d \<or> a = c \<and> b \<noteq> d \<or> a \<noteq> c \<and> b = d \<or> a \<noteq> c \<and> a \<noteq> d \<and> b \<noteq> c \<and> b \<noteq> d \<Longrightarrow>
       P a b c d"
   shows "\<And>a b c d. a \<noteq> b \<longrightarrow> c \<noteq> d \<longrightarrow>  P a b c d"
   using assms by metis
 
 lemma swap_general: "a \<noteq> b \<Longrightarrow> c \<noteq> d \<Longrightarrow>
   Fun.swap a b id \<circ> Fun.swap c d id = id \<or>
   (\<exists>x y z. x \<noteq> a \<and> y \<noteq> a \<and> z \<noteq> a \<and> x \<noteq> y \<and>
     Fun.swap a b id \<circ> Fun.swap c d id = Fun.swap x y id \<circ> Fun.swap a z id)"
 proof -
   assume neq: "a \<noteq> b" "c \<noteq> d"
   have "a \<noteq> b \<longrightarrow> c \<noteq> d \<longrightarrow>
     (Fun.swap a b id \<circ> Fun.swap c d id = id \<or>
       (\<exists>x y z. x \<noteq> a \<and> y \<noteq> a \<and> z \<noteq> a \<and> x \<noteq> y \<and>
         Fun.swap a b id \<circ> Fun.swap c d id = Fun.swap x y id \<circ> Fun.swap a z id))"
     apply (rule symmetry_lemma[where a=a and b=b and c=c and d=d])
      apply (simp_all only: swap_commute)
     apply (case_tac "a = c \<and> b = d")
      apply (clarsimp simp only: swap_commute swap_id_idempotent)
     apply (case_tac "a = c \<and> b \<noteq> d")
      apply (rule disjI2)
      apply (rule_tac x="b" in exI)
      apply (rule_tac x="d" in exI)
      apply (rule_tac x="b" in exI)
      apply (clarsimp simp add: fun_eq_iff Fun.swap_def)
     apply (case_tac "a \<noteq> c \<and> b = d")
      apply (rule disjI2)
      apply (rule_tac x="c" in exI)
      apply (rule_tac x="d" in exI)
      apply (rule_tac x="c" in exI)
      apply (clarsimp simp add: fun_eq_iff Fun.swap_def)
     apply (rule disjI2)
     apply (rule_tac x="c" in exI)
     apply (rule_tac x="d" in exI)
     apply (rule_tac x="b" in exI)
     apply (clarsimp simp add: fun_eq_iff Fun.swap_def)
     done
   with neq show ?thesis by metis
 qed
 
 lemma swapidseq_id_iff[simp]: "swapidseq 0 p \<longleftrightarrow> p = id"
   using swapidseq.cases[of 0 p "p = id"] by auto
 
 lemma swapidseq_cases: "swapidseq n p \<longleftrightarrow>
     n = 0 \<and> p = id \<or> (\<exists>a b q m. n = Suc m \<and> p = Fun.swap a b id \<circ> q \<and> swapidseq m q \<and> a \<noteq> b)"
   apply (rule iffI)
    apply (erule swapidseq.cases[of n p])
     apply simp
    apply (rule disjI2)
    apply (rule_tac x= "a" in exI)
    apply (rule_tac x= "b" in exI)
    apply (rule_tac x= "pa" in exI)
    apply (rule_tac x= "na" in exI)
    apply simp
   apply auto
   apply (rule comp_Suc, simp_all)
   done
 
 lemma fixing_swapidseq_decrease:
   assumes "swapidseq n p"
     and "a \<noteq> b"
     and "(Fun.swap a b id \<circ> p) a = a"
   shows "n \<noteq> 0 \<and> swapidseq (n - 1) (Fun.swap a b id \<circ> p)"
   using assms
 proof (induct n arbitrary: p a b)
   case 0
   then show ?case
     by (auto simp add: Fun.swap_def fun_upd_def)
 next
   case (Suc n p a b)
   from Suc.prems(1) swapidseq_cases[of "Suc n" p]
   obtain c d q m where
     cdqm: "Suc n = Suc m" "p = Fun.swap c d id \<circ> q" "swapidseq m q" "c \<noteq> d" "n = m"
     by auto
   consider "Fun.swap a b id \<circ> Fun.swap c d id = id"
     | x y z where "x \<noteq> a" "y \<noteq> a" "z \<noteq> a" "x \<noteq> y"
       "Fun.swap a b id \<circ> Fun.swap c d id = Fun.swap x y id \<circ> Fun.swap a z id"
     using swap_general[OF Suc.prems(2) cdqm(4)] by metis
   then show ?case
   proof cases
     case 1
     then show ?thesis
       by (simp only: cdqm o_assoc) (simp add: cdqm)
   next
     case prems: 2
     then have az: "a \<noteq> z"
       by simp
     from prems have *: "(Fun.swap x y id \<circ> h) a = a \<longleftrightarrow> h a = a" for h
       by (simp add: Fun.swap_def)
     from cdqm(2) have "Fun.swap a b id \<circ> p = Fun.swap a b id \<circ> (Fun.swap c d id \<circ> q)"
       by simp
     then have "Fun.swap a b id \<circ> p = Fun.swap x y id \<circ> (Fun.swap a z id \<circ> q)"
       by (simp add: o_assoc prems)
     then have "(Fun.swap a b id \<circ> p) a = (Fun.swap x y id \<circ> (Fun.swap a z id \<circ> q)) a"
       by simp
     then have "(Fun.swap x y id \<circ> (Fun.swap a z id \<circ> q)) a = a"
       unfolding Suc by metis
     then have "(Fun.swap a z id \<circ> q) a = a"
       by (simp only: *)
     from Suc.hyps[OF cdqm(3)[ unfolded cdqm(5)[symmetric]] az this]
     have **: "swapidseq (n - 1) (Fun.swap a z id \<circ> q)" "n \<noteq> 0"
       by blast+
     from \<open>n \<noteq> 0\<close> have ***: "Suc n - 1 = Suc (n - 1)"
       by auto
     show ?thesis
       apply (simp only: cdqm(2) prems o_assoc ***)
       apply (simp only: Suc_not_Zero simp_thms comp_assoc)
       apply (rule comp_Suc)
       using ** prems
        apply blast+
       done
   qed
 qed
 
 lemma swapidseq_identity_even:
   assumes "swapidseq n (id :: 'a \<Rightarrow> 'a)"
   shows "even n"
   using \<open>swapidseq n id\<close>
 proof (induct n rule: nat_less_induct)
   case H: (1 n)
   consider "n = 0"
     | a b :: 'a and q m where "n = Suc m" "id = Fun.swap a b id \<circ> q" "swapidseq m q" "a \<noteq> b"
     using H(2)[unfolded swapidseq_cases[of n id]] by auto
   then show ?case
   proof cases
     case 1
     then show ?thesis by presburger
   next
     case h: 2
     from fixing_swapidseq_decrease[OF h(3,4), unfolded h(2)[symmetric]]
     have m: "m \<noteq> 0" "swapidseq (m - 1) (id :: 'a \<Rightarrow> 'a)"
       by auto
     from h m have mn: "m - 1 < n"
       by arith
     from H(1)[rule_format, OF mn m(2)] h(1) m(1) show ?thesis
       by presburger
   qed
 qed
 
 
 subsection \<open>Therefore we have a welldefined notion of parity\<close>
 
 definition "evenperm p = even (SOME n. swapidseq n p)"
 
 lemma swapidseq_even_even:
   assumes m: "swapidseq m p"
     and n: "swapidseq n p"
   shows "even m \<longleftrightarrow> even n"
 proof -
   from swapidseq_inverse_exists[OF n] obtain q where q: "swapidseq n q" "p \<circ> q = id" "q \<circ> p = id"
     by blast
   from swapidseq_identity_even[OF swapidseq_comp_add[OF m q(1), unfolded q]] show ?thesis
     by arith
 qed
 
 lemma evenperm_unique:
   assumes p: "swapidseq n p"
     and n:"even n = b"
   shows "evenperm p = b"
   unfolding n[symmetric] evenperm_def
   apply (rule swapidseq_even_even[where p = p])
    apply (rule someI[where x = n])
   using p
    apply blast+
   done
 
 
 subsection \<open>And it has the expected composition properties\<close>
 
 lemma evenperm_id[simp]: "evenperm id = True"
   by (rule evenperm_unique[where n = 0]) simp_all
 
 lemma evenperm_swap: "evenperm (Fun.swap a b id) = (a = b)"
   by (rule evenperm_unique[where n="if a = b then 0 else 1"]) (simp_all add: swapidseq_swap)
 
 lemma evenperm_comp:
   assumes "permutation p" "permutation q"
   shows "evenperm (p \<circ> q) \<longleftrightarrow> evenperm p = evenperm q"
 proof -
   from assms obtain n m where n: "swapidseq n p" and m: "swapidseq m q"
     unfolding permutation_def by blast
   have "even (n + m) \<longleftrightarrow> (even n \<longleftrightarrow> even m)"
     by arith
   from evenperm_unique[OF n refl] evenperm_unique[OF m refl]
     and evenperm_unique[OF swapidseq_comp_add[OF n m] this] show ?thesis
     by blast
 qed
 
 lemma evenperm_inv:
   assumes "permutation p"
   shows "evenperm (inv p) = evenperm p"
 proof -
   from assms obtain n where n: "swapidseq n p"
     unfolding permutation_def by blast
   show ?thesis
     by (rule evenperm_unique[OF swapidseq_inverse[OF n] evenperm_unique[OF n refl, symmetric]])
 qed
 
 
 subsection \<open>A more abstract characterization of permutations\<close>
 
-lemma bij_iff: "bij f \<longleftrightarrow> (\<forall>x. \<exists>!y. f y = x)"
-  unfolding bij_def inj_def surj_def
-  apply auto
-   apply metis
-  apply metis
-  done
-
 lemma permutation_bijective:
   assumes "permutation p"
   shows "bij p"
 proof -
   from assms obtain n where n: "swapidseq n p"
     unfolding permutation_def by blast
   from swapidseq_inverse_exists[OF n] obtain q where q: "swapidseq n q" "p \<circ> q = id" "q \<circ> p = id"
     by blast
   then show ?thesis
     unfolding bij_iff
     apply (auto simp add: fun_eq_iff)
     apply metis
     done
 qed
 
 lemma permutation_finite_support:
   assumes "permutation p"
   shows "finite {x. p x \<noteq> x}"
 proof -
   from assms obtain n where "swapidseq n p"
     unfolding permutation_def by blast
   then show ?thesis
   proof (induct n p rule: swapidseq.induct)
     case id
     then show ?case by simp
   next
     case (comp_Suc n p a b)
     let ?S = "insert a (insert b {x. p x \<noteq> x})"
     from comp_Suc.hyps(2) have *: "finite ?S"
       by simp
     from \<open>a \<noteq> b\<close> have **: "{x. (Fun.swap a b id \<circ> p) x \<noteq> x} \<subseteq> ?S"
       by (auto simp: Fun.swap_def)
     show ?case
       by (rule finite_subset[OF ** *])
   qed
 qed
 
 lemma permutation_lemma:
   assumes "finite S"
     and "bij p"
-    and "\<forall>x. x\<notin> S \<longrightarrow> p x = x"
+    and "\<forall>x. x \<notin> S \<longrightarrow> p x = x"
   shows "permutation p"
   using assms
 proof (induct S arbitrary: p rule: finite_induct)
   case empty
   then show ?case
     by simp
 next
   case (insert a F p)
   let ?r = "Fun.swap a (p a) id \<circ> p"
   let ?q = "Fun.swap a (p a) id \<circ> ?r"
   have *: "?r a = a"
     by (simp add: Fun.swap_def)
   from insert * have **: "\<forall>x. x \<notin> F \<longrightarrow> ?r x = x"
     by (metis bij_pointE comp_apply id_apply insert_iff swap_apply(3))
   have "bij ?r"
     by (rule bij_swap_compose_bij[OF insert(4)])
   have "permutation ?r"
     by (rule insert(3)[OF \<open>bij ?r\<close> **])
   then have "permutation ?q"
     by (simp add: permutation_compose permutation_swap_id)
   then show ?case
     by (simp add: o_assoc)
 qed
 
 lemma permutation: "permutation p \<longleftrightarrow> bij p \<and> finite {x. p x \<noteq> x}"
   (is "?lhs \<longleftrightarrow> ?b \<and> ?f")
 proof
   assume ?lhs
   with permutation_bijective permutation_finite_support show "?b \<and> ?f"
     by auto
 next
   assume "?b \<and> ?f"
   then have "?f" "?b" by blast+
   from permutation_lemma[OF this] show ?lhs
     by blast
 qed
 
 lemma permutation_inverse_works:
   assumes "permutation p"
   shows "inv p \<circ> p = id"
     and "p \<circ> inv p = id"
   using permutation_bijective [OF assms] by (auto simp: bij_def inj_iff surj_iff)
 
 lemma permutation_inverse_compose:
   assumes p: "permutation p"
     and q: "permutation q"
   shows "inv (p \<circ> q) = inv q \<circ> inv p"
 proof -
   note ps = permutation_inverse_works[OF p]
   note qs = permutation_inverse_works[OF q]
   have "p \<circ> q \<circ> (inv q \<circ> inv p) = p \<circ> (q \<circ> inv q) \<circ> inv p"
     by (simp add: o_assoc)
   also have "\<dots> = id"
     by (simp add: ps qs)
   finally have *: "p \<circ> q \<circ> (inv q \<circ> inv p) = id" .
   have "inv q \<circ> inv p \<circ> (p \<circ> q) = inv q \<circ> (inv p \<circ> p) \<circ> q"
     by (simp add: o_assoc)
   also have "\<dots> = id"
     by (simp add: ps qs)
   finally have **: "inv q \<circ> inv p \<circ> (p \<circ> q) = id" .
   show ?thesis
     by (rule inv_unique_comp[OF * **])
 qed
 
 
 subsection \<open>Relation to \<open>permutes\<close>\<close>
 
 lemma permutation_permutes: "permutation p \<longleftrightarrow> (\<exists>S. finite S \<and> p permutes S)"
   unfolding permutation permutes_def bij_iff[symmetric]
   apply (rule iffI, clarify)
    apply (rule exI[where x="{x. p x \<noteq> x}"])
    apply simp
   apply clarsimp
   apply (rule_tac B="S" in finite_subset)
    apply auto
   done
 
 
 subsection \<open>Hence a sort of induction principle composing by swaps\<close>
 
-lemma permutes_induct: "finite S \<Longrightarrow> P id \<Longrightarrow>
-  (\<And>a b p. a \<in> S \<Longrightarrow> b \<in> S \<Longrightarrow> P p \<Longrightarrow> P p \<Longrightarrow> permutation p \<Longrightarrow> P (Fun.swap a b id \<circ> p)) \<Longrightarrow>
-  (\<And>p. p permutes S \<Longrightarrow> P p)"
-proof (induct S rule: finite_induct)
+lemma permutes_induct [consumes 2, case_names id swap]:
+  \<open>P p\<close> if \<open>p permutes S\<close> \<open>finite S\<close>
+  and id: \<open>P id\<close>
+  and swap: \<open>\<And>a b p. a \<in> S \<Longrightarrow> b \<in> S \<Longrightarrow> permutation p \<Longrightarrow> P p \<Longrightarrow> P (Fun.swap a b id \<circ> p)\<close>
+using \<open>finite S\<close> \<open>p permutes S\<close> id swap proof (induction S arbitrary: p)
   case empty
   then show ?case by auto
 next
   case (insert x F p)
   let ?r = "Fun.swap x (p x) id \<circ> p"
   let ?q = "Fun.swap x (p x) id \<circ> ?r"
   have qp: "?q = p"
     by (simp add: o_assoc)
-  from permutes_insert_lemma[OF insert.prems(3)] insert have Pr: "P ?r"
+  from permutes_insert_lemma[OF \<open>p permutes insert x F\<close>] insert have Pr: "P ?r"
     by blast
-  from permutes_in_image[OF insert.prems(3), of x]
+  from permutes_in_image[OF \<open>p permutes insert x F\<close>, of x]
   have pxF: "p x \<in> insert x F"
     by simp
   have xF: "x \<in> insert x F"
     by simp
   have rp: "permutation ?r"
     unfolding permutation_permutes
-    using insert.hyps(1) permutes_insert_lemma[OF insert.prems(3)]
+    using insert.hyps(1) permutes_insert_lemma[OF \<open>p permutes insert x F\<close>]
     by blast
-  from insert.prems(2)[OF xF pxF Pr Pr rp] qp show ?case
+  from insert.prems(3)[OF xF pxF rp Pr] qp show ?case
     by (simp only:)
 qed
 
 
 subsection \<open>Sign of a permutation as a real number\<close>
 
-definition "sign p = (if evenperm p then (1::int) else -1)"
+definition sign :: \<open>('a \<Rightarrow> 'a) \<Rightarrow> int\<close> \<comment> \<open>TODO: prefer less generic name\<close>
+  where \<open>sign p = (if evenperm p then (1::int) else -1)\<close>
 
 lemma sign_nz: "sign p \<noteq> 0"
   by (simp add: sign_def)
 
 lemma sign_id: "sign id = 1"
   by (simp add: sign_def)
 
 lemma sign_inverse: "permutation p \<Longrightarrow> sign (inv p) = sign p"
   by (simp add: sign_def evenperm_inv)
 
 lemma sign_compose: "permutation p \<Longrightarrow> permutation q \<Longrightarrow> sign (p \<circ> q) = sign p * sign q"
   by (simp add: sign_def evenperm_comp)
 
 lemma sign_swap_id: "sign (Fun.swap a b id) = (if a = b then 1 else -1)"
   by (simp add: sign_def evenperm_swap)
 
 lemma sign_idempotent: "sign p * sign p = 1"
   by (simp add: sign_def)
 
 
 subsection \<open>Permuting a list\<close>
 
 text \<open>This function permutes a list by applying a permutation to the indices.\<close>
 
 definition permute_list :: "(nat \<Rightarrow> nat) \<Rightarrow> 'a list \<Rightarrow> 'a list"
   where "permute_list f xs = map (\<lambda>i. xs ! (f i)) [0..<length xs]"
 
 lemma permute_list_map:
   assumes "f permutes {..<length xs}"
   shows "permute_list f (map g xs) = map g (permute_list f xs)"
   using permutes_in_image[OF assms] by (auto simp: permute_list_def)
 
 lemma permute_list_nth:
   assumes "f permutes {..<length xs}" "i < length xs"
   shows "permute_list f xs ! i = xs ! f i"
   using permutes_in_image[OF assms(1)] assms(2)
   by (simp add: permute_list_def)
 
 lemma permute_list_Nil [simp]: "permute_list f [] = []"
   by (simp add: permute_list_def)
 
 lemma length_permute_list [simp]: "length (permute_list f xs) = length xs"
   by (simp add: permute_list_def)
 
 lemma permute_list_compose:
   assumes "g permutes {..<length xs}"
   shows "permute_list (f \<circ> g) xs = permute_list g (permute_list f xs)"
   using assms[THEN permutes_in_image] by (auto simp add: permute_list_def)
 
 lemma permute_list_ident [simp]: "permute_list (\<lambda>x. x) xs = xs"
   by (simp add: permute_list_def map_nth)
 
 lemma permute_list_id [simp]: "permute_list id xs = xs"
   by (simp add: id_def)
 
 lemma mset_permute_list [simp]:
   fixes xs :: "'a list"
   assumes "f permutes {..<length xs}"
   shows "mset (permute_list f xs) = mset xs"
 proof (rule multiset_eqI)
   fix y :: 'a
   from assms have [simp]: "f x < length xs \<longleftrightarrow> x < length xs" for x
     using permutes_in_image[OF assms] by auto
   have "count (mset (permute_list f xs)) y = card ((\<lambda>i. xs ! f i) -` {y} \<inter> {..<length xs})"
     by (simp add: permute_list_def count_image_mset atLeast0LessThan)
   also have "(\<lambda>i. xs ! f i) -` {y} \<inter> {..<length xs} = f -` {i. i < length xs \<and> y = xs ! i}"
     by auto
   also from assms have "card \<dots> = card {i. i < length xs \<and> y = xs ! i}"
     by (intro card_vimage_inj) (auto simp: permutes_inj permutes_surj)
   also have "\<dots> = count (mset xs) y"
     by (simp add: count_mset length_filter_conv_card)
   finally show "count (mset (permute_list f xs)) y = count (mset xs) y"
     by simp
 qed
 
 lemma set_permute_list [simp]:
   assumes "f permutes {..<length xs}"
   shows "set (permute_list f xs) = set xs"
   by (rule mset_eq_setD[OF mset_permute_list]) fact
 
 lemma distinct_permute_list [simp]:
   assumes "f permutes {..<length xs}"
   shows "distinct (permute_list f xs) = distinct xs"
   by (simp add: distinct_count_atmost_1 assms)
 
 lemma permute_list_zip:
   assumes "f permutes A" "A = {..<length xs}"
   assumes [simp]: "length xs = length ys"
   shows "permute_list f (zip xs ys) = zip (permute_list f xs) (permute_list f ys)"
 proof -
   from permutes_in_image[OF assms(1)] assms(2) have *: "f i < length ys \<longleftrightarrow> i < length ys" for i
     by simp
   have "permute_list f (zip xs ys) = map (\<lambda>i. zip xs ys ! f i) [0..<length ys]"
     by (simp_all add: permute_list_def zip_map_map)
   also have "\<dots> = map (\<lambda>(x, y). (xs ! f x, ys ! f y)) (zip [0..<length ys] [0..<length ys])"
     by (intro nth_equalityI) (simp_all add: *)
   also have "\<dots> = zip (permute_list f xs) (permute_list f ys)"
     by (simp_all add: permute_list_def zip_map_map)
   finally show ?thesis .
 qed
 
 lemma map_of_permute:
   assumes "\<sigma> permutes fst ` set xs"
   shows "map_of xs \<circ> \<sigma> = map_of (map (\<lambda>(x,y). (inv \<sigma> x, y)) xs)"
     (is "_ = map_of (map ?f _)")
 proof
   from assms have "inj \<sigma>" "surj \<sigma>"
     by (simp_all add: permutes_inj permutes_surj)
   then show "(map_of xs \<circ> \<sigma>) x = map_of (map ?f xs) x" for x
     by (induct xs) (auto simp: inv_f_f surj_f_inv_f)
 qed
 
 
 subsection \<open>More lemmas about permutations\<close>
 
 text \<open>The following few lemmas were contributed by Lukas Bulwahn.\<close>
 
 lemma count_image_mset_eq_card_vimage:
   assumes "finite A"
   shows "count (image_mset f (mset_set A)) b = card {a \<in> A. f a = b}"
   using assms
 proof (induct A)
   case empty
   show ?case by simp
 next
   case (insert x F)
   show ?case
   proof (cases "f x = b")
     case True
     with insert.hyps
     have "count (image_mset f (mset_set (insert x F))) b = Suc (card {a \<in> F. f a = f x})"
       by auto
     also from insert.hyps(1,2) have "\<dots> = card (insert x {a \<in> F. f a = f x})"
       by simp
     also from \<open>f x = b\<close> have "card (insert x {a \<in> F. f a = f x}) = card {a \<in> insert x F. f a = b}"
       by (auto intro: arg_cong[where f="card"])
     finally show ?thesis
       using insert by auto
   next
     case False
     then have "{a \<in> F. f a = b} = {a \<in> insert x F. f a = b}"
       by auto
     with insert False show ?thesis
       by simp
   qed
 qed
 
 \<comment> \<open>Prove \<open>image_mset_eq_implies_permutes\<close> ...\<close>
 lemma image_mset_eq_implies_permutes:
   fixes f :: "'a \<Rightarrow> 'b"
   assumes "finite A"
     and mset_eq: "image_mset f (mset_set A) = image_mset f' (mset_set A)"
   obtains p where "p permutes A" and "\<forall>x\<in>A. f x = f' (p x)"
 proof -
   from \<open>finite A\<close> have [simp]: "finite {a \<in> A. f a = (b::'b)}" for f b by auto
   have "f ` A = f' ` A"
   proof -
     from \<open>finite A\<close> have "f ` A = f ` (set_mset (mset_set A))"
       by simp
     also have "\<dots> = f' ` set_mset (mset_set A)"
       by (metis mset_eq multiset.set_map)
     also from \<open>finite A\<close> have "\<dots> = f' ` A"
       by simp
     finally show ?thesis .
   qed
   have "\<forall>b\<in>(f ` A). \<exists>p. bij_betw p {a \<in> A. f a = b} {a \<in> A. f' a = b}"
   proof
     fix b
     from mset_eq have "count (image_mset f (mset_set A)) b = count (image_mset f' (mset_set A)) b"
       by simp
     with \<open>finite A\<close> have "card {a \<in> A. f a = b} = card {a \<in> A. f' a = b}"
       by (simp add: count_image_mset_eq_card_vimage)
     then show "\<exists>p. bij_betw p {a\<in>A. f a = b} {a \<in> A. f' a = b}"
       by (intro finite_same_card_bij) simp_all
   qed
   then have "\<exists>p. \<forall>b\<in>f ` A. bij_betw (p b) {a \<in> A. f a = b} {a \<in> A. f' a = b}"
     by (rule bchoice)
   then obtain p where p: "\<forall>b\<in>f ` A. bij_betw (p b) {a \<in> A. f a = b} {a \<in> A. f' a = b}" ..
   define p' where "p' = (\<lambda>a. if a \<in> A then p (f a) a else a)"
   have "p' permutes A"
   proof (rule bij_imp_permutes)
     have "disjoint_family_on (\<lambda>i. {a \<in> A. f' a = i}) (f ` A)"
       by (auto simp: disjoint_family_on_def)
     moreover
     have "bij_betw (\<lambda>a. p (f a) a) {a \<in> A. f a = b} {a \<in> A. f' a = b}" if "b \<in> f ` A" for b
       using p that by (subst bij_betw_cong[where g="p b"]) auto
     ultimately
     have "bij_betw (\<lambda>a. p (f a) a) (\<Union>b\<in>f ` A. {a \<in> A. f a = b}) (\<Union>b\<in>f ` A. {a \<in> A. f' a = b})"
       by (rule bij_betw_UNION_disjoint)
     moreover have "(\<Union>b\<in>f ` A. {a \<in> A. f a = b}) = A"
       by auto
     moreover from \<open>f ` A = f' ` A\<close> have "(\<Union>b\<in>f ` A. {a \<in> A. f' a = b}) = A"
       by auto
     ultimately show "bij_betw p' A A"
       unfolding p'_def by (subst bij_betw_cong[where g="(\<lambda>a. p (f a) a)"]) auto
   next
     show "\<And>x. x \<notin> A \<Longrightarrow> p' x = x"
       by (simp add: p'_def)
   qed
   moreover from p have "\<forall>x\<in>A. f x = f' (p' x)"
     unfolding p'_def using bij_betwE by fastforce
   ultimately show ?thesis ..
 qed
 
 lemma mset_set_upto_eq_mset_upto: "mset_set {..<n} = mset [0..<n]"
   by (induct n) (auto simp: add.commute lessThan_Suc)
 
 \<comment> \<open>... and derive the existing property:\<close>
 lemma mset_eq_permutation:
   fixes xs ys :: "'a list"
   assumes mset_eq: "mset xs = mset ys"
   obtains p where "p permutes {..<length ys}" "permute_list p ys = xs"
 proof -
   from mset_eq have length_eq: "length xs = length ys"
     by (rule mset_eq_length)
   have "mset_set {..<length ys} = mset [0..<length ys]"
     by (rule mset_set_upto_eq_mset_upto)
   with mset_eq length_eq have "image_mset (\<lambda>i. xs ! i) (mset_set {..<length ys}) =
     image_mset (\<lambda>i. ys ! i) (mset_set {..<length ys})"
     by (metis map_nth mset_map)
   from image_mset_eq_implies_permutes[OF _ this]
   obtain p where p: "p permutes {..<length ys}" and "\<forall>i\<in>{..<length ys}. xs ! i = ys ! (p i)"
     by auto
   with length_eq have "permute_list p ys = xs"
     by (auto intro!: nth_equalityI simp: permute_list_nth)
   with p show thesis ..
 qed
 
 lemma permutes_natset_le:
   fixes S :: "'a::wellorder set"
   assumes "p permutes S"
     and "\<forall>i \<in> S. p i \<le> i"
   shows "p = id"
 proof -
   have "p n = n" for n
     using assms
   proof (induct n arbitrary: S rule: less_induct)
     case (less n)
     show ?case
     proof (cases "n \<in> S")
       case False
       with less(2) show ?thesis
         unfolding permutes_def by metis
     next
       case True
       with less(3) have "p n < n \<or> p n = n"
         by auto
       then show ?thesis
       proof
         assume "p n < n"
         with less have "p (p n) = p n"
           by metis
         with permutes_inj[OF less(2)] have "p n = n"
           unfolding inj_def by blast
         with \<open>p n < n\<close> have False
           by simp
         then show ?thesis ..
       qed
     qed
   qed
   then show ?thesis by (auto simp: fun_eq_iff)
 qed
 
 lemma permutes_natset_ge:
   fixes S :: "'a::wellorder set"
   assumes p: "p permutes S"
     and le: "\<forall>i \<in> S. p i \<ge> i"
   shows "p = id"
 proof -
   have "i \<ge> inv p i" if "i \<in> S" for i
   proof -
     from that permutes_in_image[OF permutes_inv[OF p]] have "inv p i \<in> S"
       by simp
     with le have "p (inv p i) \<ge> inv p i"
       by blast
     with permutes_inverses[OF p] show ?thesis
       by simp
   qed
   then have "\<forall>i\<in>S. inv p i \<le> i"
     by blast
   from permutes_natset_le[OF permutes_inv[OF p] this] have "inv p = inv id"
     by simp
   then show ?thesis
     apply (subst permutes_inv_inv[OF p, symmetric])
     apply (rule inv_unique_comp)
      apply simp_all
     done
 qed
 
 lemma image_inverse_permutations: "{inv p |p. p permutes S} = {p. p permutes S}"
   apply (rule set_eqI)
   apply auto
   using permutes_inv_inv permutes_inv
    apply auto
   apply (rule_tac x="inv x" in exI)
   apply auto
   done
 
 lemma image_compose_permutations_left:
   assumes "q permutes S"
   shows "{q \<circ> p |p. p permutes S} = {p. p permutes S}"
   apply (rule set_eqI)
   apply auto
    apply (rule permutes_compose)
   using assms
     apply auto
   apply (rule_tac x = "inv q \<circ> x" in exI)
   apply (simp add: o_assoc permutes_inv permutes_compose permutes_inv_o)
   done
 
 lemma image_compose_permutations_right:
   assumes "q permutes S"
   shows "{p \<circ> q | p. p permutes S} = {p . p permutes S}"
   apply (rule set_eqI)
   apply auto
    apply (rule permutes_compose)
   using assms
     apply auto
   apply (rule_tac x = "x \<circ> inv q" in exI)
   apply (simp add: o_assoc permutes_inv permutes_compose permutes_inv_o comp_assoc)
   done
 
 lemma permutes_in_seg: "p permutes {1 ..n} \<Longrightarrow> i \<in> {1..n} \<Longrightarrow> 1 \<le> p i \<and> p i \<le> n"
   by (simp add: permutes_def) metis
 
 lemma sum_permutations_inverse: "sum f {p. p permutes S} = sum (\<lambda>p. f(inv p)) {p. p permutes S}"
   (is "?lhs = ?rhs")
 proof -
   let ?S = "{p . p permutes S}"
   have *: "inj_on inv ?S"
   proof (auto simp add: inj_on_def)
     fix q r
     assume q: "q permutes S"
       and r: "r permutes S"
       and qr: "inv q = inv r"
     then have "inv (inv q) = inv (inv r)"
       by simp
     with permutes_inv_inv[OF q] permutes_inv_inv[OF r] show "q = r"
       by metis
   qed
   have **: "inv ` ?S = ?S"
     using image_inverse_permutations by blast
   have ***: "?rhs = sum (f \<circ> inv) ?S"
     by (simp add: o_def)
   from sum.reindex[OF *, of f] show ?thesis
     by (simp only: ** ***)
 qed
 
 lemma setum_permutations_compose_left:
   assumes q: "q permutes S"
   shows "sum f {p. p permutes S} = sum (\<lambda>p. f(q \<circ> p)) {p. p permutes S}"
   (is "?lhs = ?rhs")
 proof -
   let ?S = "{p. p permutes S}"
   have *: "?rhs = sum (f \<circ> ((\<circ>) q)) ?S"
     by (simp add: o_def)
   have **: "inj_on ((\<circ>) q) ?S"
   proof (auto simp add: inj_on_def)
     fix p r
     assume "p permutes S"
       and r: "r permutes S"
       and rp: "q \<circ> p = q \<circ> r"
     then have "inv q \<circ> q \<circ> p = inv q \<circ> q \<circ> r"
       by (simp add: comp_assoc)
     with permutes_inj[OF q, unfolded inj_iff] show "p = r"
       by simp
   qed
   have "((\<circ>) q) ` ?S = ?S"
     using image_compose_permutations_left[OF q] by auto
   with * sum.reindex[OF **, of f] show ?thesis
     by (simp only:)
 qed
 
 lemma sum_permutations_compose_right:
   assumes q: "q permutes S"
   shows "sum f {p. p permutes S} = sum (\<lambda>p. f(p \<circ> q)) {p. p permutes S}"
   (is "?lhs = ?rhs")
 proof -
   let ?S = "{p. p permutes S}"
   have *: "?rhs = sum (f \<circ> (\<lambda>p. p \<circ> q)) ?S"
     by (simp add: o_def)
   have **: "inj_on (\<lambda>p. p \<circ> q) ?S"
   proof (auto simp add: inj_on_def)
     fix p r
     assume "p permutes S"
       and r: "r permutes S"
       and rp: "p \<circ> q = r \<circ> q"
     then have "p \<circ> (q \<circ> inv q) = r \<circ> (q \<circ> inv q)"
       by (simp add: o_assoc)
     with permutes_surj[OF q, unfolded surj_iff] show "p = r"
       by simp
   qed
   from image_compose_permutations_right[OF q] have "(\<lambda>p. p \<circ> q) ` ?S = ?S"
     by auto
   with * sum.reindex[OF **, of f] show ?thesis
     by (simp only:)
 qed
 
 
 subsection \<open>Sum over a set of permutations (could generalize to iteration)\<close>
 
 lemma sum_over_permutations_insert:
   assumes fS: "finite S"
     and aS: "a \<notin> S"
   shows "sum f {p. p permutes (insert a S)} =
     sum (\<lambda>b. sum (\<lambda>q. f (Fun.swap a b id \<circ> q)) {p. p permutes S}) (insert a S)"
 proof -
   have *: "\<And>f a b. (\<lambda>(b, p). f (Fun.swap a b id \<circ> p)) = f \<circ> (\<lambda>(b,p). Fun.swap a b id \<circ> p)"
     by (simp add: fun_eq_iff)
   have **: "\<And>P Q. {(a, b). a \<in> P \<and> b \<in> Q} = P \<times> Q"
     by blast
   show ?thesis
     unfolding * ** sum.cartesian_product permutes_insert
   proof (rule sum.reindex)
     let ?f = "(\<lambda>(b, y). Fun.swap a b id \<circ> y)"
     let ?P = "{p. p permutes S}"
     {
       fix b c p q
       assume b: "b \<in> insert a S"
       assume c: "c \<in> insert a S"
       assume p: "p permutes S"
       assume q: "q permutes S"
       assume eq: "Fun.swap a b id \<circ> p = Fun.swap a c id \<circ> q"
       from p q aS have pa: "p a = a" and qa: "q a = a"
         unfolding permutes_def by metis+
       from eq have "(Fun.swap a b id \<circ> p) a  = (Fun.swap a c id \<circ> q) a"
         by simp
       then have bc: "b = c"
         by (simp add: permutes_def pa qa o_def fun_upd_def Fun.swap_def id_def
             cong del: if_weak_cong split: if_split_asm)
       from eq[unfolded bc] have "(\<lambda>p. Fun.swap a c id \<circ> p) (Fun.swap a c id \<circ> p) =
         (\<lambda>p. Fun.swap a c id \<circ> p) (Fun.swap a c id \<circ> q)" by simp
       then have "p = q"
         unfolding o_assoc swap_id_idempotent by simp
       with bc have "b = c \<and> p = q"
         by blast
     }
     then show "inj_on ?f (insert a S \<times> ?P)"
       unfolding inj_on_def by clarify metis
   qed
 qed
 
 
 subsection \<open>Constructing permutations from association lists\<close>
 
 definition list_permutes :: "('a \<times> 'a) list \<Rightarrow> 'a set \<Rightarrow> bool"
   where "list_permutes xs A \<longleftrightarrow>
     set (map fst xs) \<subseteq> A \<and>
     set (map snd xs) = set (map fst xs) \<and>
     distinct (map fst xs) \<and>
     distinct (map snd xs)"
 
 lemma list_permutesI [simp]:
   assumes "set (map fst xs) \<subseteq> A" "set (map snd xs) = set (map fst xs)" "distinct (map fst xs)"
   shows "list_permutes xs A"
 proof -
   from assms(2,3) have "distinct (map snd xs)"
     by (intro card_distinct) (simp_all add: distinct_card del: set_map)
   with assms show ?thesis
     by (simp add: list_permutes_def)
 qed
 
 definition permutation_of_list :: "('a \<times> 'a) list \<Rightarrow> 'a \<Rightarrow> 'a"
   where "permutation_of_list xs x = (case map_of xs x of None \<Rightarrow> x | Some y \<Rightarrow> y)"
 
 lemma permutation_of_list_Cons:
   "permutation_of_list ((x, y) # xs) x' = (if x = x' then y else permutation_of_list xs x')"
   by (simp add: permutation_of_list_def)
 
 fun inverse_permutation_of_list :: "('a \<times> 'a) list \<Rightarrow> 'a \<Rightarrow> 'a"
   where
     "inverse_permutation_of_list [] x = x"
   | "inverse_permutation_of_list ((y, x') # xs) x =
       (if x = x' then y else inverse_permutation_of_list xs x)"
 
 declare inverse_permutation_of_list.simps [simp del]
 
 lemma inj_on_map_of:
   assumes "distinct (map snd xs)"
   shows "inj_on (map_of xs) (set (map fst xs))"
 proof (rule inj_onI)
   fix x y
   assume xy: "x \<in> set (map fst xs)" "y \<in> set (map fst xs)"
   assume eq: "map_of xs x = map_of xs y"
   from xy obtain x' y' where x'y': "map_of xs x = Some x'" "map_of xs y = Some y'"
     by (cases "map_of xs x"; cases "map_of xs y") (simp_all add: map_of_eq_None_iff)
   moreover from x'y' have *: "(x, x') \<in> set xs" "(y, y') \<in> set xs"
     by (force dest: map_of_SomeD)+
   moreover from * eq x'y' have "x' = y'"
     by simp
   ultimately show "x = y"
     using assms by (force simp: distinct_map dest: inj_onD[of _ _ "(x,x')" "(y,y')"])
 qed
 
 lemma inj_on_the: "None \<notin> A \<Longrightarrow> inj_on the A"
   by (auto simp: inj_on_def option.the_def split: option.splits)
 
 lemma inj_on_map_of':
   assumes "distinct (map snd xs)"
   shows "inj_on (the \<circ> map_of xs) (set (map fst xs))"
   by (intro comp_inj_on inj_on_map_of assms inj_on_the)
     (force simp: eq_commute[of None] map_of_eq_None_iff)
 
 lemma image_map_of:
   assumes "distinct (map fst xs)"
   shows "map_of xs ` set (map fst xs) = Some ` set (map snd xs)"
   using assms by (auto simp: rev_image_eqI)
 
 lemma the_Some_image [simp]: "the ` Some ` A = A"
   by (subst image_image) simp
 
 lemma image_map_of':
   assumes "distinct (map fst xs)"
   shows "(the \<circ> map_of xs) ` set (map fst xs) = set (map snd xs)"
   by (simp only: image_comp [symmetric] image_map_of assms the_Some_image)
 
 lemma permutation_of_list_permutes [simp]:
   assumes "list_permutes xs A"
   shows "permutation_of_list xs permutes A"
     (is "?f permutes _")
 proof (rule permutes_subset[OF bij_imp_permutes])
   from assms show "set (map fst xs) \<subseteq> A"
     by (simp add: list_permutes_def)
   from assms have "inj_on (the \<circ> map_of xs) (set (map fst xs))" (is ?P)
     by (intro inj_on_map_of') (simp_all add: list_permutes_def)
   also have "?P \<longleftrightarrow> inj_on ?f (set (map fst xs))"
     by (intro inj_on_cong)
       (auto simp: permutation_of_list_def map_of_eq_None_iff split: option.splits)
   finally have "bij_betw ?f (set (map fst xs)) (?f ` set (map fst xs))"
     by (rule inj_on_imp_bij_betw)
   also from assms have "?f ` set (map fst xs) = (the \<circ> map_of xs) ` set (map fst xs)"
     by (intro image_cong refl)
       (auto simp: permutation_of_list_def map_of_eq_None_iff split: option.splits)
   also from assms have "\<dots> = set (map fst xs)"
     by (subst image_map_of') (simp_all add: list_permutes_def)
   finally show "bij_betw ?f (set (map fst xs)) (set (map fst xs))" .
 qed (force simp: permutation_of_list_def dest!: map_of_SomeD split: option.splits)+
 
 lemma eval_permutation_of_list [simp]:
   "permutation_of_list [] x = x"
   "x = x' \<Longrightarrow> permutation_of_list ((x',y)#xs) x = y"
   "x \<noteq> x' \<Longrightarrow> permutation_of_list ((x',y')#xs) x = permutation_of_list xs x"
   by (simp_all add: permutation_of_list_def)
 
 lemma eval_inverse_permutation_of_list [simp]:
   "inverse_permutation_of_list [] x = x"
   "x = x' \<Longrightarrow> inverse_permutation_of_list ((y,x')#xs) x = y"
   "x \<noteq> x' \<Longrightarrow> inverse_permutation_of_list ((y',x')#xs) x = inverse_permutation_of_list xs x"
   by (simp_all add: inverse_permutation_of_list.simps)
 
 lemma permutation_of_list_id: "x \<notin> set (map fst xs) \<Longrightarrow> permutation_of_list xs x = x"
   by (induct xs) (auto simp: permutation_of_list_Cons)
 
 lemma permutation_of_list_unique':
   "distinct (map fst xs) \<Longrightarrow> (x, y) \<in> set xs \<Longrightarrow> permutation_of_list xs x = y"
   by (induct xs) (force simp: permutation_of_list_Cons)+
 
 lemma permutation_of_list_unique:
   "list_permutes xs A \<Longrightarrow> (x, y) \<in> set xs \<Longrightarrow> permutation_of_list xs x = y"
   by (intro permutation_of_list_unique') (simp_all add: list_permutes_def)
 
 lemma inverse_permutation_of_list_id:
   "x \<notin> set (map snd xs) \<Longrightarrow> inverse_permutation_of_list xs x = x"
   by (induct xs) auto
 
 lemma inverse_permutation_of_list_unique':
   "distinct (map snd xs) \<Longrightarrow> (x, y) \<in> set xs \<Longrightarrow> inverse_permutation_of_list xs y = x"
-  by (induct xs) (force simp: inverse_permutation_of_list.simps)+
+  by (induct xs) (force simp: inverse_permutation_of_list.simps(2))+
 
 lemma inverse_permutation_of_list_unique:
   "list_permutes xs A \<Longrightarrow> (x,y) \<in> set xs \<Longrightarrow> inverse_permutation_of_list xs y = x"
   by (intro inverse_permutation_of_list_unique') (simp_all add: list_permutes_def)
 
 lemma inverse_permutation_of_list_correct:
   fixes A :: "'a set"
   assumes "list_permutes xs A"
   shows "inverse_permutation_of_list xs = inv (permutation_of_list xs)"
 proof (rule ext, rule sym, subst permutes_inv_eq)
   from assms show "permutation_of_list xs permutes A"
     by simp
   show "permutation_of_list xs (inverse_permutation_of_list xs x) = x" for x
   proof (cases "x \<in> set (map snd xs)")
     case True
     then obtain y where "(y, x) \<in> set xs" by auto
     with assms show ?thesis
       by (simp add: inverse_permutation_of_list_unique permutation_of_list_unique)
   next
     case False
     with assms show ?thesis
       by (auto simp: list_permutes_def inverse_permutation_of_list_id permutation_of_list_id)
   qed
 qed
 
 end