diff --git a/thys/SC_DOM_Components/Core_DOM_DOM_Components.thy b/thys/SC_DOM_Components/Core_DOM_DOM_Components.thy
--- a/thys/SC_DOM_Components/Core_DOM_DOM_Components.thy
+++ b/thys/SC_DOM_Components/Core_DOM_DOM_Components.thy
@@ -1,2351 +1,2344 @@
 (***********************************************************************************
  * Copyright (c) 2016-2020 The University of Sheffield, UK
  *               2019-2020 University of Exeter, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section \<open>Core SC DOM Components\<close>
 theory Core_DOM_DOM_Components
   imports Core_SC_DOM.Core_DOM
 begin
 
 subsection \<open>Components\<close>
 
 locale l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_get_root_node_defs get_root_node get_root_node_locs +
   l_to_tree_order_defs to_tree_order
   for get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
     and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
 begin
 
 definition a_get_dom_component :: "(_) object_ptr \<Rightarrow> (_, (_) object_ptr list) dom_prog"
   where
     "a_get_dom_component ptr = do {
       root \<leftarrow> get_root_node ptr;
       to_tree_order root
     }"
 
 definition a_is_strongly_dom_component_safe ::
   "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
   where
     "a_is_strongly_dom_component_safe S\<^sub>a\<^sub>r\<^sub>g S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t h h' = (
       let removed_pointers = fset (object_ptr_kinds h) - fset (object_ptr_kinds h') in
       let added_pointers = fset (object_ptr_kinds h') - fset (object_ptr_kinds h) in
       let arg_components =
         (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_dom_component ptr|\<^sub>r) \<inter>
         fset (object_ptr_kinds h).  set |h \<turnstile> a_get_dom_component ptr|\<^sub>r) in
       let arg_components' =
         (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_dom_component ptr|\<^sub>r) \<inter>
         fset (object_ptr_kinds h').  set |h' \<turnstile> a_get_dom_component ptr|\<^sub>r) in
       removed_pointers \<subseteq> arg_components \<and>
       added_pointers \<subseteq> arg_components' \<and>
       S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t \<subseteq> arg_components' \<and>
       (\<forall>outside_ptr \<in> fset (object_ptr_kinds h) \<inter> fset (object_ptr_kinds h') -
         (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h  \<turnstile> a_get_dom_component ptr|\<^sub>r). preserved (get_M outside_ptr id) h h'))"
 
 definition a_is_weakly_dom_component_safe ::
   "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
   where
     "a_is_weakly_dom_component_safe S\<^sub>a\<^sub>r\<^sub>g S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t h h' = (
       let removed_pointers = fset (object_ptr_kinds h) - fset (object_ptr_kinds h') in
       let added_pointers = fset (object_ptr_kinds h') - fset (object_ptr_kinds h) in
       let arg_components =
         (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_dom_component ptr|\<^sub>r) \<inter>
         fset (object_ptr_kinds h).  set |h \<turnstile> a_get_dom_component ptr|\<^sub>r) in
       let arg_components' =
         (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_dom_component ptr|\<^sub>r) \<inter>
         fset (object_ptr_kinds h').  set |h' \<turnstile> a_get_dom_component ptr|\<^sub>r) in
       removed_pointers \<subseteq> arg_components \<and>
       S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t \<subseteq> arg_components' \<union> added_pointers  \<and>
       (\<forall>outside_ptr \<in> fset (object_ptr_kinds h) \<inter> fset (object_ptr_kinds h') -
         (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h  \<turnstile> a_get_dom_component ptr|\<^sub>r). preserved (get_M outside_ptr id) h h'))"
 
 lemma "a_is_strongly_dom_component_safe S\<^sub>a\<^sub>r\<^sub>g S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t h h' \<Longrightarrow> a_is_weakly_dom_component_safe S\<^sub>a\<^sub>r\<^sub>g S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t h h'"
   by(auto simp add: a_is_strongly_dom_component_safe_def a_is_weakly_dom_component_safe_def Let_def)
 
 definition is_document_component :: "(_) object_ptr list \<Rightarrow> bool"
   where
     "is_document_component c = is_document_ptr_kind (hd c)"
 
 definition is_disconnected_component :: "(_) object_ptr list \<Rightarrow> bool"
   where
     "is_disconnected_component c = is_node_ptr_kind (hd c)"
 end
 
 global_interpretation l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_root_node get_root_node_locs to_tree_order
   defines get_dom_component = a_get_dom_component
     and is_strongly_dom_component_safe = a_is_strongly_dom_component_safe
     and is_weakly_dom_component_safe = a_is_weakly_dom_component_safe
   .
 
 
 locale l_get_dom_component_defs =
   fixes get_dom_component :: "(_) object_ptr \<Rightarrow> (_, (_) object_ptr list) dom_prog"
   fixes is_strongly_dom_component_safe ::
     "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
   fixes is_weakly_dom_component_safe ::
     "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
 
 locale l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_to_tree_order_wf +
   l_get_dom_component_defs +
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs +
   l_get_ancestors +
   l_get_ancestors_wf +
   l_get_root_node +
   l_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_parent +
   l_get_parent_wf +
   l_get_element_by +
   l_to_tree_order_wf_get_root_node_wf +
   (* l_to_tree_order_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M _ _ _ get_child_nodes +
   l_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M _ _ get_child_nodes+
   l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M _ _ "l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.a_to_tree_order get_child_nodes"
   for get_child_nodes :: "(_::linorder) object_ptr \<Rightarrow> (_, (_) node_ptr list) dom_prog" *)
   assumes get_dom_component_impl: "get_dom_component = a_get_dom_component"
   assumes is_strongly_dom_component_safe_impl:
     "is_strongly_dom_component_safe = a_is_strongly_dom_component_safe"
   assumes is_weakly_dom_component_safe_impl:
     "is_weakly_dom_component_safe = a_is_weakly_dom_component_safe"
 begin
 lemmas get_dom_component_def = a_get_dom_component_def[folded get_dom_component_impl]
 lemmas is_strongly_dom_component_safe_def =
   a_is_strongly_dom_component_safe_def[folded is_strongly_dom_component_safe_impl]
 lemmas is_weakly_dom_component_safe_def =
   a_is_weakly_dom_component_safe_def[folded is_weakly_dom_component_safe_impl]
 
 lemma get_dom_component_ptr_in_heap:
   assumes "h \<turnstile> ok (get_dom_component ptr)"
   shows "ptr |\<in>| object_ptr_kinds h"
   using assms get_root_node_ptr_in_heap
   by(auto simp add: get_dom_component_def)
 
 lemma get_dom_component_ok:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "ptr |\<in>| object_ptr_kinds h"
   shows "h \<turnstile> ok (get_dom_component ptr)"
   using assms
   apply(auto simp add: get_dom_component_def a_get_root_node_def intro!: bind_is_OK_pure_I)[1]
   using get_root_node_ok  to_tree_order_ok get_root_node_ptr_in_heap
    apply blast
   by (simp add: local.get_root_node_root_in_heap local.to_tree_order_ok)
 
 lemma get_dom_component_ptr:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   shows "ptr \<in> set c"
 proof(insert assms(1) assms(4), induct ptr rule: heap_wellformed_induct_rev )
   case (step child)
   then show ?case
   proof (cases "is_node_ptr_kind child")
     case True
     obtain node_ptr where
       node_ptr: "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr = child"
       using \<open>is_node_ptr_kind child\<close> node_ptr_casts_commute3 by blast
     have "child |\<in>| object_ptr_kinds h"
       using \<open>h \<turnstile> get_dom_component child \<rightarrow>\<^sub>r c\<close> get_dom_component_ptr_in_heap by fast
     with node_ptr have "node_ptr |\<in>| node_ptr_kinds h"
       by auto
     then obtain parent_opt where
       parent: "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r parent_opt"
       using get_parent_ok \<open>type_wf h\<close> \<open>known_ptrs h\<close>
       by fast
     then show ?thesis
     proof (induct parent_opt)
       case None
       then have "h \<turnstile> get_root_node (cast node_ptr) \<rightarrow>\<^sub>r cast node_ptr"
         by (simp add: local.get_root_node_no_parent)
       then show ?case
         using \<open>type_wf h\<close> \<open>known_ptrs h\<close> node_ptr step(2)
         apply(auto simp add: get_dom_component_def a_get_root_node_def elim!: bind_returns_result_E2)[1]
         using to_tree_order_ptr_in_result returns_result_eq by fastforce
     next
       case (Some parent_ptr)
       then have "h \<turnstile> get_dom_component parent_ptr \<rightarrow>\<^sub>r c"
         using step(2) node_ptr \<open>type_wf h\<close> \<open>known_ptrs h\<close> \<open>heap_is_wellformed h\<close>
           get_root_node_parent_same
         by(auto simp add: get_dom_component_def elim!: bind_returns_result_E2
             intro!: bind_pure_returns_result_I)
       then have "parent_ptr \<in> set c"
         using step node_ptr Some by blast
       then show ?case
         using  \<open>type_wf h\<close> \<open>known_ptrs h\<close> \<open>heap_is_wellformed h\<close> step(2) node_ptr Some
         apply(auto simp add: get_dom_component_def elim!: bind_returns_result_E2)[1]
         using to_tree_order_parent by blast
     qed
   next
     case False
     then show ?thesis
       using \<open>type_wf h\<close> \<open>known_ptrs h\<close> step(2)
       apply(auto simp add: get_dom_component_def elim!: bind_returns_result_E2)[1]
       by (metis is_OK_returns_result_I local.get_root_node_not_node_same
           local.get_root_node_ptr_in_heap local.to_tree_order_ptr_in_result returns_result_eq)
   qed
 qed
 
 lemma get_dom_component_parent_inside:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "cast node_ptr \<in> set c"
   assumes "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some parent"
   shows "parent \<in> set c"
 proof -
   have "parent |\<in>| object_ptr_kinds h"
     using assms(6) get_parent_parent_in_heap by blast
 
   obtain root_ptr where root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr" and c: "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
     using assms(4)
     by (metis (no_types, opaque_lifting) bind_returns_result_E2 get_dom_component_def get_root_node_pure)
   then have "h \<turnstile> get_root_node (cast node_ptr) \<rightarrow>\<^sub>r root_ptr"
     using assms(1) assms(2) assms(3) assms(5) to_tree_order_same_root by blast
   then have "h \<turnstile> get_root_node parent \<rightarrow>\<^sub>r root_ptr"
     using assms(6)  get_root_node_parent_same by blast
   then have "h \<turnstile> get_dom_component parent \<rightarrow>\<^sub>r c"
     using c get_dom_component_def by auto
   then show ?thesis
     using assms(1) assms(2) assms(3) get_dom_component_ptr by blast
 qed
 
 lemma get_dom_component_subset:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "ptr' \<in> set c"
   shows "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
 proof(insert assms(1) assms(5), induct ptr' rule: heap_wellformed_induct_rev )
   case (step child)
   then show ?case
   proof (cases "is_node_ptr_kind child")
     case True
     obtain node_ptr where
       node_ptr: "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr = child"
       using \<open>is_node_ptr_kind child\<close> node_ptr_casts_commute3 by blast
     have "child |\<in>| object_ptr_kinds h"
       using to_tree_order_ptrs_in_heap assms(1) assms(2) assms(3) assms(4) step(2)
       unfolding get_dom_component_def
       by (meson bind_returns_result_E2 get_root_node_pure)
     with node_ptr have "node_ptr |\<in>| node_ptr_kinds h"
       by auto
     then obtain parent_opt where
       parent: "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r parent_opt"
       using get_parent_ok \<open>type_wf h\<close> \<open>known_ptrs h\<close>
       by fast
     then show ?thesis
     proof (induct parent_opt)
       case None
       then have "h \<turnstile> get_root_node child \<rightarrow>\<^sub>r child"
         using assms(1) get_root_node_no_parent node_ptr by blast
       then show ?case
         using \<open>type_wf h\<close> \<open>known_ptrs h\<close> node_ptr step(2) assms(4) assms(1)
         by (metis (no_types) bind_pure_returns_result_I2 bind_returns_result_E2
             get_dom_component_def get_root_node_pure is_OK_returns_result_I returns_result_eq
             to_tree_order_same_root)
     next
       case (Some parent_ptr)
       then have "h \<turnstile> get_dom_component parent_ptr \<rightarrow>\<^sub>r c"
         using step get_dom_component_parent_inside assms node_ptr by blast
       then show ?case
         using Some node_ptr
         apply(auto simp add: get_dom_component_def elim!: bind_returns_result_E2
             del: bind_pure_returns_result_I intro!: bind_pure_returns_result_I)[1]
         using get_root_node_parent_same by blast
     qed
   next
     case False
     then have "child |\<in>| object_ptr_kinds h"
       using assms(1) assms(4) step(2)
       by (metis (no_types, lifting) assms(2) assms(3) bind_returns_result_E2 get_root_node_pure
           get_dom_component_def to_tree_order_ptrs_in_heap)
     then have "h \<turnstile> get_root_node child \<rightarrow>\<^sub>r child"
       using assms(1) False get_root_node_not_node_same by blast
     then show ?thesis
       using assms(1) assms(2) assms(3) assms(4) step.prems
       by (metis (no_types) False \<open>child |\<in>| object_ptr_kinds h\<close> bind_pure_returns_result_I2
           bind_returns_result_E2 get_dom_component_def get_root_node_ok get_root_node_pure returns_result_eq
           to_tree_order_node_ptrs)
   qed
 qed
 
 lemma get_dom_component_to_tree_order_subset:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r nodes"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   shows "set nodes \<subseteq> set c"
   using assms
   apply(auto simp add: get_dom_component_def elim!: bind_returns_result_E2)[1]
   by (meson to_tree_order_subset  assms(5) contra_subsetD get_dom_component_ptr)
 
 lemma get_dom_component_to_tree_order:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to"
   assumes "ptr \<in> set to"
   shows "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
   by (metis (no_types, opaque_lifting) assms(1) assms(2) assms(3) assms(4) assms(5) assms(6)
       get_dom_component_ok get_dom_component_subset get_dom_component_to_tree_order_subset
       is_OK_returns_result_E local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap
       select_result_I2 subsetCE)
 
 lemma get_dom_component_root_node_same:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
   assumes "x \<in> set c"
   shows "h \<turnstile> get_root_node x \<rightarrow>\<^sub>r root_ptr"
 proof(insert assms(1) assms(6), induct x rule: heap_wellformed_induct_rev )
   case (step child)
   then show ?case
   proof (cases "is_node_ptr_kind child")
     case True
     obtain node_ptr where
       node_ptr: "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr = child"
       using \<open>is_node_ptr_kind child\<close> node_ptr_casts_commute3 by blast
     have "child |\<in>| object_ptr_kinds h"
       using to_tree_order_ptrs_in_heap assms(1) assms(2) assms(3) assms(4) step(2)
       unfolding get_dom_component_def
       by (meson bind_returns_result_E2 get_root_node_pure)
     with node_ptr have "node_ptr |\<in>| node_ptr_kinds h"
       by auto
     then obtain parent_opt where
       parent: "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r parent_opt"
       using get_parent_ok \<open>type_wf h\<close> \<open>known_ptrs h\<close>
       by fast
     then show ?thesis
     proof (induct parent_opt)
       case None
       then have "h \<turnstile> get_root_node child \<rightarrow>\<^sub>r child"
         using assms(1) get_root_node_no_parent  node_ptr by blast
       then show ?case
         using \<open>type_wf h\<close> \<open>known_ptrs h\<close> node_ptr step(2) assms(4) assms(1) assms(5)
         by (metis (no_types) \<open>child |\<in>| object_ptr_kinds h\<close> bind_pure_returns_result_I
             get_dom_component_def get_dom_component_ptr get_dom_component_subset get_root_node_pure
             is_OK_returns_result_E returns_result_eq to_tree_order_ok to_tree_order_same_root)
     next
       case (Some parent_ptr)
       then have "h \<turnstile> get_dom_component parent_ptr \<rightarrow>\<^sub>r c"
         using step get_dom_component_parent_inside assms node_ptr
         by (meson get_dom_component_subset)
       then show ?case
         using Some node_ptr
         apply(auto simp add: get_dom_component_def elim!: bind_returns_result_E2)[1]
         using get_root_node_parent_same
         using \<open>h \<turnstile> get_dom_component parent_ptr \<rightarrow>\<^sub>r c\<close> assms(1) assms(2) assms(3)
           get_dom_component_ptr step.hyps by blast
     qed
   next
     case False
     then have "child |\<in>| object_ptr_kinds h"
       using assms(1) assms(4) step(2)
       by (metis (no_types, lifting) assms(2) assms(3) bind_returns_result_E2 get_root_node_pure
           get_dom_component_def to_tree_order_ptrs_in_heap)
     then have "h \<turnstile> get_root_node child \<rightarrow>\<^sub>r child"
       using assms(1) False get_root_node_not_node_same by auto
     then show ?thesis
       using assms(1) assms(2) assms(3) assms(4) step.prems assms(5)
       by (metis (no_types, opaque_lifting) bind_returns_result_E2 get_dom_component_def
           get_root_node_pure returns_result_eq to_tree_order_same_root)
   qed
 qed
 
 
 lemma get_dom_component_no_overlap:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c'"
   shows "set c \<inter> set c' = {} \<or> c = c'"
 proof (rule ccontr, auto)
   fix x
   assume 1: "c \<noteq> c'" and 2: "x \<in> set c" and 3: "x \<in> set c'"
   obtain root_ptr where root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
     using assms(4) unfolding get_dom_component_def
     by (meson bind_is_OK_E is_OK_returns_result_I)
   moreover obtain root_ptr' where root_ptr': "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr'"
     using assms(5) unfolding get_dom_component_def
     by (meson bind_is_OK_E is_OK_returns_result_I)
   ultimately have "root_ptr \<noteq> root_ptr'"
     using 1 assms
     unfolding get_dom_component_def
     by (meson bind_returns_result_E3 get_root_node_pure returns_result_eq)
 
   moreover have "h \<turnstile> get_root_node x \<rightarrow>\<^sub>r root_ptr"
     using 2 root_ptr get_dom_component_root_node_same assms by blast
   moreover have "h \<turnstile> get_root_node x \<rightarrow>\<^sub>r root_ptr'"
     using 3 root_ptr' get_dom_component_root_node_same assms by blast
   ultimately show False
     using select_result_I2 by force
 qed
 
 lemma get_dom_component_separates_tree_order:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
   assumes "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c'"
   assumes "ptr' \<notin> set c"
   shows "set to \<inter> set c' = {}"
 proof -
   have "c \<noteq> c'"
     using assms get_dom_component_ptr by blast
   then have "set c \<inter> set c' = {}"
     using assms get_dom_component_no_overlap by blast
   moreover have "set to \<subseteq> set c"
     using assms get_dom_component_to_tree_order_subset by blast
   ultimately show ?thesis
     by blast
 qed
 
 lemma get_dom_component_separates_tree_order_general:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "h \<turnstile> to_tree_order ptr'' \<rightarrow>\<^sub>r to''"
   assumes "ptr'' \<in> set c"
   assumes "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c'"
   assumes "ptr' \<notin> set c"
   shows "set to'' \<inter> set c' = {}"
 proof -
   obtain root_ptr where root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
     using assms(4)
     by (metis bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
   then have c: "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
     using assms(4) unfolding get_dom_component_def
     by (simp add: bind_returns_result_E3)
   with root_ptr show ?thesis
     using assms get_dom_component_separates_tree_order get_dom_component_subset
     by meson
 qed
 end
 
 interpretation i_get_dom_component?: l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
   get_elements_by_tag_name
   by(auto simp add: l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def
       get_dom_component_def is_strongly_dom_component_safe_def is_weakly_dom_component_safe_def instances)
 declare l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>get\_child\_nodes\<close>
 
 locale l_get_dom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma get_child_nodes_is_strongly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
   assumes "child \<in> set children"
   shows "cast child \<in> set c \<longleftrightarrow> ptr' \<in> set c"
 proof
   assume 1: "cast child \<in> set c"
   obtain root_ptr where
     root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
     by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
   have "h \<turnstile> get_root_node (cast child) \<rightarrow>\<^sub>r root_ptr"
     using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
     by blast
   then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
     using assms(1) assms(2) assms(3) assms(5) assms(6) local.child_parent_dual
       local.get_root_node_parent_same by blast
   then have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
     using "1" assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) local.child_parent_dual
       local.get_dom_component_parent_inside local.get_dom_component_subset by blast
   then show "ptr' \<in> set c"
     using assms(1) assms(2) assms(3) get_dom_component_ptr by blast
 next
   assume 1: "ptr' \<in> set c"
   obtain root_ptr where
     root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
     by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
   have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
     using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
     by blast
   then have "h \<turnstile> get_root_node (cast child) \<rightarrow>\<^sub>r root_ptr"
     using assms(1) assms(2) assms(3) assms(5) assms(6) local.child_parent_dual
       local.get_root_node_parent_same by blast
   then have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
     using "1" assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) local.child_parent_dual
       local.get_dom_component_parent_inside local.get_dom_component_subset by blast
   then show "cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child \<in> set c"
-    by (smt \<open>h \<turnstile> get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root_ptr\<close> assms(1) assms(2) assms(3)
+    by (smt (verit) \<open>h \<turnstile> get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root_ptr\<close> assms(1) assms(2) assms(3)
         assms(5) assms(6) disjoint_iff_not_equal is_OK_returns_result_E is_OK_returns_result_I
         l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_no_overlap local.child_parent_dual local.get_dom_component_ok
         local.get_dom_component_parent_inside local.get_dom_component_ptr local.get_root_node_ptr_in_heap
         local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms)
 qed
 
 
 lemma get_child_nodes_get_dom_component:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   shows "cast ` set children \<subseteq> set c"
   using assms get_child_nodes_is_strongly_dom_component_safe
   using local.get_dom_component_ptr by auto
 
 
 lemma
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>h h'"
   shows "is_strongly_dom_component_safe {ptr} (cast ` set children) h h'"
 proof -
   have "h = h'"
     using assms(5)
     by (meson local.get_child_nodes_pure pure_returns_heap_eq)
   then show ?thesis
     using assms
     apply(auto simp add: is_strongly_dom_component_safe_def Let_def preserved_def)[1]
-    by (smt IntI finite_set_in get_child_nodes_is_strongly_dom_component_safe is_OK_returns_result_E
+    by (smt (verit) IntI fmember.rep_eq get_child_nodes_is_strongly_dom_component_safe
         is_OK_returns_result_I local.get_child_nodes_ptr_in_heap local.get_dom_component_impl
-        local.get_dom_component_ok local.get_dom_component_ptr select_result_I2)
+        local.get_dom_component_ok local.get_dom_component_ptr returns_result_select_result)
+
 qed
 end
 
 interpretation i_get_dom_component_get_child_nodes?: l_get_dom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
   get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
   by(auto simp add: l_get_dom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_dom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>get\_parent\<close>
 
 locale l_get_dom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma get_parent_is_strongly_dom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "h \<turnstile> get_parent ptr' \<rightarrow>\<^sub>r Some parent"
   shows "parent \<in> set c \<longleftrightarrow> cast ptr' \<in> set c"
   by (meson assms(1) assms(2) assms(3) assms(4) assms(5) is_OK_returns_result_E
       l_to_tree_order_wf.to_tree_order_parent local.get_dom_component_parent_inside
       local.get_dom_component_subset local.get_dom_component_to_tree_order_subset
       local.get_parent_parent_in_heap local.l_to_tree_order_wf_axioms local.to_tree_order_ok
       local.to_tree_order_ptr_in_result subsetCE)
 
 
 lemma get_parent_is_strongly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some parent"
   assumes "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>h h'"
   shows "is_strongly_dom_component_safe {cast node_ptr} {parent} h h'"
 proof -
   have "h = h'"
     using assms(5)
     by (meson local.get_parent_pure pure_returns_heap_eq)
   then show ?thesis
     using assms
     apply(auto simp add: is_strongly_dom_component_safe_def Let_def preserved_def)[1]
     by (metis IntI finite_set_in local.get_dom_component_impl local.get_dom_component_ok
         local.get_dom_component_parent_inside local.get_dom_component_ptr local.get_parent_parent_in_heap
         local.known_ptrs_known_ptr local.parent_child_rel_child_in_heap local.parent_child_rel_parent
         returns_result_select_result)
 qed
 end
 
 interpretation i_get_dom_component_get_parent?: l_get_dom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
   get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
   by(auto simp add: l_get_dom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_dom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>get\_root\_node\<close>
 
 locale l_get_dom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma get_root_node_is_strongly_dom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root"
   shows "root \<in> set c \<longleftrightarrow> ptr' \<in> set c"
 proof
   assume 1: "root \<in> set c"
   obtain root_ptr where
     root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
     by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
   have "h \<turnstile> get_root_node root \<rightarrow>\<^sub>r root_ptr"
     using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
     by blast
   moreover have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
     by (metis (no_types, lifting) calculation assms(1) assms(2) assms(3) assms(5)
         is_OK_returns_result_E local.get_root_node_root_in_heap local.to_tree_order_ok
         local.to_tree_order_ptr_in_result local.to_tree_order_same_root select_result_I2)
   ultimately have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
     apply(auto simp add: get_dom_component_def)[1]
-    by (smt "1" assms(1) assms(2) assms(3) assms(4) bind_pure_returns_result_I bind_returns_result_E3
-        local.get_dom_component_def local.get_dom_component_subset local.get_root_node_pure)
+    using assms(4) bind_returns_result_E3 local.get_dom_component_def root_ptr by fastforce
   then show "ptr' \<in> set c"
     using assms(1) assms(2) assms(3) get_dom_component_ptr by blast
 next
   assume 1: "ptr' \<in> set c"
   obtain root_ptr where
     root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
     by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
   have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
     using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
     by blast
   then have "h \<turnstile> get_root_node root \<rightarrow>\<^sub>r root_ptr"
     by (metis assms(1) assms(2) assms(3) assms(5) is_OK_returns_result_E
         local.get_root_node_root_in_heap local.to_tree_order_ok local.to_tree_order_ptr_in_result
         local.to_tree_order_same_root returns_result_eq)
   then have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
     using "1" assms(1) assms(2) assms(3) assms(4) local.get_dom_component_subset by blast
   then show "root \<in> set c"
     using assms(5) bind_returns_result_E3 local.get_dom_component_def local.to_tree_order_ptr_in_result
     by fastforce
 qed
 
 lemma get_root_node_is_strongly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
   assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>h h'"
   shows "is_strongly_dom_component_safe {ptr} {root} h h'"
 proof -
   have "h = h'"
     using assms(5)
     by (meson local.get_root_node_pure pure_returns_heap_eq)
   then show ?thesis
     using assms
     apply(auto simp add: is_strongly_dom_component_safe_def Let_def preserved_def)[1]
     by (metis (no_types, lifting) IntI finite_set_in get_root_node_is_strongly_dom_component_safe_step
         is_OK_returns_result_I local.get_dom_component_impl local.get_dom_component_ok
         local.get_dom_component_ptr local.get_root_node_ptr_in_heap returns_result_select_result)
 qed
 end
 
 interpretation i_get_dom_component_get_root_node?: l_get_dom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
   get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
   by(auto simp add: l_get_dom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_dom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>get\_element\_by\_id\<close>
 
 locale l_get_dom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma get_element_by_id_is_strongly_dom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "h \<turnstile> get_element_by_id ptr' idd \<rightarrow>\<^sub>r Some result"
   shows "cast result \<in> set c \<longleftrightarrow> ptr' \<in> set c"
 proof
   assume 1: "cast result \<in> set c"
   obtain root_ptr where
     root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
     by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
   then have "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
     using \<open>h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c\<close>
     by (simp add: get_dom_component_def bind_returns_result_E3)
 
   obtain to' where to': "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'"
     using \<open>h \<turnstile> get_element_by_id ptr' idd \<rightarrow>\<^sub>r Some result\<close>
     apply(simp add: get_element_by_id_def first_in_tree_order_def)
     by (meson bind_is_OK_E is_OK_returns_result_I)
   then have "cast result \<in> set to'"
     using \<open>h \<turnstile> get_element_by_id ptr' idd \<rightarrow>\<^sub>r Some result\<close> get_element_by_id_result_in_tree_order
     by blast
 
   have "h \<turnstile> get_root_node (cast result) \<rightarrow>\<^sub>r root_ptr"
     using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
     by blast
   then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
     using \<open>cast result \<in> set to'\<close> \<open>h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'\<close>
     using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_ptr get_dom_component_root_node_same
       get_dom_component_subset get_dom_component_to_tree_order
     by blast
   then have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
     using \<open>h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c\<close>
     using get_dom_component_def by auto
   then show "ptr' \<in> set c"
     using assms(1) assms(2) assms(3) get_dom_component_ptr by blast
 next
   assume "ptr' \<in> set c"
   moreover obtain to' where to': "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'"
     by (meson assms(1) assms(2) assms(3) assms(4) calculation get_dom_component_ptr_in_heap
         get_dom_component_subset is_OK_returns_result_E is_OK_returns_result_I to_tree_order_ok)
   ultimately have "set to' \<subseteq> set c"
     using assms(1) assms(2) assms(3) assms(4) get_dom_component_subset
       get_dom_component_to_tree_order_subset
     by blast
   moreover have "cast result \<in> set to'"
     using assms(5) get_element_by_id_result_in_tree_order to' by blast
   ultimately show "cast result \<in> set c"
     by blast
 qed
 
 
 lemma get_element_by_id_is_strongly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_element_by_id ptr idd \<rightarrow>\<^sub>r Some result"
   assumes "h \<turnstile> get_element_by_id ptr idd \<rightarrow>\<^sub>h h'"
   shows "is_strongly_dom_component_safe {ptr} {cast result} h h'"
 proof -
   have "h = h'"
     using assms(5)
     by(auto simp add: preserved_def get_element_by_id_def first_in_tree_order_def
         elim!: bind_returns_heap_E2 intro!: map_filter_M_pure bind_pure_I
         split: option.splits list.splits)
   have "ptr |\<in>| object_ptr_kinds h"
     using assms(4)
     apply(auto simp add: get_element_by_id_def)[1]
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) bind_is_OK_E is_OK_returns_result_I
         local.first_in_tree_order_def local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap)
   obtain to where to: "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
     by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
         local.to_tree_order_ok)
   then have "cast result \<in> set to"
     using assms(4) local.get_element_by_id_result_in_tree_order by auto
   obtain c where c: "h \<turnstile> a_get_dom_component ptr \<rightarrow>\<^sub>r c"
     using \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) local.get_dom_component_impl
       local.get_dom_component_ok by blast
 
   then show ?thesis
     using assms \<open>h = h'\<close>
     apply(auto simp add: is_strongly_dom_component_safe_def Let_def preserved_def get_element_by_id_def
         first_in_tree_order_def elim!: bind_returns_result_E2 intro!: map_filter_M_pure bind_pure_I
         split: option.splits list.splits)[1]
     by (metis (no_types, lifting) Int_iff \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(4) finite_set_in
         get_element_by_id_is_strongly_dom_component_safe_step local.get_dom_component_impl
         local.get_dom_component_ptr select_result_I2)
 qed
 end
 
 interpretation i_get_dom_component_get_element_by_id?: l_get_dom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
   get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
   by(auto simp add: l_get_dom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_dom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 subsubsection \<open>get\_elements\_by\_class\_name\<close>
 
 locale l_get_dom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma get_elements_by_class_name_is_strongly_dom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "h \<turnstile> get_elements_by_class_name ptr' idd \<rightarrow>\<^sub>r results"
   assumes "result \<in> set results"
   shows "cast result \<in> set c \<longleftrightarrow> ptr' \<in> set c"
 proof
   assume 1: "cast result \<in> set c"
   obtain root_ptr where
     root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
     by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
   then have "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
     using \<open>h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c\<close>
     by (simp add: get_dom_component_def bind_returns_result_E3)
 
   obtain to' where to': "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'"
     using assms(5)
     apply(simp add: get_elements_by_class_name_def first_in_tree_order_def)
     by (meson bind_is_OK_E is_OK_returns_result_I)
   then have "cast result \<in> set to'"
     using assms get_elements_by_class_name_result_in_tree_order by blast
 
   have "h \<turnstile> get_root_node (cast result) \<rightarrow>\<^sub>r root_ptr"
     using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
     by blast
   then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
     using \<open>cast result \<in> set to'\<close> \<open>h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'\<close>
     using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_ptr get_dom_component_root_node_same
       get_dom_component_subset get_dom_component_to_tree_order
     by blast
   then have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
     using \<open>h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c\<close>
     using get_dom_component_def by auto
   then show "ptr' \<in> set c"
     using assms(1) assms(2) assms(3) get_dom_component_ptr by blast
 next
   assume "ptr' \<in> set c"
   moreover obtain to' where to': "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'"
     by (meson assms(1) assms(2) assms(3) assms(4) calculation get_dom_component_ptr_in_heap
         get_dom_component_subset is_OK_returns_result_E is_OK_returns_result_I to_tree_order_ok)
   ultimately have "set to' \<subseteq> set c"
     using assms(1) assms(2) assms(3) assms(4) get_dom_component_subset
       get_dom_component_to_tree_order_subset
     by blast
   moreover have "cast result \<in> set to'"
     using assms get_elements_by_class_name_result_in_tree_order to' by blast
   ultimately show "cast result \<in> set c"
     by blast
 qed
 
 lemma get_elements_by_class_name_pure [simp]:
   "pure (get_elements_by_class_name ptr name) h"
   by(auto simp add: get_elements_by_class_name_def intro!: bind_pure_I map_filter_M_pure
       split: option.splits)
 
 lemma get_elements_by_class_name_is_strongly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_elements_by_class_name ptr name \<rightarrow>\<^sub>r results"
   assumes "h \<turnstile> get_elements_by_class_name ptr name \<rightarrow>\<^sub>h h'"
   shows "is_strongly_dom_component_safe {ptr} (cast ` set results) h h'"
 proof -
   have "h = h'"
     using assms(5)
     by (meson get_elements_by_class_name_pure pure_returns_heap_eq)
   have "ptr |\<in>| object_ptr_kinds h"
     using assms(4)
     apply(auto simp add: get_elements_by_class_name_def)[1]
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) bind_is_OK_E is_OK_returns_result_I
         local.first_in_tree_order_def local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap)
   obtain to where to: "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
     by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
         local.to_tree_order_ok)
   then have "cast ` set results \<subseteq> set to"
     using assms(4) local.get_elements_by_class_name_result_in_tree_order by auto
   obtain c where c: "h \<turnstile> a_get_dom_component ptr \<rightarrow>\<^sub>r c"
     using \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) local.get_dom_component_impl
       local.get_dom_component_ok by blast
 
   then show ?thesis
     using assms \<open>h = h'\<close>
     apply(auto simp add: is_strongly_dom_component_safe_def Let_def preserved_def
         get_elements_by_class_name_def first_in_tree_order_def elim!: bind_returns_result_E2
         intro!: map_filter_M_pure bind_pure_I split: option.splits list.splits)[1]
     by (metis (no_types, lifting) Int_iff \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(4) finite_set_in
         get_elements_by_class_name_is_strongly_dom_component_safe_step local.get_dom_component_impl
         local.get_dom_component_ptr select_result_I2)
 qed
 end
 
 interpretation i_get_dom_component_get_elements_by_class_name?:
   l_get_dom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
   get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
   by(auto simp add: l_get_dom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_dom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>get\_elements\_by\_tag\_name\<close>
 
 locale l_get_dom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_first_in_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_element_by\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma get_elements_by_tag_name_is_strongly_dom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   assumes "h \<turnstile> get_elements_by_tag_name ptr' idd \<rightarrow>\<^sub>r results"
   assumes "result \<in> set results"
   shows "cast result \<in> set c \<longleftrightarrow> ptr' \<in> set c"
 proof
   assume 1: "cast result \<in> set c"
   obtain root_ptr where
     root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
     by (metis assms(4) bind_is_OK_E get_dom_component_def is_OK_returns_result_I)
   then have "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
     using \<open>h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c\<close>
     by (simp add: get_dom_component_def bind_returns_result_E3)
 
   obtain to' where to': "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'"
     using assms(5)
     apply(simp add: get_elements_by_tag_name_def first_in_tree_order_def)
     by (meson bind_is_OK_E is_OK_returns_result_I)
   then have "cast result \<in> set to'"
     using assms get_elements_by_tag_name_result_in_tree_order by blast
 
   have "h \<turnstile> get_root_node (cast result) \<rightarrow>\<^sub>r root_ptr"
     using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_root_node_same root_ptr
     by blast
   then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root_ptr"
     using \<open>cast result \<in> set to'\<close> \<open>h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'\<close>
     using "1" assms(1) assms(2) assms(3) assms(4) get_dom_component_ptr
       get_dom_component_root_node_same get_dom_component_subset get_dom_component_to_tree_order
     by blast
   then have "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
     using \<open>h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c\<close>
     using get_dom_component_def by auto
   then show "ptr' \<in> set c"
     using assms(1) assms(2) assms(3) get_dom_component_ptr by blast
 next
   assume "ptr' \<in> set c"
   moreover obtain to' where to': "h \<turnstile> to_tree_order ptr' \<rightarrow>\<^sub>r to'"
     by (meson assms(1) assms(2) assms(3) assms(4) calculation get_dom_component_ptr_in_heap
         get_dom_component_subset is_OK_returns_result_E is_OK_returns_result_I to_tree_order_ok)
   ultimately have "set to' \<subseteq> set c"
     using assms(1) assms(2) assms(3) assms(4) get_dom_component_subset
       get_dom_component_to_tree_order_subset
     by blast
   moreover have "cast result \<in> set to'"
     using assms get_elements_by_tag_name_result_in_tree_order to' by blast
   ultimately show "cast result \<in> set c"
     by blast
 qed
 
 lemma get_elements_by_tag_name_is_strongly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_elements_by_tag_name ptr name \<rightarrow>\<^sub>r results"
   assumes "h \<turnstile> get_elements_by_tag_name ptr name \<rightarrow>\<^sub>h h'"
   shows "is_strongly_dom_component_safe {ptr} (cast ` set results) h h'"
 proof -
   have "h = h'"
     using assms(5)
     by (meson get_elements_by_tag_name_pure pure_returns_heap_eq)
   have "ptr |\<in>| object_ptr_kinds h"
     using assms(4)
     apply(auto simp add: get_elements_by_tag_name_def)[1]
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) bind_is_OK_E is_OK_returns_result_I
         local.first_in_tree_order_def local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap)
   obtain to where to: "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
     by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
         local.to_tree_order_ok)
   then have "cast ` set results \<subseteq> set to"
     using assms(4) local.get_elements_by_tag_name_result_in_tree_order by auto
   obtain c where c: "h \<turnstile> a_get_dom_component ptr \<rightarrow>\<^sub>r c"
     using \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) local.get_dom_component_impl
       local.get_dom_component_ok by blast
 
   then show ?thesis
     using assms \<open>h = h'\<close>
     apply(auto simp add: is_strongly_dom_component_safe_def Let_def preserved_def
         get_elements_by_class_name_def first_in_tree_order_def elim!: bind_returns_result_E2
         intro!: map_filter_M_pure bind_pure_I split: option.splits list.splits)[1]
     by (metis (no_types, lifting) IntI \<open>ptr |\<in>| object_ptr_kinds h\<close> finite_set_in
         get_elements_by_tag_name_is_strongly_dom_component_safe_step local.get_dom_component_impl
         local.get_dom_component_ptr select_result_I2)
 qed
 end
 
 interpretation i_get_dom_component_get_elements_by_tag_name?:
   l_get_dom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
   get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
   by(auto simp add: l_get_dom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_dom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>remove\_child\<close>
 
 lemma remove_child_unsafe: "\<not>(\<forall>(h
     :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
   ) h' ptr child. heap_is_wellformed h \<longrightarrow> type_wf h \<longrightarrow> known_ptrs h \<longrightarrow>
 h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h' \<longrightarrow> is_weakly_dom_component_safe {ptr, cast child} {} h h')"
 proof -
   obtain h document_ptr e1 e2 where h: "Inr ((document_ptr, e1, e2), h) = (Heap (fmempty)
       :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
     ) \<turnstile> (do {
       document_ptr \<leftarrow> create_document;
       e1 \<leftarrow> create_element document_ptr ''div'';
       e2 \<leftarrow> create_element document_ptr ''div'';
       append_child (cast e1) (cast e2);
       return (document_ptr, e1, e2)
   })"
     by(code_simp, auto simp add: equal_eq List.member_def)+
   then obtain h' where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     h': "h \<turnstile> remove_child (cast e1) (cast e2) \<rightarrow>\<^sub>h h'" and
     "\<not>(is_weakly_dom_component_safe {cast e1, cast e2} {} h h')"
     apply(code_simp)
     apply(clarify)
     by(code_simp, auto simp add: equal_eq List.member_def)+
   then show ?thesis
     by auto
 qed
 
 
 subsubsection \<open>adopt\_node\<close>
 
 lemma adopt_node_unsafe: "\<not>(\<forall>(h
     :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
   ) h' document_ptr child. heap_is_wellformed h \<longrightarrow> type_wf h \<longrightarrow> known_ptrs h \<longrightarrow> h \<turnstile> adopt_node document_ptr child \<rightarrow>\<^sub>h h' \<longrightarrow> is_weakly_dom_component_safe {cast document_ptr, cast child} {} h h')"
 proof -
   obtain h document_ptr document_ptr2 e1 where h: "Inr ((document_ptr, document_ptr2, e1), h) = (Heap (fmempty)
       :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
     ) \<turnstile> (do {
       document_ptr \<leftarrow> create_document;
       document_ptr2 \<leftarrow> create_document;
       e1 \<leftarrow> create_element document_ptr ''div'';
       adopt_node document_ptr2 (cast e1);
       return (document_ptr, document_ptr2, e1)
   })"
     by(code_simp, auto simp add: equal_eq List.member_def)+
   then obtain h' where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     h': "h \<turnstile> adopt_node document_ptr (cast e1) \<rightarrow>\<^sub>h h'" and
     "\<not>(is_weakly_dom_component_safe {cast document_ptr, cast e1} {} h h')"
     apply(code_simp)
     apply(clarify)
     by(code_simp, auto simp add: equal_eq List.member_def)+
   then show ?thesis
     by auto
 qed
 
 
 subsubsection \<open>create\_element\<close>
 
 lemma create_element_not_strongly_dom_component_safe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap" and
     h' and document_ptr and new_element_ptr and tag where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr \<rightarrow>\<^sub>h h'" and
     "\<not> is_strongly_dom_component_safe {cast document_ptr} {cast new_element_ptr} h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
 'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap"
   let ?P = "create_document"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?document_ptr = "|?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and document_ptr="?document_ptr"])
     by code_simp+
 qed
 
 
 locale l_get_dom_component_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs
   get_ancestors get_ancestors_locs get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id
   get_elements_by_class_name get_elements_by_tag_name +
   l_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes
   set_disconnected_nodes_locs set_tag_name set_tag_name_locs type_wf create_element known_ptr +
   l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_disconnected_nodes get_disconnected_nodes_locs +
   l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_disconnected_nodes set_disconnected_nodes_locs +
   l_set_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_tag_name set_tag_name_locs +
   l_new_element_get_disconnected_nodes get_disconnected_nodes get_disconnected_nodes_locs +
   l_new_element_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs +
   l_set_tag_name_get_child_nodes type_wf set_tag_name set_tag_name_locs known_ptr
   get_child_nodes get_child_nodes_locs +
   l_create_element_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr known_ptrs type_wf get_child_nodes get_child_nodes_locs
   get_disconnected_nodes get_disconnected_nodes_locs heap_is_wellformed parent_child_rel set_tag_name
   set_tag_name_locs
   set_disconnected_nodes set_disconnected_nodes_locs create_element
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
     and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
     and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
     and type_wf :: "(_) heap \<Rightarrow> bool"
     and known_ptrs :: "(_) heap \<Rightarrow> bool"
     and to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
     and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
     and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
     and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_dom_component :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
     and is_strongly_dom_component_safe :: "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
     and is_weakly_dom_component_safe :: "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
     and get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
     and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_ancestors :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
     and get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_element_by_id :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog"
     and get_elements_by_class_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
     and get_elements_by_tag_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
     and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
     and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
     and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
     and set_tag_name :: "(_) element_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
     and set_tag_name_locs :: "(_) element_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
     and create_element :: "(_) document_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr) prog"
 begin
 
 lemma create_element_is_weakly_dom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>h h'"
   assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast document_ptr)|\<^sub>r"
   assumes "ptr \<noteq> cast |h \<turnstile> create_element document_ptr tag|\<^sub>r"
   shows "preserved (get_M ptr getter) h h'"
 proof -
   obtain new_element_ptr h2 h3 disc_nodes where
     new_element_ptr: "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr" and
     h2: "h \<turnstile> new_element \<rightarrow>\<^sub>h h2" and
     h3: "h2 \<turnstile>set_tag_name new_element_ptr tag \<rightarrow>\<^sub>h h3" and
     disc_nodes: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes" and
     h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_element_ptr # disc_nodes) \<rightarrow>\<^sub>h h'"
     using assms(4)
     by(auto simp add: create_element_def
         elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated])
   have "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr"
     using new_element_ptr h2 h3 disc_nodes h'
     apply(auto simp add: create_element_def intro!: bind_returns_result_I
         bind_pure_returns_result_I[OF get_disconnected_nodes_pure])[1]
      apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
     by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
   have "preserved (get_M ptr getter) h h2"
     using h2 new_element_ptr
     apply(rule new_element_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t)
     using new_element_ptr assms(6) \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close>
     by simp
 
   have "preserved (get_M ptr getter) h2 h3"
     using set_tag_name_writes h3
     apply(rule reads_writes_preserved2)
     apply(auto simp add: set_tag_name_locs_impl a_set_tag_name_locs_def all_args_def)[1]
     by (metis (no_types, lifting) \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close> assms(6)
         get_M_Element_preserved8 select_result_I2)
 
   have "document_ptr |\<in>| document_ptr_kinds h"
     using create_element_document_in_heap
     using assms(4)
     by blast
   then
   have "ptr \<noteq> (cast document_ptr)"
     using assms(5) assms(1) assms(2) assms(3) local.get_dom_component_ok local.get_dom_component_ptr
     by auto
   have "preserved (get_M ptr getter) h3 h'"
     using set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved2)
     apply(auto simp add: set_disconnected_nodes_locs_def all_args_def)[1]
     by (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
 
   show ?thesis
     using \<open>preserved (get_M ptr getter) h h2\<close> \<open>preserved (get_M ptr getter) h2 h3\<close>
       \<open>preserved (get_M ptr getter) h3 h'\<close>
     by(auto simp add: preserved_def)
 qed
 
 
 lemma create_element_is_weakly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r result"
   assumes "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>h h'"
   shows "is_weakly_dom_component_safe {cast document_ptr} {cast result} h h'"
 proof -
 
   obtain new_element_ptr h2 h3 disc_nodes_h3 where
     new_element_ptr: "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr" and
     h2: "h \<turnstile> new_element \<rightarrow>\<^sub>h h2" and
     h3: "h2 \<turnstile> set_tag_name new_element_ptr tag \<rightarrow>\<^sub>h h3" and
     disc_nodes_h3: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3" and
     h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_element_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'"
     using assms(5)
     by(auto simp add: create_element_def
         elim!: bind_returns_heap_E
         bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
   then have "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr"
     apply(auto simp add: create_element_def intro!: bind_returns_result_I)[1]
       apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
      apply (metis is_OK_returns_heap_E is_OK_returns_result_I local.get_disconnected_nodes_pure
         pure_returns_heap_eq)
     by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
 
   have "new_element_ptr \<notin> set |h \<turnstile> element_ptr_kinds_M|\<^sub>r"
     using new_element_ptr ElementMonad.ptr_kinds_ptr_kinds_M h2
     using new_element_ptr_not_in_heap by blast
   then have "cast new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r"
     by simp
   then have "cast new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
 
   have object_ptr_kinds_eq_h: "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
     using new_element_new_ptr h2 new_element_ptr by blast
   then have node_ptr_kinds_eq_h: "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
     apply(simp add: node_ptr_kinds_def)
     by force
   then have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h |\<union>| {|new_element_ptr|}"
     apply(simp add: element_ptr_kinds_def)
     by force
   have character_data_ptr_kinds_eq_h: "character_data_ptr_kinds h2 = character_data_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: node_ptr_kinds_def character_data_ptr_kinds_def)
   have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: document_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
           OF set_tag_name_writes h3])
     using set_tag_name_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
     using object_ptr_kinds_eq_h2
     by(auto simp add: node_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
           OF set_disconnected_nodes_writes h'])
     using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
     using object_ptr_kinds_eq_h3
     by(auto simp add: node_ptr_kinds_def)
 
   have "known_ptr (cast new_element_ptr)"
     using \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close> local.create_element_known_ptr
     by blast
   then
   have "known_ptrs h2"
     using known_ptrs_new_ptr object_ptr_kinds_eq_h \<open>known_ptrs h\<close> h2
     by blast
   then
   have "known_ptrs h3"
     using known_ptrs_preserved object_ptr_kinds_eq_h2 by blast
   then
   have "known_ptrs h'"
     using known_ptrs_preserved object_ptr_kinds_eq_h3 by blast
 
 
   have "document_ptr |\<in>| document_ptr_kinds h"
     using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
       get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
     by (metis is_OK_returns_result_I)
 
   have children_eq_h: "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_element_ptr
               \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads h2 get_child_nodes_new_element[rotated, OF new_element_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
   then have children_eq2_h: "\<And>ptr'. ptr' \<noteq> cast new_element_ptr
                                     \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
 
   have "h2 \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []"
     using new_element_ptr h2 new_element_ptr_in_heap[OF h2 new_element_ptr]
       new_element_is_element_ptr[OF new_element_ptr] new_element_no_child_nodes
     by blast
   have disconnected_nodes_eq_h:
     "\<And>doc_ptr disc_nodes. h \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                              = h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads h2 get_disconnected_nodes_new_element[OF new_element_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
   then have disconnected_nodes_eq2_h:
     "\<And>doc_ptr. |h \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have children_eq_h2:
     "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_tag_name_writes h3
     apply(rule reads_writes_preserved)
     by(auto simp add: set_tag_name_get_child_nodes)
   then have children_eq2_h2: "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   have disconnected_nodes_eq_h2:
     "\<And>doc_ptr disc_nodes. h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                                = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_tag_name_writes h3
     apply(rule reads_writes_preserved)
     by(auto simp add: set_tag_name_get_disconnected_nodes)
   then have disconnected_nodes_eq2_h2:
     "\<And>doc_ptr. |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have "type_wf h2"
     using \<open>type_wf h\<close> new_element_types_preserved h2 by blast
   then have "type_wf h3"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_tag_name_writes h3]
     using  set_tag_name_types_preserved
     by(auto simp add: reflp_def transp_def)
   then have "type_wf h'"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h']
     using  set_disconnected_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
   have children_eq_h3:
     "\<And>ptr' children. h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved)
     by(auto simp add: set_disconnected_nodes_get_child_nodes)
   then have children_eq2_h3: "\<And>ptr'. |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   have disconnected_nodes_eq_h3:
     "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr
        \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                                = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved)
     by(auto simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
   then have disconnected_nodes_eq2_h3:
     "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
                 \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have disc_nodes_document_ptr_h2: "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
     using disconnected_nodes_eq_h2 disc_nodes_h3 by auto
   then have disc_nodes_document_ptr_h: "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
     using disconnected_nodes_eq_h by auto
   then have "cast new_element_ptr \<notin> set disc_nodes_h3"
     using \<open>heap_is_wellformed h\<close>
     using \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
       a_all_ptrs_in_heap_def heap_is_wellformed_def
     using NodeMonad.ptr_kinds_ptr_kinds_M local.heap_is_wellformed_disc_nodes_in_heap by blast
 
   have "acyclic (parent_child_rel h)"
     using \<open>heap_is_wellformed h\<close>
     by (simp add: heap_is_wellformed_def acyclic_heap_def)
   also have "parent_child_rel h = parent_child_rel h2"
   proof(auto simp add: parent_child_rel_def)[1]
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h"
       and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
     then show "a |\<in>| object_ptr_kinds h2"
       by (simp add: object_ptr_kinds_eq_h)
   next
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h"
       and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
     then show "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
       by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
           \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
   next
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h2"
       and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
     then show "a |\<in>| object_ptr_kinds h"
       using object_ptr_kinds_eq_h \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close>
       by(auto)
   next
     fix a x
     assume 0: "a |\<in>| object_ptr_kinds h2"
       and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
     then show "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
       by (metis (no_types, lifting)
           \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close>
           children_eq2_h empty_iff empty_set image_eqI select_result_I2)
   qed
   also have "\<dots> = parent_child_rel h3"
     by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h2 children_eq2_h2)
   also have "\<dots> = parent_child_rel h'"
     by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h3 children_eq2_h3)
   finally have "a_acyclic_heap h'"
     by (simp add: acyclic_heap_def)
 
   have "a_all_ptrs_in_heap h"
     using \<open>heap_is_wellformed h\<close>  by (simp add: heap_is_wellformed_def)
   then have "a_all_ptrs_in_heap h2"
     apply(auto simp add: a_all_ptrs_in_heap_def)[1]
      apply (metis \<open>known_ptrs h2\<close> \<open>parent_child_rel h = parent_child_rel h2\<close> \<open>type_wf h2\<close> assms
         funion_iff local.get_child_nodes_ok local.known_ptrs_known_ptr local.parent_child_rel_child_in_heap
         local.parent_child_rel_child_nodes2 node_ptr_kinds_commutes node_ptr_kinds_eq_h
         returns_result_select_result)
     by (metis assms disconnected_nodes_eq2_h document_ptr_kinds_eq_h funion_iff
         local.get_disconnected_nodes_ok local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_eq_h
         returns_result_select_result)
   then have "a_all_ptrs_in_heap h3"
     by (simp add: children_eq2_h2 disconnected_nodes_eq2_h2 document_ptr_kinds_eq_h2
         local.a_all_ptrs_in_heap_def node_ptr_kinds_eq_h2 object_ptr_kinds_eq_h2)
   then have "a_all_ptrs_in_heap h'"
-    by (smt \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close> children_eq2_h3
-        disc_nodes_document_ptr_h2 disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq_h3
-        finite_set_in h' is_OK_returns_result_I
-        l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes
-        local.a_all_ptrs_in_heap_def local.get_child_nodes_ptr_in_heap
-        local.l_set_disconnected_nodes_get_disconnected_nodes_axioms node_ptr_kinds_commutes
-        object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 select_result_I2 set_ConsD subset_code(1))
+    using assms(1) assms(2) assms(3) assms(5) local.create_element_preserves_wellformedness(1) local.heap_is_wellformed_def
+    by blast
 
   have "\<And>p. p |\<in>| object_ptr_kinds h \<Longrightarrow> cast new_element_ptr \<notin> set |h \<turnstile> get_child_nodes p|\<^sub>r"
     using \<open>heap_is_wellformed h\<close> \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
       heap_is_wellformed_children_in_heap
     by (meson NodeMonad.ptr_kinds_ptr_kinds_M a_all_ptrs_in_heap_def assms fset_mp
         fset_of_list_elem get_child_nodes_ok known_ptrs_known_ptr returns_result_select_result)
   then have "\<And>p. p |\<in>| object_ptr_kinds h2 \<Longrightarrow> cast new_element_ptr \<notin> set |h2 \<turnstile> get_child_nodes p|\<^sub>r"
     using children_eq2_h
     apply(auto simp add: object_ptr_kinds_eq_h)[1]
     using \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close> apply auto[1]
     by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
         \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>)
   then have "\<And>p. p |\<in>| object_ptr_kinds h3 \<Longrightarrow> cast new_element_ptr \<notin> set |h3 \<turnstile> get_child_nodes p|\<^sub>r"
     using object_ptr_kinds_eq_h2 children_eq2_h2 by auto
   then have new_element_ptr_not_in_any_children:
     "\<And>p. p |\<in>| object_ptr_kinds h' \<Longrightarrow> cast new_element_ptr \<notin> set |h' \<turnstile> get_child_nodes p|\<^sub>r"
     using object_ptr_kinds_eq_h3 children_eq2_h3 by auto
 
   have "a_distinct_lists h"
     using \<open>heap_is_wellformed h\<close>
     by (simp add: heap_is_wellformed_def)
   then have "a_distinct_lists h2"
 
     using \<open>h2 \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []\<close>
     apply(auto simp add: a_distinct_lists_def object_ptr_kinds_eq_h document_ptr_kinds_eq_h
         disconnected_nodes_eq2_h intro!: distinct_concat_map_I)[1]
        apply (metis distinct_sorted_list_of_set finite_fset sorted_list_of_set_insert_remove)
       apply(case_tac "x=cast new_element_ptr")
        apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
       apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
      apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
      apply (metis IntI assms empty_iff local.get_child_nodes_ok
         local.heap_is_wellformed_one_parent local.known_ptrs_known_ptr returns_result_select_result)
     apply(auto simp add: children_eq2_h[symmetric] insort_split dest: distinct_concat_map_E(2))[1]
     by (metis \<open>local.a_distinct_lists h\<close> \<open>type_wf h2\<close> disconnected_nodes_eq_h document_ptr_kinds_eq_h
         local.distinct_lists_no_parent local.get_disconnected_nodes_ok returns_result_select_result)
 
   then have "a_distinct_lists h3"
     by(auto simp add: a_distinct_lists_def disconnected_nodes_eq2_h2 document_ptr_kinds_eq_h2
         children_eq2_h2 object_ptr_kinds_eq_h2)
   then have "a_distinct_lists h'"
   proof(auto simp add: a_distinct_lists_def disconnected_nodes_eq2_h3 children_eq2_h3
       object_ptr_kinds_eq_h3 document_ptr_kinds_eq_h3
       intro!: distinct_concat_map_I)[1]
     fix x
     assume "distinct (concat (map (\<lambda>document_ptr. |h3 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                               (sorted_list_of_set (fset (document_ptr_kinds h3)))))"
       and "x |\<in>| document_ptr_kinds h3"
     then show "distinct |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
       using document_ptr_kinds_eq_h3 disconnected_nodes_eq_h3 h' set_disconnected_nodes_get_disconnected_nodes
       by (metis (no_types, lifting) \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set disc_nodes_h3\<close>
           \<open>a_distinct_lists h3\<close> \<open>type_wf h'\<close> disc_nodes_h3 distinct.simps(2)
           distinct_lists_disconnected_nodes get_disconnected_nodes_ok returns_result_eq
           returns_result_select_result)
   next
     fix x y xa
     assume "distinct (concat (map (\<lambda>document_ptr. |h3 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                             (sorted_list_of_set (fset (document_ptr_kinds h3)))))"
       and "x |\<in>| document_ptr_kinds h3"
       and "y |\<in>| document_ptr_kinds h3"
       and "x \<noteq> y"
       and "xa \<in> set |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
       and "xa \<in> set |h' \<turnstile> get_disconnected_nodes y|\<^sub>r"
     moreover have "set |h3 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h3 \<turnstile> get_disconnected_nodes y|\<^sub>r = {}"
       using calculation by(auto dest: distinct_concat_map_E(1))
     ultimately show "False"
       apply(-)
       apply(cases "x = document_ptr")
-       apply (smt NodeMonad.ptr_kinds_ptr_kinds_M
-          \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close> \<open>local.a_all_ptrs_in_heap h\<close>
-          disc_nodes_h3 disconnected_nodes_eq2_h disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3
-          disjoint_iff_not_equal document_ptr_kinds_eq_h document_ptr_kinds_eq_h2 finite_set_in h'
-          l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes
-          local.a_all_ptrs_in_heap_def local.l_set_disconnected_nodes_get_disconnected_nodes_axioms
-          select_result_I2 set_ConsD subsetD)
-      by (smt NodeMonad.ptr_kinds_ptr_kinds_M
-          \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close> \<open>local.a_all_ptrs_in_heap h\<close>
-          disc_nodes_document_ptr_h2 disconnected_nodes_eq2_h disconnected_nodes_eq2_h2
-          disconnected_nodes_eq2_h3
-          disjoint_iff_not_equal document_ptr_kinds_eq_h document_ptr_kinds_eq_h2 finite_set_in h'
-          l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes
-          local.a_all_ptrs_in_heap_def local.l_set_disconnected_nodes_get_disconnected_nodes_axioms
-          select_result_I2 set_ConsD subsetD)
+       apply (metis (mono_tags, lifting) Int_Collect Int_iff \<open>type_wf h'\<close> assms(1) assms(2) assms(3)
+               assms(5) bot_set_def document_ptr_kinds_eq_h3 empty_Collect_eq
+               l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_disconnected_nodes_ok
+               l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.heap_is_wellformed_one_disc_parent
+               local.create_element_preserves_wellformedness(1)
+               local.l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms
+               local.l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms returns_result_select_result)
+      by (metis (no_types, opaque_lifting) \<open>type_wf h'\<close> assms(1) assms(2) assms(3) assms(5)
+          disjoint_iff document_ptr_kinds_eq_h3 local.create_element_preserves_wellformedness(1)
+          local.get_disconnected_nodes_ok local.heap_is_wellformed_one_disc_parent
+          returns_result_select_result)
   next
     fix x xa xb
     assume 2: "(\<Union>x\<in>fset (object_ptr_kinds h3). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
                    \<inter> (\<Union>x\<in>fset (document_ptr_kinds h3). set |h3 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
       and 3: "xa |\<in>| object_ptr_kinds h3"
       and 4: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
       and 5: "xb |\<in>| document_ptr_kinds h3"
       and 6: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
     show "False"
       using disc_nodes_document_ptr_h disconnected_nodes_eq2_h3
       apply -
       apply(cases "xb = document_ptr")
        apply (metis (no_types, opaque_lifting) "3" "4" "6"
           \<open>\<And>p. p |\<in>| object_ptr_kinds h3
                       \<Longrightarrow> cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h3 \<turnstile> get_child_nodes p|\<^sub>r\<close>
           \<open>a_distinct_lists h3\<close> children_eq2_h3 disc_nodes_h3 distinct_lists_no_parent h'
           select_result_I2 set_ConsD set_disconnected_nodes_get_disconnected_nodes)
       by (metis "3" "4" "5" "6" \<open>a_distinct_lists h3\<close> \<open>type_wf h3\<close> children_eq2_h3
           distinct_lists_no_parent get_disconnected_nodes_ok returns_result_select_result)
   qed
 
   have "a_owner_document_valid h"
     using \<open>heap_is_wellformed h\<close>  by (simp add: heap_is_wellformed_def)
   then have "a_owner_document_valid h'"
     using disc_nodes_h3 \<open>document_ptr |\<in>| document_ptr_kinds h\<close>
     apply(auto simp add: a_owner_document_valid_def)[1]
     apply(auto simp add:  object_ptr_kinds_eq_h object_ptr_kinds_eq_h3 )[1]
     apply(auto simp add: object_ptr_kinds_eq_h2)[1]
     apply(auto simp add:  document_ptr_kinds_eq_h document_ptr_kinds_eq_h3 )[1]
     apply(auto simp add: document_ptr_kinds_eq_h2)[1]
     apply(auto simp add:  node_ptr_kinds_eq_h node_ptr_kinds_eq_h3 )[1]
     apply(auto simp add: node_ptr_kinds_eq_h2 node_ptr_kinds_eq_h )[1]
      apply(auto simp add: children_eq2_h2[symmetric] children_eq2_h3[symmetric]
         disconnected_nodes_eq2_h disconnected_nodes_eq2_h2
         disconnected_nodes_eq2_h3)[1]
      apply (metis (no_types, lifting) document_ptr_kinds_eq_h h' list.set_intros(1)
         local.set_disconnected_nodes_get_disconnected_nodes select_result_I2)
     apply(simp add: object_ptr_kinds_eq_h)
     by(metis (no_types, lifting) NodeMonad.ptr_kinds_ptr_kinds_M
         \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close> children_eq2_h
         children_eq2_h2 children_eq2_h3 disconnected_nodes_eq2_h disconnected_nodes_eq2_h2
         disconnected_nodes_eq2_h3 document_ptr_kinds_eq_h finite_set_in h'
         l_set_disconnected_nodes_get_disconnected_nodes.set_disconnected_nodes_get_disconnected_nodes
         list.set_intros(2) local.l_set_disconnected_nodes_get_disconnected_nodes_axioms
         node_ptr_kinds_commutes select_result_I2)
 
 
   have "parent_child_rel h = parent_child_rel h'"
   proof -
     have "parent_child_rel h = parent_child_rel h2"
     proof(auto simp add: parent_child_rel_def)[1]
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h"
         and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
       then show "a |\<in>| object_ptr_kinds h2"
         by (simp add: object_ptr_kinds_eq_h)
     next
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h"
         and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
       then show "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
         by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
             \<open>cast new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
     next
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h2"
         and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
       then show "a |\<in>| object_ptr_kinds h"
         using object_ptr_kinds_eq_h \<open>h2 \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []\<close>
         by(auto)
     next
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h2"
         and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
       then show "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
         by (metis (no_types, lifting) \<open>h2 \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []\<close>
             children_eq2_h empty_iff empty_set image_eqI select_result_I2)
     qed
     also have "\<dots> = parent_child_rel h3"
       by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h2 children_eq2_h2)
     also have "\<dots> = parent_child_rel h'"
       by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h3 children_eq2_h3)
     finally show ?thesis
       by simp
   qed
   have root: "h \<turnstile> get_root_node (cast document_ptr) \<rightarrow>\<^sub>r cast document_ptr"
     by (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close> local.get_root_node_not_node_same)
   then
   have root': "h' \<turnstile> get_root_node (cast document_ptr) \<rightarrow>\<^sub>r cast document_ptr"
     by (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close> document_ptr_kinds_eq_h
         local.get_root_node_not_node_same object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3)
 
   have "heap_is_wellformed h'" and "known_ptrs h'"
     using create_element_preserves_wellformedness assms
     by blast+
 
   have "cast result |\<notin>| object_ptr_kinds h"
     using \<open>cast new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
     by (metis (full_types) ObjectMonad.ptr_kinds_ptr_kinds_M
         \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close> assms(4) returns_result_eq)
 
   obtain to where to: "h \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to"
     by (meson \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(1) assms(2) assms(3)
         document_ptr_kinds_commutes is_OK_returns_result_E local.to_tree_order_ok)
   then
   have "h \<turnstile> a_get_dom_component (cast document_ptr) \<rightarrow>\<^sub>r to"
     using root
     by(auto simp add: a_get_dom_component_def)
   moreover
   obtain to' where to': "h' \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to'"
     by (meson \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> is_OK_returns_result_E
         local.get_root_node_root_in_heap local.to_tree_order_ok root')
   then
   have "h' \<turnstile> a_get_dom_component (cast document_ptr) \<rightarrow>\<^sub>r to'"
     using root'
     by(auto simp add: a_get_dom_component_def)
   moreover
   have "\<And>child. child \<in> set to \<longleftrightarrow> child \<in> set to'"
     by (metis \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close> \<open>parent_child_rel h = parent_child_rel h'\<close>
         \<open>type_wf h'\<close> assms(1) assms(2) assms(3) local.to_tree_order_parent_child_rel to to')
   ultimately
   have "set |h \<turnstile> local.a_get_dom_component (cast document_ptr)|\<^sub>r =
 set |h' \<turnstile> local.a_get_dom_component (cast document_ptr)|\<^sub>r"
     by(auto simp add: a_get_dom_component_def)
 
   show ?thesis
     apply(auto simp add: is_weakly_dom_component_safe_def Let_def)[1]
     using \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close> assms(2) assms(3)
       children_eq_h local.get_child_nodes_ok local.get_child_nodes_ptr_in_heap local.known_ptrs_known_ptr
       object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 returns_result_select_result
        apply (metis is_OK_returns_result_I)
       apply (metis \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close> assms(4)
         element_ptr_kinds_commutes h2 new_element_ptr new_element_ptr_in_heap node_ptr_kinds_eq_h2
         node_ptr_kinds_eq_h3 returns_result_eq returns_result_heap_def)
     using \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r result |\<notin>| object_ptr_kinds h\<close> element_ptr_kinds_commutes
       node_ptr_kinds_commutes apply blast
     using assms(1) assms(2) assms(3) \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>h h'\<close>
     apply(rule create_element_is_weakly_dom_component_safe_step)
      apply (simp add: local.get_dom_component_impl)
     using \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
       \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close>
     by auto
 
 qed
 end
 
 interpretation i_get_dom_component_create_element?: l_get_dom_component_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   known_ptr heap_is_wellformed parent_child_rel type_wf known_ptrs to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_element_by_id get_elements_by_class_name get_elements_by_tag_name get_disconnected_nodes
   get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs set_tag_name
   set_tag_name_locs create_element
   by(auto simp add: l_get_dom_component_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_dom_component_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 
 subsubsection \<open>create\_character\_data\<close>
 
 lemma create_character_data_not_strongly_dom_component_safe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder},
 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap" and
     h' and document_ptr and create_character_datanew_character_data_ptr and tag where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> create_character_data document_ptr tag \<rightarrow>\<^sub>r create_character_datanew_character_data_ptr \<rightarrow>\<^sub>h h'" and
     "\<not> is_strongly_dom_component_safe {cast document_ptr} {cast create_character_datanew_character_data_ptr} h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
 'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap"
   let ?P = "create_document"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?document_ptr = "|?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and document_ptr="?document_ptr"])
     by code_simp+
 qed
 
 locale l_get_dom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs
   get_ancestors get_ancestors_locs get_disconnected_nodes get_disconnected_nodes_locs
   get_element_by_id get_elements_by_class_name get_elements_by_tag_name +
   l_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes
   set_disconnected_nodes_locs set_val set_val_locs type_wf create_character_data known_ptr +
   l_get_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf get_disconnected_nodes get_disconnected_nodes_locs +
   l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_disconnected_nodes set_disconnected_nodes_locs +
   l_set_val\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_val set_val_locs +
   l_create_character_data_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr type_wf get_child_nodes get_child_nodes_locs
   get_disconnected_nodes get_disconnected_nodes_locs heap_is_wellformed parent_child_rel set_val
   set_val_locs set_disconnected_nodes set_disconnected_nodes_locs
   create_character_data known_ptrs
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
     and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
     and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
     and type_wf :: "(_) heap \<Rightarrow> bool"
     and known_ptrs :: "(_) heap \<Rightarrow> bool"
     and to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
     and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
     and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
     and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_dom_component :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
     and is_strongly_dom_component_safe :: "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
     and is_weakly_dom_component_safe :: "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
     and get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
     and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_ancestors :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
     and get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_element_by_id :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog"
     and get_elements_by_class_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
     and get_elements_by_tag_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
     and set_val :: "(_) character_data_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, unit) prog"
     and set_val_locs :: "(_) character_data_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
     and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
     and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and set_disconnected_nodes :: "(_) document_ptr \<Rightarrow> (_) node_ptr list \<Rightarrow> ((_) heap, exception, unit) prog"
     and set_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
     and create_character_data :: "(_) document_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) character_data_ptr) prog"
 begin
 
 lemma create_character_data_is_weakly_dom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>h h'"
   assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast document_ptr)|\<^sub>r"
   assumes "ptr \<noteq> cast |h \<turnstile> create_character_data document_ptr text|\<^sub>r"
   shows "preserved (get_M ptr getter) h h'"
 proof -
   obtain new_character_data_ptr h2 h3 disc_nodes where
     new_character_data_ptr: "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr" and
     h2: "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h2" and
     h3: "h2 \<turnstile> set_val new_character_data_ptr text \<rightarrow>\<^sub>h h3" and
     disc_nodes: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes" and
     h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_character_data_ptr # disc_nodes) \<rightarrow>\<^sub>h h'"
     using assms(4)
     by(auto simp add: create_character_data_def elim!: bind_returns_heap_E
         bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated])
 
   have "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr"
     using new_character_data_ptr h2 h3 disc_nodes h'
     apply(auto simp add: create_character_data_def intro!: bind_returns_result_I
         bind_pure_returns_result_I[OF get_disconnected_nodes_pure])[1]
      apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
     by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
   have "preserved (get_M ptr getter) h h2"
     using h2 new_character_data_ptr
     apply(rule new_character_data_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t)
     using new_character_data_ptr assms(6)
       \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close>
     by simp
 
   have "preserved (get_M ptr getter) h2 h3"
     using set_val_writes h3
     apply(rule reads_writes_preserved2)
     apply(auto simp add: set_val_locs_impl a_set_val_locs_def all_args_def)[1]
     by (metis (mono_tags) CharacterData_simp11
         \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close> assms(4) assms(6)
         is_OK_returns_heap_I is_OK_returns_result_E returns_result_eq select_result_I2)
 
   have "document_ptr |\<in>| document_ptr_kinds h"
     using create_character_data_document_in_heap
     using assms(4)
     by blast
   then
   have "ptr \<noteq> (cast document_ptr)"
     using assms(5) assms(1) assms(2) assms(3) local.get_dom_component_ok local.get_dom_component_ptr
     by auto
   have "preserved (get_M ptr getter) h3 h'"
     using set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved2)
     apply(auto simp add: set_disconnected_nodes_locs_def all_args_def)[1]
     by (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
 
   show ?thesis
     using \<open>preserved (get_M ptr getter) h h2\<close> \<open>preserved (get_M ptr getter) h2 h3\<close>
       \<open>preserved (get_M ptr getter) h3 h'\<close>
     by(auto simp add: preserved_def)
 qed
 
 lemma create_character_data_is_weakly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r result"
   assumes "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>h h'"
   shows "is_weakly_dom_component_safe {cast document_ptr} {cast result} h h'"
 proof -
 
 
   obtain new_character_data_ptr h2 h3 disc_nodes_h3 where
     new_character_data_ptr: "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr" and
     h2: "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h2" and
     h3: "h2 \<turnstile> set_val new_character_data_ptr text \<rightarrow>\<^sub>h h3" and
     disc_nodes_h3: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3" and
     h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_character_data_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'"
     using assms(5)
     by(auto simp add: create_character_data_def
         elim!: bind_returns_heap_E
         bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
   then
   have "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr"
     apply(auto simp add: create_character_data_def intro!: bind_returns_result_I)[1]
       apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
      apply (metis is_OK_returns_heap_E is_OK_returns_result_I local.get_disconnected_nodes_pure
         pure_returns_heap_eq)
     by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
 
   have "new_character_data_ptr \<notin> set |h \<turnstile> character_data_ptr_kinds_M|\<^sub>r"
     using new_character_data_ptr CharacterDataMonad.ptr_kinds_ptr_kinds_M h2
     using new_character_data_ptr_not_in_heap by blast
   then have "cast new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r"
     by simp
   then have "cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
 
 
 
   have object_ptr_kinds_eq_h:
     "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
     using new_character_data_new_ptr h2 new_character_data_ptr by blast
   then have node_ptr_kinds_eq_h:
     "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
     apply(simp add: node_ptr_kinds_def)
     by force
   then have character_data_ptr_kinds_eq_h:
     "character_data_ptr_kinds h2 = character_data_ptr_kinds h |\<union>| {|new_character_data_ptr|}"
     apply(simp add: character_data_ptr_kinds_def)
     by force
   have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: node_ptr_kinds_def element_ptr_kinds_def)
   have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: document_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
           OF set_val_writes h3])
     using set_val_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
     using object_ptr_kinds_eq_h2
     by(auto simp add: node_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
           OF set_disconnected_nodes_writes h'])
     using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
     using object_ptr_kinds_eq_h3
     by(auto simp add: node_ptr_kinds_def)
 
 
   have "document_ptr |\<in>| document_ptr_kinds h"
     using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
       get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
     by (metis is_OK_returns_result_I)
 
   have children_eq_h: "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_character_data_ptr
                   \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads h2 get_child_nodes_new_character_data[rotated, OF new_character_data_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
   then have children_eq2_h:
     "\<And>ptr'. ptr' \<noteq> cast new_character_data_ptr
       \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   have object_ptr_kinds_eq_h:
     "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
     using new_character_data_new_ptr h2 new_character_data_ptr by blast
   then have node_ptr_kinds_eq_h:
     "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
     apply(simp add: node_ptr_kinds_def)
     by force
   then have character_data_ptr_kinds_eq_h:
     "character_data_ptr_kinds h2 = character_data_ptr_kinds h |\<union>| {|new_character_data_ptr|}"
     apply(simp add: character_data_ptr_kinds_def)
     by force
   have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: node_ptr_kinds_def element_ptr_kinds_def)
   have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: document_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
           OF set_val_writes h3])
     using set_val_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
     using object_ptr_kinds_eq_h2
     by(auto simp add: node_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
           OF set_disconnected_nodes_writes h'])
     using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
     using object_ptr_kinds_eq_h3
     by(auto simp add: node_ptr_kinds_def)
 
 
   have "document_ptr |\<in>| document_ptr_kinds h"
     using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
       get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
     by (metis is_OK_returns_result_I)
 
   have children_eq_h: "\<And>(ptr'::(_) object_ptr) children. ptr' \<noteq> cast new_character_data_ptr
                 \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads h2 get_child_nodes_new_character_data[rotated, OF new_character_data_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
   then have children_eq2_h: "\<And>ptr'. ptr' \<noteq> cast new_character_data_ptr
                                  \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
 
   have "h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []"
     using new_character_data_ptr h2 new_character_data_ptr_in_heap[OF h2 new_character_data_ptr]
       new_character_data_is_character_data_ptr[OF new_character_data_ptr]
       new_character_data_no_child_nodes
     by blast
   have disconnected_nodes_eq_h:
     "\<And>doc_ptr disc_nodes. h \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                              = h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads h2
       get_disconnected_nodes_new_character_data[OF new_character_data_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
   then have disconnected_nodes_eq2_h:
     "\<And>doc_ptr. |h \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have children_eq_h2:
     "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_val_writes h3
     apply(rule reads_writes_preserved)
     by(auto simp add: set_val_get_child_nodes)
   then have children_eq2_h2:
     "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   have disconnected_nodes_eq_h2:
     "\<And>doc_ptr disc_nodes. h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                               = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_val_writes h3
     apply(rule reads_writes_preserved)
     by(auto simp add: set_val_get_disconnected_nodes)
   then have disconnected_nodes_eq2_h2:
     "\<And>doc_ptr. |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have "type_wf h2"
     using \<open>type_wf h\<close> new_character_data_types_preserved h2 by blast
   then have "type_wf h3"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_val_writes h3]
     using  set_val_types_preserved
     by(auto simp add: reflp_def transp_def)
   then have "type_wf h'"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h']
     using  set_disconnected_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
   have children_eq_h3:
     "\<And>ptr' children. h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved)
     by(auto simp add: set_disconnected_nodes_get_child_nodes)
   then have children_eq2_h3:
     " \<And>ptr'. |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   have disconnected_nodes_eq_h3: "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr
     \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                             = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved)
     by(auto simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
   then have disconnected_nodes_eq2_h3: "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
              \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have disc_nodes_document_ptr_h2: "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
     using disconnected_nodes_eq_h2 disc_nodes_h3 by auto
   then have disc_nodes_document_ptr_h: "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
     using disconnected_nodes_eq_h by auto
   then have "cast new_character_data_ptr \<notin> set disc_nodes_h3"
     using \<open>heap_is_wellformed h\<close> using \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
       a_all_ptrs_in_heap_def heap_is_wellformed_def
     using NodeMonad.ptr_kinds_ptr_kinds_M local.heap_is_wellformed_disc_nodes_in_heap by blast
 
   have "parent_child_rel h = parent_child_rel h'"
   proof -
     have "parent_child_rel h = parent_child_rel h2"
     proof(auto simp add: parent_child_rel_def)[1]
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h"
         and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
       then show "a |\<in>| object_ptr_kinds h2"
         by (simp add: object_ptr_kinds_eq_h)
     next
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h"
         and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
       then show "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
         by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
             \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
     next
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h2"
         and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
       then show "a |\<in>| object_ptr_kinds h"
         using object_ptr_kinds_eq_h \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
         by(auto)
     next
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h2"
         and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
       then show "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
         by (metis (no_types, lifting) \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
             children_eq2_h empty_iff empty_set image_eqI select_result_I2)
     qed
     also have "\<dots> = parent_child_rel h3"
       by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h2 children_eq2_h2)
     also have "\<dots> = parent_child_rel h'"
       by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h3 children_eq2_h3)
     finally show ?thesis
       by simp
   qed
   have root: "h \<turnstile> get_root_node (cast document_ptr) \<rightarrow>\<^sub>r cast document_ptr"
     by (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close> local.get_root_node_not_node_same)
   then
   have root': "h' \<turnstile> get_root_node (cast document_ptr) \<rightarrow>\<^sub>r cast document_ptr"
     by (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close> document_ptr_kinds_eq_h
         local.get_root_node_not_node_same object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3)
 
 
   have "heap_is_wellformed h'" and "known_ptrs h'"
     using create_character_data_preserves_wellformedness assms
     by blast+
 
   have "cast result |\<notin>| object_ptr_kinds h"
     using \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
     by (metis (full_types) ObjectMonad.ptr_kinds_ptr_kinds_M
         \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close> assms(4) returns_result_eq)
 
   obtain to where to: "h \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to"
     by (meson \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(1) assms(2) assms(3)
         document_ptr_kinds_commutes is_OK_returns_result_E local.to_tree_order_ok)
   then
   have "h \<turnstile> a_get_dom_component (cast document_ptr) \<rightarrow>\<^sub>r to"
     using root
     by(auto simp add: a_get_dom_component_def)
   moreover
   obtain to' where to': "h' \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to'"
     by (meson \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> is_OK_returns_result_E
         local.get_root_node_root_in_heap local.to_tree_order_ok root')
   then
   have "h' \<turnstile> a_get_dom_component (cast document_ptr) \<rightarrow>\<^sub>r to'"
     using root'
     by(auto simp add: a_get_dom_component_def)
   moreover
   have "\<And>child. child \<in> set to \<longleftrightarrow> child \<in> set to'"
     by (metis \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close> \<open>parent_child_rel h = parent_child_rel h'\<close>
         \<open>type_wf h'\<close> assms(1) assms(2) assms(3) local.to_tree_order_parent_child_rel to to')
   ultimately
   have "set |h \<turnstile> local.a_get_dom_component (cast document_ptr)|\<^sub>r =
 set |h' \<turnstile> local.a_get_dom_component (cast document_ptr)|\<^sub>r"
     by(auto simp add: a_get_dom_component_def)
 
   show ?thesis
     apply(auto simp add: is_weakly_dom_component_safe_def Let_def)[1]
     using  assms(2) assms(3) children_eq_h local.get_child_nodes_ok
       local.get_child_nodes_ptr_in_heap local.known_ptrs_known_ptr object_ptr_kinds_eq_h2
       object_ptr_kinds_eq_h3 returns_result_select_result
        apply (metis \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
         is_OK_returns_result_I)
 
       apply (metis \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close> assms(4)
         character_data_ptr_kinds_commutes h2 new_character_data_ptr new_character_data_ptr_in_heap
         node_ptr_kinds_eq_h2 node_ptr_kinds_eq_h3 returns_result_eq)
     using \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close>
       \<open>new_character_data_ptr \<notin> set |h \<turnstile> character_data_ptr_kinds_M|\<^sub>r\<close> assms(4) returns_result_eq
      apply fastforce
     using  assms(2) assms(3) children_eq_h local.get_child_nodes_ok local.get_child_nodes_ptr_in_heap
       local.known_ptrs_known_ptr object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 returns_result_select_result
-    apply (smt ObjectMonad.ptr_kinds_ptr_kinds_M
-        \<open>cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
-        \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close> assms(1) assms(5)
-        create_character_data_is_weakly_dom_component_safe_step local.get_dom_component_impl select_result_I2)
+    apply (smt (verit, best) ObjectMonad.ptr_kinds_ptr_kinds_M
+            \<open>cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<notin> set |h
+              \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r
+              new_character_data_ptr\<close> assms(1) assms(5)
+            create_character_data_is_weakly_dom_component_safe_step local.a_get_dom_component_def
+            local.get_dom_component_def select_result_I2)
     done
 qed
 
 end
 
 interpretation i_get_dom_component_create_character_data?: l_get_dom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   known_ptr heap_is_wellformed parent_child_rel type_wf known_ptrs to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_element_by_id get_elements_by_class_name get_elements_by_tag_name set_val set_val_locs
   get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs
   create_character_data
   by(auto simp add: l_get_dom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_dom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>create\_document\<close>
 
 lemma create_document_unsafe: "\<not>(\<forall>(h
     :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
   ) h' new_document_ptr. heap_is_wellformed h \<longrightarrow> type_wf h \<longrightarrow> known_ptrs h \<longrightarrow>
 h \<turnstile> create_document \<rightarrow>\<^sub>r new_document_ptr \<longrightarrow> h \<turnstile> create_document \<rightarrow>\<^sub>h h' \<longrightarrow>
 is_strongly_dom_component_safe {} {cast new_document_ptr} h h')"
 proof -
   obtain h document_ptr where h: "Inr (document_ptr, h) = (Heap (fmempty)
       :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
     ) \<turnstile> (do {
       document_ptr \<leftarrow> create_document;
       return (document_ptr)
   })"
     by(code_simp, auto simp add: equal_eq List.member_def)+
   then obtain h' new_document_ptr where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     h': "h \<turnstile> create_document \<rightarrow>\<^sub>r new_document_ptr" and
     h': "h \<turnstile> create_document \<rightarrow>\<^sub>h h'" and
     "\<not>(is_strongly_dom_component_safe {} {cast new_document_ptr} h h')"
     by(code_simp, auto simp add: equal_eq List.member_def)+
   then show ?thesis
     by blast
 qed
 
 locale l_get_dom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs
   get_ancestors get_ancestors_locs get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id
   get_elements_by_class_name get_elements_by_tag_name +
   l_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M create_document
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
     and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
     and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
     and type_wf :: "(_) heap \<Rightarrow> bool"
     and known_ptrs :: "(_) heap \<Rightarrow> bool"
     and to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
     and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
     and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
     and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_dom_component :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
     and is_strongly_dom_component_safe ::
     "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
     and is_weakly_dom_component_safe ::
     "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
     and get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
     and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_ancestors :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
     and get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_element_by_id ::
     "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog"
     and get_elements_by_class_name ::
     "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
     and get_elements_by_tag_name ::
     "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
     and create_document :: "((_) heap, exception, (_) document_ptr) prog"
 begin
 
 lemma create_document_is_weakly_dom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> create_document \<rightarrow>\<^sub>h h'"
   assumes "ptr \<noteq> cast |h \<turnstile> create_document|\<^sub>r"
   shows "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h h'"
   using assms
   apply(auto simp add: create_document_def)[1]
   by (metis assms(4) assms(5) is_OK_returns_heap_I local.create_document_def new_document_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
       select_result_I)
 
 lemma create_document_is_weakly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> create_document \<rightarrow>\<^sub>r result"
   assumes "h \<turnstile> create_document \<rightarrow>\<^sub>h h'"
   shows "is_weakly_dom_component_safe {} {cast result} h h'"
 proof -
   have "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast result|}"
     using assms(4) assms(5) local.create_document_def new_document_new_ptr by auto
   moreover have "result |\<notin>| document_ptr_kinds h"
     using assms(4) assms(5) local.create_document_def new_document_ptr_not_in_heap by auto
   ultimately show ?thesis
     using assms
     apply(auto simp add: is_weakly_dom_component_safe_def Let_def local.create_document_def
         new_document_ptr_not_in_heap)[1]
     by (metis \<open>result |\<notin>| document_ptr_kinds h\<close> document_ptr_kinds_commutes new_document_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t)
 qed
 end
 
 interpretation i_get_dom_component_create_document?: l_get_dom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   known_ptr heap_is_wellformed parent_child_rel type_wf known_ptrs to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_element_by_id get_elements_by_class_name get_elements_by_tag_name create_document
   by(auto simp add: l_get_dom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_dom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>insert\_before\<close>
 
 lemma insert_before_unsafe: "\<not>(\<forall>(h
     :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
   ) h' ptr child. heap_is_wellformed h \<longrightarrow> type_wf h \<longrightarrow> known_ptrs h \<longrightarrow>
 h \<turnstile> insert_before ptr child None \<rightarrow>\<^sub>h h' \<longrightarrow> is_weakly_dom_component_safe {ptr, cast child} {} h h')"
 proof -
   obtain h document_ptr e1 e2 where h: "Inr ((document_ptr, e1, e2), h) = (Heap (fmempty)
       :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
     ) \<turnstile> (do {
       document_ptr \<leftarrow> create_document;
       e1 \<leftarrow> create_element document_ptr ''div'';
       e2 \<leftarrow> create_element document_ptr ''div'';
       return (document_ptr, e1, e2)
   })"
     by(code_simp, auto simp add: equal_eq List.member_def)+
   then obtain h' where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     h': "h \<turnstile> insert_before (cast e1) (cast e2) None \<rightarrow>\<^sub>h h'" and
     "\<not>(is_weakly_dom_component_safe {cast e1, cast e2} {} h h')"
     by(code_simp, auto simp add: equal_eq List.member_def)+
   then show ?thesis
     by auto
 qed
 
 lemma insert_before_unsafe2: "\<not>(\<forall>(h
     :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
   ) h' ptr child ref. heap_is_wellformed h \<longrightarrow> type_wf h \<longrightarrow> known_ptrs h \<longrightarrow>
 h \<turnstile> insert_before ptr child (Some ref) \<rightarrow>\<^sub>h h' \<longrightarrow>
 is_weakly_dom_component_safe {ptr, cast child, cast ref} {} h h')"
 proof -
   obtain h document_ptr e1 e2 e3 where h: "Inr ((document_ptr, e1, e2, e3), h) = (Heap (fmempty)
       :: ('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap
     ) \<turnstile> (do {
       document_ptr \<leftarrow> create_document;
       e1 \<leftarrow> create_element document_ptr ''div'';
       e2 \<leftarrow> create_element document_ptr ''div'';
       e3 \<leftarrow> create_element document_ptr ''div'';
       append_child (cast e1) (cast e2);
       return (document_ptr, e1, e2, e3)
   })"
     by(code_simp, auto simp add: equal_eq List.member_def)+
   then obtain h' where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     h': "h \<turnstile> insert_before (cast e1) (cast e3) (Some (cast e2)) \<rightarrow>\<^sub>h h'" and
     "\<not>(is_weakly_dom_component_safe {cast e1, cast e3, cast e2} {} h h')"
     apply(code_simp)
     apply(clarify)
     by(code_simp, auto simp add: equal_eq List.member_def)+
   then show ?thesis
     by fast
 qed
 
 
 lemma append_child_unsafe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap" and
     h' and ptr and child where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> append_child ptr child \<rightarrow>\<^sub>h h'" and
     "\<not> is_weakly_dom_component_safe {ptr, cast child} {} h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
 'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap"
   let ?P = "do {
       document_ptr \<leftarrow> create_document;
       e1 \<leftarrow> create_element document_ptr ''div'';
       e2 \<leftarrow> create_element document_ptr ''div'';
       return (e1, e2)
   }"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?e1 = "fst |?h0 \<turnstile> ?P|\<^sub>r"
   let ?e2 = "snd |?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and ptr="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e1" and child="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e2"])
     by code_simp+
 qed
 
 
 subsubsection \<open>get\_owner\_document\<close>
 
 lemma get_owner_document_unsafe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap" and
     h' and ptr and owner_document where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document \<rightarrow>\<^sub>h h'" and
     "\<not>is_weakly_dom_component_safe {ptr} {cast owner_document} h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
 'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap"
   let ?P = "do {
       document_ptr \<leftarrow> create_document;
       e1 \<leftarrow> create_element document_ptr ''div'';
       return (document_ptr, e1)
   }"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?document_ptr = "fst |?h0 \<turnstile> ?P|\<^sub>r"
   let ?e1 = "snd |?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and ptr="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e1" and owner_document="?document_ptr"])
     by code_simp+
 qed
 
 end
diff --git a/thys/SC_DOM_Components/Core_DOM_SC_DOM_Components.thy b/thys/SC_DOM_Components/Core_DOM_SC_DOM_Components.thy
--- a/thys/SC_DOM_Components/Core_DOM_SC_DOM_Components.thy
+++ b/thys/SC_DOM_Components/Core_DOM_SC_DOM_Components.thy
@@ -1,3758 +1,3761 @@
 (***********************************************************************************
  * Copyright (c) 2016-2020 The University of Sheffield, UK
  *               2019-2020 University of Exeter, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section \<open>Core SC DOM Components II\<close>
 theory Core_DOM_SC_DOM_Components
   imports
     Core_DOM_DOM_Components
 begin
 declare [[smt_timeout=2400]]
 
 section \<open>Scope Components\<close>
 
 subsection \<open>Definition\<close>
 
 locale l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs =
   l_get_disconnected_nodes_defs get_disconnected_nodes get_disconnected_nodes_locs +
   l_get_owner_document_defs get_owner_document +
   l_to_tree_order_defs to_tree_order
   for get_owner_document :: "(_::linorder) object_ptr \<Rightarrow> ((_) heap, exception, (_) document_ptr) prog"
     and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
     and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
 begin
 definition a_get_scdom_component :: "(_) object_ptr \<Rightarrow> (_, (_) object_ptr list) dom_prog"
   where
     "a_get_scdom_component ptr = do {
       document \<leftarrow> get_owner_document ptr;
       disc_nodes \<leftarrow> get_disconnected_nodes document;
       tree_order \<leftarrow> to_tree_order (cast document);
       disconnected_tree_orders \<leftarrow> map_M (to_tree_order \<circ> cast) disc_nodes;
       return (tree_order @ (concat disconnected_tree_orders))
     }"
 
 definition a_is_strongly_scdom_component_safe ::
   "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
   where
     "a_is_strongly_scdom_component_safe S\<^sub>a\<^sub>r\<^sub>g S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t h h' = (
       let removed_pointers = fset (object_ptr_kinds h) - fset (object_ptr_kinds h') in
       let added_pointers = fset (object_ptr_kinds h') - fset (object_ptr_kinds h) in
       let arg_components =
         (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_scdom_component ptr|\<^sub>r) \<inter>
         fset (object_ptr_kinds h).  set |h \<turnstile> a_get_scdom_component ptr|\<^sub>r) in
       let arg_components' =
         (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_scdom_component ptr|\<^sub>r) \<inter>
         fset (object_ptr_kinds h').  set |h' \<turnstile> a_get_scdom_component ptr|\<^sub>r) in
       removed_pointers \<subseteq> arg_components \<and>
       added_pointers \<subseteq> arg_components' \<and>
       S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t \<subseteq> arg_components' \<and>
       (\<forall>outside_ptr \<in> fset (object_ptr_kinds h) \<inter> fset (object_ptr_kinds h') -
         (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h  \<turnstile> a_get_scdom_component ptr|\<^sub>r). preserved (get_M outside_ptr id) h h'))"
 
 definition a_is_weakly_scdom_component_safe ::
   "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
   where
     "a_is_weakly_scdom_component_safe S\<^sub>a\<^sub>r\<^sub>g S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t h h' = (
       let removed_pointers = fset (object_ptr_kinds h) - fset (object_ptr_kinds h') in
       let added_pointers = fset (object_ptr_kinds h') - fset (object_ptr_kinds h) in
       let arg_components =
         (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_scdom_component ptr|\<^sub>r) \<inter>
         fset (object_ptr_kinds h).  set |h \<turnstile> a_get_scdom_component ptr|\<^sub>r) in
       let arg_components' =
         (\<Union>ptr \<in> (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h \<turnstile> a_get_scdom_component ptr|\<^sub>r) \<inter>
         fset (object_ptr_kinds h').  set |h' \<turnstile> a_get_scdom_component ptr|\<^sub>r) in
       removed_pointers \<subseteq> arg_components \<and>
       S\<^sub>r\<^sub>e\<^sub>s\<^sub>u\<^sub>l\<^sub>t \<subseteq> arg_components' \<union> added_pointers  \<and>
       (\<forall>outside_ptr \<in> fset (object_ptr_kinds h) \<inter> fset (object_ptr_kinds h') -
         (\<Union>ptr \<in> S\<^sub>a\<^sub>r\<^sub>g. set |h  \<turnstile> a_get_scdom_component ptr|\<^sub>r). preserved (get_M outside_ptr id) h h'))"
 end
 
 global_interpretation l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_owner_document get_disconnected_nodes
   get_disconnected_nodes_locs to_tree_order
   defines get_scdom_component = "l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_scdom_component
 get_owner_document get_disconnected_nodes to_tree_order"
     and is_strongly_scdom_component_safe = a_is_strongly_scdom_component_safe
     and is_weakly_scdom_component_safe = a_is_weakly_scdom_component_safe
   .
 
 locale l_get_scdom_component_defs =
   fixes get_scdom_component :: "(_) object_ptr \<Rightarrow> (_, (_) object_ptr list) dom_prog"
   fixes is_strongly_scdom_component_safe ::
     "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
   fixes is_weakly_scdom_component_safe ::
     "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
 
 
 locale l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_scdom_component_defs +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs +
   assumes get_scdom_component_impl: "get_scdom_component = a_get_scdom_component"
   assumes is_strongly_scdom_component_safe_impl:
     "is_strongly_scdom_component_safe = a_is_strongly_scdom_component_safe"
   assumes is_weakly_scdom_component_safe_impl:
     "is_weakly_scdom_component_safe = a_is_weakly_scdom_component_safe"
 begin
 lemmas get_scdom_component_def = a_get_scdom_component_def[folded get_scdom_component_impl]
 lemmas is_strongly_scdom_component_safe_def =
   a_is_strongly_scdom_component_safe_def[folded is_strongly_scdom_component_safe_impl]
 lemmas is_weakly_scdom_component_safe_def =
   a_is_weakly_scdom_component_safe_def[folded is_weakly_scdom_component_safe_impl]
 end
 
 interpretation i_get_scdom_component?: l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
   get_owner_document get_disconnected_nodes get_disconnected_nodes_locs to_tree_order
   by(auto simp add: l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def get_scdom_component_def
       is_strongly_scdom_component_safe_def is_weakly_scdom_component_safe_def instances)
 declare l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 locale l_get_dom_component_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_heap_is_wellformed +
   l_get_owner_document +
   l_get_owner_document_wf +
   l_get_disconnected_nodes +
   l_to_tree_order +
   l_known_ptr +
   l_known_ptrs +
   l_get_owner_document_wf_get_root_node_wf +
   assumes known_ptr_impl: "known_ptr = DocumentClass.known_ptr"
 begin
 
 lemma known_ptr_node_or_document: "known_ptr ptr \<Longrightarrow> is_node_ptr_kind ptr \<or> is_document_ptr_kind ptr"
   by(auto simp add: known_ptr_impl known_ptr_defs DocumentClass.known_ptr_defs
       CharacterDataClass.known_ptr_defs ElementClass.known_ptr_defs NodeClass.known_ptr_defs
       split: option.splits)
 
 lemma get_scdom_component_ptr_in_heap2:
   assumes "h \<turnstile> ok (get_scdom_component ptr)"
   shows "ptr |\<in>| object_ptr_kinds h"
   using assms get_root_node_ptr_in_heap
   apply(auto simp add: get_scdom_component_def elim!: bind_is_OK_E3 intro!: map_M_pure_I)[1]
   by (simp add: is_OK_returns_result_I local.get_owner_document_ptr_in_heap)
 
 lemma get_scdom_component_subset_get_dom_component:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   shows "set c \<subseteq> set sc"
 proof -
   obtain document disc_nodes tree_order disconnected_tree_orders where
     document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r document"
     and disc_nodes: "h \<turnstile> get_disconnected_nodes document \<rightarrow>\<^sub>r disc_nodes"
     and tree_order: "h \<turnstile> to_tree_order (cast document) \<rightarrow>\<^sub>r tree_order"
     and disconnected_tree_orders: "h \<turnstile> map_M (to_tree_order \<circ> cast) disc_nodes \<rightarrow>\<^sub>r disconnected_tree_orders"
     and sc: "sc = tree_order @ (concat disconnected_tree_orders)"
     using assms(4)
     by(auto simp add: get_scdom_component_def elim!: bind_returns_result_E
         elim!: bind_returns_result_E2[rotated, OF get_owner_document_pure, rotated]
         elim!: bind_returns_result_E2[rotated, OF get_disconnected_nodes_pure, rotated]
         elim!: bind_returns_result_E2[rotated, OF to_tree_order_pure, rotated]
         )
 
   obtain root_ptr where root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
     and c: "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
     using assms(5)
     by(auto simp add: get_dom_component_def elim!: bind_returns_result_E2[rotated, OF get_root_node_pure, rotated])
 
   show ?thesis
   proof (cases "is_document_ptr_kind root_ptr")
     case True
     then have "cast document = root_ptr"
       using get_root_node_document assms(1) assms(2) assms(3) root_ptr document
       by (metis document_ptr_casts_commute3 returns_result_eq)
     then have "c = tree_order"
       using tree_order c
       by auto
     then show ?thesis
       by(simp add: sc)
   next
     case False
     moreover have "root_ptr |\<in>| object_ptr_kinds h"
       using assms(1) assms(2) assms(3) local.get_root_node_root_in_heap root_ptr by blast
     ultimately have "is_node_ptr_kind root_ptr"
       using assms(3) known_ptrs_known_ptr known_ptr_node_or_document
       by auto
     then obtain root_node_ptr where root_node_ptr: "root_ptr = cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_node_ptr"
       by (metis node_ptr_casts_commute3)
     then have "h \<turnstile> get_owner_document root_ptr \<rightarrow>\<^sub>r document"
       using get_root_node_same_owner_document
       using assms(1) assms(2) assms(3) document root_ptr by blast
     then have "root_node_ptr \<in> set disc_nodes"
       using assms(1) assms(2) assms(3) disc_nodes in_disconnected_nodes_no_parent root_node_ptr
       using local.get_root_node_same_no_parent root_ptr by blast
     then have "c \<in> set disconnected_tree_orders"
       using c root_node_ptr
       using map_M_pure_E[OF disconnected_tree_orders]
       by (metis (mono_tags, lifting) comp_apply local.to_tree_order_pure select_result_I2)
     then show ?thesis
       by(auto simp add: sc)
   qed
 qed
 
 lemma get_scdom_component_ptrs_same_owner_document:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "ptr' \<in> set sc"
   assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
   shows "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document"
 proof -
   obtain document disc_nodes tree_order disconnected_tree_orders where
     document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r document"
     and disc_nodes: "h \<turnstile> get_disconnected_nodes document \<rightarrow>\<^sub>r disc_nodes"
     and tree_order: "h \<turnstile> to_tree_order (cast document) \<rightarrow>\<^sub>r tree_order"
     and disconnected_tree_orders: "h \<turnstile> map_M (to_tree_order \<circ> cast) disc_nodes \<rightarrow>\<^sub>r disconnected_tree_orders"
     and sc: "sc = tree_order @ (concat disconnected_tree_orders)"
     using assms(4)
     by(auto simp add: get_scdom_component_def elim!: bind_returns_result_E
         elim!: bind_returns_result_E2[rotated, OF get_owner_document_pure, rotated]
         elim!: bind_returns_result_E2[rotated, OF get_disconnected_nodes_pure, rotated]
         elim!: bind_returns_result_E2[rotated, OF to_tree_order_pure, rotated]
         )
   show ?thesis
   proof (cases "ptr' \<in> set tree_order")
     case True
     have "owner_document = document"
       using assms(6) document by fastforce
     then show ?thesis
       by (metis (no_types) True assms(1) assms(2) assms(3) cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject document
           document_ptr_casts_commute3 document_ptr_document_ptr_cast document_ptr_kinds_commutes
           local.get_owner_document_owner_document_in_heap local.get_root_node_document
           local.get_root_node_not_node_same local.to_tree_order_same_root node_ptr_no_document_ptr_cast tree_order)
   next
     case False
     then obtain disconnected_tree_order where disconnected_tree_order:
       "ptr' \<in> set disconnected_tree_order" and "disconnected_tree_order \<in> set disconnected_tree_orders"
       using sc \<open>ptr' \<in> set sc\<close>
       by auto
     obtain root_ptr' where
       root_ptr': "root_ptr' \<in> set disc_nodes" and
       "h \<turnstile> to_tree_order (cast root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order"
       using map_M_pure_E2[OF disconnected_tree_orders \<open>disconnected_tree_order \<in> set disconnected_tree_orders\<close>]
       by (metis comp_apply local.to_tree_order_pure)
     have "\<not>(\<exists>parent \<in> fset (object_ptr_kinds h). root_ptr' \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)"
       using disc_nodes
       by (meson assms(1) assms(2) assms(3) disjoint_iff_not_equal local.get_child_nodes_ok
           local.heap_is_wellformed_children_disc_nodes_different local.known_ptrs_known_ptr notin_fset
           returns_result_select_result root_ptr')
     then
     have "h \<turnstile> get_parent root_ptr' \<rightarrow>\<^sub>r None"
       using disc_nodes
       by (metis (no_types, lifting) assms(1) assms(2) assms(3) fmember.rep_eq local.get_parent_child_dual
           local.get_parent_ok local.get_parent_parent_in_heap local.heap_is_wellformed_disc_nodes_in_heap
           returns_result_select_result root_ptr' select_result_I2 split_option_ex)
     then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast root_ptr'"
       using \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order\<close> assms(1)
         assms(2) assms(3) disconnected_tree_order local.get_root_node_no_parent
         local.to_tree_order_get_root_node local.to_tree_order_ptr_in_result
       by blast
     then have "h \<turnstile> get_owner_document (cast root_ptr') \<rightarrow>\<^sub>r document"
       using assms(1) assms(2) assms(3) disc_nodes local.get_owner_document_disconnected_nodes root_ptr'
       by blast
 
     then have "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r document"
       using \<open>h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr'\<close> assms(1) assms(2) assms(3)
         local.get_root_node_same_owner_document
       by blast
     then show ?thesis
       using assms(6) document returns_result_eq by force
   qed
 qed
 
 lemma get_scdom_component_ptrs_same_scope_component:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "ptr' \<in> set sc"
   shows "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
 proof -
   obtain document disc_nodes tree_order disconnected_tree_orders where
     document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r document"
     and disc_nodes: "h \<turnstile> get_disconnected_nodes document \<rightarrow>\<^sub>r disc_nodes"
     and tree_order: "h \<turnstile> to_tree_order (cast document) \<rightarrow>\<^sub>r tree_order"
     and disconnected_tree_orders: "h \<turnstile> map_M (to_tree_order \<circ> cast) disc_nodes \<rightarrow>\<^sub>r disconnected_tree_orders"
     and sc: "sc = tree_order @ (concat disconnected_tree_orders)"
     using assms(4)
     by(auto simp add: get_scdom_component_def elim!: bind_returns_result_E
         elim!: bind_returns_result_E2[rotated, OF get_owner_document_pure, rotated]
         elim!: bind_returns_result_E2[rotated, OF get_disconnected_nodes_pure, rotated]
         elim!: bind_returns_result_E2[rotated, OF to_tree_order_pure, rotated]
         )
   show ?thesis
   proof (cases "ptr' \<in> set tree_order")
     case True
     then have "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r document"
       by (metis assms(1) assms(2) assms(3) cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject document
           document_ptr_casts_commute3 document_ptr_kinds_commutes known_ptr_node_or_document
           local.get_owner_document_owner_document_in_heap local.get_root_node_document
           local.get_root_node_not_node_same local.known_ptrs_known_ptr local.to_tree_order_get_root_node
           local.to_tree_order_ptr_in_result node_ptr_no_document_ptr_cast tree_order)
     then show ?thesis
       using disc_nodes tree_order disconnected_tree_orders sc
       by(auto simp add: get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
   next
     case False
     then obtain disconnected_tree_order where disconnected_tree_order:
       "ptr' \<in> set disconnected_tree_order" and "disconnected_tree_order \<in> set disconnected_tree_orders"
       using sc \<open>ptr' \<in> set sc\<close>
       by auto
     obtain root_ptr' where
       root_ptr': "root_ptr' \<in> set disc_nodes" and
       "h \<turnstile> to_tree_order (cast root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order"
       using map_M_pure_E2[OF disconnected_tree_orders \<open>disconnected_tree_order \<in> set disconnected_tree_orders\<close>]
       by (metis comp_apply local.to_tree_order_pure)
     have "\<not>(\<exists>parent \<in> fset (object_ptr_kinds h). root_ptr' \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)"
       using disc_nodes
       by (meson assms(1) assms(2) assms(3) disjoint_iff_not_equal local.get_child_nodes_ok
           local.heap_is_wellformed_children_disc_nodes_different local.known_ptrs_known_ptr notin_fset
           returns_result_select_result root_ptr')
     then
     have "h \<turnstile> get_parent root_ptr' \<rightarrow>\<^sub>r None"
       using disc_nodes
       by (metis (no_types, lifting) assms(1) assms(2) assms(3) fmember.rep_eq
           local.get_parent_child_dual local.get_parent_ok local.get_parent_parent_in_heap
           local.heap_is_wellformed_disc_nodes_in_heap returns_result_select_result root_ptr'
           select_result_I2 split_option_ex)
     then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast root_ptr'"
       using \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order\<close> assms(1)
         assms(2) assms(3) disconnected_tree_order local.get_root_node_no_parent
         local.to_tree_order_get_root_node local.to_tree_order_ptr_in_result
       by blast
     then have "h \<turnstile> get_owner_document (cast root_ptr') \<rightarrow>\<^sub>r document"
       using assms(1) assms(2) assms(3) disc_nodes local.get_owner_document_disconnected_nodes root_ptr'
       by blast
 
     then have "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r document"
       using \<open>h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr'\<close> assms(1) assms(2) assms(3)
         local.get_root_node_same_owner_document
       by blast
     then show ?thesis
       using disc_nodes tree_order disconnected_tree_orders sc
       by(auto simp add: get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
   qed
 qed
 
 lemma get_scdom_component_ok:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "ptr |\<in>| object_ptr_kinds h"
   shows "h \<turnstile> ok (get_scdom_component ptr)"
   using assms
   apply(auto simp add: get_scdom_component_def intro!: bind_is_OK_pure_I map_M_pure_I map_M_ok_I)[1]
   using get_owner_document_ok
      apply blast
     apply (simp add: local.get_disconnected_nodes_ok local.get_owner_document_owner_document_in_heap)
    apply (simp add: local.get_owner_document_owner_document_in_heap local.to_tree_order_ok)
   using local.heap_is_wellformed_disc_nodes_in_heap local.to_tree_order_ok node_ptr_kinds_commutes
   by blast
 
 lemma get_scdom_component_ptr_in_heap:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "ptr' \<in> set sc"
   shows "ptr' |\<in>| object_ptr_kinds h"
   apply(insert assms )
   apply(auto simp add: get_scdom_component_def elim!: bind_returns_result_E2 intro!: map_M_pure_I)[1]
   using local.to_tree_order_ptrs_in_heap apply blast
   by (metis (no_types, lifting) assms(4) assms(5) bind_returns_result_E
       get_scdom_component_ptrs_same_scope_component is_OK_returns_result_I get_scdom_component_def
       local.get_owner_document_ptr_in_heap)
 
 lemma get_scdom_component_contains_get_dom_component:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "ptr' \<in> set sc"
   obtains c where "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c" and "set c \<subseteq> set sc"
 proof -
   have "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
     using assms(1) assms(2) assms(3) assms(4) assms(5) get_scdom_component_ptrs_same_scope_component
     by blast
   then show ?thesis
     by (meson assms(1) assms(2) assms(3) assms(5) get_scdom_component_ptr_in_heap
         get_scdom_component_subset_get_dom_component is_OK_returns_result_E local.get_dom_component_ok that)
 qed
 
 lemma get_scdom_component_owner_document_same:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "ptr' \<in> set sc"
   obtains owner_document where "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document" and "cast owner_document \<in> set sc"
   using assms
   apply(auto simp add: get_scdom_component_def elim!: bind_returns_result_E2 intro!: map_M_pure_I)[1]
    apply (metis (no_types, lifting) assms(4) assms(5) document_ptr_casts_commute3
       document_ptr_document_ptr_cast get_scdom_component_contains_get_dom_component
       local.get_dom_component_ptr local.get_dom_component_root_node_same local.get_dom_component_to_tree_order
       local.get_root_node_document local.get_root_node_not_node_same local.to_tree_order_ptr_in_result
       local.to_tree_order_ptrs_in_heap node_ptr_no_document_ptr_cast)
   apply(rule map_M_pure_E2)
      apply(simp)
     apply(simp)
    apply(simp)
-  by (smt assms(4) assms(5) comp_apply get_scdom_component_ptr_in_heap is_OK_returns_result_E
-      local.get_owner_document_disconnected_nodes local.get_root_node_ok local.get_root_node_same_owner_document
-      local.to_tree_order_get_root_node local.to_tree_order_ptr_in_result)
+  using assms(4) assms(5) get_scdom_component_ptrs_same_owner_document local.to_tree_order_ptr_in_result
+  by blast
 
 lemma get_scdom_component_different_owner_documents:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
   assumes "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document'"
   assumes "owner_document \<noteq> owner_document'"
   shows "set |h \<turnstile> get_scdom_component ptr|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = {}"
   using assms get_scdom_component_ptrs_same_owner_document
-  by (smt disjoint_iff_not_equal get_scdom_component_ok is_OK_returns_result_I
+  by (smt (verit) disjoint_iff_not_equal get_scdom_component_ok is_OK_returns_result_I
       local.get_owner_document_ptr_in_heap returns_result_eq returns_result_select_result)
 
 
 lemma get_scdom_component_ptr:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r c"
   shows "ptr \<in> set c"
   using assms
   by (meson get_scdom_component_ptr_in_heap2 get_scdom_component_subset_get_dom_component
       is_OK_returns_result_E is_OK_returns_result_I local.get_dom_component_ok local.get_dom_component_ptr
       subsetD)
 end
 
 locale l_get_dom_component_get_scdom_component = l_get_owner_document_defs + l_heap_is_wellformed_defs +
   l_type_wf + l_known_ptrs + l_get_scdom_component_defs + l_get_dom_component_defs +
   assumes get_scdom_component_subset_get_dom_component:
     "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc \<Longrightarrow>
 h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c \<Longrightarrow> set c \<subseteq> set sc"
   assumes get_scdom_component_ptrs_same_scope_component:
     "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc \<Longrightarrow>
 ptr' \<in> set sc \<Longrightarrow> h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
   assumes get_scdom_component_ptrs_same_owner_document:
     "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc \<Longrightarrow>
 ptr' \<in> set sc \<Longrightarrow> h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document \<Longrightarrow> h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document"
   assumes get_scdom_component_ok:
     "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> ptr |\<in>| object_ptr_kinds h \<Longrightarrow>
 h \<turnstile> ok (get_scdom_component ptr)"
   assumes get_scdom_component_ptr_in_heap:
     "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc \<Longrightarrow>
 ptr' \<in> set sc \<Longrightarrow> ptr' |\<in>| object_ptr_kinds h"
   assumes get_scdom_component_contains_get_dom_component:
     "(\<And>c. h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c \<Longrightarrow> set c \<subseteq> set sc \<Longrightarrow> thesis) \<Longrightarrow> heap_is_wellformed h \<Longrightarrow>
 type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc \<Longrightarrow> ptr' \<in> set sc \<Longrightarrow> thesis"
   assumes get_scdom_component_owner_document_same:
     "(\<And>owner_document. h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document \<Longrightarrow> cast owner_document \<in> set sc \<Longrightarrow> thesis) \<Longrightarrow>
     heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc \<Longrightarrow>
 ptr' \<in> set sc \<Longrightarrow> thesis"
   assumes get_scdom_component_different_owner_documents:
     "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document \<Longrightarrow>
 h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document' \<Longrightarrow> owner_document \<noteq> owner_document' \<Longrightarrow>
 set |h \<turnstile> get_scdom_component ptr|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = {}"
 
 interpretation i_get_dom_component_get_scdom_component?: l_get_dom_component_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_owner_document
   get_disconnected_nodes get_disconnected_nodes_locs to_tree_order heap_is_wellformed parent_child_rel
   type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors
   get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
   by(auto simp add: l_get_dom_component_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_dom_component_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def instances)
 declare l_get_dom_component_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 lemma get_dom_component_get_scdom_component_is_l_get_dom_component_get_scdom_component [instances]:
   "l_get_dom_component_get_scdom_component get_owner_document heap_is_wellformed type_wf known_ptr
 known_ptrs get_scdom_component get_dom_component"
   apply(auto simp add: l_get_dom_component_get_scdom_component_def l_get_dom_component_get_scdom_component_axioms_def instances)[1]
   using get_scdom_component_subset_get_dom_component apply fast
   using get_scdom_component_ptrs_same_scope_component apply fast
   using get_scdom_component_ptrs_same_owner_document apply fast
   using get_scdom_component_ok apply fast
   using get_scdom_component_ptr_in_heap apply fast
   using get_scdom_component_contains_get_dom_component apply blast
   using get_scdom_component_owner_document_same apply blast
   using get_scdom_component_different_owner_documents apply fast
   done
 
 
 subsubsection \<open>get\_child\_nodes\<close>
 
 locale l_get_scdom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_scdom_component +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma get_child_nodes_is_strongly_scdom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
   assumes "child \<in> set children"
   shows "cast child \<in> set sc \<longleftrightarrow> ptr' \<in> set sc"
   apply(auto)[1]
    apply (meson assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) contra_subsetD
       get_scdom_component_ptrs_same_scope_component get_scdom_component_subset_get_dom_component
       is_OK_returns_result_E local.get_child_nodes_is_strongly_dom_component_safe local.get_dom_component_ok
       local.get_dom_component_ptr local.heap_is_wellformed_children_in_heap node_ptr_kinds_commutes)
   by (meson assms(1) assms(2) assms(3) assms(4) assms(5) assms(6)
       get_scdom_component_contains_get_dom_component is_OK_returns_result_E is_OK_returns_result_I
       get_child_nodes_is_strongly_dom_component_safe local.get_child_nodes_ptr_in_heap
       local.get_dom_component_ok local.get_dom_component_ptr set_rev_mp)
 
 lemma get_child_nodes_is_strongly_scdom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
   assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>h h'"
   shows "is_strongly_scdom_component_safe {ptr} (cast ` set children) h h'"
 proof -
   have "h = h'"
     using assms(5)
     by (meson local.get_child_nodes_pure pure_returns_heap_eq)
   then show ?thesis
     using assms
     apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def)[1]
-    by (smt Int_absorb2 finite_set_in get_child_nodes_is_strongly_scdom_component_safe_step in_mono
-        is_OK_returns_result_I local.get_child_nodes_ptr_in_heap local.get_dom_component_ok
-        local.get_dom_component_ptr local.get_scdom_component_impl local.get_scdom_component_ok
-        local.get_scdom_component_ptr_in_heap local.get_scdom_component_subset_get_dom_component
-        returns_result_select_result subsetI)
+    by (smt (verit, del_insts) IntI finite_set_in
+        get_child_nodes_is_strongly_scdom_component_safe_step is_OK_returns_result_I
+        local.get_child_nodes_ptr_in_heap local.get_dom_component_ok local.get_dom_component_ptr
+        local.get_scdom_component_impl local.get_scdom_component_ok
+        local.get_scdom_component_subset_get_dom_component returns_result_select_result subsetD)
 qed
 end
 
 interpretation i_get_scdom_component_get_child_nodes?: l_get_scdom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
   get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_disconnected_nodes
   get_disconnected_nodes_locs to_tree_order get_parent get_parent_locs get_child_nodes
   get_child_nodes_locs get_root_node get_root_node_locs get_ancestors get_ancestors_locs get_element_by_id
   get_elements_by_class_name get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
   by(auto simp add: l_get_scdom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_scdom_component_get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>get\_parent\<close>
 
 locale l_get_scdom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_scdom_component +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma get_parent_is_strongly_scdom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "h \<turnstile> get_parent ptr' \<rightarrow>\<^sub>r Some parent"
   shows "parent \<in> set sc \<longleftrightarrow> cast ptr' \<in> set sc"
   by (meson assms(1) assms(2) assms(3) assms(4) assms(5) contra_subsetD
       get_scdom_component_contains_get_dom_component local.get_dom_component_ptr
       local.get_parent_is_strongly_dom_component_safe_step)
 
 lemma get_parent_is_strongly_scdom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some parent"
   assumes "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>h h'"
   shows "is_strongly_scdom_component_safe {cast node_ptr} {parent} h h'"
 proof -
   have "h = h'"
     using assms(5)
     by (meson local.get_parent_pure pure_returns_heap_eq)
   then show ?thesis
     using assms
     apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def)[1]
-    by (smt IntI finite_set_in in_mono local.get_dom_component_ok local.get_dom_component_ptr
-        local.get_parent_is_strongly_dom_component_safe_step local.get_parent_parent_in_heap
-        local.get_scdom_component_impl local.get_scdom_component_ok local.get_scdom_component_subset_get_dom_component
-        local.to_tree_order_ok local.to_tree_order_parent local.to_tree_order_ptr_in_result
-        local.to_tree_order_ptrs_in_heap returns_result_select_result)
+    by (smt (verit) Int_iff get_parent_is_strongly_scdom_component_safe_step in_mono
+        l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ptr local.get_dom_component_ok
+        local.get_parent_parent_in_heap local.get_scdom_component_impl local.get_scdom_component_ok
+        local.get_scdom_component_ptr_in_heap local.get_scdom_component_ptrs_same_scope_component
+        local.get_scdom_component_subset_get_dom_component
+        local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms notin_fset returns_result_eq
+        returns_result_select_result)
 qed
 end
 
 interpretation i_get_scdom_component_get_parent?: l_get_scdom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe get_disconnected_nodes
   get_disconnected_nodes_locs to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs
   get_root_node get_root_node_locs get_ancestors get_ancestors_locs get_element_by_id
   get_elements_by_class_name get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
   by(auto simp add: l_get_scdom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_scdom_component_get_parent\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>get\_root\_node\<close>
 
 locale l_get_scdom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_scdom_component +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma get_root_node_is_strongly_scdom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r root"
   shows "root \<in> set sc \<longleftrightarrow> ptr' \<in> set sc"
   by (meson assms(1) assms(2) assms(3) assms(4) assms(5) contra_subsetD
       get_scdom_component_contains_get_dom_component local.get_dom_component_ptr
       local.get_root_node_is_strongly_dom_component_safe_step)
 
 lemma get_root_node_is_strongly_scdom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
   assumes "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>h h'"
   shows "is_strongly_scdom_component_safe {ptr} {root} h h'"
 proof -
   have "h = h'"
     using assms(5)
     by (meson local.get_root_node_pure pure_returns_heap_eq)
   then show ?thesis
     using assms
     apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def)[1]
-    by (smt Int_iff finite_set_in is_OK_returns_result_I local.get_dom_component_ok
+    by (smt (verit) Int_iff finite_set_in is_OK_returns_result_I local.get_dom_component_ok
         local.get_dom_component_ptr local.get_root_node_is_strongly_dom_component_safe_step
         local.get_root_node_ptr_in_heap local.get_scdom_component_impl local.get_scdom_component_ok
         local.get_scdom_component_subset_get_dom_component returns_result_select_result subset_eq)
 qed
 end
 
 interpretation i_get_scdom_component_get_root_node?: l_get_scdom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe get_disconnected_nodes
   get_disconnected_nodes_locs to_tree_order get_parent get_parent_locs get_child_nodes
   get_child_nodes_locs get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_element_by_id get_elements_by_class_name get_elements_by_tag_name first_in_tree_order
   get_attribute get_attribute_locs
   by(auto simp add: l_get_scdom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_scdom_component_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>get\_element\_by\_id\<close>
 
 locale l_get_scdom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_scdom_component +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma get_element_by_id_is_strongly_scdom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "h \<turnstile> get_element_by_id ptr' idd \<rightarrow>\<^sub>r Some result"
   shows "cast result \<in> set sc \<longleftrightarrow> ptr' \<in> set sc"
   by (meson assms(1) assms(2) assms(3) assms(4) assms(5) contra_subsetD
       get_element_by_id_is_strongly_dom_component_safe_step get_scdom_component_contains_get_dom_component
       local.get_dom_component_ptr)
 
 lemma get_element_by_id_is_strongly_scdom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_element_by_id ptr idd \<rightarrow>\<^sub>r Some result"
   assumes "h \<turnstile> get_element_by_id ptr idd \<rightarrow>\<^sub>h h'"
   shows "is_strongly_scdom_component_safe {ptr} {cast result} h h'"
 proof -
   have "h = h'"
     using assms(5)
     by(auto simp add: preserved_def get_element_by_id_def first_in_tree_order_def
         elim!: bind_returns_heap_E2 intro!: map_filter_M_pure bind_pure_I
         split: option.splits list.splits)
   have "ptr |\<in>| object_ptr_kinds h"
     using assms(4)
     apply(auto simp add: get_element_by_id_def)[1]
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) bind_is_OK_E is_OK_returns_result_I
         local.first_in_tree_order_def local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap)
   obtain to where to: "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
     by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
         local.to_tree_order_ok)
   then have "cast result \<in> set to"
     using assms(4) local.get_element_by_id_result_in_tree_order by auto
   obtain c where c: "h \<turnstile> a_get_scdom_component ptr \<rightarrow>\<^sub>r c"
     using \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) local.get_scdom_component_impl
       local.get_scdom_component_ok
     by blast
 
   then show ?thesis
     using assms \<open>h = h'\<close>
     apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def
         get_element_by_id_def first_in_tree_order_def elim!: bind_returns_result_E2
         intro!: map_filter_M_pure bind_pure_I split: option.splits list.splits)[1]
-    by (smt IntI \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(4) finite_set_in
+    by (smt (verit) IntI \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(4) finite_set_in
         get_element_by_id_is_strongly_scdom_component_safe_step local.get_dom_component_ok
         local.get_dom_component_ptr local.get_scdom_component_impl
         local.get_scdom_component_subset_get_dom_component returns_result_select_result select_result_I2
         subsetD)
 qed
 end
 
 interpretation i_get_scdom_component_get_element_by_id?: l_get_scdom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe get_disconnected_nodes
   get_disconnected_nodes_locs to_tree_order get_parent get_parent_locs get_child_nodes
   get_child_nodes_locs get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_element_by_id get_elements_by_class_name get_elements_by_tag_name first_in_tree_order
   get_attribute get_attribute_locs
   by(auto simp add: l_get_scdom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_scdom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>get\_elements\_by\_class\_name\<close>
 
 locale l_get_scdom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_scdom_component +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma get_elements_by_class_name_is_strongly_scdom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "h \<turnstile> get_elements_by_class_name ptr' idd \<rightarrow>\<^sub>r results"
   assumes "result \<in> set results"
   shows "cast result \<in> set sc \<longleftrightarrow> ptr' \<in> set sc"
   by (meson assms local.get_dom_component_ptr
       local.get_elements_by_class_name_is_strongly_dom_component_safe_step
       local.get_scdom_component_contains_get_dom_component subsetD)
 
 
 lemma get_elements_by_class_name_is_strongly_scdom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_elements_by_class_name ptr idd \<rightarrow>\<^sub>r results"
   assumes "h \<turnstile> get_elements_by_class_name ptr idd \<rightarrow>\<^sub>h h'"
   shows "is_strongly_scdom_component_safe {ptr} (cast ` set results) h h'"
 proof -
   have "h = h'"
     using assms(5)
     by (meson local.get_elements_by_class_name_pure pure_returns_heap_eq)
   have "ptr |\<in>| object_ptr_kinds h"
     using assms(4)
     apply(auto simp add: get_elements_by_class_name_def)[1]
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) bind_is_OK_E is_OK_returns_result_I
         local.first_in_tree_order_def local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap)
   obtain to where to: "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
     by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
         local.to_tree_order_ok)
   then have "cast ` set results \<subseteq> set to"
     using assms(4) local.get_elements_by_class_name_result_in_tree_order by auto
   obtain c where c: "h \<turnstile> a_get_scdom_component ptr \<rightarrow>\<^sub>r c"
     using \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) local.get_scdom_component_impl
       local.get_scdom_component_ok by blast
 
   then show ?thesis
     using assms \<open>h = h'\<close>
     apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def
         get_element_by_id_def first_in_tree_order_def elim!: bind_returns_result_E2 intro!: map_filter_M_pure
         bind_pure_I split: option.splits list.splits)[1]
-    by (smt IntI \<open>ptr |\<in>| object_ptr_kinds h\<close> finite_set_in
+    by (smt (verit) IntI \<open>ptr |\<in>| object_ptr_kinds h\<close> finite_set_in
         get_elements_by_class_name_is_strongly_scdom_component_safe_step local.get_dom_component_ok
         local.get_dom_component_ptr local.get_scdom_component_impl
         local.get_scdom_component_subset_get_dom_component returns_result_select_result select_result_I2 subsetD)
 qed
 end
 
 interpretation i_get_scdom_component_get_elements_by_class_name?: l_get_scdom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe get_disconnected_nodes
   get_disconnected_nodes_locs to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs
   get_root_node get_root_node_locs get_ancestors get_ancestors_locs get_element_by_id
   get_elements_by_class_name get_elements_by_tag_name first_in_tree_order get_attribute get_attribute_locs
   by(auto simp add: l_get_scdom_component_get_elements_by_class_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_scdom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>get\_elements\_by\_tag\_name\<close>
 
 locale l_get_scdom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_scdom_component +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma get_elements_by_tag_name_is_strongly_scdom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "h \<turnstile> get_elements_by_tag_name ptr' idd \<rightarrow>\<^sub>r results"
   assumes "result \<in> set results"
   shows "cast result \<in> set sc \<longleftrightarrow> ptr' \<in> set sc"
   by (meson assms local.get_dom_component_ptr
       local.get_elements_by_tag_name_is_strongly_dom_component_safe_step
       local.get_scdom_component_contains_get_dom_component subsetD)
 
 
 lemma get_elements_by_tag_name_is_strongly_scdom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_elements_by_tag_name ptr idd \<rightarrow>\<^sub>r results"
   assumes "h \<turnstile> get_elements_by_tag_name ptr idd \<rightarrow>\<^sub>h h'"
   shows "is_strongly_scdom_component_safe {ptr} (cast ` set results) h h'"
 proof -
   have "h = h'"
     using assms(5)
     by (meson local.get_elements_by_tag_name_pure pure_returns_heap_eq)
   have "ptr |\<in>| object_ptr_kinds h"
     using assms(4)
     apply(auto simp add: get_elements_by_tag_name_def)[1]
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) bind_is_OK_E is_OK_returns_result_I
         local.first_in_tree_order_def local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap)
   obtain to where to: "h \<turnstile> to_tree_order ptr \<rightarrow>\<^sub>r to"
     by (meson \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
         local.to_tree_order_ok)
   then have "cast ` set results \<subseteq> set to"
     using assms(4) local.get_elements_by_tag_name_result_in_tree_order by auto
   obtain c where c: "h \<turnstile> a_get_scdom_component ptr \<rightarrow>\<^sub>r c"
     using \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) local.get_scdom_component_impl
       local.get_scdom_component_ok by blast
 
   then show ?thesis
     using assms \<open>h = h'\<close>
     apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def
         get_element_by_id_def first_in_tree_order_def elim!: bind_returns_result_E2 intro!:
         map_filter_M_pure bind_pure_I split: option.splits list.splits)[1]
-    by (smt IntI \<open>ptr |\<in>| object_ptr_kinds h\<close> finite_set_in
+    by (smt (verit) IntI \<open>ptr |\<in>| object_ptr_kinds h\<close> finite_set_in
         get_elements_by_tag_name_is_strongly_scdom_component_safe_step local.get_dom_component_ok
         local.get_dom_component_ptr local.get_scdom_component_impl
         local.get_scdom_component_subset_get_dom_component returns_result_select_result select_result_I2
         subsetD)
 qed
 end
 
 interpretation i_get_scdom_component_get_elements_by_tag_name?:
   l_get_scdom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
   get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe
   get_disconnected_nodes get_disconnected_nodes_locs to_tree_order get_parent get_parent_locs
   get_child_nodes get_child_nodes_locs get_root_node get_root_node_locs get_ancestors
   get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
   first_in_tree_order get_attribute get_attribute_locs
   by(auto simp add: l_get_scdom_component_get_elements_by_tag_name\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_scdom_component_get_element_by_id\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>remove\_child\<close>
 
 locale l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_scdom_component +
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_owner_document_wf +
   l_remove_child_wf2\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_child_nodes get_child_nodes_locs set_child_nodes set_child_nodes_locs
   get_parent get_parent_locs get_owner_document get_disconnected_nodes get_disconnected_nodes_locs
   set_disconnected_nodes set_disconnected_nodes_locs remove_child remove_child_locs remove type_wf
   known_ptr known_ptrs heap_is_wellformed parent_child_rel
 begin
 lemma remove_child_is_component_unsafe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> remove_child ptr' child \<rightarrow>\<^sub>h h'"
   assumes "ptr \<notin> set |h \<turnstile> get_dom_component ptr'|\<^sub>r"
   assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child)|\<^sub>r)|\<^sub>r"
     (* assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast child)|\<^sub>r" *)
   shows "preserved (get_M ptr getter) h h'"
 proof -
   have "ptr \<noteq> ptr'"
     using assms(5)
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(4) is_OK_returns_heap_I
         is_OK_returns_result_E local.get_dom_component_ok local.get_dom_component_ptr
         local.remove_child_ptr_in_heap select_result_I2)
 
   obtain owner_document where owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r owner_document"
     by (meson assms(1) assms(2) assms(3) assms(4) is_OK_returns_result_E local.get_owner_document_ok
         local.remove_child_child_in_heap node_ptr_kinds_commutes)
   then
   obtain c where "h \<turnstile> get_dom_component (cast owner_document) \<rightarrow>\<^sub>r c"
     using get_dom_component_ok owner_document assms(1) assms(2) assms(3)
     by (meson document_ptr_kinds_commutes get_owner_document_owner_document_in_heap select_result_I)
   then
   have "ptr \<noteq> cast owner_document"
     using assms(6) assms(1) assms(2) assms(3) local.get_dom_component_ptr owner_document
     by auto
 
   show ?thesis
     using remove_child_writes assms(4)
     apply(rule reads_writes_preserved2)
     apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
         set_disconnected_nodes_locs_def all_args_def split: option.splits)[1]
          apply (metis \<open>ptr \<noteq> ptr'\<close> document_ptr_casts_commute3 get_M_Mdocument_preserved3)
         apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
         get_M_Mdocument_preserved3 owner_document select_result_I2)
        apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
         get_M_Mdocument_preserved3 owner_document select_result_I2)
       apply (metis \<open>ptr \<noteq> ptr'\<close> element_ptr_casts_commute3 get_M_Element_preserved8)
      apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
         get_M_Mdocument_preserved3 owner_document select_result_I2)
     apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
         get_M_Mdocument_preserved3 owner_document select_result_I2)
     done
 qed
 
 lemma remove_child_is_strongly_dom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> remove_child ptr' child \<rightarrow>\<^sub>h h'"
   assumes "ptr \<notin> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r"
     (* assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child)|\<^sub>r)|\<^sub>r" *)
   assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast child)|\<^sub>r"
   shows "preserved (get_M ptr getter) h h'"
 proof -
   obtain sc where sc: "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
     using get_scdom_component_ok
     by (meson assms(1) assms(2) assms(3) assms(4) is_OK_returns_heap_I local.remove_child_ptr_in_heap
         returns_result_select_result)
 
   have "child |\<in>| node_ptr_kinds h"
     using assms(4) remove_child_child_in_heap by blast
   then
   obtain child_sc where child_sc: "h \<turnstile> get_scdom_component (cast child) \<rightarrow>\<^sub>r child_sc"
     using get_scdom_component_ok
     by (meson assms(1) assms(2) assms(3) node_ptr_kinds_commutes select_result_I)
   then obtain owner_document where owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r owner_document"
     by (meson \<open>child |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3) contra_subsetD
         get_scdom_component_owner_document_same is_OK_returns_result_E
         get_scdom_component_subset_get_dom_component local.get_dom_component_ok local.get_dom_component_ptr
         node_ptr_kinds_commutes)
   then have "h \<turnstile> get_scdom_component (cast owner_document) \<rightarrow>\<^sub>r child_sc"
     using child_sc
-    by (smt \<open>child |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3) contra_subsetD
+    by (smt (verit) \<open>child |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3) contra_subsetD
         get_scdom_component_subset_get_dom_component get_scdom_component_owner_document_same
         get_scdom_component_ptrs_same_scope_component local.get_dom_component_ok local.get_dom_component_ptr
         node_ptr_kinds_commutes returns_result_select_result select_result_I2)
 
   have "ptr \<notin> set |h \<turnstile> get_dom_component ptr'|\<^sub>r"
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(4) assms(5) contra_subsetD
         get_scdom_component_subset_get_dom_component is_OK_returns_heap_I local.get_dom_component_ok
         local.remove_child_ptr_in_heap returns_result_select_result sc select_result_I2)
 
   moreover have "ptr \<notin> set |h \<turnstile> get_scdom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child)|\<^sub>r)|\<^sub>r"
     using get_scdom_component_owner_document_same get_scdom_component_ptrs_same_scope_component
     by (metis (no_types, lifting)
         \<open>h \<turnstile> get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document) \<rightarrow>\<^sub>r child_sc\<close> assms(6) child_sc
         owner_document select_result_I2)
   have "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child)|\<^sub>r)|\<^sub>r"
     using get_scdom_component_owner_document_same
     by (metis (no_types, lifting)
         \<open>h \<turnstile> get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document) \<rightarrow>\<^sub>r child_sc\<close>
         \<open>ptr \<notin> set |h \<turnstile> get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child)|\<^sub>r)|\<^sub>r\<close>
         assms(1) assms(2) assms(3) contra_subsetD document_ptr_kinds_commutes get_scdom_component_subset_get_dom_component
         is_OK_returns_result_E local.get_dom_component_ok local.get_owner_document_owner_document_in_heap owner_document
         select_result_I2)
   ultimately show ?thesis
     using assms(1) assms(2) assms(3) assms(4) remove_child_is_component_unsafe by blast
 qed
 
 
 
 lemma remove_child_is_strongly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> remove_child ptr child \<rightarrow>\<^sub>h h'"
   shows "is_strongly_scdom_component_safe {ptr, cast child} {} h h'"
 proof -
   obtain owner_document children_h h2 disconnected_nodes_h where
     owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r owner_document" and
     children_h: "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children_h" and
     child_in_children_h: "child \<in> set children_h" and
     disconnected_nodes_h: "h \<turnstile>  get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h" and
     h2: "h \<turnstile>  set_disconnected_nodes owner_document (child # disconnected_nodes_h) \<rightarrow>\<^sub>h h2" and
     h': "h2 \<turnstile> set_child_nodes ptr (remove1 child children_h) \<rightarrow>\<^sub>h h'"
     using assms(4)
     apply(auto simp add: remove_child_def elim!: bind_returns_heap_E
         dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure]
         pure_returns_heap_eq[rotated, OF get_child_nodes_pure] split: if_splits)[1]
     using pure_returns_heap_eq by fastforce
 
   have object_ptr_kinds_eq3: "object_ptr_kinds h = object_ptr_kinds h'"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
           OF remove_child_writes assms(4)])
     unfolding remove_child_locs_def
     using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have object_ptr_kinds_eq: "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     unfolding object_ptr_kinds_M_defs by simp
   then have object_ptr_kinds_eq2: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
     using select_result_eq by force
   then have node_ptr_kinds_eq2: "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by auto
   then have node_ptr_kinds_eq3: "node_ptr_kinds h = node_ptr_kinds h'"
     using node_ptr_kinds_M_eq by auto
   have document_ptr_kinds_eq2: "|h \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
     using object_ptr_kinds_eq2 document_ptr_kinds_M_eq by auto
   then have document_ptr_kinds_eq3: "document_ptr_kinds h = document_ptr_kinds h'"
     using document_ptr_kinds_M_eq by auto
   have children_eq:
     "\<And>ptr' children. ptr \<noteq> ptr' \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     apply(rule reads_writes_preserved[OF get_child_nodes_reads remove_child_writes assms(4)])
     unfolding remove_child_locs_def
     using set_disconnected_nodes_get_child_nodes set_child_nodes_get_child_nodes_different_pointers
     by fast
   then have children_eq2:
     "\<And>ptr' children. ptr \<noteq> ptr' \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   have disconnected_nodes_eq: "\<And>document_ptr disconnected_nodes. document_ptr \<noteq> owner_document
          \<Longrightarrow> h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disconnected_nodes
              = h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disconnected_nodes"
     apply(rule reads_writes_preserved[OF get_disconnected_nodes_reads remove_child_writes assms(4)])
     unfolding remove_child_locs_def
     using set_child_nodes_get_disconnected_nodes set_disconnected_nodes_get_disconnected_nodes_different_pointers
     by (metis (no_types, lifting) Un_iff owner_document select_result_I2)
   then have disconnected_nodes_eq2:
     "\<And>document_ptr. document_ptr \<noteq> owner_document
     \<Longrightarrow> |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
     using select_result_eq by force
 
   have "h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children_h"
     apply(rule reads_writes_separate_forwards[OF get_child_nodes_reads set_disconnected_nodes_writes h2 children_h] )
     by (simp add: set_disconnected_nodes_get_child_nodes)
 
   have "known_ptrs h'"
     using object_ptr_kinds_eq3 known_ptrs_preserved \<open>known_ptrs h\<close> by blast
 
   have "known_ptr ptr"
     using assms(3)
     using children_h get_child_nodes_ptr_in_heap local.known_ptrs_known_ptr by blast
   have "type_wf h2"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h2]
     using set_disconnected_nodes_types_preserved assms(2)
     by(auto simp add: reflp_def transp_def)
   then have "type_wf h'"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_child_nodes_writes h']
     using  set_child_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
   have children_h': "h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r remove1 child children_h"
     using assms(4) owner_document h2 disconnected_nodes_h children_h
     apply(auto simp add: remove_child_def split: if_splits)[1]
     apply(drule bind_returns_heap_E3)
       apply(auto split: if_splits)[1]
      apply(simp)
     apply(auto split: if_splits)[1]
     apply(drule bind_returns_heap_E3)
       apply(auto)[1]
      apply(simp)
     apply(drule bind_returns_heap_E3)
       apply(auto)[1]
      apply(simp)
     apply(drule bind_returns_heap_E4)
       apply(auto)[1]
      apply simp
     using \<open>type_wf h2\<close> set_child_nodes_get_child_nodes \<open>known_ptr ptr\<close> h'
     by blast
 
   have disconnected_nodes_h2: "h2 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r child # disconnected_nodes_h"
     using owner_document assms(4) h2 disconnected_nodes_h
     apply (auto simp add: remove_child_def  split: if_splits)[1]
     apply(drule bind_returns_heap_E2)
       apply(auto split: if_splits)[1]
      apply(simp)
     by(auto simp add: local.set_disconnected_nodes_get_disconnected_nodes split: if_splits)
   then have disconnected_nodes_h': "h' \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r child # disconnected_nodes_h"
     apply(rule reads_writes_separate_forwards[OF get_disconnected_nodes_reads set_child_nodes_writes h'])
     by (simp add: set_child_nodes_get_disconnected_nodes)
 
   moreover have "a_acyclic_heap h"
     using assms(1)  by (simp add: heap_is_wellformed_def)
   have "parent_child_rel h' \<subseteq> parent_child_rel h"
   proof (standard, safe)
     fix parent child
     assume a1: "(parent, child) \<in> parent_child_rel h'"
     then show "(parent, child) \<in> parent_child_rel h"
     proof (cases "parent = ptr")
       case True
       then show ?thesis
         using a1 remove_child_removes_parent[OF assms(1) assms(4)] children_h children_h'
           get_child_nodes_ptr_in_heap
         apply(auto simp add: parent_child_rel_def object_ptr_kinds_eq )[1]
         by (metis imageI notin_set_remove1)
     next
       case False
       then show ?thesis
         using a1
         by(auto simp add: parent_child_rel_def object_ptr_kinds_eq3 children_eq2)
     qed
   qed
   then have "a_acyclic_heap h'"
     using \<open>a_acyclic_heap h\<close> acyclic_heap_def acyclic_subset by blast
 
   moreover have "a_all_ptrs_in_heap h"
     using assms(1)  by (simp add: heap_is_wellformed_def)
   then have "a_all_ptrs_in_heap h'"
     apply(auto simp add: a_all_ptrs_in_heap_def node_ptr_kinds_eq3 disconnected_nodes_eq)[1]
      apply (metis (no_types, lifting) \<open>type_wf h'\<close> assms local.get_child_nodes_ok local.known_ptrs_known_ptr
         local.remove_child_children_subset notin_fset object_ptr_kinds_eq3 returns_result_select_result subset_code(1))
     apply (metis (no_types, lifting) assms(4) disconnected_nodes_eq2 disconnected_nodes_h disconnected_nodes_h'
         document_ptr_kinds_eq3 finite_set_in local.remove_child_child_in_heap node_ptr_kinds_eq3 select_result_I2
         set_ConsD subset_code(1))
     done
   moreover have "a_owner_document_valid h"
     using assms(1)  by (simp add: heap_is_wellformed_def)
   then have "a_owner_document_valid h'"
     apply(auto simp add: a_owner_document_valid_def object_ptr_kinds_eq3 document_ptr_kinds_eq3
         node_ptr_kinds_eq3)[1]
   proof -
     fix node_ptr
     assume 0: "\<forall>node_ptr\<in>fset (node_ptr_kinds h'). (\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h' \<and>
 node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) \<or> (\<exists>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h' \<and>
 node_ptr \<in> set |h \<turnstile> get_child_nodes parent_ptr|\<^sub>r)"
       and 1: "node_ptr |\<in>| node_ptr_kinds h'"
       and 2: "\<forall>parent_ptr. parent_ptr |\<in>| object_ptr_kinds h' \<longrightarrow> node_ptr \<notin> set |h' \<turnstile> get_child_nodes parent_ptr|\<^sub>r"
     then show "\<exists>document_ptr. document_ptr |\<in>| document_ptr_kinds h'
                        \<and> node_ptr \<in> set |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
     proof (cases "node_ptr = child")
       case True
       show ?thesis
         apply(rule exI[where x=owner_document])
         using children_eq2 disconnected_nodes_eq2 children_h children_h' disconnected_nodes_h' True
         by (metis (no_types, lifting) get_disconnected_nodes_ptr_in_heap is_OK_returns_result_I
             list.set_intros(1) select_result_I2)
     next
       case False
       then show ?thesis
         using 0 1 2 children_eq2 children_h children_h' disconnected_nodes_eq2 disconnected_nodes_h
           disconnected_nodes_h'
         apply(auto simp add: children_eq2 disconnected_nodes_eq2 dest!: select_result_I2)[1]
         by (metis children_eq2 disconnected_nodes_eq2 finite_set_in in_set_remove1 list.set_intros(2))
     qed
   qed
 
   moreover
   {
     have h0: "a_distinct_lists h"
       using assms(1)  by (simp add: heap_is_wellformed_def)
     moreover have ha1: "(\<Union>x\<in>set |h \<turnstile> object_ptr_kinds_M|\<^sub>r. set |h \<turnstile> get_child_nodes x|\<^sub>r)
                  \<inter> (\<Union>x\<in>set |h \<turnstile> document_ptr_kinds_M|\<^sub>r. set |h \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
       using \<open>a_distinct_lists h\<close>
       unfolding a_distinct_lists_def
       by(auto)
     have ha2: "ptr |\<in>| object_ptr_kinds h"
       using children_h get_child_nodes_ptr_in_heap by blast
     have ha3: "child \<in> set |h \<turnstile> get_child_nodes ptr|\<^sub>r"
       using child_in_children_h children_h
       by(simp)
     have child_not_in: "\<And>document_ptr. document_ptr |\<in>| document_ptr_kinds h
                           \<Longrightarrow> child \<notin> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r"
       using ha1 ha2 ha3
       apply(simp)
       using IntI by fastforce
     moreover have "distinct |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
       apply(rule select_result_I)
       by(auto simp add: object_ptr_kinds_M_defs)
     moreover have "distinct |h \<turnstile> document_ptr_kinds_M|\<^sub>r"
       apply(rule select_result_I)
       by(auto simp add: document_ptr_kinds_M_defs)
     ultimately have "a_distinct_lists h'"
     proof(simp (no_asm) add: a_distinct_lists_def, safe)
       assume 1: "a_distinct_lists h"
         and 3: "distinct |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
 
       assume 1: "a_distinct_lists h"
         and 3: "distinct |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
       have 4: "distinct (concat ((map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r) |h \<turnstile> object_ptr_kinds_M|\<^sub>r)))"
         using 1 by(auto simp add: a_distinct_lists_def)
       show "distinct (concat (map (\<lambda>ptr. |h' \<turnstile> get_child_nodes ptr|\<^sub>r)
                      (sorted_list_of_set (fset (object_ptr_kinds h')))))"
       proof(rule distinct_concat_map_I[OF 3[unfolded object_ptr_kinds_eq2], simplified])
         fix x
         assume 5: "x |\<in>| object_ptr_kinds h'"
         then have 6: "distinct |h \<turnstile> get_child_nodes x|\<^sub>r"
           using 4 distinct_concat_map_E object_ptr_kinds_eq2 by fastforce
         obtain children where children: "h \<turnstile> get_child_nodes x \<rightarrow>\<^sub>r children"
           and distinct_children: "distinct children"
           by (metis "5" "6" assms get_child_nodes_ok local.known_ptrs_known_ptr
               object_ptr_kinds_eq3 select_result_I)
         obtain children' where children': "h' \<turnstile> get_child_nodes x \<rightarrow>\<^sub>r children'"
           using children children_eq children_h' by fastforce
         then have "distinct children'"
         proof (cases "ptr = x")
           case True
           then show ?thesis
             using children distinct_children children_h children_h'
             by (metis children' distinct_remove1 returns_result_eq)
         next
           case False
           then show ?thesis
             using children distinct_children children_eq[OF False]
             using children' distinct_lists_children h0
             using select_result_I2 by fastforce
         qed
 
         then show "distinct |h' \<turnstile> get_child_nodes x|\<^sub>r"
           using children' by(auto simp add: )
       next
         fix x y
         assume 5: "x |\<in>| object_ptr_kinds h'" and 6: "y |\<in>| object_ptr_kinds h'" and 7: "x \<noteq> y"
         obtain children_x where children_x: "h \<turnstile> get_child_nodes x \<rightarrow>\<^sub>r children_x"
           by (metis "5" assms get_child_nodes_ok is_OK_returns_result_E
               local.known_ptrs_known_ptr object_ptr_kinds_eq3)
         obtain children_y where children_y: "h \<turnstile> get_child_nodes y \<rightarrow>\<^sub>r children_y"
           by (metis "6" assms get_child_nodes_ok is_OK_returns_result_E
               local.known_ptrs_known_ptr object_ptr_kinds_eq3)
         obtain children_x' where children_x': "h' \<turnstile> get_child_nodes x \<rightarrow>\<^sub>r children_x'"
           using children_eq children_h' children_x by fastforce
         obtain children_y' where children_y': "h' \<turnstile> get_child_nodes y \<rightarrow>\<^sub>r children_y'"
           using children_eq children_h' children_y by fastforce
         have "distinct (concat (map (\<lambda>ptr. |h \<turnstile> get_child_nodes ptr|\<^sub>r) |h \<turnstile> object_ptr_kinds_M|\<^sub>r))"
           using h0 by(auto simp add: a_distinct_lists_def)
         then have 8: "set children_x \<inter> set children_y = {}"
           using "7" assms(1) children_x children_y local.heap_is_wellformed_one_parent by blast
         have "set children_x' \<inter> set children_y' = {}"
         proof (cases "ptr = x")
           case True
           then have "ptr \<noteq> y"
             by(simp add: 7)
           have "children_x' = remove1 child children_x"
             using children_h children_h' children_x children_x' True returns_result_eq by fastforce
           moreover have "children_y' = children_y"
             using children_y children_y' children_eq[OF \<open>ptr \<noteq> y\<close>] by auto
           ultimately show ?thesis
             using 8 set_remove1_subset by fastforce
         next
           case False
           then show ?thesis
           proof (cases "ptr = y")
             case True
             have "children_y' = remove1 child children_y"
               using children_h children_h' children_y children_y' True returns_result_eq by fastforce
             moreover have "children_x' = children_x"
               using children_x children_x' children_eq[OF \<open>ptr \<noteq> x\<close>] by auto
             ultimately show ?thesis
               using 8 set_remove1_subset by fastforce
           next
             case False
             have "children_x' = children_x"
               using children_x children_x' children_eq[OF \<open>ptr \<noteq> x\<close>] by auto
             moreover have "children_y' = children_y"
               using children_y children_y' children_eq[OF \<open>ptr \<noteq> y\<close>] by auto
             ultimately show ?thesis
               using 8 by simp
           qed
         qed
         then show "set |h' \<turnstile> get_child_nodes x|\<^sub>r \<inter> set |h' \<turnstile> get_child_nodes y|\<^sub>r = {}"
           using children_x' children_y'
           by (metis (no_types, lifting) select_result_I2)
       qed
     next
       assume 2: "distinct |h \<turnstile> document_ptr_kinds_M|\<^sub>r"
       then have 4: "distinct  (sorted_list_of_set (fset (document_ptr_kinds h')))"
         by simp
       have 3: "distinct (concat (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                         (sorted_list_of_set (fset (document_ptr_kinds h')))))"
         using h0
         by(simp add: a_distinct_lists_def document_ptr_kinds_eq3)
 
       show "distinct (concat (map (\<lambda>document_ptr. |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                          (sorted_list_of_set (fset (document_ptr_kinds h')))))"
       proof(rule distinct_concat_map_I[OF 4[unfolded document_ptr_kinds_eq3]])
         fix x
         assume 4: "x \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
         have 5: "distinct |h \<turnstile> get_disconnected_nodes x|\<^sub>r"
           using distinct_lists_disconnected_nodes[OF h0] 4 get_disconnected_nodes_ok
           by (simp add: assms document_ptr_kinds_eq3 select_result_I)
         show "distinct |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
         proof (cases "x = owner_document")
           case True
           have "child \<notin> set |h \<turnstile> get_disconnected_nodes x|\<^sub>r"
             using child_not_in  document_ptr_kinds_eq2 "4" by fastforce
           moreover have "|h' \<turnstile> get_disconnected_nodes x|\<^sub>r = child # |h \<turnstile> get_disconnected_nodes x|\<^sub>r"
             using disconnected_nodes_h' disconnected_nodes_h unfolding True
             by(simp)
           ultimately show ?thesis
             using 5 unfolding True
             by simp
         next
           case False
           show ?thesis
             using "5" False disconnected_nodes_eq2 by auto
         qed
       next
         fix x y
         assume 4: "x \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
           and 5: "y \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))" and "x \<noteq> y"
         obtain disc_nodes_x where disc_nodes_x: "h \<turnstile> get_disconnected_nodes x \<rightarrow>\<^sub>r disc_nodes_x"
           using 4 get_disconnected_nodes_ok[OF \<open>type_wf h\<close>, of x] document_ptr_kinds_eq2
           by auto
         obtain disc_nodes_y where disc_nodes_y: "h \<turnstile> get_disconnected_nodes y \<rightarrow>\<^sub>r disc_nodes_y"
           using 5 get_disconnected_nodes_ok[OF \<open>type_wf h\<close>, of y] document_ptr_kinds_eq2
           by auto
         obtain disc_nodes_x' where disc_nodes_x': "h' \<turnstile> get_disconnected_nodes x \<rightarrow>\<^sub>r disc_nodes_x'"
           using 4 get_disconnected_nodes_ok[OF \<open>type_wf h'\<close>, of x] document_ptr_kinds_eq2
           by auto
         obtain disc_nodes_y' where disc_nodes_y': "h' \<turnstile> get_disconnected_nodes y \<rightarrow>\<^sub>r disc_nodes_y'"
           using 5 get_disconnected_nodes_ok[OF \<open>type_wf h'\<close>, of y] document_ptr_kinds_eq2
           by auto
         have "distinct
                (concat (map (\<lambda>document_ptr. |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r) |h \<turnstile> document_ptr_kinds_M|\<^sub>r))"
           using h0 by (simp add: a_distinct_lists_def)
         then have 6: "set disc_nodes_x \<inter> set disc_nodes_y = {}"
           using \<open>x \<noteq> y\<close> assms(1) disc_nodes_x disc_nodes_y local.heap_is_wellformed_one_disc_parent
           by blast
 
         have "set disc_nodes_x' \<inter> set disc_nodes_y' = {}"
         proof (cases "x = owner_document")
           case True
           then have "y \<noteq> owner_document"
             using \<open>x \<noteq> y\<close> by simp
           then have "disc_nodes_y' = disc_nodes_y"
             using disconnected_nodes_eq[OF \<open>y \<noteq> owner_document\<close>] disc_nodes_y disc_nodes_y'
             by auto
           have "disc_nodes_x' = child # disc_nodes_x"
             using disconnected_nodes_h' disc_nodes_x disc_nodes_x' True disconnected_nodes_h returns_result_eq
             by fastforce
           have "child \<notin> set disc_nodes_y"
             using child_not_in  disc_nodes_y 5
             using document_ptr_kinds_eq2  by fastforce
           then show ?thesis
             apply(unfold \<open>disc_nodes_x' = child # disc_nodes_x\<close> \<open>disc_nodes_y' = disc_nodes_y\<close>)
             using 6 by auto
         next
           case False
           then show ?thesis
           proof (cases "y = owner_document")
             case True
             then have "disc_nodes_x' = disc_nodes_x"
               using disconnected_nodes_eq[OF \<open>x \<noteq> owner_document\<close>] disc_nodes_x disc_nodes_x' by auto
             have "disc_nodes_y' = child # disc_nodes_y"
               using disconnected_nodes_h' disc_nodes_y disc_nodes_y' True disconnected_nodes_h returns_result_eq
               by fastforce
             have "child \<notin> set disc_nodes_x"
               using child_not_in  disc_nodes_x 4
               using document_ptr_kinds_eq2  by fastforce
             then show ?thesis
               apply(unfold \<open>disc_nodes_y' = child # disc_nodes_y\<close> \<open>disc_nodes_x' = disc_nodes_x\<close>)
               using 6 by auto
           next
             case False
             have "disc_nodes_x' = disc_nodes_x"
               using disconnected_nodes_eq[OF \<open>x \<noteq> owner_document\<close>] disc_nodes_x disc_nodes_x' by auto
             have "disc_nodes_y' = disc_nodes_y"
               using disconnected_nodes_eq[OF \<open>y \<noteq> owner_document\<close>] disc_nodes_y disc_nodes_y' by auto
             then show ?thesis
               apply(unfold \<open>disc_nodes_y' = disc_nodes_y\<close> \<open>disc_nodes_x' = disc_nodes_x\<close>)
               using 6 by auto
           qed
         qed
         then show "set |h' \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h' \<turnstile> get_disconnected_nodes y|\<^sub>r = {}"
           using disc_nodes_x' disc_nodes_y' by auto
       qed
     next
       fix x xa xb
       assume 1: "xa \<in> fset (object_ptr_kinds h')"
         and 2: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
         and 3: "xb \<in> fset (document_ptr_kinds h')"
         and 4: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
       obtain disc_nodes where disc_nodes: "h \<turnstile> get_disconnected_nodes xb \<rightarrow>\<^sub>r disc_nodes"
         using 3 get_disconnected_nodes_ok[OF \<open>type_wf h\<close>, of xb] document_ptr_kinds_eq2 by auto
       obtain disc_nodes' where disc_nodes': "h' \<turnstile> get_disconnected_nodes xb \<rightarrow>\<^sub>r disc_nodes'"
         using 3 get_disconnected_nodes_ok[OF \<open>type_wf h'\<close>, of xb]  document_ptr_kinds_eq2 by auto
 
       obtain children where children: "h \<turnstile> get_child_nodes xa \<rightarrow>\<^sub>r children"
         by (metis "1" assms finite_set_in get_child_nodes_ok is_OK_returns_result_E
             local.known_ptrs_known_ptr object_ptr_kinds_eq3)
       obtain children' where children': "h' \<turnstile> get_child_nodes xa \<rightarrow>\<^sub>r children'"
         using children children_eq children_h' by fastforce
       have "\<And>x. x \<in> set |h \<turnstile> get_child_nodes xa|\<^sub>r \<Longrightarrow> x \<in> set |h \<turnstile> get_disconnected_nodes xb|\<^sub>r \<Longrightarrow> False"
         using 1 3
         apply(fold \<open> object_ptr_kinds h =  object_ptr_kinds h'\<close>)
         apply(fold \<open> document_ptr_kinds h =  document_ptr_kinds h'\<close>)
         using children disc_nodes h0 apply(auto simp add: a_distinct_lists_def)[1]
         by (metis (no_types, lifting) h0 local.distinct_lists_no_parent select_result_I2)
       then have 5: "\<And>x. x \<in> set children \<Longrightarrow> x \<in> set disc_nodes \<Longrightarrow> False"
         using children disc_nodes  by fastforce
       have 6: "|h' \<turnstile> get_child_nodes xa|\<^sub>r = children'"
         using children' by simp
       have 7: "|h' \<turnstile> get_disconnected_nodes xb|\<^sub>r = disc_nodes'"
         using disc_nodes' by simp
       have "False"
       proof (cases "xa = ptr")
         case True
         have "distinct children_h"
           using children_h distinct_lists_children h0 \<open>known_ptr ptr\<close> by blast
         have "|h' \<turnstile> get_child_nodes ptr|\<^sub>r = remove1 child children_h"
           using children_h'
           by simp
         have "children = children_h"
           using True children children_h by auto
         show ?thesis
           using disc_nodes' children' 5 2 4 children_h \<open>distinct children_h\<close> disconnected_nodes_h'
           apply(auto simp add: 6 7
               \<open>xa = ptr\<close> \<open>|h' \<turnstile> get_child_nodes ptr|\<^sub>r = remove1 child children_h\<close> \<open>children = children_h\<close>)[1]
           by (metis (no_types, lifting) disc_nodes disconnected_nodes_eq2 disconnected_nodes_h
               select_result_I2 set_ConsD)
       next
         case False
         have "children' = children"
           using children' children children_eq[OF False[symmetric]]
           by auto
         then show ?thesis
         proof (cases "xb = owner_document")
           case True
           then show ?thesis
             using disc_nodes disconnected_nodes_h disconnected_nodes_h'
             using "2" "4" "5" "6" "7" False \<open>children' = children\<close> assms(1) child_in_children_h
               child_parent_dual children children_h disc_nodes' get_child_nodes_ptr_in_heap
               list.set_cases list.simps(3) option.simps(1) returns_result_eq set_ConsD
             by (metis (no_types, opaque_lifting) assms)
         next
           case False
           then show ?thesis
             using "2" "4" "5" "6" "7" \<open>children' = children\<close> disc_nodes disc_nodes'
               disconnected_nodes_eq returns_result_eq
             by metis
         qed
       qed
       then show "x \<in> {}"
         by simp
     qed
   }
 
   ultimately have "heap_is_wellformed h'"
     using heap_is_wellformed_def by blast
 
   show ?thesis
     apply(auto simp add: is_strongly_scdom_component_safe_def Let_def object_ptr_kinds_eq3)[1]
     using assms(1) assms(2) assms(3) assms(4) local.get_scdom_component_impl
       remove_child_is_strongly_dom_component_safe_step
     by blast
 qed
 end
 
 interpretation i_get_scdom_component_remove_child?: l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_root_node get_root_node_locs get_ancestors
   get_ancestors_locs get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id
   get_elements_by_class_name get_elements_by_tag_name set_child_nodes set_child_nodes_locs
   set_disconnected_nodes set_disconnected_nodes_locs remove_child remove_child_locs remove
   by(auto simp add: l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 
 subsubsection \<open>adopt\_node\<close>
 
 locale l_get_scdom_component_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_scdom_component +
   l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_adopt_node_wf +
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_owner_document_wf +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_adopt_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma adopt_node_is_component_unsafe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> adopt_node document_ptr node_ptr \<rightarrow>\<^sub>h h'"
   assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast document_ptr)|\<^sub>r"
   assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast node_ptr)|\<^sub>r"
   assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr)|\<^sub>r)|\<^sub>r"
   shows "preserved (get_M ptr getter) h h'"
 proof -
   obtain owner_document where owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr) \<rightarrow>\<^sub>r owner_document"
     using assms(4) local.adopt_node_def by auto
   then
   obtain c where "h \<turnstile> get_dom_component (cast owner_document) \<rightarrow>\<^sub>r c"
     using get_dom_component_ok assms(1) assms(2) assms(3) get_owner_document_owner_document_in_heap
     by (meson document_ptr_kinds_commutes select_result_I)
   then
   have "ptr \<noteq> cast owner_document"
     using assms(6) assms(1) assms(2) assms(3) local.get_dom_component_ptr owner_document
     by (metis (no_types, lifting) assms(7) select_result_I2)
 
   have "document_ptr |\<in>| document_ptr_kinds h"
     using adopt_node_document_in_heap assms(1) assms(2) assms(3) assms(4) by auto
   then
   have "ptr \<noteq> cast document_ptr"
     using assms(5)
     using assms(1) assms(2) assms(3) local.get_dom_component_ptr get_dom_component_ok
     by (meson document_ptr_kinds_commutes returns_result_select_result)
 
   have "\<And>parent. |h \<turnstile> get_parent node_ptr|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr"
     by (metis assms(1) assms(2) assms(3) assms(6) is_OK_returns_result_I local.get_dom_component_ok
         local.get_dom_component_parent_inside local.get_dom_component_ptr local.get_owner_document_ptr_in_heap
         local.get_parent_ok node_ptr_kinds_commutes owner_document returns_result_select_result)
 
   show ?thesis
     using adopt_node_writes assms(4)
     apply(rule reads_writes_preserved2)
     apply(auto simp add: adopt_node_locs_def remove_child_locs_def set_child_nodes_locs_def set_disconnected_nodes_locs_def all_args_def)[1]
                     apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
                    apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
                   apply(drule \<open>\<And>parent. |h \<turnstile> get_parent node_ptr|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr\<close>)[1] apply (metis element_ptr_casts_commute3 get_M_Element_preserved8 is_node_ptr_kind_none node_ptr_casts_commute3 option.case_eq_if)
                  apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
                 apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
                apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
               apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
              apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
             apply(drule \<open>\<And>parent. |h \<turnstile> get_parent node_ptr|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr\<close>)[1] apply (metis document_ptr_casts_commute3 get_M_Mdocument_preserved3)
            apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
           apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
          apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
         apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
        apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
       apply(drule \<open>\<And>parent. |h \<turnstile> get_parent node_ptr|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr\<close>)[1]
       apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
      apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr\<close> get_M_Mdocument_preserved3)
     apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close> get_M_Mdocument_preserved3 owner_document select_result_I2)
     done
 qed
 
 lemma adopt_node_is_strongly_dom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> adopt_node document_ptr node_ptr \<rightarrow>\<^sub>h h'"
   assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast document_ptr)|\<^sub>r"
   assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast node_ptr)|\<^sub>r"
   shows "preserved (get_M ptr getter) h h'"
 proof -
   have "document_ptr |\<in>| document_ptr_kinds h"
     by (meson assms(1) assms(2) assms(3) assms(4) is_OK_returns_heap_I local.adopt_node_document_in_heap)
   then
   obtain sc where sc: "h \<turnstile> get_scdom_component (cast document_ptr) \<rightarrow>\<^sub>r sc"
     using get_scdom_component_ok
     by (meson assms(1) assms(2) assms(3) document_ptr_kinds_commutes returns_result_select_result)
 
   have "node_ptr |\<in>| node_ptr_kinds h"
     using assms(4)
     by (meson is_OK_returns_heap_I local.adopt_node_child_in_heap)
   then
   obtain child_sc where child_sc: "h \<turnstile> get_scdom_component (cast node_ptr) \<rightarrow>\<^sub>r child_sc"
     using get_scdom_component_ok
     by (meson assms(1) assms(2) assms(3) is_OK_returns_result_E node_ptr_kinds_commutes)
 
   then obtain owner_document where owner_document: "h \<turnstile> get_owner_document (cast node_ptr) \<rightarrow>\<^sub>r owner_document"
     by (meson \<open>node_ptr |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3) contra_subsetD
         get_scdom_component_owner_document_same is_OK_returns_result_E
         get_scdom_component_subset_get_dom_component local.get_dom_component_ok local.get_dom_component_ptr
         node_ptr_kinds_commutes)
   then have "h \<turnstile> get_scdom_component (cast owner_document) \<rightarrow>\<^sub>r child_sc"
     using child_sc
     by (metis (no_types, lifting) \<open>node_ptr |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3)
         get_scdom_component_owner_document_same get_scdom_component_ptrs_same_scope_component
         get_scdom_component_subset_get_dom_component is_OK_returns_result_E local.get_dom_component_ok
         local.get_dom_component_ptr node_ptr_kinds_commutes select_result_I2 subset_code(1))
 
   have "ptr \<notin> set |h \<turnstile> get_dom_component (cast document_ptr)|\<^sub>r"
     by (metis (no_types, lifting) \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(1) assms(2) assms(3)
         assms(5) contra_subsetD document_ptr_kinds_commutes get_scdom_component_subset_get_dom_component
         local.get_dom_component_ok returns_result_select_result sc select_result_I2)
 
   moreover have "ptr \<notin> set |h \<turnstile> get_dom_component (cast node_ptr)|\<^sub>r"
     by (metis (no_types, lifting) \<open>node_ptr |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3) assms(6)
         child_sc contra_subsetD get_scdom_component_subset_get_dom_component local.get_dom_component_ok
         node_ptr_kinds_commutes returns_result_select_result select_result_I2)
 
   moreover have "ptr \<notin> set |h \<turnstile> get_scdom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr)|\<^sub>r)|\<^sub>r"
     using get_scdom_component_owner_document_same get_scdom_component_ptrs_same_scope_component
     by (metis (no_types, lifting)
         \<open>h \<turnstile> get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document) \<rightarrow>\<^sub>r child_sc\<close> assms(6) child_sc
         owner_document select_result_I2)
   have "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr)|\<^sub>r)|\<^sub>r"
     using get_scdom_component_owner_document_same
     by (metis (no_types, opaque_lifting)
         \<open>\<And>thesis. (\<And>owner_document. h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr) \<rightarrow>\<^sub>r owner_document \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close>
         \<open>h \<turnstile> get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document) \<rightarrow>\<^sub>r child_sc\<close>
         \<open>ptr \<notin> set |h \<turnstile> get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r node_ptr)|\<^sub>r)|\<^sub>r\<close>
         assms(1) assms(2) assms(3) contra_subsetD document_ptr_kinds_commutes get_scdom_component_subset_get_dom_component
         is_OK_returns_result_E local.get_dom_component_ok local.get_owner_document_owner_document_in_heap owner_document
         returns_result_eq select_result_I2)
   ultimately show ?thesis
     using assms(1) assms(2) assms(3) assms(4) adopt_node_is_component_unsafe
     by blast
 qed
 
 lemma adopt_node_is_strongly_scdom_component_safe:
   assumes "heap_is_wellformed h" and type_wf: "type_wf h" and known_ptrs: "known_ptrs h"
   assumes "h \<turnstile> adopt_node document_ptr child \<rightarrow>\<^sub>h h'"
   shows "is_strongly_scdom_component_safe {cast document_ptr, cast child} {} h h'"
 proof -
 
   obtain old_document parent_opt h2 where
     old_document: "h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r old_document"
     and
     parent_opt: "h \<turnstile> get_parent child \<rightarrow>\<^sub>r parent_opt"
     and
     h2: "h \<turnstile> (case parent_opt of Some parent \<Rightarrow> remove_child parent child | None \<Rightarrow> return ()) \<rightarrow>\<^sub>h h2"
     and
     h': "h2 \<turnstile> (if document_ptr \<noteq> old_document then do {
         old_disc_nodes \<leftarrow> get_disconnected_nodes old_document;
         set_disconnected_nodes old_document (remove1 child old_disc_nodes);
         disc_nodes \<leftarrow> get_disconnected_nodes document_ptr;
         set_disconnected_nodes document_ptr (child # disc_nodes)
       } else do {
         return ()
       }) \<rightarrow>\<^sub>h h'"
     using assms(4)
     by(auto simp add: adopt_node_def elim!: bind_returns_heap_E
         dest!: pure_returns_heap_eq[rotated, OF get_owner_document_pure]
         pure_returns_heap_eq[rotated, OF get_parent_pure])
 
   have object_ptr_kinds_h_eq3: "object_ptr_kinds h = object_ptr_kinds h2"
     using h2 apply(simp split: option.splits)
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
           OF remove_child_writes])
     using remove_child_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have object_ptr_kinds_M_eq_h:
     "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     unfolding object_ptr_kinds_M_defs by simp
   then have object_ptr_kinds_eq_h: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq_h: "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
 
   have wellformed_h2: "heap_is_wellformed h2"
     using h2 remove_child_heap_is_wellformed_preserved known_ptrs type_wf
     by (metis (no_types, lifting) assms(1) option.case_eq_if pure_returns_heap_eq return_pure)
   have "type_wf h2"
     using h2 remove_child_preserves_type_wf known_ptrs type_wf
     by (metis (no_types, lifting) assms(1) option.case_eq_if pure_returns_heap_eq return_pure)
   have "known_ptrs h2"
     using h2 remove_child_preserves_known_ptrs known_ptrs type_wf
     by (metis (no_types, lifting) assms(1) option.case_eq_if pure_returns_heap_eq return_pure)
   have "heap_is_wellformed h' \<and> known_ptrs h' \<and> type_wf h'"
   proof(cases "document_ptr = old_document")
     case True
     then show ?thesis
       using h' wellformed_h2 \<open>type_wf h2\<close> \<open>known_ptrs h2\<close> by auto
   next
     case False
     then obtain h3 old_disc_nodes disc_nodes_document_ptr_h3 where
       docs_neq: "document_ptr \<noteq> old_document" and
       old_disc_nodes: "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r old_disc_nodes" and
       h3: "h2 \<turnstile> set_disconnected_nodes old_document (remove1 child old_disc_nodes) \<rightarrow>\<^sub>h h3" and
       disc_nodes_document_ptr_h3:
       "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_document_ptr_h3" and
       h': "h3 \<turnstile> set_disconnected_nodes document_ptr (child # disc_nodes_document_ptr_h3) \<rightarrow>\<^sub>h h'"
       using h'
       by(auto elim!: bind_returns_heap_E
           bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
 
     have object_ptr_kinds_h2_eq3: "object_ptr_kinds h2 = object_ptr_kinds h3"
       apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
             OF set_disconnected_nodes_writes h3])
       using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
       by (auto simp add: reflp_def transp_def)
     then have object_ptr_kinds_M_eq_h2:
       "\<And>ptrs. h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
       by(simp add: object_ptr_kinds_M_defs)
     then have object_ptr_kinds_eq_h2: "|h2 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> object_ptr_kinds_M|\<^sub>r"
       by(simp)
     then have node_ptr_kinds_eq_h2: "|h2 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> node_ptr_kinds_M|\<^sub>r"
       using node_ptr_kinds_M_eq by blast
     then have node_ptr_kinds_eq3_h2: "node_ptr_kinds h2 = node_ptr_kinds h3"
       by auto
     have document_ptr_kinds_eq2_h2: "|h2 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> document_ptr_kinds_M|\<^sub>r"
       using object_ptr_kinds_eq_h2 document_ptr_kinds_M_eq by auto
     then have document_ptr_kinds_eq3_h2: "document_ptr_kinds h2 = document_ptr_kinds h3"
       using object_ptr_kinds_eq_h2 document_ptr_kinds_M_eq by auto
     have children_eq_h2:
       "\<And>ptr children. h2 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
       using get_child_nodes_reads set_disconnected_nodes_writes h3
       apply(rule reads_writes_preserved)
       by (simp add: set_disconnected_nodes_get_child_nodes)
     then have children_eq2_h2: "\<And>ptr. |h2 \<turnstile> get_child_nodes ptr|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr|\<^sub>r"
       using select_result_eq by force
 
     have object_ptr_kinds_h3_eq3: "object_ptr_kinds h3 = object_ptr_kinds h'"
       apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
             OF set_disconnected_nodes_writes h'])
       using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
       by (auto simp add: reflp_def transp_def)
     then have object_ptr_kinds_M_eq_h3:
       "\<And>ptrs. h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
       by(simp add: object_ptr_kinds_M_defs)
     then have object_ptr_kinds_eq_h3: "|h3 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
       by(simp)
     then have node_ptr_kinds_eq_h3: "|h3 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
       using node_ptr_kinds_M_eq by blast
     then have node_ptr_kinds_eq3_h3: "node_ptr_kinds h3 = node_ptr_kinds h'"
       by auto
     have document_ptr_kinds_eq2_h3: "|h3 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
       using object_ptr_kinds_eq_h3 document_ptr_kinds_M_eq by auto
     then have document_ptr_kinds_eq3_h3: "document_ptr_kinds h3 = document_ptr_kinds h'"
       using object_ptr_kinds_eq_h3 document_ptr_kinds_M_eq by auto
     have children_eq_h3:
       "\<And>ptr children. h3 \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
       using get_child_nodes_reads set_disconnected_nodes_writes h'
       apply(rule reads_writes_preserved)
       by (simp add: set_disconnected_nodes_get_child_nodes)
     then have children_eq2_h3: "\<And>ptr. |h3 \<turnstile> get_child_nodes ptr|\<^sub>r = |h' \<turnstile> get_child_nodes ptr|\<^sub>r"
       using select_result_eq by force
 
     have disconnected_nodes_eq_h2:
       "\<And>doc_ptr disc_nodes. old_document \<noteq> doc_ptr
       \<Longrightarrow> h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
       using get_disconnected_nodes_reads set_disconnected_nodes_writes h3
       apply(rule reads_writes_preserved)
       by (simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
     then have disconnected_nodes_eq2_h2:
       "\<And>doc_ptr. old_document \<noteq> doc_ptr
        \<Longrightarrow> |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
       using select_result_eq by force
     obtain disc_nodes_old_document_h2 where disc_nodes_old_document_h2:
       "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r disc_nodes_old_document_h2"
       using old_disc_nodes by blast
     then have disc_nodes_old_document_h3:
       "h3 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r remove1 child disc_nodes_old_document_h2"
       using h3 old_disc_nodes returns_result_eq set_disconnected_nodes_get_disconnected_nodes
       by fastforce
     have "distinct disc_nodes_old_document_h2"
       using disc_nodes_old_document_h2 local.heap_is_wellformed_disconnected_nodes_distinct wellformed_h2
       by blast
 
 
     have "type_wf h2"
     proof (insert h2, induct  parent_opt)
       case None
       then show ?case
         using type_wf by simp
     next
       case (Some option)
       then show ?case
         using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF remove_child_writes]
           type_wf remove_child_types_preserved
         by (simp add: reflp_def transp_def)
     qed
     then have "type_wf h3"
       using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h3]
       using  set_disconnected_nodes_types_preserved
       by(auto simp add: reflp_def transp_def)
     then have "type_wf h'"
       using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h']
       using  set_disconnected_nodes_types_preserved
       by(auto simp add: reflp_def transp_def)
 
     have "known_ptrs h3"
       using known_ptrs local.known_ptrs_preserved object_ptr_kinds_h2_eq3 object_ptr_kinds_h_eq3 by blast
     then have "known_ptrs h'"
       using local.known_ptrs_preserved object_ptr_kinds_h3_eq3 by blast
 
     have disconnected_nodes_eq_h3:
       "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr
        \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
       using get_disconnected_nodes_reads set_disconnected_nodes_writes h'
       apply(rule reads_writes_preserved)
       by (simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
     then have disconnected_nodes_eq2_h3:
       "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
       \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
       using select_result_eq by force
     have disc_nodes_document_ptr_h2:
       "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_document_ptr_h3"
       using disconnected_nodes_eq_h2 docs_neq disc_nodes_document_ptr_h3 by auto
     have disc_nodes_document_ptr_h': "
       h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r child # disc_nodes_document_ptr_h3"
       using h' disc_nodes_document_ptr_h3
       using set_disconnected_nodes_get_disconnected_nodes by blast
 
     have document_ptr_in_heap: "document_ptr |\<in>| document_ptr_kinds h2"
       using disc_nodes_document_ptr_h3 document_ptr_kinds_eq2_h2 get_disconnected_nodes_ok assms(1)
       unfolding heap_is_wellformed_def
       using disc_nodes_document_ptr_h2 get_disconnected_nodes_ptr_in_heap by blast
     have old_document_in_heap: "old_document |\<in>| document_ptr_kinds h2"
       using disc_nodes_old_document_h3 document_ptr_kinds_eq2_h2 get_disconnected_nodes_ok assms(1)
       unfolding heap_is_wellformed_def
       using get_disconnected_nodes_ptr_in_heap old_disc_nodes by blast
 
     have "child \<in> set disc_nodes_old_document_h2"
     proof (insert parent_opt h2, induct parent_opt)
       case None
       then have "h = h2"
         by(auto)
       moreover have "a_owner_document_valid h"
         using assms(1) heap_is_wellformed_def by(simp add: heap_is_wellformed_def)
       ultimately show ?case
         using old_document disc_nodes_old_document_h2 None(1) child_parent_dual[OF assms(1)]
           in_disconnected_nodes_no_parent assms(1) known_ptrs type_wf by blast
     next
       case (Some option)
       then show ?case
         apply(simp split: option.splits)
         using assms(1) disc_nodes_old_document_h2 old_document remove_child_in_disconnected_nodes known_ptrs
         by blast
     qed
     have "child \<notin> set (remove1 child disc_nodes_old_document_h2)"
       using disc_nodes_old_document_h3 h3 known_ptrs wellformed_h2 \<open>distinct disc_nodes_old_document_h2\<close>
       by auto
     have "child \<notin> set disc_nodes_document_ptr_h3"
     proof -
       have "a_distinct_lists h2"
         using heap_is_wellformed_def wellformed_h2 by blast
       then have 0: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                                           |h2 \<turnstile> document_ptr_kinds_M|\<^sub>r))"
         by(simp add: a_distinct_lists_def)
       show ?thesis
         using distinct_concat_map_E(1)[OF 0] \<open>child \<in> set disc_nodes_old_document_h2\<close>
           disc_nodes_old_document_h2 disc_nodes_document_ptr_h2
         by (meson \<open>type_wf h2\<close> docs_neq known_ptrs local.get_owner_document_disconnected_nodes
             local.known_ptrs_preserved object_ptr_kinds_h_eq3 returns_result_eq wellformed_h2)
     qed
 
     have child_in_heap: "child |\<in>| node_ptr_kinds h"
       using get_owner_document_ptr_in_heap[OF is_OK_returns_result_I[OF old_document]]
         node_ptr_kinds_commutes by blast
     have "a_acyclic_heap h2"
       using wellformed_h2 by (simp add: heap_is_wellformed_def)
     have "parent_child_rel h' \<subseteq> parent_child_rel h2"
     proof
       fix x
       assume "x \<in> parent_child_rel h'"
       then show "x \<in> parent_child_rel h2"
         using object_ptr_kinds_h2_eq3  object_ptr_kinds_h3_eq3 children_eq2_h2 children_eq2_h3
           mem_Collect_eq object_ptr_kinds_M_eq_h3 select_result_eq split_cong
         unfolding parent_child_rel_def
         by(simp)
     qed
     then have "a_acyclic_heap h'"
       using \<open>a_acyclic_heap h2\<close> acyclic_heap_def acyclic_subset by blast
 
     moreover have "a_all_ptrs_in_heap h2"
       using wellformed_h2 by (simp add: heap_is_wellformed_def)
     then have "a_all_ptrs_in_heap h3"
       apply(auto simp add: a_all_ptrs_in_heap_def node_ptr_kinds_eq3_h2 children_eq_h2)[1]
        apply (simp add: children_eq2_h2 object_ptr_kinds_h2_eq3 subset_code(1))
       by (metis (no_types, lifting) \<open>child \<in> set disc_nodes_old_document_h2\<close> \<open>type_wf h2\<close>
           disc_nodes_old_document_h2 disc_nodes_old_document_h3 disconnected_nodes_eq2_h2 document_ptr_kinds_eq3_h2
           in_set_remove1 local.get_disconnected_nodes_ok local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_eq3_h2
           returns_result_select_result select_result_I2 wellformed_h2)
     then have "a_all_ptrs_in_heap h'"
       apply(auto simp add: a_all_ptrs_in_heap_def node_ptr_kinds_eq3_h3 children_eq_h3)[1]
        apply (simp add: children_eq2_h3 object_ptr_kinds_h3_eq3 subset_code(1))
       by (metis (no_types, lifting) \<open>child \<in> set disc_nodes_old_document_h2\<close> disc_nodes_document_ptr_h'
           disc_nodes_document_ptr_h2 disc_nodes_old_document_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq3_h3
           finite_set_in local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_eq3_h2 node_ptr_kinds_eq3_h3
           select_result_I2 set_ConsD subset_code(1) wellformed_h2)
 
     moreover have "a_owner_document_valid h2"
       using wellformed_h2 by (simp add: heap_is_wellformed_def)
     then have "a_owner_document_valid h'"
       apply(simp add: a_owner_document_valid_def node_ptr_kinds_eq_h2 node_ptr_kinds_eq3_h3
           object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 document_ptr_kinds_eq2_h2
           document_ptr_kinds_eq2_h3 children_eq2_h2 children_eq2_h3 )
-      by (smt disc_nodes_document_ptr_h' disc_nodes_document_ptr_h2
+      by (smt (verit) disc_nodes_document_ptr_h' disc_nodes_document_ptr_h2
           disc_nodes_old_document_h2 disc_nodes_old_document_h3
           disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_in_heap
           document_ptr_kinds_eq3_h2 document_ptr_kinds_eq3_h3 in_set_remove1
           list.set_intros(1) node_ptr_kinds_eq3_h2 node_ptr_kinds_eq3_h3
           object_ptr_kinds_h2_eq3 object_ptr_kinds_h3_eq3 select_result_I2
           set_subset_Cons subset_code(1))
 
     have a_distinct_lists_h2: "a_distinct_lists h2"
       using wellformed_h2 by (simp add: heap_is_wellformed_def)
     then have "a_distinct_lists h'"
       apply(auto simp add: a_distinct_lists_def object_ptr_kinds_eq_h3 object_ptr_kinds_eq_h2
           children_eq2_h2 children_eq2_h3)[1]
     proof -
       assume 1: "distinct (concat (map (\<lambda>ptr. |h' \<turnstile> get_child_nodes ptr|\<^sub>r)
                           (sorted_list_of_set (fset (object_ptr_kinds h')))))"
         and 2: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                              (sorted_list_of_set (fset (document_ptr_kinds h2)))))"
         and 3: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
                    \<inter> (\<Union>x\<in>fset (document_ptr_kinds h2). set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
       show "distinct (concat (map (\<lambda>document_ptr. |h' \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                               (sorted_list_of_set (fset (document_ptr_kinds h')))))"
       proof(rule distinct_concat_map_I)
         show "distinct (sorted_list_of_set (fset (document_ptr_kinds h')))"
           by(auto simp add: document_ptr_kinds_M_def )
       next
         fix x
         assume a1: "x \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
         have 4: "distinct |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r"
           using a_distinct_lists_h2 "2" a1 concat_map_all_distinct document_ptr_kinds_eq2_h2
             document_ptr_kinds_eq2_h3
           by fastforce
         then show "distinct |h' \<turnstile> get_disconnected_nodes x|\<^sub>r"
         proof (cases "old_document \<noteq> x")
           case True
           then show ?thesis
           proof (cases "document_ptr \<noteq> x")
             case True
             then show ?thesis
               using disconnected_nodes_eq2_h2[OF \<open>old_document \<noteq> x\<close>]
                 disconnected_nodes_eq2_h3[OF \<open>document_ptr \<noteq> x\<close>] 4
               by(auto)
           next
             case False
             then show ?thesis
               using  disc_nodes_document_ptr_h3 disc_nodes_document_ptr_h' 4
                 \<open>child \<notin> set disc_nodes_document_ptr_h3\<close>
               by(auto simp add: disconnected_nodes_eq2_h2[OF \<open>old_document \<noteq> x\<close>] )
           qed
         next
           case False
           then show ?thesis
             by (metis (no_types, opaque_lifting) \<open>distinct disc_nodes_old_document_h2\<close>
                 disc_nodes_old_document_h3 disconnected_nodes_eq2_h3
                 distinct_remove1 docs_neq select_result_I2)
         qed
       next
         fix x y
         assume a0: "x \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
           and a1: "y \<in> set (sorted_list_of_set (fset (document_ptr_kinds h')))"
           and a2: "x \<noteq> y"
 
         moreover have 5: "set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r = {}"
           using 2 calculation
           by (auto simp add: document_ptr_kinds_eq3_h2 document_ptr_kinds_eq3_h3 dest: distinct_concat_map_E(1))
         ultimately show "set |h' \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h' \<turnstile> get_disconnected_nodes y|\<^sub>r = {}"
         proof(cases "old_document = x")
           case True
           have "old_document \<noteq> y"
             using \<open>x \<noteq> y\<close> \<open>old_document = x\<close> by simp
           have "document_ptr \<noteq> x"
             using docs_neq \<open>old_document = x\<close> by auto
           show ?thesis
           proof(cases "document_ptr = y")
             case True
             then show ?thesis
               using 5 True select_result_I2[OF disc_nodes_document_ptr_h']
                 select_result_I2[OF disc_nodes_document_ptr_h2]
                 select_result_I2[OF disc_nodes_old_document_h2]
                 select_result_I2[OF disc_nodes_old_document_h3] \<open>old_document = x\<close>
               by (metis (no_types, lifting) \<open>child \<notin> set (remove1 child disc_nodes_old_document_h2)\<close>
                   \<open>document_ptr \<noteq> x\<close> disconnected_nodes_eq2_h3 disjoint_iff_not_equal
                   notin_set_remove1 set_ConsD)
           next
             case False
             then show ?thesis
               using 5 select_result_I2[OF disc_nodes_document_ptr_h']
                 select_result_I2[OF disc_nodes_document_ptr_h2]
                 select_result_I2[OF disc_nodes_old_document_h2]
                 select_result_I2[OF disc_nodes_old_document_h3]
                 disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 \<open>old_document = x\<close>
                 docs_neq \<open>old_document \<noteq> y\<close>
               by (metis (no_types, lifting) disjoint_iff_not_equal notin_set_remove1)
           qed
         next
           case False
           then show ?thesis
           proof(cases "old_document = y")
             case True
             then show ?thesis
             proof(cases "document_ptr = x")
               case True
               show ?thesis
                 using 5 select_result_I2[OF disc_nodes_document_ptr_h']
                   select_result_I2[OF disc_nodes_document_ptr_h2]
                   select_result_I2[OF disc_nodes_old_document_h2]
                   select_result_I2[OF disc_nodes_old_document_h3]
                   \<open>old_document \<noteq> x\<close> \<open>old_document = y\<close> \<open>document_ptr = x\<close>
                 apply(simp)
                 by (metis (no_types, lifting) \<open>child \<notin> set (remove1 child disc_nodes_old_document_h2)\<close>
                     disconnected_nodes_eq2_h3 disjoint_iff_not_equal notin_set_remove1)
             next
               case False
               then show ?thesis
                 using 5 select_result_I2[OF disc_nodes_document_ptr_h']
                   select_result_I2[OF disc_nodes_document_ptr_h2]
                   select_result_I2[OF disc_nodes_old_document_h2]
                   select_result_I2[OF disc_nodes_old_document_h3]
                   \<open>old_document \<noteq> x\<close> \<open>old_document = y\<close> \<open>document_ptr \<noteq> x\<close>
                 by (metis (no_types, lifting) disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3
                     disjoint_iff_not_equal docs_neq notin_set_remove1)
             qed
           next
             case False
             have "set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}"
               by (metis DocumentMonad.ptr_kinds_M_ok DocumentMonad.ptr_kinds_M_ptr_kinds False
                   \<open>type_wf h2\<close> a1 disc_nodes_old_document_h2 document_ptr_kinds_M_def
                   document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3
                   l_ptr_kinds_M.ptr_kinds_ptr_kinds_M local.get_disconnected_nodes_ok
                   local.heap_is_wellformed_one_disc_parent returns_result_select_result
                   wellformed_h2)
             then show ?thesis
             proof(cases "document_ptr = x")
               case True
               then have "document_ptr \<noteq> y"
                 using \<open>x \<noteq> y\<close> by auto
               have "set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}"
                 using \<open>set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}\<close>
                 by blast
               then show ?thesis
                 using 5 select_result_I2[OF disc_nodes_document_ptr_h']
                   select_result_I2[OF disc_nodes_document_ptr_h2]
                   select_result_I2[OF disc_nodes_old_document_h2]
                   select_result_I2[OF disc_nodes_old_document_h3]
                   \<open>old_document \<noteq> x\<close> \<open>old_document \<noteq> y\<close> \<open>document_ptr = x\<close> \<open>document_ptr \<noteq> y\<close>
                   \<open>child \<in> set disc_nodes_old_document_h2\<close> disconnected_nodes_eq2_h2
                   disconnected_nodes_eq2_h3
                   \<open>set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}\<close>
                 by(auto)
             next
               case False
               then show ?thesis
               proof(cases "document_ptr = y")
                 case True
                 have f1: "set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set disc_nodes_document_ptr_h3 = {}"
                   using 2 a1 document_ptr_in_heap document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3
                     \<open>document_ptr \<noteq> x\<close> select_result_I2[OF disc_nodes_document_ptr_h3, symmetric]
                     disconnected_nodes_eq2_h2[OF docs_neq[symmetric], symmetric]
                   by (simp add: "5" True)
                 moreover have f1:
                   "set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r \<inter> set |h2 \<turnstile> get_disconnected_nodes old_document|\<^sub>r = {}"
                   using 2 a1 old_document_in_heap document_ptr_kinds_eq2_h2 document_ptr_kinds_eq2_h3
                     \<open>old_document \<noteq> x\<close>
                   by (metis (no_types, lifting) a0 distinct_concat_map_E(1) document_ptr_kinds_eq3_h2
                       document_ptr_kinds_eq3_h3 finite_fset fmember.rep_eq set_sorted_list_of_set)
                 ultimately show ?thesis
                   using 5 select_result_I2[OF disc_nodes_document_ptr_h']
                     select_result_I2[OF disc_nodes_old_document_h2] \<open>old_document \<noteq> x\<close>
                     \<open>document_ptr \<noteq> x\<close> \<open>document_ptr = y\<close>
                     \<open>child \<in> set disc_nodes_old_document_h2\<close> disconnected_nodes_eq2_h2
                     disconnected_nodes_eq2_h3
                   by auto
               next
                 case False
                 then show ?thesis
                   using 5
                     select_result_I2[OF disc_nodes_old_document_h2] \<open>old_document \<noteq> x\<close>
                     \<open>document_ptr \<noteq> x\<close> \<open>document_ptr \<noteq> y\<close>
                     \<open>child \<in> set disc_nodes_old_document_h2\<close>
                     disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3
                   by (metis \<open>set |h2 \<turnstile> get_disconnected_nodes y|\<^sub>r \<inter> set disc_nodes_old_document_h2 = {}\<close>
                       empty_iff inf.idem)
               qed
             qed
           qed
         qed
       qed
     next
       fix x xa xb
       assume 0: "distinct (concat (map (\<lambda>ptr. |h' \<turnstile> get_child_nodes ptr|\<^sub>r)
                                   (sorted_list_of_set (fset (object_ptr_kinds h')))))"
         and 1: "distinct (concat (map (\<lambda>document_ptr. |h2 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)
                                    (sorted_list_of_set (fset (document_ptr_kinds h2)))))"
         and 2: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
                     \<inter> (\<Union>x\<in>fset (document_ptr_kinds h2). set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
         and 3: "xa |\<in>| object_ptr_kinds h'"
         and 4: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
         and 5: "xb |\<in>| document_ptr_kinds h'"
         and 6: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
       then show False
         using \<open>child \<in> set disc_nodes_old_document_h2\<close> disc_nodes_document_ptr_h'
           disc_nodes_document_ptr_h2 disc_nodes_old_document_h2 disc_nodes_old_document_h3
           disconnected_nodes_eq2_h2 disconnected_nodes_eq2_h3 document_ptr_kinds_eq2_h2
           document_ptr_kinds_eq2_h3  old_document_in_heap
         apply(auto)[1]
         apply(cases "xb = old_document")
       proof -
         assume a1: "xb = old_document"
         assume a2: "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r disc_nodes_old_document_h2"
         assume a3: "h3 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r remove1 child disc_nodes_old_document_h2"
         assume a4: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
         assume "document_ptr_kinds h2 = document_ptr_kinds h'"
         assume a5: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
                    \<inter> (\<Union>x\<in>fset (document_ptr_kinds h'). set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
         have f6: "old_document |\<in>| document_ptr_kinds h'"
           using a1 \<open>xb |\<in>| document_ptr_kinds h'\<close> by blast
         have f7: "|h2 \<turnstile> get_disconnected_nodes old_document|\<^sub>r = disc_nodes_old_document_h2"
           using a2 by simp
         have "x \<in> set disc_nodes_old_document_h2"
           using f6 a3 a1 by (metis (no_types) \<open>type_wf h'\<close> \<open>x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r\<close>
               disconnected_nodes_eq_h3 docs_neq get_disconnected_nodes_ok returns_result_eq
               returns_result_select_result set_remove1_subset subsetCE)
         then have "set |h' \<turnstile> get_child_nodes xa|\<^sub>r \<inter>  set |h2 \<turnstile> get_disconnected_nodes xb|\<^sub>r = {}"
           using f7 f6 a5 a4 \<open>xa |\<in>| object_ptr_kinds h'\<close>
           by fastforce
         then show ?thesis
           using \<open>x \<in> set disc_nodes_old_document_h2\<close> a1 a4 f7 by blast
       next
         assume a1: "xb \<noteq> old_document"
         assume a2: "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_document_ptr_h3"
         assume a3: "h2 \<turnstile> get_disconnected_nodes old_document \<rightarrow>\<^sub>r disc_nodes_old_document_h2"
         assume a4: "xa |\<in>| object_ptr_kinds h'"
         assume a5: "h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r child # disc_nodes_document_ptr_h3"
         assume a6: "old_document |\<in>| document_ptr_kinds h'"
         assume a7: "x \<in> set |h' \<turnstile> get_disconnected_nodes xb|\<^sub>r"
         assume a8: "x \<in> set |h' \<turnstile> get_child_nodes xa|\<^sub>r"
         assume a9: "document_ptr_kinds h2 = document_ptr_kinds h'"
         assume a10: "\<And>doc_ptr. old_document \<noteq> doc_ptr
                \<Longrightarrow> |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
         assume a11: "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
                \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
         assume a12: "(\<Union>x\<in>fset (object_ptr_kinds h'). set |h' \<turnstile> get_child_nodes x|\<^sub>r)
                     \<inter> (\<Union>x\<in>fset (document_ptr_kinds h'). set |h2 \<turnstile> get_disconnected_nodes x|\<^sub>r) = {}"
         have f13: "\<And>d. d \<notin> set |h' \<turnstile> document_ptr_kinds_M|\<^sub>r \<or> h2 \<turnstile> ok get_disconnected_nodes d"
           using a9 \<open>type_wf h2\<close> get_disconnected_nodes_ok
           by simp
         then have f14: "|h2 \<turnstile> get_disconnected_nodes old_document|\<^sub>r = disc_nodes_old_document_h2"
           using a6 a3 by simp
         have "x \<notin> set |h2 \<turnstile> get_disconnected_nodes xb|\<^sub>r"
           using a12 a8 a4 \<open>xb |\<in>| document_ptr_kinds h'\<close>
           by (meson UN_I disjoint_iff_not_equal fmember.rep_eq)
         then have "x = child"
           using f13 a11 a10 a7 a5 a2 a1
           by (metis (no_types, lifting) select_result_I2 set_ConsD)
         then have "child \<notin> set disc_nodes_old_document_h2"
           using f14 a12 a8 a6 a4
           by (metis \<open>type_wf h'\<close> adopt_node_removes_child assms type_wf
               get_child_nodes_ok known_ptrs local.known_ptrs_known_ptr object_ptr_kinds_h2_eq3
               object_ptr_kinds_h3_eq3 object_ptr_kinds_h_eq3 returns_result_select_result)
         then show ?thesis
           using \<open>child \<in> set disc_nodes_old_document_h2\<close> by fastforce
       qed
     qed
     ultimately show ?thesis
       using \<open>type_wf h'\<close> \<open>known_ptrs h'\<close> \<open>a_owner_document_valid h'\<close> heap_is_wellformed_def by blast
   qed
   then have "heap_is_wellformed h'" and "known_ptrs h'" and "type_wf h'"
     by auto
 
   have object_ptr_kinds_eq3: "object_ptr_kinds h = object_ptr_kinds h'"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
           OF adopt_node_writes assms(4)])
     unfolding adopt_node_locs_def
     using set_disconnected_nodes_pointers_preserved set_child_nodes_pointers_preserved
       remove_child_pointers_preserved
     by (auto simp add: reflp_def transp_def split: if_splits)
   show ?thesis
     apply(auto simp add: is_strongly_scdom_component_safe_def Let_def object_ptr_kinds_eq3 )[1]
     using adopt_node_is_strongly_dom_component_safe_step get_scdom_component_impl assms by blast
 qed
 end
 
 interpretation i_get_scdom_component_adopt_node?: l_get_scdom_component_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe get_parent get_parent_locs remove_child
   remove_child_locs get_disconnected_nodes get_disconnected_nodes_locs set_disconnected_nodes
   set_disconnected_nodes_locs adopt_node adopt_node_locs get_child_nodes get_child_nodes_locs
   set_child_nodes set_child_nodes_locs remove to_tree_order get_root_node get_root_node_locs
   get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
   by(auto simp add: l_get_scdom_component_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_scdom_component_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 
 subsubsection \<open>create\_element\<close>
 
 locale l_get_scdom_component_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_scdom_component +
   l_get_dom_component_create_element\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_create_element_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma create_element_is_strongly_scdom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>h h'"
   assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast document_ptr)|\<^sub>r"
   assumes "ptr \<noteq> cast |h \<turnstile> create_element document_ptr tag|\<^sub>r"
   shows "preserved (get_M ptr getter) h h'"
 proof -
   obtain new_element_ptr h2 h3 disc_nodes where
     new_element_ptr: "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr" and
     h2: "h \<turnstile> new_element \<rightarrow>\<^sub>h h2" and
     h3: "h2 \<turnstile>set_tag_name new_element_ptr tag \<rightarrow>\<^sub>h h3" and
     disc_nodes: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes" and
     h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_element_ptr # disc_nodes) \<rightarrow>\<^sub>h h'"
     using assms(4)
     by(auto simp add: create_element_def elim!: bind_returns_heap_E bind_returns_heap_E2[rotated,
           OF get_disconnected_nodes_pure, rotated])
 
   have object_ptr_kinds_eq_h: "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
     using new_element_new_ptr h2 new_element_ptr by blast
   then have node_ptr_kinds_eq_h: "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
     apply(simp add: node_ptr_kinds_def)
     by force
   then have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h |\<union>| {|new_element_ptr|}"
     apply(simp add: element_ptr_kinds_def)
     by force
   have character_data_ptr_kinds_eq_h: "character_data_ptr_kinds h2 = character_data_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: node_ptr_kinds_def character_data_ptr_kinds_def)
   have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: document_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h", OF set_tag_name_writes h3])
     using set_tag_name_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
     using object_ptr_kinds_eq_h2
     by(auto simp add: node_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
           OF set_disconnected_nodes_writes h'])
     using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
     using object_ptr_kinds_eq_h3
     by(auto simp add: node_ptr_kinds_def)
 
 
   have "heap_is_wellformed h'"
     using assms(4)
     using assms(1) assms(2) assms(3) local.create_element_preserves_wellformedness(1) by blast
   have "type_wf h'"
     using assms(1) assms(2) assms(3) assms(4) local.create_element_preserves_wellformedness(2) by blast
   have "known_ptrs h'"
     using assms(1) assms(2) assms(3) assms(4) local.create_element_preserves_wellformedness(3) by blast
 
   have "document_ptr |\<in>| document_ptr_kinds h"
     by (meson assms(4) is_OK_returns_heap_I local.create_element_document_in_heap)
   then
   obtain sc where sc: "h \<turnstile> get_scdom_component (cast document_ptr) \<rightarrow>\<^sub>r sc"
     using get_scdom_component_ok
     by (meson assms(1) assms(2) assms(3) document_ptr_kinds_commutes returns_result_select_result)
 
   have "document_ptr |\<in>| document_ptr_kinds h'"
     using \<open>document_ptr |\<in>| document_ptr_kinds h\<close> document_ptr_kinds_eq_h
     using document_ptr_kinds_eq_h2 document_ptr_kinds_eq_h3 by blast
   then
   obtain sc' where sc': "h' \<turnstile> get_scdom_component (cast document_ptr) \<rightarrow>\<^sub>r sc'"
     using get_scdom_component_ok
     by (meson \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> document_ptr_kinds_commutes
         returns_result_select_result)
 
   obtain c where c: "h \<turnstile> get_dom_component (cast document_ptr) \<rightarrow>\<^sub>r c"
     by (meson \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(1) assms(2) assms(3)
         document_ptr_kinds_commutes is_OK_returns_result_E local.get_dom_component_ok)
 
   have "set c \<subseteq> set sc"
     using assms(1) assms(2) assms(3) c get_scdom_component_subset_get_dom_component sc by blast
 
   have "ptr \<notin> set c"
     using \<open>set c \<subseteq> set sc\<close> assms(5) sc
     by auto
   then
   show ?thesis
     using create_element_is_weakly_dom_component_safe
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(4) assms(6) c
         local.create_element_is_weakly_dom_component_safe_step select_result_I2)
 qed
 
 lemma create_element_is_strongly_scdom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r result"
   assumes "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>h h'"
   shows "is_strongly_scdom_component_safe {cast document_ptr} {cast result} h h'"
 proof -
   obtain new_element_ptr h2 h3 disc_nodes_h3 where
     new_element_ptr: "h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr" and
     h2: "h \<turnstile> new_element \<rightarrow>\<^sub>h h2" and
     h3: "h2 \<turnstile> set_tag_name new_element_ptr tag \<rightarrow>\<^sub>h h3" and
     disc_nodes_h3: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3" and
     h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_element_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'"
     using assms(5)
     by(auto simp add: create_element_def returns_result_heap_def
         elim!: bind_returns_heap_E
         bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
   then have "h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr"
     apply(auto simp add: create_element_def intro!: bind_returns_result_I)[1]
       apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
      apply (metis is_OK_returns_heap_E is_OK_returns_result_I local.get_disconnected_nodes_pure pure_returns_heap_eq)
     by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
   then have "result = new_element_ptr"
     using assms(4) by auto
 
 
   have "new_element_ptr \<notin> set |h \<turnstile> element_ptr_kinds_M|\<^sub>r"
     using new_element_ptr ElementMonad.ptr_kinds_ptr_kinds_M h2
     using new_element_ptr_not_in_heap by blast
   then have "cast new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r"
     by simp
   then have "cast new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
 
   have object_ptr_kinds_eq_h: "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
     using new_element_new_ptr h2 new_element_ptr by blast
   then have node_ptr_kinds_eq_h: "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
     apply(simp add: node_ptr_kinds_def)
     by force
   then have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h |\<union>| {|new_element_ptr|}"
     apply(simp add: element_ptr_kinds_def)
     by force
   have character_data_ptr_kinds_eq_h: "character_data_ptr_kinds h2 = character_data_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: node_ptr_kinds_def character_data_ptr_kinds_def)
   have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: document_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h", OF set_tag_name_writes h3])
     using set_tag_name_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
     using object_ptr_kinds_eq_h2
     by(auto simp add: node_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
           OF set_disconnected_nodes_writes h'])
     using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
     using object_ptr_kinds_eq_h3
     by(auto simp add: node_ptr_kinds_def)
 
   have "known_ptr (cast new_element_ptr)"
     using \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close> local.create_element_known_ptr by blast
   then
   have "known_ptrs h2"
     using known_ptrs_new_ptr object_ptr_kinds_eq_h \<open>known_ptrs h\<close> h2
     by blast
   then
   have "known_ptrs h3"
     using known_ptrs_preserved object_ptr_kinds_eq_h2 by blast
   then
   have "known_ptrs h'"
     using known_ptrs_preserved object_ptr_kinds_eq_h3 by blast
 
 
   have "document_ptr |\<in>| document_ptr_kinds h"
     using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
       get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
     by (metis is_OK_returns_result_I)
 
   have children_eq_h: "\<And>ptr' children. ptr' \<noteq> cast new_element_ptr
               \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads h2 get_child_nodes_new_element[rotated, OF new_element_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
   then have children_eq2_h: "\<And>ptr'. ptr' \<noteq> cast new_element_ptr
                                     \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
 
   have "h2 \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []"
     using new_element_ptr h2 new_element_ptr_in_heap[OF h2 new_element_ptr]
       new_element_is_element_ptr[OF new_element_ptr] new_element_no_child_nodes
     by blast
   have disconnected_nodes_eq_h:
     "\<And>doc_ptr disc_nodes. h \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                              = h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads h2 get_disconnected_nodes_new_element[OF new_element_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
   then have disconnected_nodes_eq2_h:
     "\<And>doc_ptr. |h \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have children_eq_h2:
     "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_tag_name_writes h3
     apply(rule reads_writes_preserved)
     by(auto simp add: set_tag_name_get_child_nodes)
   then have children_eq2_h2: "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   have disconnected_nodes_eq_h2:
     "\<And>doc_ptr disc_nodes. h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                                = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_tag_name_writes h3
     apply(rule reads_writes_preserved)
     by(auto simp add: set_tag_name_get_disconnected_nodes)
   then have disconnected_nodes_eq2_h2:
     "\<And>doc_ptr. |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have "type_wf h2"
     using \<open>type_wf h\<close> new_element_types_preserved h2 by blast
   then have "type_wf h3"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_tag_name_writes h3]
     using  set_tag_name_types_preserved
     by(auto simp add: reflp_def transp_def)
   then have "type_wf h'"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h']
     using  set_disconnected_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
   have children_eq_h3:
     "\<And>ptr' children. h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved)
     by(auto simp add: set_disconnected_nodes_get_child_nodes)
   then have children_eq2_h3: "\<And>ptr'. |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   have disconnected_nodes_eq_h3:
     "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr
        \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                                = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved)
     by(auto simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
   then have disconnected_nodes_eq2_h3:
     "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
                 \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have disc_nodes_document_ptr_h2: "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
     using disconnected_nodes_eq_h2 disc_nodes_h3 by auto
   then have disc_nodes_document_ptr_h: "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
     using disconnected_nodes_eq_h by auto
   then have "cast new_element_ptr \<notin> set disc_nodes_h3"
     using \<open>heap_is_wellformed h\<close>
     using \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
       a_all_ptrs_in_heap_def heap_is_wellformed_def
     using NodeMonad.ptr_kinds_ptr_kinds_M local.heap_is_wellformed_disc_nodes_in_heap by blast
 
 
 
   have "parent_child_rel h = parent_child_rel h'"
   proof -
     have "parent_child_rel h = parent_child_rel h2"
     proof(auto simp add: parent_child_rel_def)[1]
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h"
         and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
       then show "a |\<in>| object_ptr_kinds h2"
         by (simp add: object_ptr_kinds_eq_h)
     next
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h"
         and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
       then show "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
         by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
             \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
     next
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h2"
         and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
       then show "a |\<in>| object_ptr_kinds h"
         using object_ptr_kinds_eq_h \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close>
         by(auto)
     next
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h2"
         and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
       then show "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
         by (metis (no_types, lifting)
             \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close>
             children_eq2_h empty_iff empty_set image_eqI select_result_I2)
     qed
     also have "\<dots> = parent_child_rel h3"
       by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h2 children_eq2_h2)
     also have "\<dots> = parent_child_rel h'"
       by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h3 children_eq2_h3)
     finally show ?thesis
       by simp
   qed
 
 
   have "document_ptr |\<in>| document_ptr_kinds h'"
     by (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close> document_ptr_kinds_eq_h
         document_ptr_kinds_eq_h2 document_ptr_kinds_eq_h3)
 
   have "known_ptr (cast document_ptr)"
     using \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(3) document_ptr_kinds_commutes
       local.known_ptrs_known_ptr by blast
   have "h \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr"
     using \<open>known_ptr (cast document_ptr)\<close> \<open>document_ptr |\<in>| document_ptr_kinds h\<close>
     apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
     apply(split invoke_splits, rule conjI)+
     by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
         ElementClass.known_ptr_defs NodeClass.known_ptr_defs a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: bind_pure_returns_result_I split: option.splits)
   have "h' \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr"
     using \<open>known_ptr (cast document_ptr)\<close> \<open>document_ptr |\<in>| document_ptr_kinds h'\<close>
     apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
     apply(split invoke_splits, rule conjI)+
     by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
         ElementClass.known_ptr_defs NodeClass.known_ptr_defs a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def intro!: bind_pure_returns_result_I split: option.splits)
 
   obtain to where to: "h \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to"
     by (meson \<open>h \<turnstile> get_owner_document (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r document_ptr\<close> assms(1)
         assms(2) assms(3) is_OK_returns_result_E is_OK_returns_result_I local.get_owner_document_ptr_in_heap
         local.to_tree_order_ok)
   obtain to' where to': "h' \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to'"
     by (metis \<open>document_ptr |\<in>| document_ptr_kinds h\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> assms(1) assms(2)
         assms(3) assms(5) document_ptr_kinds_commutes document_ptr_kinds_eq_h document_ptr_kinds_eq_h2
         document_ptr_kinds_eq_h3 is_OK_returns_result_E local.create_element_preserves_wellformedness(1)
         local.to_tree_order_ok)
   have "set to = set to'"
   proof safe
     fix x
     assume "x \<in> set to"
     show "x \<in> set to'"
       using to to'
       using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
       by (metis \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to\<close> assms(1) assms(2) assms(3) assms(5)
           local.create_element_preserves_wellformedness(1))
   next
     fix x
     assume "x \<in> set to'"
     show "x \<in> set to"
       using to to'
       using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
       by (metis \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to'\<close> assms(1) assms(2) assms(3) assms(5)
           local.create_element_preserves_wellformedness(1))
   qed
 
   have "h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r cast new_element_ptr # disc_nodes_h3"
     using h' local.set_disconnected_nodes_get_disconnected_nodes by auto
   obtain disc_nodes_h' where disc_nodes_h': "h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h'"
     and "cast new_element_ptr \<in> set disc_nodes_h'"
     and "disc_nodes_h' =  cast new_element_ptr # disc_nodes_h3"
     by (simp add: \<open>h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr # disc_nodes_h3\<close>)
 
   have "\<And>disc_ptr to to'. disc_ptr \<in> set disc_nodes_h3 \<Longrightarrow> h \<turnstile> to_tree_order (cast disc_ptr) \<rightarrow>\<^sub>r to \<Longrightarrow>
 h' \<turnstile> to_tree_order (cast disc_ptr) \<rightarrow>\<^sub>r to' \<Longrightarrow> set to = set to'"
   proof safe
     fix disc_ptr to to' x
     assume "disc_ptr \<in> set disc_nodes_h3"
     assume "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to"
     assume "h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'"
     assume "x \<in> set to"
     show "x \<in> set to'"
       using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
       by (metis \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to\<close>
           \<open>h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to\<close>
           assms(1) assms(2) assms(3) assms(5) local.create_element_preserves_wellformedness(1))
   next
     fix disc_ptr to to' x
     assume "disc_ptr \<in> set disc_nodes_h3"
     assume "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to"
     assume "h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'"
     assume "x \<in> set to'"
     show "x \<in> set to"
       using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
       by (metis \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to\<close>
           \<open>h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to'\<close>
           assms(1) assms(2) assms(3) assms(5) local.create_element_preserves_wellformedness(1))
   qed
 
   have "heap_is_wellformed h'"
     using assms(1) assms(2) assms(3) assms(5) local.create_element_preserves_wellformedness(1)
     by blast
 
   have "cast new_element_ptr |\<in>| object_ptr_kinds h'"
     using \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<in> set disc_nodes_h'\<close> \<open>heap_is_wellformed h'\<close> disc_nodes_h'
       local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_commutes by blast
   then
   have "new_element_ptr |\<in>| element_ptr_kinds h'"
     by simp
 
   have "\<And>node_ptr. node_ptr \<in> set disc_nodes_h3 \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h'"
     by (meson \<open>heap_is_wellformed h'\<close> h' local.heap_is_wellformed_disc_nodes_in_heap
         local.set_disconnected_nodes_get_disconnected_nodes set_subset_Cons subset_code(1))
 
   have "h \<turnstile> ok (map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h3)"
     using assms(1) assms(2) assms(3) to_tree_order_ok
     apply(auto intro!: map_M_ok_I)[1]
     using disc_nodes_document_ptr_h local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_commutes
     by blast
   then
   obtain disc_tree_orders where disc_tree_orders:
     "h \<turnstile> map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h3 \<rightarrow>\<^sub>r disc_tree_orders"
     by auto
 
   have "h' \<turnstile> ok (map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h')"
     apply(auto intro!: map_M_ok_I)[1]
     apply(simp add: \<open>disc_nodes_h' =  cast new_element_ptr # disc_nodes_h3\<close>)
     using \<open>\<And>node_ptr. node_ptr \<in> set disc_nodes_h3 \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h'\<close>
       \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<in> set disc_nodes_h'\<close> \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close>
       \<open>type_wf h'\<close> disc_nodes_h' local.heap_is_wellformed_disc_nodes_in_heap local.to_tree_order_ok
       node_ptr_kinds_commutes by blast
   then
   obtain disc_tree_orders' where disc_tree_orders':
     "h' \<turnstile> map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h' \<rightarrow>\<^sub>r disc_tree_orders'"
     by auto
 
   have "h' \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []"
     using \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r []\<close> children_eq_h2
       children_eq_h3 by auto
 
   obtain new_tree_order where new_tree_order:
     "h' \<turnstile> to_tree_order (cast new_element_ptr) \<rightarrow>\<^sub>r new_tree_order" and
     "new_tree_order \<in> set disc_tree_orders'"
     using map_M_pure_E[OF disc_tree_orders' \<open>cast new_element_ptr \<in> set disc_nodes_h'\<close>]
     by auto
   then have "new_tree_order = [cast new_element_ptr]"
     using \<open>h' \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []\<close>
     by(auto simp add: to_tree_order_def
         dest!: bind_returns_result_E3[rotated, OF \<open>h' \<turnstile> get_child_nodes (cast new_element_ptr) \<rightarrow>\<^sub>r []\<close>, rotated])
 
   obtain foo where foo: "h' \<turnstile> map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r)
 (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr # disc_nodes_h3) \<rightarrow>\<^sub>r [cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr] # foo"
     apply(auto intro!: bind_pure_returns_result_I map_M_pure_I)[1]
     using \<open>new_tree_order = [cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr]\<close> new_tree_order apply auto[1]
-    by (smt \<open>disc_nodes_h' = cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr # disc_nodes_h3\<close>
+    by (smt (verit) \<open>disc_nodes_h' = cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr # disc_nodes_h3\<close>
         bind_pure_returns_result_I bind_returns_result_E2 comp_apply disc_tree_orders'
         local.to_tree_order_pure map_M.simps(2) map_M_pure_I return_returns_result returns_result_eq)
   then have "set (concat foo) = set (concat disc_tree_orders)"
     apply(auto elim!: bind_returns_result_E2 intro!: map_M_pure_I)[1]
-     apply (smt \<open>\<And>to' toa disc_ptr. \<lbrakk>disc_ptr \<in> set disc_nodes_h3;
-h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r toa; h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<rbrakk>
-\<Longrightarrow> set toa = set to'\<close> comp_apply disc_tree_orders local.to_tree_order_pure map_M_pure_E map_M_pure_E2)
-    using \<open>\<And>to' toa disc_ptr. \<lbrakk>disc_ptr \<in> set disc_nodes_h3; h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r toa;
-h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<rbrakk> \<Longrightarrow> set toa = set to'\<close> comp_apply
-      disc_tree_orders local.to_tree_order_pure map_M_pure_E map_M_pure_E2
-    by smt
+     apply (smt (verit) \<open>\<And>to' toa disc_ptr. \<lbrakk>disc_ptr \<in> set disc_nodes_h3; h \<turnstile> to_tree_order
+             (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r toa; h' \<turnstile> to_tree_order
+             (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<rbrakk> \<Longrightarrow> set toa = set to'\<close>
+             comp_eq_dest_lhs disc_tree_orders local.to_tree_order_pure map_M_pure_E map_M_pure_E2)
+    by (smt (verit) \<open>\<And>to' toa disc_ptr. \<lbrakk>disc_ptr \<in> set disc_nodes_h3; h \<turnstile> to_tree_order
+        (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r toa; h' \<turnstile> to_tree_order
+        (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<rbrakk> \<Longrightarrow> set toa = set to'\<close>
+        comp_eq_dest_lhs disc_tree_orders local.to_tree_order_pure map_M_pure_E map_M_pure_E2)
 
   have "disc_tree_orders' = [cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr] # foo"
     using foo disc_tree_orders'
     by (simp add: \<open>disc_nodes_h' = cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr # disc_nodes_h3\<close> returns_result_eq)
 
   have "set (concat disc_tree_orders') = {cast new_element_ptr} \<union> set (concat disc_tree_orders)"
     apply(auto simp add: \<open>disc_tree_orders' = [cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr] # foo\<close>)[1]
     using \<open>set (concat foo) = set (concat disc_tree_orders)\<close> by auto
 
   have "h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r to' @ concat disc_tree_orders'"
     using \<open>h' \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr\<close> disc_nodes_h' to' disc_tree_orders'
     by(auto simp add: a_get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
   then
   have "set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set to' \<union> set (concat disc_tree_orders')"
     by auto
   have "h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r to @ concat disc_tree_orders"
     using \<open>h \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr\<close> disc_nodes_document_ptr_h
       to disc_tree_orders
     by(auto simp add: a_get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
   then
   have "set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r = set to \<union> set (concat disc_tree_orders)"
     by auto
 
   have "{cast new_element_ptr} \<union> set |h \<turnstile> local.a_get_scdom_component (cast document_ptr)|\<^sub>r =
 set |h' \<turnstile> local.a_get_scdom_component (cast document_ptr)|\<^sub>r"
   proof(safe)
     show "cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr
          \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
       using \<open>h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r to' @ concat disc_tree_orders'\<close>
       apply(auto simp add: a_get_scdom_component_def)[1]
       by (meson \<open>\<And>thesis. (\<And>new_tree_order. \<lbrakk>h' \<turnstile> to_tree_order (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr) \<rightarrow>\<^sub>r new_tree_order;
 new_tree_order \<in> set disc_tree_orders'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> local.to_tree_order_ptr_in_result)
   next
     fix x
     assume " x \<in> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
     then
     show "x \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
       using \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set to \<union>set (concat disc_tree_orders)\<close>
       using \<open>set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set to' \<union> set (concat disc_tree_orders')\<close>
       using \<open>set to = set to'\<close>
       using \<open>set (concat disc_tree_orders') = {cast new_element_ptr} \<union> set (concat disc_tree_orders)\<close>
       by(auto)
   next
     fix x
     assume " x \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
     assume "x \<notin> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
     show "x = cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr"
       using \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set to \<union> set (concat disc_tree_orders)\<close>
       using \<open>set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set to' \<union> set (concat disc_tree_orders')\<close>
       using \<open>set to = set to'\<close>
       using \<open>set (concat disc_tree_orders') = {cast new_element_ptr} \<union> set (concat disc_tree_orders)\<close>
       using \<open>x \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
         \<open>x \<notin> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
       by auto
   qed
 
 
   have "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast new_element_ptr|}"
     using object_ptr_kinds_eq_h object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 by auto
   then
   show ?thesis
     apply(auto simp add: is_strongly_scdom_component_safe_def Let_def)[1]
        apply(rule bexI[where x="cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr"])
     using \<open>{cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr} \<union>
 set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
         apply auto[2]
     using \<open>set to = set to'\<close> \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set to \<union> set (concat disc_tree_orders)\<close> local.to_tree_order_ptr_in_result to'
         apply auto[1]
     using \<open>document_ptr |\<in>| document_ptr_kinds h\<close>
        apply blast
       apply(rule bexI[where x="cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr"])
     using \<open>result = new_element_ptr\<close>
       \<open>{cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr} \<union> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close> apply auto[1]
       apply(auto)[1]
     using \<open>set to = set to'\<close> \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set to \<union> set (concat disc_tree_orders)\<close> local.to_tree_order_ptr_in_result to' apply auto[1]
       apply (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close>)
     using \<open>\<And>thesis. (\<And>new_element_ptr h2 h3 disc_nodes_h3. \<lbrakk>h \<turnstile> new_element \<rightarrow>\<^sub>r new_element_ptr;
 h \<turnstile> new_element \<rightarrow>\<^sub>h h2; h2 \<turnstile> set_tag_name new_element_ptr tag \<rightarrow>\<^sub>h h3;
 h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3;
 h3 \<turnstile> set_disconnected_nodes document_ptr (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close>
       new_element_ptr new_element_ptr_not_in_heap
      apply auto[1]
     using create_element_is_strongly_scdom_component_safe_step
-    by (smt ObjectMonad.ptr_kinds_ptr_kinds_M \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
-        \<open>result = new_element_ptr\<close> assms(1) assms(2) assms(3) assms(4) assms(5) local.get_scdom_component_impl select_result_I2)
+    by (smt (verit, best) ObjectMonad.ptr_kinds_ptr_kinds_M
+        \<open>cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_element_ptr \<notin> set |h \<turnstile>
+        object_ptr_kinds_M|\<^sub>r\<close> \<open>h \<turnstile> create_element document_ptr tag \<rightarrow>\<^sub>r new_element_ptr\<close> assms(1)
+        assms(2) assms(3) assms(5) local.get_scdom_component_impl select_result_I2)
 qed
 end
 
 interpretation i_get_scdom_component_remove_child?: l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs get_scdom_component
   is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs
   get_root_node get_root_node_locs get_ancestors get_ancestors_locs get_disconnected_nodes get_disconnected_nodes_locs
   get_element_by_id get_elements_by_class_name get_elements_by_tag_name set_child_nodes set_child_nodes_locs
   set_disconnected_nodes set_disconnected_nodes_locs remove_child remove_child_locs remove
   by(auto simp add: l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_scdom_component_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>create\_character\_data\<close>
 
 locale l_get_scdom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_scdom_component +
   l_get_dom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_create_character_data_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_to_tree_order\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_owner_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma create_character_data_is_strongly_dom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>h h'"
   assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast document_ptr)|\<^sub>r"
   assumes "ptr \<noteq> cast |h \<turnstile> create_character_data document_ptr text|\<^sub>r"
   shows "preserved (get_M ptr getter) h h'"
 proof -
   have "document_ptr |\<in>| document_ptr_kinds h"
     by (meson assms(4) is_OK_returns_heap_I local.create_character_data_document_in_heap)
   then
   obtain sc where sc: "h \<turnstile> get_scdom_component (cast document_ptr) \<rightarrow>\<^sub>r sc"
     using get_scdom_component_ok
     by (meson assms(1) assms(2) assms(3) document_ptr_kinds_commutes returns_result_select_result)
 
   obtain c where c: "h \<turnstile> get_dom_component (cast document_ptr) \<rightarrow>\<^sub>r c"
     by (meson \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(1) assms(2) assms(3)
         document_ptr_kinds_commutes is_OK_returns_result_E local.get_dom_component_ok)
 
   have "set c \<subseteq> set sc"
     using assms(1) assms(2) assms(3) c get_scdom_component_subset_get_dom_component sc by blast
 
   have "ptr \<notin> set c"
     using \<open>set c \<subseteq> set sc\<close> assms(5) sc
     by auto
   then
   show ?thesis
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(4) assms(6) c
         local.create_character_data_is_weakly_dom_component_safe_step select_result_I2)
 qed
 
 lemma create_character_data_is_strongly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r result"
   assumes "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>h h'"
   shows "is_strongly_scdom_component_safe {cast document_ptr} {cast result} h h'"
 proof -
 
   obtain new_character_data_ptr h2 h3 disc_nodes_h3 where
     new_character_data_ptr: "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr" and
     h2: "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h2" and
     h3: "h2 \<turnstile> set_val new_character_data_ptr text \<rightarrow>\<^sub>h h3" and
     disc_nodes_h3: "h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3" and
     h': "h3 \<turnstile> set_disconnected_nodes document_ptr (cast new_character_data_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'"
     using assms(5)
     by(auto simp add: create_character_data_def
         elim!: bind_returns_heap_E
         bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated] )
   then have "h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr"
     apply(auto simp add: create_character_data_def intro!: bind_returns_result_I)[1]
       apply (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
      apply (metis is_OK_returns_heap_E is_OK_returns_result_I local.get_disconnected_nodes_pure
         pure_returns_heap_eq)
     by (metis is_OK_returns_heap_I is_OK_returns_result_E old.unit.exhaust)
   then have "result = new_character_data_ptr"
     using assms(4) by auto
 
   have "new_character_data_ptr \<notin> set |h \<turnstile> character_data_ptr_kinds_M|\<^sub>r"
     using new_character_data_ptr CharacterDataMonad.ptr_kinds_ptr_kinds_M h2
     using new_character_data_ptr_not_in_heap by blast
   then have "cast new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r"
     by simp
   then have "cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
 
 
 
   have object_ptr_kinds_eq_h:
     "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
     using new_character_data_new_ptr h2 new_character_data_ptr by blast
   then have node_ptr_kinds_eq_h:
     "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
     apply(simp add: node_ptr_kinds_def)
     by force
   then have character_data_ptr_kinds_eq_h:
     "character_data_ptr_kinds h2 = character_data_ptr_kinds h |\<union>| {|new_character_data_ptr|}"
     apply(simp add: character_data_ptr_kinds_def)
     by force
   have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: node_ptr_kinds_def element_ptr_kinds_def)
   have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: document_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
           OF set_val_writes h3])
     using set_val_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
     using object_ptr_kinds_eq_h2
     by(auto simp add: node_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
           OF set_disconnected_nodes_writes h'])
     using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
     using object_ptr_kinds_eq_h3
     by(auto simp add: node_ptr_kinds_def)
 
 
   have "document_ptr |\<in>| document_ptr_kinds h"
     using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
       get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
     by (metis is_OK_returns_result_I)
 
   have children_eq_h: "\<And>ptr' children. ptr' \<noteq> cast new_character_data_ptr
                   \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads h2 get_child_nodes_new_character_data[rotated, OF new_character_data_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
   then have children_eq2_h:
     "\<And>ptr'. ptr' \<noteq> cast new_character_data_ptr
       \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   have object_ptr_kinds_eq_h:
     "object_ptr_kinds h2 = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
     using new_character_data_new_ptr h2 new_character_data_ptr by blast
   then have node_ptr_kinds_eq_h:
     "node_ptr_kinds h2 = node_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
     apply(simp add: node_ptr_kinds_def)
     by force
   then have character_data_ptr_kinds_eq_h:
     "character_data_ptr_kinds h2 = character_data_ptr_kinds h |\<union>| {|new_character_data_ptr|}"
     apply(simp add: character_data_ptr_kinds_def)
     by force
   have element_ptr_kinds_eq_h: "element_ptr_kinds h2 = element_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: node_ptr_kinds_def element_ptr_kinds_def)
   have document_ptr_kinds_eq_h: "document_ptr_kinds h2 = document_ptr_kinds h"
     using object_ptr_kinds_eq_h
     by(auto simp add: document_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h2: "object_ptr_kinds h3 = object_ptr_kinds h2"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
           OF set_val_writes h3])
     using set_val_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h2: "document_ptr_kinds h3 = document_ptr_kinds h2"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h2: "node_ptr_kinds h3 = node_ptr_kinds h2"
     using object_ptr_kinds_eq_h2
     by(auto simp add: node_ptr_kinds_def)
 
   have object_ptr_kinds_eq_h3: "object_ptr_kinds h' = object_ptr_kinds h3"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h' = object_ptr_kinds h",
           OF set_disconnected_nodes_writes h'])
     using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have document_ptr_kinds_eq_h3: "document_ptr_kinds h' = document_ptr_kinds h3"
     by (auto simp add: document_ptr_kinds_def)
   have node_ptr_kinds_eq_h3: "node_ptr_kinds h' = node_ptr_kinds h3"
     using object_ptr_kinds_eq_h3
     by(auto simp add: node_ptr_kinds_def)
 
 
   have "document_ptr |\<in>| document_ptr_kinds h"
     using disc_nodes_h3 document_ptr_kinds_eq_h object_ptr_kinds_eq_h2
       get_disconnected_nodes_ptr_in_heap \<open>type_wf h\<close> document_ptr_kinds_def
     by (metis is_OK_returns_result_I)
 
   have children_eq_h: "\<And>ptr' children. ptr' \<noteq> cast new_character_data_ptr
                 \<Longrightarrow> h \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads h2 get_child_nodes_new_character_data[rotated, OF new_character_data_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
   then have children_eq2_h: "\<And>ptr'. ptr' \<noteq> cast new_character_data_ptr
                                  \<Longrightarrow> |h \<turnstile> get_child_nodes ptr'|\<^sub>r = |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
 
   have "h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []"
     using new_character_data_ptr h2 new_character_data_ptr_in_heap[OF h2 new_character_data_ptr]
       new_character_data_is_character_data_ptr[OF new_character_data_ptr]
       new_character_data_no_child_nodes
     by blast
   have disconnected_nodes_eq_h:
     "\<And>doc_ptr disc_nodes. h \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                              = h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads h2
       get_disconnected_nodes_new_character_data[OF new_character_data_ptr h2]
     apply(auto simp add: reads_def reflp_def transp_def preserved_def)[1]
     by blast+
   then have disconnected_nodes_eq2_h:
     "\<And>doc_ptr. |h \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have children_eq_h2:
     "\<And>ptr' children. h2 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_val_writes h3
     apply(rule reads_writes_preserved)
     by(auto simp add: set_val_get_child_nodes)
   then have children_eq2_h2:
     "\<And>ptr'. |h2 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   have disconnected_nodes_eq_h2:
     "\<And>doc_ptr disc_nodes. h2 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                                               = h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_val_writes h3
     apply(rule reads_writes_preserved)
     by(auto simp add: set_val_get_disconnected_nodes)
   then have disconnected_nodes_eq2_h2:
     "\<And>doc_ptr. |h2 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have "type_wf h2"
     using \<open>type_wf h\<close> new_character_data_types_preserved h2 by blast
   then have "type_wf h3"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_val_writes h3]
     using  set_val_types_preserved
     by(auto simp add: reflp_def transp_def)
   then have "type_wf h'"
     using writes_small_big[where P="\<lambda>h h'. type_wf h \<longrightarrow> type_wf h'", OF set_disconnected_nodes_writes h']
     using  set_disconnected_nodes_types_preserved
     by(auto simp add: reflp_def transp_def)
 
   have children_eq_h3:
     "\<And>ptr' children. h3 \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children = h' \<turnstile> get_child_nodes ptr' \<rightarrow>\<^sub>r children"
     using get_child_nodes_reads set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved)
     by(auto simp add: set_disconnected_nodes_get_child_nodes)
   then have children_eq2_h3:
     " \<And>ptr'. |h3 \<turnstile> get_child_nodes ptr'|\<^sub>r = |h' \<turnstile> get_child_nodes ptr'|\<^sub>r"
     using select_result_eq by force
   have disconnected_nodes_eq_h3: "\<And>doc_ptr disc_nodes. document_ptr \<noteq> doc_ptr
     \<Longrightarrow> h3 \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes
                             = h' \<turnstile> get_disconnected_nodes doc_ptr \<rightarrow>\<^sub>r disc_nodes"
     using get_disconnected_nodes_reads set_disconnected_nodes_writes h'
     apply(rule reads_writes_preserved)
     by(auto simp add: set_disconnected_nodes_get_disconnected_nodes_different_pointers)
   then have disconnected_nodes_eq2_h3: "\<And>doc_ptr. document_ptr \<noteq> doc_ptr
              \<Longrightarrow> |h3 \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r = |h' \<turnstile> get_disconnected_nodes doc_ptr|\<^sub>r"
     using select_result_eq by force
 
   have disc_nodes_document_ptr_h2: "h2 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
     using disconnected_nodes_eq_h2 disc_nodes_h3 by auto
   then have disc_nodes_document_ptr_h: "h \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3"
     using disconnected_nodes_eq_h by auto
   then have "cast new_character_data_ptr \<notin> set disc_nodes_h3"
     using \<open>heap_is_wellformed h\<close> using \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> node_ptr_kinds_M|\<^sub>r\<close>
       a_all_ptrs_in_heap_def heap_is_wellformed_def
     using NodeMonad.ptr_kinds_ptr_kinds_M local.heap_is_wellformed_disc_nodes_in_heap by blast
 
 
 
 
 
   have "parent_child_rel h = parent_child_rel h'"
   proof -
     have "parent_child_rel h = parent_child_rel h2"
     proof(auto simp add: parent_child_rel_def)[1]
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h"
         and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
       then show "a |\<in>| object_ptr_kinds h2"
         by (simp add: object_ptr_kinds_eq_h)
     next
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h"
         and 1: "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
       then show "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
         by (metis ObjectMonad.ptr_kinds_ptr_kinds_M
             \<open>cast new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close> children_eq2_h)
     next
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h2"
         and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
       then show "a |\<in>| object_ptr_kinds h"
         using object_ptr_kinds_eq_h \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
         by(auto)
     next
       fix a x
       assume 0: "a |\<in>| object_ptr_kinds h2"
         and 1: "x \<in> set |h2 \<turnstile> get_child_nodes a|\<^sub>r"
       then show "x \<in> set |h \<turnstile> get_child_nodes a|\<^sub>r"
         by (metis (no_types, lifting) \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
             children_eq2_h empty_iff empty_set image_eqI select_result_I2)
     qed
     also have "\<dots> = parent_child_rel h3"
       by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h2 children_eq2_h2)
     also have "\<dots> = parent_child_rel h'"
       by(auto simp add: parent_child_rel_def object_ptr_kinds_eq_h3 children_eq2_h3)
     finally show ?thesis
       by simp
   qed
 
   have "known_ptr (cast new_character_data_ptr)"
     using \<open>h \<turnstile> create_character_data document_ptr text \<rightarrow>\<^sub>r new_character_data_ptr\<close>
       create_character_data_known_ptr by blast
   then
   have "known_ptrs h2"
     using known_ptrs_new_ptr object_ptr_kinds_eq_h \<open>known_ptrs h\<close> h2
     by blast
   then
   have "known_ptrs h3"
     using known_ptrs_preserved object_ptr_kinds_eq_h2 by blast
   then
   have "known_ptrs h'"
     using known_ptrs_preserved object_ptr_kinds_eq_h3 by blast
 
 
 
 
   have "document_ptr |\<in>| document_ptr_kinds h'"
     by (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close> document_ptr_kinds_eq_h
         document_ptr_kinds_eq_h2 document_ptr_kinds_eq_h3)
 
   have "known_ptr (cast document_ptr)"
     using \<open>document_ptr |\<in>| document_ptr_kinds h\<close> assms(3) document_ptr_kinds_commutes
       local.known_ptrs_known_ptr by blast
   have "h \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr"
     using \<open>known_ptr (cast document_ptr)\<close> \<open>document_ptr |\<in>| document_ptr_kinds h\<close>
     apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
     apply(split invoke_splits, rule conjI)+
     by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
         ElementClass.known_ptr_defs NodeClass.known_ptr_defs a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
         intro!: bind_pure_returns_result_I split: option.splits)
   have "h' \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr"
     using \<open>known_ptr (cast document_ptr)\<close> \<open>document_ptr |\<in>| document_ptr_kinds h'\<close>
     apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def)[1]
     apply(split invoke_splits, rule conjI)+
     by(auto simp add: known_ptr_impl known_ptr_defs CharacterDataClass.known_ptr_defs
         ElementClass.known_ptr_defs NodeClass.known_ptr_defs a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
         intro!: bind_pure_returns_result_I split: option.splits)
 
   obtain to where to: "h \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to"
     by (meson \<open>h \<turnstile> get_owner_document (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r document_ptr\<close>
         assms(1) assms(2) assms(3) is_OK_returns_result_E is_OK_returns_result_I
         local.get_owner_document_ptr_in_heap local.to_tree_order_ok)
   obtain to' where to': "h' \<turnstile> to_tree_order (cast document_ptr) \<rightarrow>\<^sub>r to'"
     by (metis \<open>document_ptr |\<in>| document_ptr_kinds h\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> assms(1) assms(2)
         assms(3) assms(5) document_ptr_kinds_commutes document_ptr_kinds_eq_h document_ptr_kinds_eq_h2
         document_ptr_kinds_eq_h3 is_OK_returns_result_E local.create_character_data_preserves_wellformedness(1)
         local.to_tree_order_ok)
   have "set to = set to'"
   proof safe
     fix x
     assume "x \<in> set to"
     show "x \<in> set to'"
       using to to'
       using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
       by (metis \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to\<close> assms(1) assms(2) assms(3) assms(5)
           local.create_character_data_preserves_wellformedness(1))
   next
     fix x
     assume "x \<in> set to'"
     show "x \<in> set to"
       using to to'
       using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
       by (metis \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to'\<close> assms(1) assms(2) assms(3) assms(5)
           local.create_character_data_preserves_wellformedness(1))
   qed
 
   have "h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r cast new_character_data_ptr # disc_nodes_h3"
     using h' local.set_disconnected_nodes_get_disconnected_nodes by auto
   obtain disc_nodes_h' where disc_nodes_h': "h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h'"
     and "cast new_character_data_ptr \<in> set disc_nodes_h'"
     and "disc_nodes_h' =  cast new_character_data_ptr # disc_nodes_h3"
     by (simp add: \<open>h' \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r cast new_character_data_ptr # disc_nodes_h3\<close>)
 
   have "\<And>disc_ptr to to'. disc_ptr \<in> set disc_nodes_h3 \<Longrightarrow> h \<turnstile> to_tree_order (cast disc_ptr) \<rightarrow>\<^sub>r to \<Longrightarrow>
 h' \<turnstile> to_tree_order (cast disc_ptr) \<rightarrow>\<^sub>r to' \<Longrightarrow> set to = set to'"
   proof safe
     fix disc_ptr to to' x
     assume "disc_ptr \<in> set disc_nodes_h3"
     assume "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to"
     assume "h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'"
     assume "x \<in> set to"
     show "x \<in> set to'"
       using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
       by (metis \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to\<close>
           \<open>h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to\<close>
           assms(1) assms(2) assms(3) assms(5) local.create_character_data_preserves_wellformedness(1))
   next
     fix disc_ptr to to' x
     assume "disc_ptr \<in> set disc_nodes_h3"
     assume "h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to"
     assume "h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'"
     assume "x \<in> set to'"
     show "x \<in> set to"
       using to_tree_order_parent_child_rel \<open>parent_child_rel h = parent_child_rel h'\<close>
       by (metis \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to\<close>
           \<open>h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<close> \<open>known_ptrs h'\<close> \<open>type_wf h'\<close> \<open>x \<in> set to'\<close>
           assms(1) assms(2) assms(3) assms(5) local.create_character_data_preserves_wellformedness(1))
   qed
 
   have "heap_is_wellformed h'"
     using assms(1) assms(2) assms(3) assms(5) local.create_character_data_preserves_wellformedness(1)
     by blast
 
   have "cast new_character_data_ptr |\<in>| object_ptr_kinds h'"
     using \<open>cast new_character_data_ptr \<in> set disc_nodes_h'\<close> \<open>heap_is_wellformed h'\<close> disc_nodes_h'
       local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_commutes by blast
   then
   have "new_character_data_ptr |\<in>| character_data_ptr_kinds h'"
     by simp
 
   have "\<And>node_ptr. node_ptr \<in> set disc_nodes_h3 \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h'"
     by (meson \<open>heap_is_wellformed h'\<close> h' local.heap_is_wellformed_disc_nodes_in_heap
         local.set_disconnected_nodes_get_disconnected_nodes set_subset_Cons subset_code(1))
 
   have "h \<turnstile> ok (map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h3)"
     using assms(1) assms(2) assms(3) to_tree_order_ok
     apply(auto intro!: map_M_ok_I)[1]
     using disc_nodes_document_ptr_h local.heap_is_wellformed_disc_nodes_in_heap node_ptr_kinds_commutes
     by blast
   then
   obtain disc_tree_orders where disc_tree_orders:
     "h \<turnstile> map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h3 \<rightarrow>\<^sub>r disc_tree_orders"
     by auto
 
   have "h' \<turnstile> ok (map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h')"
     apply(auto intro!: map_M_ok_I)[1]
     apply(simp add: \<open>disc_nodes_h' =  cast new_character_data_ptr # disc_nodes_h3\<close>)
     using \<open>\<And>node_ptr. node_ptr \<in> set disc_nodes_h3 \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h'\<close>
       \<open>cast new_character_data_ptr \<in> set disc_nodes_h'\<close> \<open>heap_is_wellformed h'\<close> \<open>known_ptrs h'\<close>
       \<open>type_wf h'\<close> disc_nodes_h' local.heap_is_wellformed_disc_nodes_in_heap local.to_tree_order_ok
       node_ptr_kinds_commutes by blast
   then
   obtain disc_tree_orders' where disc_tree_orders':
     "h' \<turnstile> map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r) disc_nodes_h' \<rightarrow>\<^sub>r disc_tree_orders'"
     by auto
 
   have "h' \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []"
     using \<open>h2 \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close> children_eq_h2 children_eq_h3 by auto
 
   obtain new_tree_order where new_tree_order:
     "h' \<turnstile> to_tree_order (cast new_character_data_ptr) \<rightarrow>\<^sub>r new_tree_order" and
     "new_tree_order \<in> set disc_tree_orders'"
     using map_M_pure_E[OF disc_tree_orders' \<open>cast new_character_data_ptr \<in> set disc_nodes_h'\<close>]
     by auto
   then have "new_tree_order = [cast new_character_data_ptr]"
     using \<open>h' \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>
     by(auto simp add: to_tree_order_def
         dest!: bind_returns_result_E3[rotated, OF \<open>h' \<turnstile> get_child_nodes (cast new_character_data_ptr) \<rightarrow>\<^sub>r []\<close>, rotated])
 
   obtain foo where foo: "h' \<turnstile> map_M (to_tree_order \<circ> cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r)
 (cast new_character_data_ptr # disc_nodes_h3) \<rightarrow>\<^sub>r [cast new_character_data_ptr] # foo"
     apply(auto intro!: bind_pure_returns_result_I map_M_pure_I)[1]
     using \<open>new_tree_order = [cast new_character_data_ptr]\<close> new_tree_order apply auto[1]
     using \<open>disc_nodes_h' = cast new_character_data_ptr # disc_nodes_h3\<close> bind_pure_returns_result_I
       bind_returns_result_E2 comp_apply disc_tree_orders' local.to_tree_order_pure map_M.simps(2)
       map_M_pure_I return_returns_result returns_result_eq
     apply simp
-    by (smt \<open>disc_nodes_h' = cast new_character_data_ptr # disc_nodes_h3\<close> bind_pure_returns_result_I
+    by (smt (verit) \<open>disc_nodes_h' = cast new_character_data_ptr # disc_nodes_h3\<close> bind_pure_returns_result_I
         bind_returns_result_E2 comp_apply disc_tree_orders' local.to_tree_order_pure map_M.simps(2) map_M_pure_I
         return_returns_result returns_result_eq)
   then have "set (concat foo) = set (concat disc_tree_orders)"
     apply(auto elim!: bind_returns_result_E2 intro!: map_M_pure_I)[1]
-     apply (smt \<open>\<And>to' toa disc_ptr. \<lbrakk>disc_ptr \<in> set disc_nodes_h3;
+     apply (smt (verit) \<open>\<And>to' toa disc_ptr. \<lbrakk>disc_ptr \<in> set disc_nodes_h3;
 h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r toa; h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<rbrakk> \<Longrightarrow>
 set toa = set to'\<close> comp_apply disc_tree_orders local.to_tree_order_pure map_M_pure_E map_M_pure_E2)
-    using \<open>\<And>to' toa disc_ptr. \<lbrakk>disc_ptr \<in> set disc_nodes_h3; h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r toa;
+    by (smt (verit) \<open>\<And>to' toa disc_ptr. \<lbrakk>disc_ptr \<in> set disc_nodes_h3; h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r toa;
 h' \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_ptr) \<rightarrow>\<^sub>r to'\<rbrakk> \<Longrightarrow> set toa = set to'\<close> comp_apply disc_tree_orders
-      local.to_tree_order_pure map_M_pure_E map_M_pure_E2
-    by smt
+      local.to_tree_order_pure map_M_pure_E map_M_pure_E2)
 
   have "disc_tree_orders' = [cast new_character_data_ptr] # foo"
     using foo disc_tree_orders'
     by (simp add: \<open>disc_nodes_h' = cast new_character_data_ptr # disc_nodes_h3\<close> returns_result_eq)
 
   have "set (concat disc_tree_orders') = {cast new_character_data_ptr} \<union> set (concat disc_tree_orders)"
     apply(auto simp add: \<open>disc_tree_orders' = [cast new_character_data_ptr] # foo\<close>)[1]
     using \<open>set (concat foo) = set (concat disc_tree_orders)\<close> by auto
 
   have "h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r to' @ concat disc_tree_orders'"
     using \<open>h' \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr\<close> disc_nodes_h' to' disc_tree_orders'
     by(auto simp add: a_get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
   then
   have "set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r = set to' \<union> set (concat disc_tree_orders')"
     by auto
   have "h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r to @ concat disc_tree_orders"
     using \<open>h \<turnstile> get_owner_document (cast document_ptr) \<rightarrow>\<^sub>r document_ptr\<close> disc_nodes_document_ptr_h to disc_tree_orders
     by(auto simp add: a_get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
   then
   have "set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r = set to \<union> set (concat disc_tree_orders)"
     by auto
 
   have "{cast new_character_data_ptr} \<union> set |h \<turnstile> local.a_get_scdom_component (cast document_ptr)|\<^sub>r =
 set |h' \<turnstile> local.a_get_scdom_component (cast document_ptr)|\<^sub>r"
   proof(safe)
     show "cast new_character_data_ptr
          \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
       using \<open>h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr) \<rightarrow>\<^sub>r to' @ concat disc_tree_orders'\<close>
       apply(auto simp add: a_get_scdom_component_def)[1]
       by (meson \<open>\<And>thesis. (\<And>new_tree_order. \<lbrakk>h' \<turnstile> to_tree_order (cast new_character_data_ptr) \<rightarrow>\<^sub>r new_tree_order;
 new_tree_order \<in> set disc_tree_orders'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> local.to_tree_order_ptr_in_result)
   next
     fix x
     assume " x \<in> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
     then
     show "x \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
       using \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set to \<union> set (concat disc_tree_orders)\<close>
       using \<open>set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set to' \<union> set (concat disc_tree_orders')\<close>
       using \<open>set to = set to'\<close>
       using \<open>set (concat disc_tree_orders') = {cast new_character_data_ptr} \<union> set (concat disc_tree_orders)\<close>
       by(auto)
   next
     fix x
     assume " x \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
     assume "x \<notin> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r"
     show "x = cast new_character_data_ptr"
       using \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set to \<union> set (concat disc_tree_orders)\<close>
       using \<open>set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set to' \<union> set (concat disc_tree_orders')\<close>
       using \<open>set to = set to'\<close>
       using \<open>set (concat disc_tree_orders') = {cast new_character_data_ptr} \<union> set (concat disc_tree_orders)\<close>
       using \<open>x \<in> set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
         \<open>x \<notin> set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
       by auto
   qed
 
 
   have "object_ptr_kinds h' = object_ptr_kinds h |\<union>| {|cast new_character_data_ptr|}"
     using object_ptr_kinds_eq_h object_ptr_kinds_eq_h2 object_ptr_kinds_eq_h3 by auto
   then
   show ?thesis
     apply(auto simp add: is_strongly_scdom_component_safe_def Let_def)[1]
        apply(rule bexI[where x="cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr"])
     using \<open>{cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr} \<union> set |h \<turnstile> local.a_get_scdom_component
 (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r = set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
         apply auto[2]
     using \<open>set to = set to'\<close> \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set to \<union> set (concat disc_tree_orders)\<close> local.to_tree_order_ptr_in_result to'
         apply auto[1]
     using \<open>document_ptr |\<in>| document_ptr_kinds h\<close>
        apply blast
       apply(rule bexI[where x="cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr"])
     using \<open>result = new_character_data_ptr\<close> \<open>{cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr} \<union>
 set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set |h' \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r\<close>
        apply auto[1]
       apply(auto)[1]
     using \<open>set to = set to'\<close> \<open>set |h \<turnstile> local.a_get_scdom_component (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r document_ptr)|\<^sub>r =
 set to \<union> set (concat disc_tree_orders)\<close> local.to_tree_order_ptr_in_result to' apply auto[1]
       apply (simp add: \<open>document_ptr |\<in>| document_ptr_kinds h\<close>)
     using \<open>\<And>thesis. (\<And>new_character_data_ptr h2 h3 disc_nodes_h3. \<lbrakk>h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr;
 h \<turnstile> new_character_data \<rightarrow>\<^sub>h h2; h2 \<turnstile> set_val new_character_data_ptr text \<rightarrow>\<^sub>h h3;
 h3 \<turnstile> get_disconnected_nodes document_ptr \<rightarrow>\<^sub>r disc_nodes_h3;
 h3 \<turnstile> set_disconnected_nodes document_ptr (cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr # disc_nodes_h3) \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close>
       new_character_data_ptr new_character_data_ptr_not_in_heap
      apply auto[1]
     using create_character_data_is_strongly_dom_component_safe_step
-    by (smt ObjectMonad.ptr_kinds_ptr_kinds_M \<open>cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
+    by (smt (verit) ObjectMonad.ptr_kinds_ptr_kinds_M \<open>cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<notin> set |h \<turnstile> object_ptr_kinds_M|\<^sub>r\<close>
         \<open>result = new_character_data_ptr\<close> assms(1) assms(2) assms(3) assms(4) assms(5) local.get_scdom_component_impl select_result_I2)
 qed
 end
 
 interpretation i_get_scdom_component_create_character_data?: l_get_scdom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs get_scdom_component
   is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs
   get_root_node get_root_node_locs get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name
   get_elements_by_tag_name set_val set_val_locs get_disconnected_nodes get_disconnected_nodes_locs
   set_disconnected_nodes set_disconnected_nodes_locs create_character_data
   by(auto simp add: l_get_scdom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_scdom_component_create_character_data\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>create\_document\<close>
 
 lemma create_document_not_strongly_component_safe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap" and
     h' and new_document_ptr where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> create_document \<rightarrow>\<^sub>r new_document_ptr \<rightarrow>\<^sub>h h'" and
     "\<not> is_strongly_scdom_component_safe {} {cast new_document_ptr} h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
 'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}) heap"
   let ?P = "create_document"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?document_ptr = "|?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1"])
     by code_simp+
 qed
 
 locale l_get_scdom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_scdom_component +
   l_get_dom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma create_document_is_weakly_scdom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> create_document \<rightarrow>\<^sub>r result"
   assumes "h \<turnstile> create_document \<rightarrow>\<^sub>h h'"
   shows "is_weakly_scdom_component_safe {} {cast result} h h'"
 proof -
   have "object_ptr_kinds h' = {|cast result|} |\<union>| object_ptr_kinds h"
     using assms(4) assms(5) local.create_document_def new_document_new_ptr by blast
   have "result |\<notin>| document_ptr_kinds h"
     using assms(4) assms(5) local.create_document_def new_document_ptr_not_in_heap by auto
   show ?thesis
     using assms
     apply(auto simp add: is_weakly_scdom_component_safe_def Let_def)[1]
     using \<open>object_ptr_kinds h' = {|cast result|} |\<union>| object_ptr_kinds h\<close> apply(auto)[1]
       apply (simp add: local.create_document_def new_document_ptr_in_heap)
     using \<open>result |\<notin>| document_ptr_kinds h\<close> apply auto[1]
 
     apply (metis (no_types, lifting) \<open>result |\<notin>| document_ptr_kinds h\<close> document_ptr_kinds_commutes
         local.create_document_is_weakly_dom_component_safe_step select_result_I2)
     done
 qed
 end
 
 interpretation i_get_scdom_component_create_document?: l_get_scdom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe to_tree_order get_parent get_parent_locs
   get_child_nodes get_child_nodes_locs get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_element_by_id get_elements_by_class_name get_elements_by_tag_name create_document
   get_disconnected_nodes get_disconnected_nodes_locs
   by(auto simp add: l_get_scdom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_scdom_component_create_document\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>insert\_before\<close>
 
 locale l_get_dom_component_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_set_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_set_disconnected_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_append_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_owner_document_wf +
   l_get_dom_component_get_scdom_component +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_insert_before_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_set_child_nodes_get_disconnected_nodes +
   l_remove_child +
   l_get_root_node_wf +
   l_set_disconnected_nodes_get_disconnected_nodes_wf +
   l_set_disconnected_nodes_get_ancestors +
   l_get_ancestors_wf +
   l_get_owner_document +
   l_heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma insert_before_is_component_unsafe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> insert_before ptr' child ref \<rightarrow>\<^sub>h h'"
   assumes "ptr \<notin> set |h \<turnstile> get_dom_component ptr'|\<^sub>r"
   assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast child)|\<^sub>r"
   assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document ptr'|\<^sub>r)|\<^sub>r"
   assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast child)|\<^sub>r)|\<^sub>r"
   shows "preserved (get_M ptr getter) h h'"
 proof -
   obtain owner_document where owner_document: "h \<turnstile> get_owner_document (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r owner_document"
     using assms(4)
     by(auto simp add: local.adopt_node_def insert_before_def elim!:  bind_returns_heap_E
         bind_returns_heap_E2[rotated, OF ensure_pre_insertion_validity_pure, rotated]
         bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated] bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated] split: if_splits)
   then
   obtain c where "h \<turnstile> get_dom_component (cast owner_document) \<rightarrow>\<^sub>r c"
     using get_dom_component_ok assms(1) assms(2) assms(3) get_owner_document_owner_document_in_heap
     by (meson document_ptr_kinds_commutes select_result_I)
   then
   have "ptr \<noteq> cast owner_document"
     using assms(6) assms(1) assms(2) assms(3) local.get_dom_component_ptr owner_document
     by (metis (no_types, lifting) assms(8) select_result_I2)
 
   obtain owner_document' where owner_document': "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document'"
     using assms(4)
     by(auto simp add: local.adopt_node_def insert_before_def elim!:  bind_returns_heap_E
         bind_returns_heap_E2[rotated, OF ensure_pre_insertion_validity_pure, rotated]
         bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
         bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated] split: if_splits)
   then
   obtain c where "h \<turnstile> get_dom_component (cast owner_document') \<rightarrow>\<^sub>r c"
     using get_dom_component_ok assms(1) assms(2) assms(3) get_owner_document_owner_document_in_heap
     by (meson document_ptr_kinds_commutes select_result_I)
   then
   have "ptr \<noteq> cast owner_document'"
     using assms(1) assms(2) assms(3) assms(7) local.get_dom_component_ptr owner_document' by auto
   then
   have "ptr \<noteq> cast |h \<turnstile> get_owner_document ptr'|\<^sub>r"
     using owner_document' by auto
 
   have "ptr \<noteq> ptr'"
     by (metis (mono_tags, opaque_lifting) assms(1) assms(2) assms(3) assms(5) assms(7) is_OK_returns_result_I
         l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ok l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ptr
         l_get_owner_document.get_owner_document_ptr_in_heap local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms
         local.l_get_owner_document_axioms owner_document' return_returns_result returns_result_select_result)
   have "\<And>parent. h \<turnstile> get_parent child \<rightarrow>\<^sub>r Some parent \<Longrightarrow> parent \<noteq> ptr"
     by (meson assms(1) assms(2) assms(3) assms(6) l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ptr
         local.get_dom_component_ok local.get_dom_component_to_tree_order local.get_parent_parent_in_heap
         local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms local.to_tree_order_ok local.to_tree_order_parent
         local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap returns_result_select_result)
   then
   have "\<And>parent. |h \<turnstile> get_parent child|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr"
     by (metis assms(2) assms(3) assms(4) is_OK_returns_heap_I local.get_parent_ok
         local.insert_before_child_in_heap select_result_I)
 
   show ?thesis
     using insert_before_writes assms(4)
     apply(rule reads_writes_preserved2)
     apply(auto simp add: insert_before_locs_def adopt_node_locs_def all_args_def)[1]
             apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
         set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
             apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |h \<turnstile> get_owner_document ptr'|\<^sub>r\<close>
         get_M_Mdocument_preserved3)
            apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
         set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
            apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
         get_M_Mdocument_preserved3 owner_document select_result_I2)
           apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
         set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
            apply (metis \<open>ptr \<noteq> ptr'\<close> document_ptr_casts_commute3 get_M_Mdocument_preserved3)
           apply(auto split: option.splits)[1] 
           apply (metis \<open>ptr \<noteq> ptr'\<close> element_ptr_casts_commute3 get_M_Element_preserved8)
          apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def set_disconnected_nodes_locs_def
         all_args_def split: if_splits)[1]
          apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |h \<turnstile> get_owner_document ptr'|\<^sub>r\<close> get_M_Mdocument_preserved3)
         apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
         set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
             apply (metis (no_types, lifting) \<open>\<And>parent. |h \<turnstile> get_parent child|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr\<close>
         element_ptr_casts_commute3 get_M_Element_preserved8 node_ptr_casts_commute option.case_eq_if option.collapse)
            apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
         get_M_Mdocument_preserved3 owner_document select_result_I2)
           apply (metis \<open>\<And>parent. |h \<turnstile> get_parent child|\<^sub>r = Some parent \<Longrightarrow> parent \<noteq> ptr\<close>
         document_ptr_casts_commute3 get_M_Mdocument_preserved3)
          apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
         get_M_Mdocument_preserved3 owner_document select_result_I2)
         apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
         get_M_Mdocument_preserved3 owner_document select_result_I2)
        apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
         set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
        apply (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |h \<turnstile> get_owner_document ptr'|\<^sub>r\<close>
         get_M_Mdocument_preserved3)
       apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
         set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
       apply (metis (no_types, lifting) \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r owner_document\<close>
         get_M_Mdocument_preserved3 owner_document select_result_I2)
      apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
         set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
       apply (metis \<open>ptr \<noteq> ptr'\<close> document_ptr_casts_commute3 get_M_Mdocument_preserved3)
      apply (metis (no_types, lifting) \<open>ptr \<noteq> ptr'\<close> element_ptr_casts_commute3
         get_M_Element_preserved8 node_ptr_casts_commute option.case_eq_if option.collapse)
     apply(auto simp add: remove_child_locs_def set_child_nodes_locs_def
         set_disconnected_nodes_locs_def all_args_def split: if_splits)[1]
     by (metis \<open>ptr \<noteq> cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r |h \<turnstile> get_owner_document ptr'|\<^sub>r\<close> get_M_Mdocument_preserved3)
 qed
 
 lemma insert_before_is_strongly_dom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> insert_before ptr' child ref \<rightarrow>\<^sub>h h'"
   assumes "ptr \<notin> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r"
   assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast child)|\<^sub>r"
   shows "preserved (get_M ptr getter) h h'"
 proof -
   have "ptr' |\<in>| object_ptr_kinds h"
     by (meson assms(4) is_OK_returns_heap_I local.insert_before_ptr_in_heap)
   then
   obtain sc' where sc': "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc'"
     by (meson assms(1) assms(2) assms(3) get_scdom_component_ok is_OK_returns_result_E)
   moreover
   obtain c' where c': "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c'"
     by (meson \<open>ptr' |\<in>| object_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
         local.get_dom_component_ok)
   ultimately have "set c' \<subseteq> set sc'"
     using assms(1) assms(2) assms(3) get_scdom_component_subset_get_dom_component by blast
 
   have "child |\<in>| node_ptr_kinds h"
     by (meson assms(4) is_OK_returns_heap_I local.insert_before_child_in_heap)
   then
   obtain child_sc where child_sc: "h \<turnstile> get_scdom_component (cast child) \<rightarrow>\<^sub>r child_sc"
     by (meson assms(1) assms(2) assms(3) get_scdom_component_ok is_OK_returns_result_E
         node_ptr_kinds_commutes)
   moreover
   obtain child_c where child_c: "h \<turnstile> get_dom_component (cast child) \<rightarrow>\<^sub>r child_c"
     by (meson \<open>child |\<in>| node_ptr_kinds h\<close> assms(1) assms(2) assms(3) is_OK_returns_result_E
         local.get_dom_component_ok node_ptr_kinds_commutes)
   ultimately have "set child_c \<subseteq> set child_sc"
     using assms(1) assms(2) assms(3) get_scdom_component_subset_get_dom_component by blast
 
   obtain ptr'_owner_document where ptr'_owner_document: "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r ptr'_owner_document"
     by (meson \<open>set c' \<subseteq> set sc'\<close> assms(1) assms(2) assms(3) c' get_scdom_component_owner_document_same
         local.get_dom_component_ptr sc' subset_code(1))
   then
   have "h \<turnstile> get_scdom_component (cast ptr'_owner_document) \<rightarrow>\<^sub>r sc'"
     by (metis (no_types, lifting) \<open>set c' \<subseteq> set sc'\<close> assms(1) assms(2) assms(3) c'
         get_scdom_component_owner_document_same get_scdom_component_ptrs_same_scope_component
         local.get_dom_component_ptr sc' select_result_I2 subset_code(1))
   moreover
   obtain ptr'_owner_document_c where ptr'_owner_document_c:
     "h \<turnstile> get_dom_component (cast ptr'_owner_document) \<rightarrow>\<^sub>r ptr'_owner_document_c"
     by (meson assms(1) assms(2) assms(3) document_ptr_kinds_commutes is_OK_returns_result_E
         local.get_dom_component_ok local.get_owner_document_owner_document_in_heap ptr'_owner_document)
   ultimately have "set ptr'_owner_document_c \<subseteq> set sc'"
     using assms(1) assms(2) assms(3) get_scdom_component_subset_get_dom_component by blast
 
   obtain child_owner_document where child_owner_document: "h \<turnstile> get_owner_document (cast child) \<rightarrow>\<^sub>r child_owner_document"
     by (meson \<open>set child_c \<subseteq> set child_sc\<close> assms(1) assms(2) assms(3) child_c child_sc
         get_scdom_component_owner_document_same local.get_dom_component_ptr subset_code(1))
 
   have "child_owner_document |\<in>| document_ptr_kinds h"
     using assms(1) assms(2) assms(3) child_owner_document local.get_owner_document_owner_document_in_heap
     by blast
   then
   have "h \<turnstile> get_scdom_component (cast child_owner_document) \<rightarrow>\<^sub>r child_sc"
     using get_scdom_component_ok assms(1) assms(2) assms(3) child_sc
     by (metis (no_types, lifting) \<open>set child_c \<subseteq> set child_sc\<close> child_c child_owner_document
         get_scdom_component_owner_document_same get_scdom_component_ptrs_same_scope_component
         local.get_dom_component_ptr returns_result_eq set_mp)
   moreover
   obtain child_owner_document_c where child_owner_document_c:
     "h \<turnstile> get_dom_component (cast child_owner_document) \<rightarrow>\<^sub>r child_owner_document_c"
     by (meson assms(1) assms(2) assms(3) child_owner_document document_ptr_kinds_commutes
         is_OK_returns_result_E local.get_dom_component_ok local.get_owner_document_owner_document_in_heap)
   ultimately have "set child_owner_document_c \<subseteq> set child_sc"
     using assms(1) assms(2) assms(3) get_scdom_component_subset_get_dom_component by blast
 
 
   have "ptr \<notin> set |h \<turnstile> get_dom_component ptr'|\<^sub>r"
     using \<open>set c' \<subseteq> set sc'\<close> assms(5) c' sc' by auto
   moreover have "ptr \<notin> set |h \<turnstile> get_dom_component (cast child)|\<^sub>r"
     using \<open>set child_c \<subseteq> set child_sc\<close> assms(6) child_c child_sc by auto
   moreover have "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document ptr'|\<^sub>r)|\<^sub>r"
     using \<open>set ptr'_owner_document_c \<subseteq> set sc'\<close> assms(5) ptr'_owner_document ptr'_owner_document_c sc'
     by auto
   moreover have "ptr \<notin> set |h \<turnstile> get_dom_component (cast |h \<turnstile> get_owner_document (cast child)|\<^sub>r)|\<^sub>r"
     using \<open>set child_owner_document_c \<subseteq> set child_sc\<close> assms(6) child_owner_document child_owner_document_c
       child_sc by auto
 
   ultimately show ?thesis
     using assms insert_before_is_component_unsafe
     by blast
 qed
 
 lemma insert_before_is_strongly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> insert_before ptr node child \<rightarrow>\<^sub>h h'"
   shows "is_strongly_scdom_component_safe ({ptr, cast node} \<union> (case child of Some ref \<Rightarrow> {cast ref} | None \<Rightarrow> {} )) {} h h'"
 proof -
   obtain ancestors reference_child owner_document h2 h3 disconnected_nodes_h2 where
     ancestors: "h \<turnstile> get_ancestors ptr \<rightarrow>\<^sub>r ancestors" and
     node_not_in_ancestors: "cast node \<notin> set ancestors" and
     reference_child:
     "h \<turnstile> (if Some node = child then a_next_sibling node else return child) \<rightarrow>\<^sub>r reference_child" and
     owner_document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document" and
     h2: "h \<turnstile> adopt_node owner_document node \<rightarrow>\<^sub>h h2" and
     disconnected_nodes_h2: "h2 \<turnstile> get_disconnected_nodes owner_document \<rightarrow>\<^sub>r disconnected_nodes_h2" and
     h3: "h2 \<turnstile> set_disconnected_nodes owner_document (remove1 node disconnected_nodes_h2) \<rightarrow>\<^sub>h h3" and
     h': "h3 \<turnstile> a_insert_node ptr node reference_child \<rightarrow>\<^sub>h h'"
     using assms(4)
     by(auto simp add: insert_before_def a_ensure_pre_insertion_validity_def
         elim!: bind_returns_heap_E bind_returns_result_E
         bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
         bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
         bind_returns_heap_E2[rotated, OF get_disconnected_nodes_pure, rotated]
         bind_returns_heap_E2[rotated, OF get_ancestors_pure, rotated]
         bind_returns_heap_E2[rotated, OF next_sibling_pure, rotated]
         bind_returns_heap_E2[rotated, OF get_owner_document_pure, rotated]
         split: if_splits option.splits)
 
   have object_ptr_kinds_M_eq3_h: "object_ptr_kinds h = object_ptr_kinds h2"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
           OF adopt_node_writes h2])
     using adopt_node_pointers_preserved
       apply blast
     by (auto simp add: reflp_def transp_def)
   then have object_ptr_kinds_M_eq_h: "\<And>ptrs. h \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs )
   then have object_ptr_kinds_M_eq2_h: "|h \<turnstile> object_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq2_h: "|h \<turnstile> node_ptr_kinds_M|\<^sub>r = |h2 \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
 
   have "known_ptrs h2"
     using assms(3) object_ptr_kinds_M_eq3_h known_ptrs_preserved by blast
 
   have wellformed_h2: "heap_is_wellformed h2"
     using adopt_node_preserves_wellformedness[OF assms(1) h2] assms(3) assms(2) .
 
   have object_ptr_kinds_M_eq3_h2: "object_ptr_kinds h2 = object_ptr_kinds h3"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
           OF set_disconnected_nodes_writes h3])
     unfolding a_remove_child_locs_def
     using set_disconnected_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have object_ptr_kinds_M_eq_h2: "\<And>ptrs. h2 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs)
   then have object_ptr_kinds_M_eq2_h2: "|h2 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq2_h2: "|h2 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
   have document_ptr_kinds_eq2_h2: "|h2 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h3 \<turnstile> document_ptr_kinds_M|\<^sub>r"
     using object_ptr_kinds_M_eq2_h2 document_ptr_kinds_M_eq by auto
 
   have "known_ptrs h3"
     using object_ptr_kinds_M_eq3_h2 known_ptrs_preserved \<open>known_ptrs h2\<close> by blast
 
   have object_ptr_kinds_M_eq3_h': "object_ptr_kinds h3 = object_ptr_kinds h'"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
           OF insert_node_writes h'])
     unfolding a_remove_child_locs_def
     using set_child_nodes_pointers_preserved
     by (auto simp add: reflp_def transp_def)
   then have object_ptr_kinds_M_eq_h3:
     "\<And>ptrs. h3 \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs = h' \<turnstile> object_ptr_kinds_M \<rightarrow>\<^sub>r ptrs"
     by(simp add: object_ptr_kinds_M_defs)
   then have object_ptr_kinds_M_eq2_h3:
     "|h3 \<turnstile> object_ptr_kinds_M|\<^sub>r = |h' \<turnstile> object_ptr_kinds_M|\<^sub>r"
     by simp
   then have node_ptr_kinds_eq2_h3: "|h3 \<turnstile> node_ptr_kinds_M|\<^sub>r = |h' \<turnstile> node_ptr_kinds_M|\<^sub>r"
     using node_ptr_kinds_M_eq by blast
   have document_ptr_kinds_eq2_h3: "|h3 \<turnstile> document_ptr_kinds_M|\<^sub>r = |h' \<turnstile> document_ptr_kinds_M|\<^sub>r"
     using object_ptr_kinds_M_eq2_h3 document_ptr_kinds_M_eq by auto
 
 
   have "object_ptr_kinds h = object_ptr_kinds h'"
     by (simp add: object_ptr_kinds_M_eq3_h object_ptr_kinds_M_eq3_h' object_ptr_kinds_M_eq3_h2)
   then
   show ?thesis
     using assms
     apply(auto simp add: is_strongly_scdom_component_safe_def)[1]
     using insert_before_is_strongly_dom_component_safe_step local.get_scdom_component_impl by blast
 qed
 
 lemma append_child_is_strongly_dom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> append_child ptr' child \<rightarrow>\<^sub>h h'"
   assumes "ptr \<notin> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r"
   assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast child)|\<^sub>r"
   shows "preserved (get_M ptr getter) h h'"
   by (metis assms(1) assms(2) assms(3) assms(4) assms(5) assms(6)
       insert_before_is_strongly_dom_component_safe_step local.append_child_def)
 
 lemma append_child_is_strongly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> append_child ptr child \<rightarrow>\<^sub>h h'"
   shows "is_strongly_scdom_component_safe {ptr, cast child} {} h h'"
   using assms unfolding append_child_def
   using insert_before_is_strongly_dom_component_safe
   by fastforce
 end
 
 interpretation i_get_dom_component_insert_before?: l_get_dom_component_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
   get_elements_by_tag_name set_child_nodes set_child_nodes_locs set_disconnected_nodes set_disconnected_nodes_locs
   get_owner_document remove_child remove_child_locs remove adopt_node adopt_node_locs insert_before
   insert_before_locs append_child get_scdom_component is_strongly_scdom_component_safe
   is_weakly_scdom_component_safe
   by(auto simp add: l_get_dom_component_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_dom_component_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>get\_owner\_document\<close>
 
 locale l_get_owner_document_scope_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_owner_document_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component_get_scdom_component +
   l_get_owner_document_wf_get_root_node_wf
 begin
 lemma get_owner_document_is_strongly_scdom_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document"
   shows "cast owner_document \<in> set sc \<longleftrightarrow> ptr' \<in> set sc"
 proof -
   have "h \<turnstile> get_owner_document (cast owner_document) \<rightarrow>\<^sub>r owner_document"
     by (metis assms(1) assms(2) assms(3) assms(5) cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject
         document_ptr_casts_commute3 document_ptr_document_ptr_cast document_ptr_kinds_commutes
         local.get_owner_document_owner_document_in_heap local.get_root_node_document
         local.get_root_node_not_node_same node_ptr_no_document_ptr_cast)
   then show ?thesis
     using assms
     using bind_returns_result_E contra_subsetD get_scdom_component_ok
       get_scdom_component_ptrs_same_scope_component get_scdom_component_subset_get_dom_component
       is_OK_returns_result_E is_OK_returns_result_I local.get_dom_component_ok local.get_dom_component_ptr
       local.get_owner_document_ptr_in_heap local.get_owner_document_pure local.get_scdom_component_def
       pure_returns_heap_eq returns_result_eq
-    by (smt local.get_scdom_component_ptrs_same_owner_document subsetD)
+    by (smt (verit) local.get_scdom_component_ptrs_same_owner_document subsetD)
 qed
 
 
 lemma get_owner_document_is_strongly_scdom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
   assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>h h'"
   shows "is_strongly_scdom_component_safe {ptr} {cast owner_document} h h'"
 proof -
   have "h = h'"
     by (meson assms(5) local.get_owner_document_pure pure_returns_heap_eq)
   then show ?thesis
     using assms
     apply(auto simp add: is_strongly_scdom_component_safe_def Let_def preserved_def)[1]
-    by (smt get_owner_document_is_strongly_scdom_component_safe_step inf.orderE is_OK_returns_result_I
+    by (smt (verit) get_owner_document_is_strongly_scdom_component_safe_step inf.orderE is_OK_returns_result_I
         local.get_dom_component_ok local.get_dom_component_to_tree_order_subset local.get_owner_document_ptr_in_heap
         local.get_scdom_component_impl local.get_scdom_component_ok local.get_scdom_component_ptr_in_heap
         local.get_scdom_component_subset_get_dom_component local.to_tree_order_ok
         local.to_tree_order_ptr_in_result notin_fset returns_result_select_result subset_eq)
 qed
 end
 
 interpretation i_get_owner_document_scope_component?: l_get_owner_document_scope_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
   get_owner_document get_disconnected_nodes get_disconnected_nodes_locs to_tree_order known_ptr
   known_ptrs type_wf heap_is_wellformed parent_child_rel get_child_nodes get_child_nodes_locs
   get_parent get_parent_locs get_ancestors get_ancestors_locs get_root_node get_root_node_locs
   get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_element_by_id
   get_elements_by_class_name get_elements_by_tag_name
   by(auto simp add: l_get_owner_document_scope_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_owner_document_scope_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 end
diff --git a/thys/SC_DOM_Components/Shadow_DOM_DOM_Components.thy b/thys/SC_DOM_Components/Shadow_DOM_DOM_Components.thy
--- a/thys/SC_DOM_Components/Shadow_DOM_DOM_Components.thy
+++ b/thys/SC_DOM_Components/Shadow_DOM_DOM_Components.thy
@@ -1,1323 +1,1323 @@
 (***********************************************************************************
  * Copyright (c) 2016-2020 The University of Sheffield, UK
  *               2019-2020 University of Exeter, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section \<open>Shadow SC DOM Components\<close>
 theory Shadow_DOM_DOM_Components
   imports
     Shadow_SC_DOM.Shadow_DOM
     Core_DOM_DOM_Components
 begin
 
 declare [[smt_timeout = 1200]]
 
 section \<open>Shadow root components\<close>
 
 
 subsection \<open>get\_component\<close>
 
 global_interpretation l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_root_node get_root_node_locs to_tree_order
   defines get_dom_component = a_get_dom_component
     and is_strongly_dom_component_safe = a_is_strongly_dom_component_safe
     and is_weakly_dom_component_safe = a_is_weakly_dom_component_safe
   .
 
 interpretation i_get_dom_component?: l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id get_elements_by_class_name
   get_elements_by_tag_name
   by(auto simp add: l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def
       get_dom_component_def is_strongly_dom_component_safe_def is_weakly_dom_component_safe_def instances)
 declare l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 
 
 subsection \<open>attach\_shadow\_root\<close>
 
 locale l_get_dom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   to_tree_order get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs
   get_ancestors get_ancestors_locs get_disconnected_nodes get_disconnected_nodes_locs get_element_by_id
   get_elements_by_class_name get_elements_by_tag_name +
   l_attach_shadow_root\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M known_ptr set_shadow_root set_shadow_root_locs set_mode set_mode_locs
   attach_shadow_root type_wf get_tag_name get_tag_name_locs get_shadow_root get_shadow_root_locs +
   l_set_mode\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_mode set_mode_locs +
   l_set_shadow_root\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M type_wf set_shadow_root set_shadow_root_locs
   for known_ptr :: "(_::linorder) object_ptr \<Rightarrow> bool"
     and heap_is_wellformed :: "(_) heap \<Rightarrow> bool"
     and parent_child_rel :: "(_) heap \<Rightarrow> ((_) object_ptr \<times> (_) object_ptr) set"
     and type_wf :: "(_) heap \<Rightarrow> bool"
     and known_ptrs :: "(_) heap \<Rightarrow> bool"
     and to_tree_order :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
     and get_parent :: "(_) node_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr option) prog"
     and get_parent_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_child_nodes :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
     and get_child_nodes_locs :: "(_) object_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_dom_component :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
     and get_root_node :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr) prog"
     and get_root_node_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_ancestors :: "(_) object_ptr \<Rightarrow> ((_) heap, exception, (_) object_ptr list) prog"
     and get_ancestors_locs :: "((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_element_by_id :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr option) prog"
     and get_elements_by_class_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
     and get_elements_by_tag_name :: "(_) object_ptr \<Rightarrow> char list \<Rightarrow> ((_) heap, exception, (_) element_ptr list) prog"
     and set_shadow_root :: "(_) element_ptr \<Rightarrow> (_) shadow_root_ptr option \<Rightarrow> ((_) heap, exception, unit) prog"
     and set_shadow_root_locs :: "(_) element_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
     and set_mode :: "(_) shadow_root_ptr \<Rightarrow> shadow_root_mode \<Rightarrow> ((_) heap, exception, unit) prog"
     and set_mode_locs :: "(_) shadow_root_ptr \<Rightarrow> ((_) heap, exception, unit) prog set"
     and attach_shadow_root :: "(_) element_ptr \<Rightarrow> shadow_root_mode \<Rightarrow> ((_) heap, exception, (_) shadow_root_ptr) prog"
     and get_disconnected_nodes :: "(_) document_ptr \<Rightarrow> ((_) heap, exception, (_) node_ptr list) prog"
     and get_disconnected_nodes_locs :: "(_) document_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and is_strongly_dom_component_safe :: "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
     and is_weakly_dom_component_safe :: "(_) object_ptr set \<Rightarrow> (_) object_ptr set \<Rightarrow> (_) heap \<Rightarrow> (_) heap \<Rightarrow> bool"
     and get_tag_name :: "(_) element_ptr \<Rightarrow> ((_) heap, exception, char list) prog"
     and get_tag_name_locs :: "(_) element_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
     and get_shadow_root :: "(_) element_ptr \<Rightarrow> ((_) heap, exception, (_) shadow_root_ptr option) prog"
     and get_shadow_root_locs :: "(_) element_ptr \<Rightarrow> ((_) heap \<Rightarrow> (_) heap \<Rightarrow> bool) set"
 begin
 
 lemma attach_shadow_root_is_weakly_dom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>h h'"
   assumes "ptr \<noteq> cast |h \<turnstile> attach_shadow_root element_ptr shadow_root_mode|\<^sub>r"
   assumes "ptr \<notin> set |h \<turnstile> get_dom_component (cast element_ptr)|\<^sub>r"
   shows "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h h'"
 proof -
   obtain h2 h3 new_shadow_root_ptr where
     h2: "h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>h h2" and
     new_shadow_root_ptr: "h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>r new_shadow_root_ptr" and
     h3: "h2 \<turnstile> set_mode new_shadow_root_ptr shadow_root_mode \<rightarrow>\<^sub>h h3" and
     h': "h3 \<turnstile> set_shadow_root element_ptr (Some new_shadow_root_ptr) \<rightarrow>\<^sub>h h'"
     using assms(4)
     by(auto simp add: attach_shadow_root_def elim!:  bind_returns_heap_E
         bind_returns_heap_E2[rotated, OF get_tag_name_pure, rotated]
         bind_returns_heap_E2[rotated, OF get_shadow_root_pure, rotated] split: if_splits)
   have "h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r new_shadow_root_ptr"
     using new_shadow_root_ptr h2 h3 h'
     using assms(4)
     by(auto simp add: attach_shadow_root_def intro!: bind_returns_result_I
         bind_pure_returns_result_I[OF get_tag_name_pure] bind_pure_returns_result_I[OF get_shadow_root_pure]
         elim!:  bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_tag_name_pure, rotated]
         bind_returns_heap_E2[rotated, OF get_shadow_root_pure, rotated] split: if_splits)
   have "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h h2"
     using h2 new_shadow_root_ptr
     by (metis (no_types, lifting) \<open>h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r new_shadow_root_ptr\<close>
         assms(5) new_shadow_root_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t select_result_I2)
 
   have "ptr \<noteq> cast new_shadow_root_ptr"
     using \<open>h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r new_shadow_root_ptr\<close> assms(5)
     by auto
 
   have "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h2 h3"
     using set_mode_writes h3
     apply(rule reads_writes_preserved2)
     apply(auto simp add: set_mode_locs_def all_args_def)[1]
     using \<open>ptr \<noteq> cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_shadow_root_ptr\<close>
     by (metis get_M_Mshadow_root_preserved3a)
 
   have "element_ptr |\<in>| element_ptr_kinds h"
     using \<open>h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r new_shadow_root_ptr\<close> attach_shadow_root_element_ptr_in_heap
     by blast
   have "ptr \<noteq> cast element_ptr"
     by (metis (no_types, lifting) \<open>element_ptr |\<in>| element_ptr_kinds h\<close> assms(1) assms(2) assms(3)
         assms(6) element_ptr_kinds_commutes is_OK_returns_result_E l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ok
         local.get_dom_component_ptr local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms node_ptr_kinds_commutes select_result_I2)
 
   have "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h3 h'"
     using set_shadow_root_writes h'
     apply(rule reads_writes_preserved2)
     apply(auto simp add: set_shadow_root_locs_def all_args_def)[1]
     by (metis \<open>ptr \<noteq> cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r element_ptr\<close> get_M_Element_preserved8)
 
   show ?thesis
     using \<open>preserved (get_M ptr getter) h h2\<close> \<open>preserved (get_M ptr getter) h2 h3\<close> \<open>preserved (get_M ptr getter) h3 h'\<close>
     by(auto simp add: preserved_def)
 qed
 end
 
 interpretation i_get_dom_component_attach_shadow_root?: l_get_dom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   known_ptr heap_is_wellformed parent_child_rel type_wf known_ptrs to_tree_order get_parent
   get_parent_locs get_child_nodes get_child_nodes_locs get_dom_component get_root_node get_root_node_locs
   get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
   set_shadow_root set_shadow_root_locs set_mode set_mode_locs attach_shadow_root get_disconnected_nodes
   get_disconnected_nodes_locs is_strongly_dom_component_safe is_weakly_dom_component_safe get_tag_name
   get_tag_name_locs get_shadow_root get_shadow_root_locs
   by(auto simp add: l_get_dom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_dom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsection \<open>get\_shadow\_root\<close>
 
 locale l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_shadow_root +
   l_heap_is_wellformed\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_root_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_root_node_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_remove_shadow_root_get_child_nodes
 begin
 lemma get_shadow_root_is_component_unsafe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr"
   shows "set |h \<turnstile> get_dom_component (cast host)|\<^sub>r \<inter> set |h \<turnstile> get_dom_component (cast shadow_root_ptr)|\<^sub>r = {}"
 proof -
   have "cast host |\<in>| object_ptr_kinds h"
     using assms(4) get_shadow_root_ptr_in_heap by auto
   then obtain host_c where host_c: "h \<turnstile> get_dom_component (cast host) \<rightarrow>\<^sub>r host_c"
     by (meson  assms(1) assms(2) assms(3) get_dom_component_ok is_OK_returns_result_E)
   obtain host_root where host_root: "h \<turnstile> get_root_node (cast host) \<rightarrow>\<^sub>r host_root"
     by (metis (no_types, lifting) bind_returns_heap_E get_dom_component_def host_c
         is_OK_returns_result_I pure_def pure_eq_iff)
 
   have "cast shadow_root_ptr |\<in>| object_ptr_kinds h"
     using get_shadow_root_shadow_root_ptr_in_heap assms shadow_root_ptr_kinds_commutes
     using document_ptr_kinds_commutes by blast
   then obtain shadow_root_ptr_c where shadow_root_ptr_c: "h \<turnstile> get_dom_component (cast shadow_root_ptr) \<rightarrow>\<^sub>r shadow_root_ptr_c"
     by (meson  assms(1) assms(2) assms(3) get_dom_component_ok is_OK_returns_result_E)
   have "h \<turnstile> get_root_node (cast shadow_root_ptr) \<rightarrow>\<^sub>r cast shadow_root_ptr"
     using \<open>cast shadow_root_ptr |\<in>| object_ptr_kinds h\<close>
     by(auto simp add: get_root_node_def get_ancestors_def intro!: bind_pure_returns_result_I
         split: option.splits)
 
   have "host_root \<noteq> cast shadow_root_ptr"
   proof (rule ccontr, simp)
     assume "host_root = cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr"
 
     have "(cast shadow_root_ptr, host_root) \<in> (parent_child_rel h)\<^sup>*"
       using \<open>host_root = cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr\<close> by auto
     moreover have "(host_root, cast host) \<in> (parent_child_rel h)\<^sup>*"
       using get_root_node_parent_child_rel host_root assms
       by blast
     moreover have "(cast host, cast shadow_root_ptr) \<in> (a_host_shadow_root_rel h)"
       using assms(4) apply(auto simp add: a_host_shadow_root_rel_def)[1]
       by (metis (mono_tags, lifting) get_shadow_root_ptr_in_heap image_eqI is_OK_returns_result_I
           mem_Collect_eq prod.simps(2) select_result_I2)
     moreover have " acyclic (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> a_ptr_disconnected_node_rel h)"
       using assms(1)[unfolded heap_is_wellformed_def]
       by auto
     ultimately show False
       using local.parent_child_rel_node_ptr
       by (metis (no_types, lifting) Un_iff \<open>host_root = cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr\<close>
           acyclic_def in_rtrancl_UnI rtrancl_into_trancl1)
   qed
   then have "host_c \<noteq> shadow_root_ptr_c"
     by (metis \<open>h \<turnstile> get_root_node (cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr) \<rightarrow>\<^sub>r cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr\<close>
         assms(1) assms(2) assms(3) get_dom_component_ptr get_dom_component_root_node_same host_c host_root
         local.get_root_node_parent_child_rel local.get_root_node_same_no_parent_parent_child_rel rtranclE shadow_root_ptr_c)
   then have "set host_c \<inter> set shadow_root_ptr_c = {}"
     using assms get_dom_component_no_overlap Shadow_DOM.a_heap_is_wellformed_def host_c shadow_root_ptr_c
     by blast
   then show ?thesis
     using host_c shadow_root_ptr_c
     by auto
 qed
 end
 
 interpretation i_get_shadow_root_component?: l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   type_wf get_shadow_root get_shadow_root_locs get_child_nodes get_child_nodes_locs
   get_disconnected_nodes get_disconnected_nodes_locs get_tag_name get_tag_name_locs known_ptr
   heap_is_wellformed parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_host get_host_locs
   get_disconnected_document get_disconnected_document_locs known_ptrs to_tree_order get_parent
   get_parent_locs get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe
   get_root_node get_root_node_locs get_ancestors get_ancestors_locs get_element_by_id
   get_elements_by_class_name get_elements_by_tag_name remove_shadow_root remove_shadow_root_locs
   by(auto simp add: l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsection \<open>get\_host\<close>
 
 locale l_get_host_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_heap_is_wellformed\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_host +
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M  +
   l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma get_host_is_component_unsafe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_host shadow_root_ptr \<rightarrow>\<^sub>r host"
   shows "set |h \<turnstile> get_dom_component (cast host)|\<^sub>r \<inter> set |h \<turnstile> get_dom_component (cast shadow_root_ptr)|\<^sub>r = {}"
 proof -
   have "h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr"
     using assms(1) assms(2) assms(4) local.shadow_root_host_dual by blast
   then show ?thesis
     using assms(1) assms(2) assms(3) local.get_shadow_root_is_component_unsafe by blast
 qed
 end
 
 interpretation i_get_host_component?: l_get_host_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_child_nodes get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs
   get_shadow_root get_shadow_root_locs get_tag_name get_tag_name_locs known_ptr type_wf heap_is_wellformed
   parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_host get_host_locs get_disconnected_document
   get_disconnected_document_locs known_ptrs to_tree_order get_parent get_parent_locs get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors
   get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name remove_shadow_root
   remove_shadow_root_locs
   by(auto simp add: l_get_host_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_host_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 
 subsection \<open>get\_root\_node\_si\<close>
 
 locale l_get_dom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_root_node_si_wf\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma get_root_node_si_is_component_unsafe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_root_node_si ptr' \<rightarrow>\<^sub>r root"
   shows "set |h \<turnstile> get_dom_component ptr'|\<^sub>r = set |h \<turnstile> get_dom_component root|\<^sub>r \<or>
 set |h \<turnstile> get_dom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_dom_component root|\<^sub>r = {}"
 proof -
   have "ptr' |\<in>| object_ptr_kinds h"
     using get_ancestors_si_ptr_in_heap assms(4)
     by(auto simp add: get_root_node_si_def elim!: bind_returns_result_E2)
   then
   obtain c where "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c"
     by (meson assms(1) assms(2) assms(3) local.get_dom_component_ok select_result_I)
   moreover
   have "root |\<in>| object_ptr_kinds h"
     using get_ancestors_si_ptr assms(4)
     apply(auto simp add: get_root_node_si_def elim!: bind_returns_result_E2)[1]
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) empty_iff empty_set
         get_ancestors_si_ptrs_in_heap last_in_set)
   then
   obtain c' where "h \<turnstile> get_dom_component root \<rightarrow>\<^sub>r c'"
     by (meson assms(1) assms(2) assms(3) local.get_dom_component_ok select_result_I)
   ultimately show ?thesis
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) local.get_dom_component_no_overlap select_result_I2)
 qed
 end
 
 interpretation i_get_dom_component_get_root_node_si?: l_get_dom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs
   get_host get_host_locs get_ancestors_si get_ancestors_si_locs get_root_node_si get_root_node_si_locs
   get_disconnected_nodes get_disconnected_nodes_locs get_shadow_root get_shadow_root_locs get_tag_name
   get_tag_name_locs heap_is_wellformed parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_document
   get_disconnected_document_locs to_tree_order get_dom_component is_strongly_dom_component_safe
   is_weakly_dom_component_safe get_root_node get_root_node_locs get_ancestors get_ancestors_locs
   get_element_by_id get_elements_by_class_name get_elements_by_tag_name
   by(auto simp add: l_get_dom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_dom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 
 subsection \<open>get\_assigned\_nodes\<close>
 
 lemma get_shadow_root_not_weakly_dom_component_safe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
     element_ptr and shadow_root_ptr_opt and h' where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> get_shadow_root element_ptr \<rightarrow>\<^sub>r shadow_root_ptr_opt \<rightarrow>\<^sub>h h'" and
     "\<not> is_weakly_dom_component_safe {cast element_ptr} (cast ` set_option shadow_root_ptr_opt) h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
 'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
 'Shadowroot::{equal,linorder}) heap"
   let ?P = "do {
         document_ptr \<leftarrow> create_document;
         html \<leftarrow> create_element document_ptr ''html'';
         append_child (cast document_ptr) (cast html);
         head \<leftarrow> create_element document_ptr ''head'';
         append_child (cast html) (cast head);
         body \<leftarrow> create_element document_ptr ''body'';
         append_child (cast html) (cast body);
         e1 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast body) (cast e1);
         e2 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast e1) (cast e2);
         s1 \<leftarrow> attach_shadow_root e1 Open;
         e3 \<leftarrow> create_element document_ptr ''slot'';
         append_child (cast s1) (cast e3);
         return e1
       }"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?e1 = "|?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and element_ptr="?e1"])
     by code_simp+
 qed
 
 lemma assigned_nodes_not_weakly_dom_component_safe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder}, 'CharacterData::{equal,linorder},
 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
     node_ptr and nodes and h' where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> assigned_nodes node_ptr \<rightarrow>\<^sub>r nodes \<rightarrow>\<^sub>h h'" and
     "\<not> is_weakly_dom_component_safe {cast node_ptr} (cast ` set nodes) h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
 'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
 'Shadowroot::{equal,linorder}) heap"
   let ?P = "do {
         document_ptr \<leftarrow> create_document;
         html \<leftarrow> create_element document_ptr ''html'';
         append_child (cast document_ptr) (cast html);
         head \<leftarrow> create_element document_ptr ''head'';
         append_child (cast html) (cast head);
         body \<leftarrow> create_element document_ptr ''body'';
         append_child (cast html) (cast body);
         e1 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast body) (cast e1);
         e2 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast e1) (cast e2);
         s1 \<leftarrow> attach_shadow_root e1 Closed;
         e3 \<leftarrow> create_element document_ptr ''slot'';
         append_child (cast s1) (cast e3);
         return e3
       }"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?e3 = "|?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and node_ptr="?e3"])
     by code_simp+
 qed
 
 lemma get_composed_root_node_not_weakly_dom_component_safe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
     ptr and root and h' where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> get_root_node_si ptr \<rightarrow>\<^sub>r root \<rightarrow>\<^sub>h h'" and
     "\<not> is_weakly_dom_component_safe {ptr} {root} h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
 'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
 'Shadowroot::{equal,linorder}) heap"
   let ?P = "do {
         document_ptr \<leftarrow> create_document;
         html \<leftarrow> create_element document_ptr ''html'';
         append_child (cast document_ptr) (cast html);
         head \<leftarrow> create_element document_ptr ''head'';
         append_child (cast html) (cast head);
         body \<leftarrow> create_element document_ptr ''body'';
         append_child (cast html) (cast body);
         e1 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast body) (cast e1);
         e2 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast e1) (cast e2);
         s1 \<leftarrow> attach_shadow_root e1 Closed;
         e3 \<leftarrow> create_element document_ptr ''slot'';
         append_child (cast s1) (cast e3);
         return e3
       }"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?e3 = "|?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and ptr="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e3"])
     by code_simp+
 qed
 
 lemma assigned_slot_not_weakly_dom_component_safe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder}, 'CharacterData::{equal,linorder},
 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
     node_ptr and slot_opt and h' where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> assigned_slot node_ptr \<rightarrow>\<^sub>r slot_opt \<rightarrow>\<^sub>h h'" and
     "\<not> is_weakly_dom_component_safe {cast node_ptr} (cast ` set_option slot_opt) h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
 'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
  'Shadowroot::{equal,linorder}) heap"
   let ?P = "do {
         document_ptr \<leftarrow> create_document;
         html \<leftarrow> create_element document_ptr ''html'';
         append_child (cast document_ptr) (cast html);
         head \<leftarrow> create_element document_ptr ''head'';
         append_child (cast html) (cast head);
         body \<leftarrow> create_element document_ptr ''body'';
         append_child (cast html) (cast body);
         e1 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast body) (cast e1);
         e2 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast e1) (cast e2);
         s1 \<leftarrow> attach_shadow_root e1 Open;
         e3 \<leftarrow> create_element document_ptr ''slot'';
         append_child (cast s1) (cast e3);
         return e2
       }"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?e2 = "|?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and node_ptr="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e2"])
     by code_simp+
 qed
 
 locale l_assigned_nodes_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_tag_name +
   l_get_child_nodes +
   l_heap_is_wellformed\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_find_slot\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_assigned_nodes\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_assigned_nodes_wf\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_adopt_node\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_remove_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_remove_child_wf2 +
   l_insert_before_wf +
   l_insert_before_wf2 +
   l_append_child\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_append_child_wf\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_set_disconnected_nodes_get_tag_name +
   l_set_shadow_root_get_child_nodes +
   l_set_child_nodes_get_tag_name +
   l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_remove_shadow_root\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_remove_shadow_root_get_tag_name +
   l_set_disconnected_nodes_get_shadow_root +
   l_set_child_nodes_get_shadow_root +
   l_remove_shadow_root_wf\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma find_slot_is_component_unsafe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> find_slot open_flag node_ptr \<rightarrow>\<^sub>r Some slot"
   shows "set |h \<turnstile> get_dom_component (cast node_ptr)|\<^sub>r \<inter> set |h \<turnstile> get_dom_component (cast slot)|\<^sub>r = {}"
 proof -
   obtain host shadow_root_ptr to where
     "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some (cast host)" and
     "h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr" and
     "h \<turnstile> to_tree_order (cast shadow_root_ptr) \<rightarrow>\<^sub>r to" and
     "cast slot \<in> set to"
     using assms(4)
     apply(auto simp add: find_slot_def first_in_tree_order_def elim!: bind_returns_result_E2
         map_filter_M_pure_E[where y=slot] split: option.splits if_splits list.splits intro!: map_filter_M_pure
         bind_pure_I)[1]
     by (metis element_ptr_casts_commute3)+
 
   have "node_ptr |\<in>| node_ptr_kinds h"
     using assms(4) find_slot_ptr_in_heap by blast
   then obtain node_ptr_c where node_ptr_c: "h \<turnstile> get_dom_component (cast node_ptr) \<rightarrow>\<^sub>r node_ptr_c"
     using assms(1) assms(2) assms(3) get_dom_component_ok is_OK_returns_result_E
       node_ptr_kinds_commutes[symmetric]
     by metis
 
   then have "cast host \<in> set node_ptr_c"
     using \<open>h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some (cast host)\<close> get_dom_component_parent_inside assms(1)
       assms(2) assms(3) get_dom_component_ptr
     by blast
 
   then have "h \<turnstile> get_dom_component (cast host) \<rightarrow>\<^sub>r node_ptr_c"
     using \<open>h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some (cast host)\<close> get_dom_component_subset a_heap_is_wellformed_def
       assms(1) assms(2) assms(3) node_ptr_c
     by blast
 
   moreover have "slot |\<in>| element_ptr_kinds h"
     using assms(4) find_slot_slot_in_heap by blast
   then obtain slot_c where slot_c: "h \<turnstile> get_dom_component (cast slot) \<rightarrow>\<^sub>r slot_c"
     using a_heap_is_wellformed_def assms(1) assms(2) assms(3) get_dom_component_ok is_OK_returns_result_E
       node_ptr_kinds_commutes[symmetric] element_ptr_kinds_commutes[symmetric]
     by metis
   then have "cast shadow_root_ptr \<in> set slot_c"
     using \<open>h \<turnstile> to_tree_order (cast shadow_root_ptr) \<rightarrow>\<^sub>r to\<close> \<open>cast slot \<in> set to\<close> get_dom_component_to_tree_order
       assms(1) assms(2) assms(3) get_dom_component_ptr
     by blast
   then have "h \<turnstile> get_dom_component (cast shadow_root_ptr) \<rightarrow>\<^sub>r slot_c"
     using  \<open>h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr\<close> get_dom_component_subset assms(1) assms(2)
       assms(3) slot_c
     by blast
 
   ultimately show ?thesis
     using get_shadow_root_is_component_unsafe assms \<open>h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr\<close>
       node_ptr_c slot_c
     by fastforce
 qed
 
 
 lemma assigned_nodes_is_component_unsafe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> assigned_nodes element_ptr \<rightarrow>\<^sub>r nodes"
   assumes "node_ptr \<in> set nodes"
   shows "set |h \<turnstile> get_dom_component (cast element_ptr)|\<^sub>r \<inter> set |h \<turnstile> get_dom_component (cast node_ptr)|\<^sub>r = {}"
 proof -
   have "h \<turnstile> find_slot False node_ptr \<rightarrow>\<^sub>r Some element_ptr"
     using assms(4) assms(5)
     by(auto simp add: assigned_nodes_def elim!: bind_returns_result_E2
         dest!: filter_M_holds_for_result[where x=node_ptr] intro!: bind_pure_I split: if_splits)
   then show ?thesis
     using assms find_slot_is_component_unsafe
     by blast
 qed
 
 lemma flatten_dom_assigned_nodes_become_children:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> flatten_dom \<rightarrow>\<^sub>h h'"
   assumes "h \<turnstile> assigned_nodes slot \<rightarrow>\<^sub>r nodes"
   assumes "nodes \<noteq> []"
   shows "h' \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes"
 proof -
   obtain tups h2 element_ptrs shadow_root_ptrs where
     "h \<turnstile> element_ptr_kinds_M \<rightarrow>\<^sub>r element_ptrs" and
     tups: "h \<turnstile> map_filter_M2 (\<lambda>element_ptr. do {
       tag \<leftarrow> get_tag_name element_ptr;
       assigned_nodes \<leftarrow> assigned_nodes element_ptr;
       (if tag = ''slot'' \<and> assigned_nodes \<noteq> [] then return (Some (element_ptr, assigned_nodes))
 else return None)}) element_ptrs \<rightarrow>\<^sub>r tups" (is "h \<turnstile> map_filter_M2 ?f element_ptrs \<rightarrow>\<^sub>r tups") and
     h2: "h \<turnstile> forall_M (\<lambda>(slot, assigned_nodes). do {
       get_child_nodes (cast slot) \<bind> forall_M remove;
       forall_M (append_child (cast slot)) assigned_nodes
     }) tups \<rightarrow>\<^sub>h h2" and
     "h2 \<turnstile> shadow_root_ptr_kinds_M \<rightarrow>\<^sub>r shadow_root_ptrs" and
     h': "h2 \<turnstile> forall_M (\<lambda>shadow_root_ptr. do {
       host \<leftarrow> get_host shadow_root_ptr;
       get_child_nodes (cast host) \<bind> forall_M remove;
       get_child_nodes (cast shadow_root_ptr) \<bind> forall_M (append_child (cast host));
       remove_shadow_root host
     }) shadow_root_ptrs \<rightarrow>\<^sub>h h'"
     using \<open>h \<turnstile> flatten_dom \<rightarrow>\<^sub>h h'\<close>
     apply(auto simp add: flatten_dom_def elim!: bind_returns_heap_E
         bind_returns_heap_E2[rotated, OF ElementMonad.ptr_kinds_M_pure, rotated]
         bind_returns_heap_E2[rotated, OF ShadowRootMonad.ptr_kinds_M_pure, rotated])[1]
     apply(drule pure_returns_heap_eq)
     by(auto intro!: map_filter_M2_pure bind_pure_I)
 
   have all_tups_slot: "\<And>slot assigned_nodes. (slot, assigned_nodes) \<in> set tups \<Longrightarrow>
 h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
     using tups
     apply(induct element_ptrs arbitrary: tups)
     by(auto elim!: bind_returns_result_E2 split: if_splits intro!: map_filter_M2_pure bind_pure_I)
 
   have "distinct element_ptrs"
     using \<open>h \<turnstile> element_ptr_kinds_M \<rightarrow>\<^sub>r element_ptrs\<close>
     by auto
   then
   have "distinct tups"
     using tups
     apply(induct element_ptrs arbitrary: tups)
     by(auto elim!: bind_returns_result_E2 intro!: map_filter_M2_pure bind_pure_I
         split: option.splits if_splits intro: map_filter_pure_foo[rotated] )
 
 
   have "slot \<in> set element_ptrs"
     using assms(5) assigned_nodes_ptr_in_heap \<open>h \<turnstile> element_ptr_kinds_M \<rightarrow>\<^sub>r element_ptrs\<close>
     by auto
   then
   have "(slot, nodes) \<in> set tups"
     apply(rule map_filter_M2_in_result[OF tups])
     apply(auto intro!: bind_pure_I)[1]
     apply(intro bind_pure_returns_result_I)
     using assms assigned_nodes_slot_is_slot
     by(auto intro!: bind_pure_returns_result_I)
 
   have "\<And>slot nodes. (slot, nodes) \<in> set tups \<Longrightarrow> h \<turnstile> assigned_nodes slot \<rightarrow>\<^sub>r nodes"
     using tups
     apply(induct element_ptrs arbitrary: tups)
     by(auto elim!: bind_returns_result_E2 intro!: map_filter_M2_pure bind_pure_I split: if_splits)
   then
   have elementwise_eq: "\<And>slot slot' nodes nodes'. (slot, nodes) \<in> set tups \<Longrightarrow>
 (slot', nodes') \<in> set tups \<Longrightarrow> slot = slot' \<Longrightarrow> nodes = nodes'"
     by (meson returns_result_eq)
 
   have "\<And>slot nodes. (slot, nodes) \<in> set tups \<Longrightarrow> distinct nodes"
     using \<open>\<And>slot nodes. (slot, nodes) \<in> set tups \<Longrightarrow> h \<turnstile> assigned_nodes slot \<rightarrow>\<^sub>r nodes\<close> assigned_nodes_distinct
     using assms(1) by blast
 
   have "\<And>slot slot' nodes nodes'. (slot, nodes) \<in> set tups \<Longrightarrow> (slot', nodes') \<in> set tups \<Longrightarrow> slot \<noteq> slot' \<Longrightarrow> set nodes \<inter> set nodes' = {}"
     using \<open>\<And>slot nodes. (slot, nodes) \<in> set tups \<Longrightarrow> h \<turnstile> assigned_nodes slot \<rightarrow>\<^sub>r nodes\<close>
       assigned_nodes_different_ptr assms(1) assms(2) assms(3) by blast
 
   have "h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
     using \<open>(slot, nodes) \<in> set tups\<close> all_tups_slot by blast
   then have "h2 \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
     using h2
   proof(induct tups arbitrary: h, simp)
     case (Cons x xs)
     obtain xc ha hb slot' nodes' where
       "x = (slot', nodes')" and
       "h \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot') \<rightarrow>\<^sub>r xc" and
       ha: "h \<turnstile> forall_M remove xc \<rightarrow>\<^sub>h ha" and
       hb: "ha \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot')) nodes' \<rightarrow>\<^sub>h hb" and
       remainder: "hb \<turnstile> forall_M (\<lambda>(slot, assigned_nodes). Heap_Error_Monad.bind
 (get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot))
 (\<lambda>x. Heap_Error_Monad.bind (forall_M remove x)
 (\<lambda>_. forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot)) assigned_nodes))) xs \<rightarrow>\<^sub>h h2"
       using Cons(3)
       by (auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
           bind_returns_result_E bind_returns_result_E2[rotated, OF get_child_nodes_pure, rotated] split: prod.splits)
 
     have "ha \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
       using \<open>h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close> ha
     proof(induct xc arbitrary: h, simp)
       case (Cons a yc)
       obtain hb1 where
         hb1: "h \<turnstile> remove a \<rightarrow>\<^sub>h hb1" and
         hba: "hb1 \<turnstile> forall_M remove yc \<rightarrow>\<^sub>h ha"
         using Cons
         by (auto elim!: bind_returns_heap_E)
       have "hb1 \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
         using \<open>h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close> hb1
         by(auto simp add: CD.remove_child_locs_def set_child_nodes_get_tag_name
             set_disconnected_nodes_get_tag_name dest!: reads_writes_separate_forwards[OF get_tag_name_reads
               CD.remove_writes])
       then show ?case
         using hba Cons(1) by simp
     qed
     then
     have "hb \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
       using hb
     proof (induct nodes' arbitrary: ha, simp)
       case (Cons a nodes')
       obtain ha1 where
         ha1: "ha \<turnstile> append_child (cast slot') a \<rightarrow>\<^sub>h ha1" and
         hb: "ha1 \<turnstile> forall_M (append_child (cast slot')) nodes' \<rightarrow>\<^sub>h hb"
         using Cons
         by (auto elim!: bind_returns_heap_E)
       have "ha1 \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
         using \<open>ha \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close> ha1
         by(auto simp add: append_child_def insert_before_locs_def adopt_node_locs_def
             CD.adopt_node_locs_def CD.remove_child_locs_def set_child_nodes_get_tag_name
             set_disconnected_nodes_get_tag_name dest!: reads_writes_separate_forwards[OF get_tag_name_reads
               insert_before_writes] split: if_splits)
       then show ?case
         using ha1 hb Cons(1)
         by simp
     qed
     then
     show ?case
       using Cons(1) remainder by simp
   qed
 
   have "h2 \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes \<and> heap_is_wellformed h2 \<and> type_wf h2 \<and> known_ptrs h2"
     using \<open>(slot, nodes) \<in> set tups\<close>
     using h2 assms(1) assms(2) assms(3) \<open>distinct tups\<close> all_tups_slot elementwise_eq
     using \<open>\<And>slot slot' assigned_nodes nodes'. (slot, assigned_nodes) \<in> set tups \<Longrightarrow>
 (slot', nodes') \<in> set tups \<Longrightarrow> slot \<noteq> slot' \<Longrightarrow> set assigned_nodes \<inter> set nodes' = {}\<close>
     using \<open>\<And>slot assigned_nodes. (slot, assigned_nodes) \<in> set tups \<Longrightarrow> distinct assigned_nodes\<close>
   proof(induct tups arbitrary: h, simp)
     case (Cons x xs)
     obtain xc ha hb slot' nodes' where
       "x = (slot', nodes')" and
       "h \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot') \<rightarrow>\<^sub>r xc" and
       ha: "h \<turnstile> forall_M remove xc \<rightarrow>\<^sub>h ha" and
       hb: "ha \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot')) nodes' \<rightarrow>\<^sub>h hb" and
       remainder: "hb \<turnstile> forall_M (\<lambda>(slot, assigned_nodes). Heap_Error_Monad.bind
 (get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot)) (\<lambda>x. Heap_Error_Monad.bind (forall_M remove x)
 (\<lambda>_. forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot)) assigned_nodes))) xs \<rightarrow>\<^sub>h h2"
       using Cons(3)
       by (auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated]
           bind_returns_result_E bind_returns_result_E2[rotated, OF get_child_nodes_pure, rotated]
           split: prod.splits)
 
     have "\<And>slot assigned_nodes. (slot, assigned_nodes) \<in> set xs \<Longrightarrow> h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
       using Cons by auto
 
     have "heap_is_wellformed ha" and "type_wf ha" and "known_ptrs ha"
       using Cons(4) Cons(5) Cons(6) \<open>h \<turnstile> forall_M remove xc \<rightarrow>\<^sub>h ha\<close>
       apply(induct xc arbitrary: h)
       apply(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
           simp add: CD.remove_def split: option.splits)[1]
       apply(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
           simp add: CD.remove_def split: option.splits)[1]
       apply(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
           simp add: CD.remove_def split: option.splits)[1]
       apply(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
           simp add: CD.remove_def split: option.splits)[1]
       using remove_child_heap_is_wellformed_preserved remove_child_preserves_type_wf remove_child_preserves_known_ptrs
       apply metis
       apply(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
           simp add: CD.remove_def split: option.splits)[1]
       using remove_child_heap_is_wellformed_preserved remove_child_preserves_type_wf remove_child_preserves_known_ptrs
       apply metis
       apply(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_parent_pure, rotated]
           simp add: CD.remove_def split: option.splits)[1]
       using remove_child_heap_is_wellformed_preserved remove_child_preserves_type_wf remove_child_preserves_known_ptrs
       apply metis
       done
     then
     have "heap_is_wellformed hb" and "type_wf hb" and "known_ptrs hb"
       using \<open>ha \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot')) nodes' \<rightarrow>\<^sub>h hb\<close>
       apply(induct nodes' arbitrary: ha)
       apply(auto elim!: bind_returns_heap_E simp add: append_child_def)[1]
       apply(auto elim!: bind_returns_heap_E simp add: append_child_def)[1]
       apply(auto elim!: bind_returns_heap_E simp add: append_child_def)[1]
       apply(auto elim!: bind_returns_heap_E simp add: append_child_def)[1]
       using insert_before_heap_is_wellformed_preserved insert_before_preserves_type_wf insert_before_preserves_known_ptrs
       apply metis
       apply(auto elim!: bind_returns_heap_E simp add: append_child_def)[1]
       using insert_before_heap_is_wellformed_preserved insert_before_preserves_type_wf insert_before_preserves_known_ptrs
       apply metis
       apply(auto elim!: bind_returns_heap_E simp add: append_child_def)[1]
       using insert_before_heap_is_wellformed_preserved insert_before_preserves_type_wf insert_before_preserves_known_ptrs
       apply metis
       done
 
     {
       fix slot assigned_nodes
       assume "(slot, assigned_nodes) \<in> set xs"
       then have "h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
         using \<open>\<And>slot assigned_nodes. (slot, assigned_nodes) \<in> set xs \<Longrightarrow> h \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close>
         by auto
       then have "ha \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
         using \<open>h \<turnstile> forall_M remove xc \<rightarrow>\<^sub>h ha\<close>
         apply(induct xc arbitrary: h)
         by(auto simp add: CD.remove_child_locs_def set_child_nodes_get_tag_name set_disconnected_nodes_get_tag_name
             dest!: reads_writes_separate_forwards[OF get_tag_name_reads CD.remove_writes]
             elim!: bind_returns_heap_E)
       then have "hb \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
         using \<open>ha \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot')) nodes' \<rightarrow>\<^sub>h hb\<close>
         apply(induct nodes' arbitrary: ha)
         by(auto simp add: append_child_def insert_before_locs_def adopt_node_locs_def CD.adopt_node_locs_def
             CD.remove_child_locs_def set_child_nodes_get_tag_name set_disconnected_nodes_get_tag_name
             dest!: reads_writes_separate_forwards[OF get_tag_name_reads insert_before_writes]
             elim!: bind_returns_heap_E
             split: if_splits)
     } note tag_names_same = this
 
     show ?case
     proof(cases "slot' = slot")
       case True
       then
       have "nodes' = nodes"
         using Cons.prems(1) Cons.prems(8) \<open>x = (slot', nodes')\<close>
         by (metis list.set_intros(1))
       then
       have "(slot, nodes) \<notin> set xs"
         using Cons.prems(6) True \<open>x = (slot', nodes')\<close> by auto
 
       have "ha \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r []"
         using remove_for_all_empty_children Cons.prems(3) Cons.prems(4) Cons.prems(5)
           True \<open>h \<turnstile> forall_M remove xc \<rightarrow>\<^sub>h ha\<close>
         using \<open>h \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot') \<rightarrow>\<^sub>r xc\<close>
         by blast
       then
       have "hb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes"
         using  append_child_for_all_on_no_children[OF \<open>heap_is_wellformed hb\<close> \<open>type_wf hb\<close> \<open>known_ptrs hb\<close>]
           True \<open>nodes' = nodes\<close>
         using \<open>ha \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot')) nodes' \<rightarrow>\<^sub>h hb\<close>
         using \<open>(slot, nodes) \<in> set tups\<close> \<open>\<And>slot assigned_nodes. (slot, assigned_nodes) \<in> set tups \<Longrightarrow>
 distinct assigned_nodes\<close> \<open>heap_is_wellformed ha\<close> \<open>known_ptrs ha\<close> \<open>type_wf ha\<close> local.append_child_for_all_on_no_children
         by blast
       with \<open>heap_is_wellformed hb\<close> and \<open>type_wf hb\<close> and \<open>known_ptrs hb\<close>
       show ?thesis
         using \<open>(slot, nodes) \<notin> set xs\<close> remainder
         using \<open>\<And>slot slot' assigned_nodes nodes'. (slot, assigned_nodes) \<in> set (x#xs) \<Longrightarrow>
 (slot', nodes') \<in> set (x#xs) \<Longrightarrow> slot = slot' \<Longrightarrow> assigned_nodes = nodes'\<close>
         using \<open>(slot, nodes) \<in> set (x # xs)\<close>
         using \<open>\<And>slot slot' assigned_nodes nodes'. (slot, assigned_nodes) \<in> set (x#xs) \<Longrightarrow>
 (slot', nodes') \<in> set (x#xs) \<Longrightarrow> slot \<noteq> slot' \<Longrightarrow> set assigned_nodes \<inter> set nodes' = {}\<close>
       proof(induct xs arbitrary: hb, simp)
         case (Cons y ys)
         obtain yc hba hbb slot'' nodes'' where
           "y = (slot'', nodes'')" and
           "hb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'') \<rightarrow>\<^sub>r yc" and
           "hb \<turnstile> forall_M remove yc \<rightarrow>\<^sub>h hba" and
           "hba \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'')) nodes'' \<rightarrow>\<^sub>h hbb" and
           remainder: "hbb \<turnstile> forall_M (\<lambda>(slot, assigned_nodes).
 Heap_Error_Monad.bind (get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot))
 (\<lambda>x. Heap_Error_Monad.bind (forall_M remove x)
 (\<lambda>_. forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot)) assigned_nodes))) ys \<rightarrow>\<^sub>h h2"
           using Cons(7)
           by (auto elim!: bind_returns_heap_E
               bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated] split: prod.splits)
 
         have "slot \<noteq> slot''"
           by (metis Cons.prems(5) Cons.prems(7) Cons.prems(8) \<open>y = (slot'', nodes'')\<close>
               list.set_intros(1) list.set_intros(2))
         then have "set nodes \<inter> set nodes'' = {}"
           by (metis Cons.prems(8) Cons.prems(9) \<open>y = (slot'', nodes'')\<close> list.set_intros(1)
               list.set_intros(2))
 
         have "hba \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes \<and> heap_is_wellformed hba \<and> type_wf hba \<and> known_ptrs hba"
           using \<open>hb \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes\<close>
           using \<open>hb \<turnstile> forall_M remove yc \<rightarrow>\<^sub>h hba\<close>
           using \<open>hb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'') \<rightarrow>\<^sub>r yc\<close>
           using \<open>heap_is_wellformed hb\<close> \<open>type_wf hb\<close> \<open>known_ptrs hb\<close>
         proof(induct yc arbitrary: hb, simp)
           case (Cons a yc)
           obtain hb1 where
             hb1: "hb \<turnstile> remove a \<rightarrow>\<^sub>h hb1" and
             hba: "hb1 \<turnstile> forall_M remove yc \<rightarrow>\<^sub>h hba"
             using Cons
             by (auto elim!: bind_returns_heap_E)
           have "hb \<turnstile> get_parent a \<rightarrow>\<^sub>r Some (cast slot'')"
             using Cons.prems(3) Cons.prems(4) Cons.prems(5) Cons.prems(6) local.child_parent_dual
             by auto
 
           moreover
           have "heap_is_wellformed hb1" and "type_wf hb1" and "known_ptrs hb1"
             using  \<open>hb \<turnstile> remove a \<rightarrow>\<^sub>h hb1\<close> Cons.prems(4) Cons.prems(5) Cons.prems(6)
               local.remove_child_heap_is_wellformed_preserved
             apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
                 bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
             using Cons.prems(4) Cons.prems(5) Cons.prems(6) hb1 local.remove_preserves_type_wf
             apply blast
             using Cons.prems(4) Cons.prems(5) Cons.prems(6) hb1 local.remove_preserves_known_ptrs
             by blast
           moreover have "hb1 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'') \<rightarrow>\<^sub>r yc"
             using \<open>hb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'') \<rightarrow>\<^sub>r a # yc\<close> hb1
             using remove_removes_child \<open>heap_is_wellformed hb\<close> \<open>type_wf hb\<close> \<open>known_ptrs hb\<close>
             by simp
           moreover have "hb1 \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes"
             using Cons(2) hb1 CD.set_child_nodes_get_child_nodes_different_pointers
               \<open>hb \<turnstile> get_parent a \<rightarrow>\<^sub>r Some (cast slot'')\<close> \<open>slot \<noteq> slot''\<close>
             apply(auto simp add: CD.remove_child_locs_def elim!: bind_returns_heap_E
                 dest!: reads_writes_separate_forwards[OF get_child_nodes_reads CD.remove_writes])[1]
             by (metis cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject)
           ultimately show ?thesis
             using \<open>hb1 \<turnstile> forall_M remove (yc) \<rightarrow>\<^sub>h hba\<close> Cons
             by auto
         qed
 
 
         then have "hbb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes \<and>
 heap_is_wellformed hbb \<and> type_wf hbb \<and> known_ptrs hbb"
           using \<open>hba \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'')) nodes'' \<rightarrow>\<^sub>h hbb\<close>
           using \<open>set nodes \<inter> set nodes'' = {}\<close>
         proof(induct nodes'' arbitrary: hba, simp)
           case (Cons a nodes'')
           then have "hba \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes" and
             "heap_is_wellformed hba" and
             "type_wf hba" and
             "known_ptrs hba"
             by auto
           obtain hba1 where
             hba1: "hba \<turnstile> append_child (cast slot'') a \<rightarrow>\<^sub>h hba1" and
             "hba1 \<turnstile> forall_M (append_child (cast slot'')) nodes'' \<rightarrow>\<^sub>h hbb"
             using Cons(3)
             by (auto elim!: bind_returns_heap_E)
 
           have "heap_is_wellformed hba1" and "type_wf hba1" and "known_ptrs hba1"
             using Cons.prems(1) hba1 local.append_child_heap_is_wellformed_preserved(1)
             apply blast
             using \<open>heap_is_wellformed hba\<close> \<open>known_ptrs hba\<close> \<open>type_wf hba\<close> hba1 local.append_child_preserves_type_wf
             apply blast
             using Cons.prems(1) hba1 local.append_child_preserves_known_ptrs
             by blast
 
           moreover
           have "a \<notin> set nodes"
             using \<open>set nodes \<inter> set (a # nodes'') = {}\<close>
             by auto
 
 
           moreover
           obtain parent_opt where "hba \<turnstile> get_parent a \<rightarrow>\<^sub>r parent_opt"
             using insert_before_child_in_heap hba1 get_parent_ok unfolding append_child_def
             by (meson Cons.prems(1) is_OK_returns_heap_I is_OK_returns_result_E)
           then
           have "hba1 \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes"
           proof (induct parent_opt)
             case None
             then show ?case
               using \<open>hba \<turnstile> append_child (cast slot'') a \<rightarrow>\<^sub>h hba1\<close>
               using \<open>hba \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes\<close>
               using \<open>slot \<noteq> slot''\<close>
               apply(auto simp add: append_child_def insert_before_locs_def adopt_node_locs_def
                   CD.adopt_node_locs_def remove_child_locs_def elim!: reads_writes_separate_forwards[OF get_child_nodes_reads
                     insert_before_writes])[1]
               by (metis cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject
                   CD.set_child_nodes_get_child_nodes_different_pointers)
           next
             case (Some parent)
             have "parent \<noteq> cast slot"
               apply(rule ccontr, simp)
               using Cons(2)
               apply -
               apply(rule get_parent_child_dual[OF \<open>hba \<turnstile> get_parent a \<rightarrow>\<^sub>r Some parent\<close>])
               apply(auto)[1]
               using \<open>a \<notin> set nodes\<close> returns_result_eq
               by fastforce
             show ?case
               apply(rule reads_writes_separate_forwards)
               apply(fact get_child_nodes_reads)
               apply(fact insert_before_writes)
               apply(fact \<open>hba \<turnstile> append_child (cast slot'') a \<rightarrow>\<^sub>h hba1\<close>[unfolded append_child_def])
               apply(fact \<open>hba \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes\<close>)
               using \<open>hba \<turnstile> get_parent a \<rightarrow>\<^sub>r Some parent\<close> \<open>parent \<noteq> cast slot\<close> \<open>slot \<noteq> slot''\<close>
               apply(auto simp add: insert_before_locs_def adopt_node_locs_def CD.adopt_node_locs_def
                   CD.remove_child_locs_def)[1]
               apply (simp_all add: CD.set_child_nodes_get_child_nodes_different_pointers
                   CD.set_disconnected_nodes_get_child_nodes)
               by (metis cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject
                   CD.set_child_nodes_get_child_nodes_different_pointers)
           qed
           moreover
           have "set nodes \<inter> set nodes'' = {}"
             using Cons.prems(3) by auto
           ultimately show ?case
             using Cons.hyps  \<open>hba1 \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot'')) nodes'' \<rightarrow>\<^sub>h hbb\<close>
             by blast
         qed
         show ?case
           apply(rule Cons(1))
           using \<open>hbb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes \<and>
 heap_is_wellformed hbb \<and> type_wf hbb \<and> known_ptrs hbb\<close>
           apply(auto)[1]
           using \<open>hbb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes \<and>
 heap_is_wellformed hbb \<and> type_wf hbb \<and> known_ptrs hbb\<close>
           apply(auto)[1]
           using \<open>hbb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes \<and>
 heap_is_wellformed hbb \<and> type_wf hbb \<and> known_ptrs hbb\<close>
           apply(auto)[1]
           using \<open>hbb \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes \<and>
 heap_is_wellformed hbb \<and> type_wf hbb \<and> known_ptrs hbb\<close>
           apply(auto)[1]
           using Cons.prems(5) apply auto[1]
           apply (simp add: remainder)
           using Cons.prems(7) apply auto[1]
           apply (simp add: True \<open>nodes' = nodes\<close> \<open>x = (slot', nodes')\<close>)
           by (metis Cons.prems(9) insert_iff list.simps(15))
       qed
     next
       case False
       then have "nodes' \<noteq> nodes"
         using Cons.prems(1) Cons.prems(9) \<open>x = (slot', nodes')\<close>
         by (metis assms(6) inf.idem list.set_intros(1) set_empty2)
       then
       have "(slot, nodes) \<in> set xs"
         using Cons.prems(1) \<open>x = (slot', nodes')\<close>
         by auto
       then show ?thesis
         using Cons(1)[simplified, OF \<open>(slot, nodes) \<in> set xs\<close> remainder
             \<open>heap_is_wellformed hb\<close> \<open>type_wf hb\<close> \<open>known_ptrs hb\<close>]
         using Cons.prems(6) tag_names_same  Cons.prems(8) Cons.prems(9)
-        by (smt Cons.prems(10) distinct.simps(2) list.set_intros(2))
+        by (smt (verit) Cons.prems(10) distinct.simps(2) list.set_intros(2))
     qed
   qed
   then
   show ?thesis
     using h' \<open>h2 \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close>
   proof(induct shadow_root_ptrs arbitrary: h2, simp)
     case (Cons shadow_root_ptr shadow_root_ptrs)
     then have "h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes" and
       "heap_is_wellformed h2" and
       "type_wf h2" and
       "known_ptrs h2"
       by auto
     obtain host h2a h2b h2c host_children shadow_root_children where
       "h2 \<turnstile> get_host shadow_root_ptr \<rightarrow>\<^sub>r host" and
       "h2 \<turnstile> get_child_nodes (cast host) \<rightarrow>\<^sub>r host_children" and
       h2a: "h2 \<turnstile> forall_M remove host_children \<rightarrow>\<^sub>h h2a" and
       "h2a \<turnstile> get_child_nodes (cast shadow_root_ptr) \<rightarrow>\<^sub>r shadow_root_children" and
       h2b: "h2a \<turnstile> forall_M (append_child (cast host)) shadow_root_children \<rightarrow>\<^sub>h h2b" and
       "h2b \<turnstile> remove_shadow_root host \<rightarrow>\<^sub>h h2c" and
       remainder: "h2c \<turnstile> forall_M(\<lambda>shadow_root_ptr. Heap_Error_Monad.bind (get_host shadow_root_ptr)
         (\<lambda>host. Heap_Error_Monad.bind (get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host))
                      (\<lambda>x. Heap_Error_Monad.bind (forall_M remove x)
                             (\<lambda>_. Heap_Error_Monad.bind (get_child_nodes (cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr))
                                    (\<lambda>x. Heap_Error_Monad.bind (forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host)) x)
                                           (\<lambda>_. remove_shadow_root host))))))
            shadow_root_ptrs
        \<rightarrow>\<^sub>h h'"
       using Cons(3)
       by(auto elim!: bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_host_pure, rotated]
           bind_returns_heap_E2[rotated, OF get_child_nodes_pure, rotated])
 
 
     have "h2 \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr"
       using \<open>h2 \<turnstile> get_host shadow_root_ptr \<rightarrow>\<^sub>r host\<close> shadow_root_host_dual
       using \<open>heap_is_wellformed h2\<close> \<open>type_wf h2\<close> by blast
     then have "h2a \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr"
       using \<open>h2 \<turnstile> forall_M remove host_children \<rightarrow>\<^sub>h h2a\<close>
       apply(induct host_children arbitrary: h2)
       by(auto simp add: set_disconnected_nodes_get_shadow_root set_child_nodes_get_shadow_root
           CD.remove_child_locs_def elim!: bind_returns_heap_E
           dest!: reads_writes_separate_forwards[OF get_shadow_root_reads CD.remove_writes])
     then have "h2b \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr"
       using \<open>h2a \<turnstile> forall_M (append_child (cast host)) shadow_root_children \<rightarrow>\<^sub>h h2b\<close>
       apply(induct shadow_root_children arbitrary: h2a)
       by(auto simp add: set_disconnected_nodes_get_shadow_root set_child_nodes_get_shadow_root
           append_child_def insert_before_locs_def adopt_node_locs_def CD.adopt_node_locs_def
           CD.remove_child_locs_def elim!: bind_returns_heap_E
           dest!: reads_writes_separate_forwards[OF get_shadow_root_reads insert_before_writes]
           split: if_splits)
 
     have "host \<noteq> slot"
     proof (rule ccontr, simp)
       assume "host = slot"
       show False
         using get_host_valid_tag_name[OF \<open>heap_is_wellformed h2\<close> \<open>type_wf h2\<close>
             \<open>h2 \<turnstile> get_host shadow_root_ptr \<rightarrow>\<^sub>r host\<close>[unfolded \<open>host = slot\<close>] \<open>h2 \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close>]
         by(simp)
     qed
 
     have "heap_is_wellformed h2a" and "type_wf h2a" and "known_ptrs h2a"
       using \<open>heap_is_wellformed h2\<close> and \<open>type_wf h2\<close> and \<open>known_ptrs h2\<close> \<open>h2 \<turnstile> forall_M remove host_children \<rightarrow>\<^sub>h h2a\<close>
       apply(induct host_children arbitrary: h2)
       apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
           bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
       apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
           bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
       apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
           bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
       apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
           bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
       using remove_child_heap_is_wellformed_preserved remove_child_preserves_type_wf
         remove_child_preserves_known_ptrs apply metis
       apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
           bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
       using remove_child_heap_is_wellformed_preserved remove_child_preserves_type_wf
         remove_child_preserves_known_ptrs apply metis
       apply(auto simp add: CD.remove_def elim!: bind_returns_heap_E
           bind_returns_heap_E2[rotated, OF get_parent_pure, rotated] split: option.splits)[1]
       using remove_child_heap_is_wellformed_preserved remove_child_preserves_type_wf
         remove_child_preserves_known_ptrs apply metis
       done
     then
     have "heap_is_wellformed h2b" and "type_wf h2b" and "known_ptrs h2b"
       using \<open>h2a \<turnstile> forall_M (append_child (cast host)) shadow_root_children \<rightarrow>\<^sub>h h2b\<close>
       apply(induct shadow_root_children arbitrary: h2a)
       apply(auto simp add: append_child_def elim!: bind_returns_heap_E)[1]
       apply(auto simp add: append_child_def elim!: bind_returns_heap_E)[1]
       apply(auto simp add: append_child_def elim!: bind_returns_heap_E)[1]
       apply(auto simp add: append_child_def elim!: bind_returns_heap_E)[1]
       using insert_before_heap_is_wellformed_preserved insert_before_preserves_type_wf insert_before_preserves_known_ptrs
       apply(metis)
       apply(auto simp add: append_child_def elim!: bind_returns_heap_E)[1]
       using insert_before_heap_is_wellformed_preserved insert_before_preserves_type_wf insert_before_preserves_known_ptrs
       apply(metis)
       apply(auto simp add: append_child_def elim!: bind_returns_heap_E)[1]
       using insert_before_heap_is_wellformed_preserved insert_before_preserves_type_wf insert_before_preserves_known_ptrs
       apply(metis)
       done
     then
     have "heap_is_wellformed h2c" and "type_wf h2c" and "known_ptrs h2c"
       using remove_shadow_root_preserves \<open>h2b \<turnstile> remove_shadow_root host \<rightarrow>\<^sub>h h2c\<close>
       by blast+
 
     moreover
     have "h2a \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes"
       using \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes\<close>
       using \<open>h2 \<turnstile> forall_M remove host_children \<rightarrow>\<^sub>h h2a\<close>
       using \<open>h2 \<turnstile> get_child_nodes (cast host) \<rightarrow>\<^sub>r host_children\<close>
       using \<open>heap_is_wellformed h2\<close> \<open>type_wf h2\<close> \<open>known_ptrs h2\<close>
     proof (induct host_children arbitrary: h2, simp)
       case (Cons a host_children)
       obtain h21 where "h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21" and
         "h21 \<turnstile> forall_M remove host_children \<rightarrow>\<^sub>h h2a"
         using Cons(3)
         by(auto elim!: bind_returns_heap_E)
 
       have "heap_is_wellformed h21" and "type_wf h21" and "known_ptrs h21"
         using Cons.prems(4) Cons.prems(5) Cons.prems(6) \<open>h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21\<close> local.remove_heap_is_wellformed_preserved
         apply blast
         using Cons.prems(4) Cons.prems(5) Cons.prems(6) \<open>h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21\<close> local.remove_preserves_type_wf
         apply blast
         using Cons.prems(4) Cons.prems(5) Cons.prems(6) \<open>h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21\<close> local.remove_preserves_known_ptrs
         by blast
       have "h2 \<turnstile> get_parent a \<rightarrow>\<^sub>r Some (cast host)"
         using \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) \<rightarrow>\<^sub>r a # host_children\<close>
         using \<open>heap_is_wellformed h2\<close> \<open>type_wf h2\<close> \<open>known_ptrs h2\<close> child_parent_dual
         using heap_is_wellformed_def by auto
       then have "h21 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes"
         using \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes\<close> \<open>host \<noteq> slot\<close>
         using \<open>h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21\<close>
         apply(auto simp add: CD.remove_child_locs_def CD.set_disconnected_nodes_get_child_nodes
             dest!: reads_writes_preserved[OF get_child_nodes_reads CD.remove_writes])[1]
         by (meson cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject
             CD.set_child_nodes_get_child_nodes_different_pointers)
       moreover have "h21 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) \<rightarrow>\<^sub>r host_children"
         using \<open>h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21\<close>  remove_removes_child[OF \<open>heap_is_wellformed h2\<close> \<open>type_wf h2\<close>
             \<open>known_ptrs h2\<close> \<open>h2 \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) \<rightarrow>\<^sub>r a # host_children\<close>]
         by blast
       ultimately show ?case
         using \<open>heap_is_wellformed h21\<close> and \<open>type_wf h21\<close> and \<open>known_ptrs h21\<close>
           \<open>h21 \<turnstile> forall_M remove host_children \<rightarrow>\<^sub>h h2a\<close> Cons(1)
         using Cons.prems(3) Cons.prems(4) Cons.prems(5) Cons.prems(6) heap_is_wellformed_def
           \<open>h2 \<turnstile> remove a \<rightarrow>\<^sub>h h21\<close> remove_removes_child
         by blast
     qed
 
     then
     have "h2b \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes"
       using \<open>h2a \<turnstile> forall_M (append_child (cast host)) shadow_root_children \<rightarrow>\<^sub>h h2b\<close>
       using \<open>h2a \<turnstile> get_child_nodes (cast shadow_root_ptr) \<rightarrow>\<^sub>r shadow_root_children\<close>
       using \<open>heap_is_wellformed h2a\<close> \<open>type_wf h2a\<close> \<open>known_ptrs h2a\<close>
     proof(induct shadow_root_children arbitrary: h2a, simp)
       case (Cons a shadow_root_children)
       obtain h2a1 where "h2a \<turnstile> append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) a \<rightarrow>\<^sub>h h2a1" and
         "h2a1 \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host)) (shadow_root_children) \<rightarrow>\<^sub>h h2b"
         using Cons(3)
         by(auto elim!: bind_returns_heap_E)
 
       have "heap_is_wellformed h2a1" and "type_wf h2a1" and "known_ptrs h2a1"
         using Cons.prems(4) Cons.prems(5) Cons.prems(6) \<open>h2a \<turnstile> append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) a \<rightarrow>\<^sub>h h2a1\<close>
           local.append_child_heap_is_wellformed_preserved by blast+
       moreover have "h2a1 \<turnstile> get_child_nodes (cast shadow_root_ptr) \<rightarrow>\<^sub>r shadow_root_children"
         using \<open>h2a \<turnstile> get_child_nodes (cast shadow_root_ptr) \<rightarrow>\<^sub>r a # shadow_root_children\<close>
         using insert_before_removes_child \<open>h2a \<turnstile> append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) a \<rightarrow>\<^sub>h h2a1\<close>[unfolded append_child_def]
         using \<open>heap_is_wellformed h2a\<close> \<open>type_wf h2a\<close> \<open>known_ptrs h2a\<close>
         using cast_document_ptr_not_node_ptr(2) by blast
       moreover have "h2a \<turnstile> get_parent a \<rightarrow>\<^sub>r Some (cast shadow_root_ptr)"
         using \<open>h2a \<turnstile> get_child_nodes (cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr) \<rightarrow>\<^sub>r a # shadow_root_children\<close>
         using \<open>heap_is_wellformed h2a\<close> \<open>type_wf h2a\<close> \<open>known_ptrs h2a\<close> child_parent_dual
         using heap_is_wellformed_def by auto
       then have "h2a1 \<turnstile> get_child_nodes (cast slot) \<rightarrow>\<^sub>r nodes"
         using \<open>h2a \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes\<close>
         using \<open>h2a \<turnstile> append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host) a \<rightarrow>\<^sub>h h2a1\<close> \<open>host \<noteq> slot\<close>
         apply(auto simp add:  set_disconnected_nodes_get_child_nodes append_child_def
             insert_before_locs_def adopt_node_locs_def CD.adopt_node_locs_def CD.remove_child_locs_def
             elim!: bind_returns_heap_E dest!: reads_writes_preserved[OF get_child_nodes_reads insert_before_writes])[1]
         using CD.set_child_nodes_get_child_nodes_different_pointers cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject
           cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject cast_document_ptr_not_node_ptr(2)
         by metis+
       ultimately
       show ?case
         using Cons(1) \<open>h2a1 \<turnstile> forall_M (append_child (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host)) shadow_root_children \<rightarrow>\<^sub>h h2b\<close>
         by blast
     qed
     then
     have "h2c \<turnstile> get_child_nodes (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r slot) \<rightarrow>\<^sub>r nodes"
       using \<open>h2b \<turnstile> remove_shadow_root host \<rightarrow>\<^sub>h h2c\<close>
       by(auto simp add: remove_shadow_root_get_child_nodes_different_pointers[OF
             cast_document_ptr_not_node_ptr(2)] dest!: reads_writes_separate_forwards[OF get_child_nodes_reads
             remove_shadow_root_writes])
 
     moreover
     have "h2a \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
       using h2a \<open>h2 \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''\<close>
       apply(induct host_children arbitrary: h2)
       by(auto simp add: CD.remove_child_locs_def set_disconnected_nodes_get_tag_name
           set_child_nodes_get_tag_name dest!: reads_writes_separate_forwards[OF get_tag_name_reads CD.remove_writes]
           elim!: bind_returns_heap_E)
     then
     have "h2b \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
       using h2b
       apply(induct shadow_root_children arbitrary: h2a)
       by(auto simp add: append_child_def insert_before_locs_def adopt_node_locs_def
           CD.adopt_node_locs_def CD.remove_child_locs_def set_disconnected_nodes_get_tag_name
           set_child_nodes_get_tag_name dest!: reads_writes_separate_forwards[OF get_tag_name_reads insert_before_writes]
           elim!: bind_returns_heap_E split: if_splits)
     then
     have "h2c \<turnstile> get_tag_name slot \<rightarrow>\<^sub>r ''slot''"
       using \<open>h2b \<turnstile> remove_shadow_root host \<rightarrow>\<^sub>h h2c\<close>
       by(auto simp add: remove_shadow_root_get_tag_name dest!:
           reads_writes_separate_forwards[OF get_tag_name_reads remove_shadow_root_writes])
 
     ultimately show ?case
       using Cons(1) remainder
       by auto
   qed
 qed
 end
 
 interpretation i_assigned_nodes_component?: l_assigned_nodes_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   type_wf get_tag_name get_tag_name_locs known_ptr get_child_nodes get_child_nodes_locs
   get_disconnected_nodes get_disconnected_nodes_locs get_shadow_root get_shadow_root_locs
   heap_is_wellformed parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_host get_host_locs get_disconnected_document
   get_disconnected_document_locs get_parent get_parent_locs get_mode get_mode_locs get_attribute
   get_attribute_locs first_in_tree_order find_slot assigned_slot known_ptrs to_tree_order assigned_nodes
   assigned_nodes_flatten flatten_dom get_root_node get_root_node_locs remove insert_before insert_before_locs
   append_child remove_shadow_root remove_shadow_root_locs set_shadow_root set_shadow_root_locs remove_child
   remove_child_locs get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_ancestors
   get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name get_owner_document
   set_disconnected_nodes set_disconnected_nodes_locs get_ancestors_di get_ancestors_di_locs
   adopt_node adopt_node_locs adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M adopt_node_locs\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M set_child_nodes set_child_nodes_locs
   by(auto simp add: l_assigned_nodes_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_assigned_nodes_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>get\_owner\_document\<close>
 
 locale l_get_owner_document_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_owner_document_wf\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma get_owner_document_is_component_unsafe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
   assumes "\<not>is_document_ptr_kind |h \<turnstile> get_root_node ptr|\<^sub>r"
   shows "set |h \<turnstile> get_dom_component ptr|\<^sub>r \<inter> set |h \<turnstile> get_dom_component (cast owner_document)|\<^sub>r = {}"
 proof -
   have "owner_document |\<in>| document_ptr_kinds h"
     using assms(1) assms(2) assms(3) assms(4) get_owner_document_owner_document_in_heap by blast
   have "ptr |\<in>| object_ptr_kinds h"
     by (meson assms(4) is_OK_returns_result_I local.get_owner_document_ptr_in_heap)
   obtain root where root: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root"
     by (meson assms(1) assms(2) assms(3) assms(4) is_OK_returns_result_I
         local.get_owner_document_ptr_in_heap local.get_root_node_ok returns_result_select_result)
   then obtain to where to: "h \<turnstile> to_tree_order root \<rightarrow>\<^sub>r to"
     by (meson assms(1) assms(2) assms(3) is_OK_returns_result_E local.get_root_node_root_in_heap
         local.to_tree_order_ok)
   then have "\<forall>p \<in> set to. \<not>is_document_ptr_kind p"
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(5) document_ptr_casts_commute3
         local.to_tree_order_node_ptrs node_ptr_no_document_ptr_cast root select_result_I2)
   then have "cast owner_document \<notin> set |h \<turnstile> get_dom_component ptr|\<^sub>r"
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(5) document_ptr_document_ptr_cast
         is_OK_returns_result_I l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ok local.get_dom_component_root_node_same
         local.get_root_node_not_node_same local.get_root_node_ptr_in_heap local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms
         node_ptr_no_document_ptr_cast returns_result_select_result root select_result_I2)
   then have "|h \<turnstile> get_dom_component ptr|\<^sub>r \<noteq> |h \<turnstile> get_dom_component (cast owner_document)|\<^sub>r"
     by (metis (no_types, lifting) \<open>owner_document |\<in>| document_ptr_kinds h\<close> assms(1) assms(2) assms(3)
         document_ptr_kinds_commutes l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ok local.get_dom_component_ptr
         local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms returns_result_select_result)
   then show ?thesis
     by (meson \<open>owner_document |\<in>| document_ptr_kinds h\<close> \<open>ptr |\<in>| object_ptr_kinds h\<close> assms(1) assms(2)
         assms(3) document_ptr_kinds_commutes l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_no_overlap
         l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M.get_dom_component_ok local.l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms returns_result_select_result)
 qed
 
 end
 
 interpretation i_get_owner_document_component?: l_get_owner_document_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   type_wf get_disconnected_nodes get_disconnected_nodes_locs known_ptr get_child_nodes get_child_nodes_locs
   DocumentClass.known_ptr get_parent get_parent_locs DocumentClass.type_wf get_root_node get_root_node_locs
   CD.a_get_owner_document get_host get_host_locs get_owner_document get_shadow_root get_shadow_root_locs
   get_tag_name get_tag_name_locs heap_is_wellformed parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_disconnected_document get_disconnected_document_locs known_ptrs get_ancestors get_ancestors_locs to_tree_order
   get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_element_by_id
   get_elements_by_class_name get_elements_by_tag_name
   by(auto simp add: l_get_owner_document_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_owner_document_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 definition is_shadow_root_component :: "(_) object_ptr list \<Rightarrow> bool"
   where
     "is_shadow_root_component c = is_shadow_root_ptr_kind (hd c)"
 
 end
diff --git a/thys/SC_DOM_Components/Shadow_DOM_SC_DOM_Components.thy b/thys/SC_DOM_Components/Shadow_DOM_SC_DOM_Components.thy
--- a/thys/SC_DOM_Components/Shadow_DOM_SC_DOM_Components.thy
+++ b/thys/SC_DOM_Components/Shadow_DOM_SC_DOM_Components.thy
@@ -1,1005 +1,1005 @@
 (***********************************************************************************
  * Copyright (c) 2016-2020 The University of Sheffield, UK
  *               2019-2020 University of Exeter, UK
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * * Redistributions of source code must retain the above copyright notice, this
  *   list of conditions and the following disclaimer.
  *
  * * Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * SPDX-License-Identifier: BSD-2-Clause
  ***********************************************************************************)
 
 section \<open>Shadow SC DOM Components II\<close>
 theory Shadow_DOM_SC_DOM_Components
   imports
     Core_DOM_SC_DOM_Components
     Shadow_DOM_DOM_Components
 begin
 
 section \<open>Shadow root scope components\<close>
 
 
 subsection \<open>get\_scope\_component\<close>
 
 global_interpretation l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs get_owner_document get_disconnected_nodes
   get_disconnected_nodes_locs to_tree_order
   defines get_scdom_component = a_get_scdom_component
     and is_strongly_scdom_component_safe = a_is_strongly_scdom_component_safe
     and is_weakly_scdom_component_safe = a_is_weakly_scdom_component_safe
   .
 interpretation i_get_scdom_component?: l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
   get_owner_document get_disconnected_nodes get_disconnected_nodes_locs to_tree_order
   by(auto simp add: l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def get_scdom_component_def
       is_strongly_scdom_component_safe_def is_weakly_scdom_component_safe_def instances)
 declare l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsubsection \<open>get\_component\<close>
 
 locale l_get_dom_component_get_scdom_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_heap_is_wellformed +
   l_get_owner_document +
   l_get_owner_document_wf +
   l_get_disconnected_nodes +
   l_to_tree_order +
   l_known_ptr +
   l_known_ptrs +
   l_get_owner_document_wf_get_root_node_wf +
   assumes known_ptr_impl: "known_ptr = ShadowRootClass.known_ptr"
 begin
 
 lemma known_ptr_node_or_document: "known_ptr ptr \<Longrightarrow> is_node_ptr_kind ptr \<or> is_document_ptr_kind ptr"
   by(auto simp add: known_ptr_impl known_ptr_defs DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs
       ElementClass.known_ptr_defs NodeClass.known_ptr_defs split: option.splits)
 
 lemma get_scdom_component_subset_get_dom_component:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
   shows "set c \<subseteq> set sc"
 proof -
   obtain document disc_nodes tree_order disconnected_tree_orders where document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r document"
     and disc_nodes: "h \<turnstile> get_disconnected_nodes document \<rightarrow>\<^sub>r disc_nodes"
     and tree_order: "h \<turnstile> to_tree_order (cast document) \<rightarrow>\<^sub>r tree_order"
     and disconnected_tree_orders: "h \<turnstile> map_M (to_tree_order \<circ> cast) disc_nodes \<rightarrow>\<^sub>r disconnected_tree_orders"
     and sc: "sc = tree_order @ (concat disconnected_tree_orders)"
     using assms(4)
     by(auto simp add: get_scdom_component_def elim!: bind_returns_result_E
         elim!: bind_returns_result_E2[rotated, OF get_owner_document_pure, rotated]
         elim!: bind_returns_result_E2[rotated, OF get_disconnected_nodes_pure, rotated]
         elim!: bind_returns_result_E2[rotated, OF to_tree_order_pure, rotated]
         )
 
   obtain root_ptr where root_ptr: "h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr"
     and c: "h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c"
     using assms(5)
     by(auto simp add: get_dom_component_def elim!: bind_returns_result_E2[rotated, OF get_root_node_pure, rotated])
 
   show ?thesis
   proof (cases "is_document_ptr_kind root_ptr")
     case True
     then have "cast document = root_ptr"
       using get_root_node_document assms(1) assms(2) assms(3) root_ptr document
       by (metis document_ptr_casts_commute3 returns_result_eq)
     then have "c = tree_order"
       using tree_order c
       by auto
     then show ?thesis
       by(simp add: sc)
   next
     case False
     moreover have "root_ptr |\<in>| object_ptr_kinds h"
       using assms(1) assms(2) assms(3) local.get_root_node_root_in_heap root_ptr by blast
     ultimately have "is_node_ptr_kind root_ptr"
       using assms(3) known_ptrs_known_ptr known_ptr_node_or_document
       by auto
     then obtain root_node_ptr where root_node_ptr: "root_ptr = cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_node_ptr"
       by (metis node_ptr_casts_commute3)
     then have "h \<turnstile> get_owner_document root_ptr \<rightarrow>\<^sub>r document"
       using get_root_node_same_owner_document
       using assms(1) assms(2) assms(3) document root_ptr by blast
     then have "root_node_ptr \<in> set disc_nodes"
       using assms(1) assms(2) assms(3) disc_nodes in_disconnected_nodes_no_parent root_node_ptr
       using local.get_root_node_same_no_parent root_ptr by blast
     then have "c \<in> set disconnected_tree_orders"
       using c root_node_ptr
       using map_M_pure_E[OF disconnected_tree_orders]
       by (metis (mono_tags, lifting) comp_apply local.to_tree_order_pure select_result_I2)
     then show ?thesis
       by(auto simp add: sc)
   qed
 qed
 
 lemma get_scdom_component_ptrs_same_owner_document:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "ptr' \<in> set sc"
   assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
   shows "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document"
 proof -
   obtain document disc_nodes tree_order disconnected_tree_orders where document: "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r document"
     and disc_nodes: "h \<turnstile> get_disconnected_nodes document \<rightarrow>\<^sub>r disc_nodes"
     and tree_order: "h \<turnstile> to_tree_order (cast document) \<rightarrow>\<^sub>r tree_order"
     and disconnected_tree_orders: "h \<turnstile> map_M (to_tree_order \<circ> cast) disc_nodes \<rightarrow>\<^sub>r disconnected_tree_orders"
     and sc: "sc = tree_order @ (concat disconnected_tree_orders)"
     using assms(4)
     by(auto simp add: get_scdom_component_def elim!: bind_returns_result_E
         elim!: bind_returns_result_E2[rotated, OF get_owner_document_pure, rotated]
         elim!: bind_returns_result_E2[rotated, OF get_disconnected_nodes_pure, rotated]
         elim!: bind_returns_result_E2[rotated, OF to_tree_order_pure, rotated]
         )
   show ?thesis
   proof (cases "ptr' \<in> set tree_order")
     case True
     have "owner_document = document"
       using assms(6) document by fastforce
     then show ?thesis
       by (metis (no_types) True assms(1) assms(2) assms(3) cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject document
           document_ptr_casts_commute3 document_ptr_document_ptr_cast document_ptr_kinds_commutes
           local.get_owner_document_owner_document_in_heap local.get_root_node_document
           local.get_root_node_not_node_same local.to_tree_order_same_root node_ptr_no_document_ptr_cast
           tree_order)
   next
     case False
     then obtain disconnected_tree_order where disconnected_tree_order:
       "ptr' \<in> set disconnected_tree_order" and "disconnected_tree_order \<in> set disconnected_tree_orders"
       using sc \<open>ptr' \<in> set sc\<close>
       by auto
     obtain root_ptr' where
       root_ptr': "root_ptr' \<in> set disc_nodes" and
       "h \<turnstile> to_tree_order (cast root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order"
       using map_M_pure_E2[OF disconnected_tree_orders \<open>disconnected_tree_order \<in> set disconnected_tree_orders\<close>]
       by (metis comp_apply local.to_tree_order_pure)
     have "\<not>(\<exists>parent \<in> fset (object_ptr_kinds h). root_ptr' \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)"
       using disc_nodes
       by (meson assms(1) assms(2) assms(3) disjoint_iff_not_equal local.get_child_nodes_ok
           local.heap_is_wellformed_children_disc_nodes_different local.known_ptrs_known_ptr notin_fset
           returns_result_select_result root_ptr')
     then
     have "h \<turnstile> get_parent root_ptr' \<rightarrow>\<^sub>r None"
       using disc_nodes
       by (metis (no_types, lifting) assms(1) assms(2) assms(3) fmember.rep_eq local.get_parent_child_dual
           local.get_parent_ok local.get_parent_parent_in_heap local.heap_is_wellformed_disc_nodes_in_heap
           returns_result_select_result root_ptr' select_result_I2 split_option_ex)
     then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast root_ptr'"
       using \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order\<close> assms(1)
         assms(2) assms(3) disconnected_tree_order local.get_root_node_no_parent local.to_tree_order_get_root_node
         local.to_tree_order_ptr_in_result
       by blast
     then have "h \<turnstile> get_owner_document (cast root_ptr') \<rightarrow>\<^sub>r document"
       using assms(1) assms(2) assms(3) disc_nodes local.get_owner_document_disconnected_nodes root_ptr'
       by blast
 
     then have "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r document"
       using \<open>h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr'\<close> assms(1) assms(2) assms(3)
         local.get_root_node_same_owner_document
       by blast
     then show ?thesis
       using assms(6) document returns_result_eq by force
   qed
 qed
 
 lemma get_scdom_component_ptrs_same_scope_component:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "ptr' \<in> set sc"
   shows "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
 proof -
   obtain document disc_nodes tree_order disconnected_tree_orders where document:
     "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r document"
     and disc_nodes: "h \<turnstile> get_disconnected_nodes document \<rightarrow>\<^sub>r disc_nodes"
     and tree_order: "h \<turnstile> to_tree_order (cast document) \<rightarrow>\<^sub>r tree_order"
     and disconnected_tree_orders: "h \<turnstile> map_M (to_tree_order \<circ> cast) disc_nodes \<rightarrow>\<^sub>r disconnected_tree_orders"
     and sc: "sc = tree_order @ (concat disconnected_tree_orders)"
     using assms(4)
     by(auto simp add: get_scdom_component_def elim!: bind_returns_result_E
         elim!: bind_returns_result_E2[rotated, OF get_owner_document_pure, rotated]
         elim!: bind_returns_result_E2[rotated, OF get_disconnected_nodes_pure, rotated]
         elim!: bind_returns_result_E2[rotated, OF to_tree_order_pure, rotated]
         )
   show ?thesis
   proof (cases "ptr' \<in> set tree_order")
     case True
     then have "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r document"
       by (metis assms(1) assms(2) assms(3) cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_inject document document_ptr_casts_commute3
           document_ptr_kinds_commutes known_ptr_node_or_document local.get_owner_document_owner_document_in_heap
           local.get_root_node_document local.get_root_node_not_node_same local.known_ptrs_known_ptr
           local.to_tree_order_get_root_node local.to_tree_order_ptr_in_result node_ptr_no_document_ptr_cast tree_order)
     then show ?thesis
       using disc_nodes tree_order disconnected_tree_orders sc
       by(auto simp add: get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
   next
     case False
     then obtain disconnected_tree_order where disconnected_tree_order:
       "ptr' \<in> set disconnected_tree_order" and "disconnected_tree_order \<in> set disconnected_tree_orders"
       using sc \<open>ptr' \<in> set sc\<close>
       by auto
     obtain root_ptr' where
       root_ptr': "root_ptr' \<in> set disc_nodes" and
       "h \<turnstile> to_tree_order (cast root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order"
       using map_M_pure_E2[OF disconnected_tree_orders \<open>disconnected_tree_order \<in> set disconnected_tree_orders\<close>]
       by (metis comp_apply local.to_tree_order_pure)
     have "\<not>(\<exists>parent \<in> fset (object_ptr_kinds h). root_ptr' \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)"
       using disc_nodes
       by (meson assms(1) assms(2) assms(3) disjoint_iff_not_equal local.get_child_nodes_ok
           local.heap_is_wellformed_children_disc_nodes_different local.known_ptrs_known_ptr notin_fset
           returns_result_select_result root_ptr')
     then
     have "h \<turnstile> get_parent root_ptr' \<rightarrow>\<^sub>r None"
       using disc_nodes
       by (metis (no_types, lifting) assms(1) assms(2) assms(3) fmember.rep_eq local.get_parent_child_dual
           local.get_parent_ok local.get_parent_parent_in_heap local.heap_is_wellformed_disc_nodes_in_heap
           returns_result_select_result root_ptr' select_result_I2 split_option_ex)
     then have "h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast root_ptr'"
       using \<open>h \<turnstile> to_tree_order (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr') \<rightarrow>\<^sub>r disconnected_tree_order\<close> assms(1)
         assms(2) assms(3) disconnected_tree_order local.get_root_node_no_parent local.to_tree_order_get_root_node
         local.to_tree_order_ptr_in_result
       by blast
     then have "h \<turnstile> get_owner_document (cast root_ptr') \<rightarrow>\<^sub>r document"
       using assms(1) assms(2) assms(3) disc_nodes local.get_owner_document_disconnected_nodes root_ptr'
       by blast
 
     then have "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r document"
       using \<open>h \<turnstile> get_root_node ptr' \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r root_ptr'\<close> assms(1) assms(2) assms(3)
         local.get_root_node_same_owner_document
       by blast
     then show ?thesis
       using disc_nodes tree_order disconnected_tree_orders sc
       by(auto simp add: get_scdom_component_def intro!: bind_pure_returns_result_I map_M_pure_I)
   qed
 qed
 
 lemma get_scdom_component_ok:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "ptr |\<in>| object_ptr_kinds h"
   shows "h \<turnstile> ok (get_scdom_component ptr)"
   using assms
   apply(auto simp add: get_scdom_component_def intro!: bind_is_OK_pure_I map_M_pure_I map_M_ok_I)[1]
   using get_owner_document_ok
      apply blast
     apply (simp add: local.get_disconnected_nodes_ok local.get_owner_document_owner_document_in_heap)
    apply (simp add: local.get_owner_document_owner_document_in_heap local.to_tree_order_ok)
   using local.heap_is_wellformed_disc_nodes_in_heap local.to_tree_order_ok node_ptr_kinds_commutes
   by blast
 
 
 lemma get_scdom_component_ptr_in_heap:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "ptr' \<in> set sc"
   shows "ptr' |\<in>| object_ptr_kinds h"
   using assms
   apply(auto simp add: get_scdom_component_def elim!: bind_returns_result_E2 intro!: map_M_pure_I)[1]
   using local.to_tree_order_ptrs_in_heap apply blast
   by (metis (no_types, lifting) assms(4) assms(5) bind_returns_result_E get_scdom_component_impl
       get_scdom_component_ptrs_same_scope_component is_OK_returns_result_I
       l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_defs.a_get_scdom_component_def local.get_owner_document_ptr_in_heap)
 
 lemma get_scdom_component_contains_get_dom_component:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "ptr' \<in> set sc"
   obtains c where "h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c" and "set c \<subseteq> set sc"
 proof -
   have "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
     using assms(1) assms(2) assms(3) assms(4) assms(5) get_scdom_component_ptrs_same_scope_component
     by blast
   then show ?thesis
     by (meson assms(1) assms(2) assms(3) assms(5) get_scdom_component_ptr_in_heap
         get_scdom_component_subset_get_dom_component is_OK_returns_result_E local.get_dom_component_ok that)
 qed
 
 lemma get_scdom_component_owner_document_same:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "ptr' \<in> set sc"
   obtains owner_document where "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document" and "cast owner_document \<in> set sc"
   using assms
   apply(auto simp add: get_scdom_component_def elim!: bind_returns_result_E2 intro!: map_M_pure_I)[1]
    apply (metis (no_types, lifting) assms(4) assms(5) document_ptr_casts_commute3
       document_ptr_document_ptr_cast get_scdom_component_contains_get_dom_component local.get_dom_component_ptr
       local.get_dom_component_root_node_same local.get_dom_component_to_tree_order local.get_root_node_document
       local.get_root_node_not_node_same local.to_tree_order_ptr_in_result local.to_tree_order_ptrs_in_heap
       node_ptr_no_document_ptr_cast)
   apply(rule map_M_pure_E2)
      apply(simp)
     apply(simp)
    apply(simp)
-  by (smt assms(4) assms(5) comp_apply get_scdom_component_ptr_in_heap is_OK_returns_result_E
+  by (smt (verit) assms(4) assms(5) comp_apply get_scdom_component_ptr_in_heap is_OK_returns_result_E
       local.get_owner_document_disconnected_nodes local.get_root_node_ok local.get_root_node_same_owner_document
       local.to_tree_order_get_root_node local.to_tree_order_ptr_in_result)
 
 lemma get_scdom_component_different_owner_documents:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r owner_document"
   assumes "h \<turnstile> get_owner_document ptr' \<rightarrow>\<^sub>r owner_document'"
   assumes "owner_document \<noteq> owner_document'"
   shows "set |h \<turnstile> get_scdom_component ptr|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = {}"
   using assms get_scdom_component_ptrs_same_owner_document
-  by (smt disjoint_iff_not_equal get_scdom_component_ok is_OK_returns_result_I
+  by (smt (verit) disjoint_iff_not_equal get_scdom_component_ok is_OK_returns_result_I
       local.get_owner_document_ptr_in_heap returns_result_eq returns_result_select_result)
 end
 
 interpretation i_get_dom_component_get_scdom_component?: l_get_dom_component_get_scdom_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_owner_document
   get_disconnected_nodes get_disconnected_nodes_locs to_tree_order heap_is_wellformed parent_child_rel
   type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs
   get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node
   get_root_node_locs get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name
   get_elements_by_tag_name
   by(auto simp add: l_get_dom_component_get_scdom_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_dom_component_get_scdom_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def instances)
 declare l_get_dom_component_get_scdom_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 lemma get_dom_component_get_scdom_component_is_l_get_dom_component_get_scdom_component [instances]:
   "l_get_dom_component_get_scdom_component get_owner_document heap_is_wellformed type_wf known_ptr known_ptrs get_scdom_component get_dom_component"
   apply(auto simp add: l_get_dom_component_get_scdom_component_def
       l_get_dom_component_get_scdom_component_axioms_def instances)[1]
   using get_scdom_component_subset_get_dom_component apply fast
   using get_scdom_component_ptrs_same_scope_component apply fast
   using get_scdom_component_ptrs_same_owner_document apply fast
   using get_scdom_component_ok apply fast
   using get_scdom_component_ptr_in_heap apply fast
   using get_scdom_component_contains_get_dom_component apply blast
   using get_scdom_component_owner_document_same apply blast
   using get_scdom_component_different_owner_documents apply fast
   done
 
 
 subsection \<open>attach\_shadow\_root\<close>
 
 lemma attach_shadow_root_not_strongly_component_safe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'ShadowRoot::{equal,linorder}) heap" and
     h' and host and new_shadow_root_ptr where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> attach_shadow_root host m \<rightarrow>\<^sub>r new_shadow_root_ptr \<rightarrow>\<^sub>h h'" and
     "\<not> is_strongly_scdom_component_safe {cast host} {cast new_shadow_root_ptr} h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
 'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
 'ShadowRoot::{equal,linorder}) heap"
   let ?P = "do {
     doc \<leftarrow> create_document;
     create_element doc ''div''
 }"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?e1 = "|?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and host="?e1"])
     by code_simp+
 qed
 
 locale l_get_scdom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_scdom_component +
   l_get_dom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component_get_scdom_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma attach_shadow_root_is_weakly_component_safe_step:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>h h'"
   assumes "ptr \<noteq> cast |h \<turnstile> attach_shadow_root element_ptr shadow_root_mode|\<^sub>r"
   assumes "ptr \<notin> set |h \<turnstile> get_scdom_component (cast element_ptr)|\<^sub>r"
   shows "preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t ptr getter) h h'"
 proof -
   have "element_ptr |\<in>| element_ptr_kinds h"
     by (meson assms(4) is_OK_returns_heap_I local.attach_shadow_root_element_ptr_in_heap)
   obtain sc where sc: "h \<turnstile> get_scdom_component (cast element_ptr) \<rightarrow>\<^sub>r sc"
     using get_scdom_component_ok
     by (meson assms(1) assms(2) assms(3) assms(4) element_ptr_kinds_commutes is_OK_returns_heap_I
         local.attach_shadow_root_element_ptr_in_heap node_ptr_kinds_commutes select_result_I)
   then have "ptr \<notin> set |h \<turnstile> get_dom_component (cast element_ptr)|\<^sub>r"
     by (metis (no_types, lifting) \<open>element_ptr |\<in>| element_ptr_kinds h\<close> assms(1) assms(2) assms(3)
         assms(6) element_ptr_kinds_commutes local.get_dom_component_ok
         local.get_scdom_component_subset_get_dom_component node_ptr_kinds_commutes
         returns_result_select_result select_result_I2 set_rev_mp)
   then show ?thesis
     using assms(1) assms(2) assms(3) assms(4) assms(5) local.attach_shadow_root_is_weakly_dom_component_safe
     by blast
 qed
 
 lemma attach_shadow_root_is_weakly_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r result"
   assumes "h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>h h'"
   shows "is_weakly_scdom_component_safe {cast element_ptr} {cast result} h h'"
 proof -
 
   obtain h2 h3 new_shadow_root_ptr where
     h2: "h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>h h2" and
     new_shadow_root_ptr: "h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>r new_shadow_root_ptr" and
     h3: "h2 \<turnstile> set_mode new_shadow_root_ptr shadow_root_mode \<rightarrow>\<^sub>h h3" and
     h': "h3 \<turnstile> set_shadow_root element_ptr (Some new_shadow_root_ptr) \<rightarrow>\<^sub>h h'"
     using assms(5)
     by(auto simp add: attach_shadow_root_def elim!:  bind_returns_heap_E
         bind_returns_heap_E2[rotated, OF get_tag_name_pure, rotated]
         bind_returns_heap_E2[rotated, OF get_shadow_root_pure, rotated] split: if_splits)
   have "h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r new_shadow_root_ptr"
     using new_shadow_root_ptr h2 h3 h'
     using assms(5)
     by(auto simp add: attach_shadow_root_def intro!: bind_returns_result_I
         bind_pure_returns_result_I[OF get_tag_name_pure] bind_pure_returns_result_I[OF get_shadow_root_pure]
         elim!:  bind_returns_heap_E bind_returns_heap_E2[rotated, OF get_tag_name_pure, rotated]
         bind_returns_heap_E2[rotated, OF get_shadow_root_pure, rotated] split: if_splits)
   then
   have "object_ptr_kinds h2 = {|cast result|} |\<union>| object_ptr_kinds h"
     using h2 new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M_new_ptr
     using new_shadow_root_ptr
     using assms(4) by auto
   moreover
   have object_ptr_kinds_eq_h2: "object_ptr_kinds h2 = object_ptr_kinds h3"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
           OF set_mode_writes h3])
     using set_mode_pointers_preserved
       apply blast
     by (auto simp add: reflp_def transp_def)
   moreover
   have object_ptr_kinds_eq_h3: "object_ptr_kinds h3 = object_ptr_kinds h'"
     apply(rule writes_small_big[where P="\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h'",
           OF set_shadow_root_writes h'])
     using set_shadow_root_pointers_preserved
       apply blast
     by (auto simp add: reflp_def transp_def)
   ultimately have "object_ptr_kinds h' = {|cast result|} |\<union>| object_ptr_kinds h"
     by simp
   moreover
   have "result |\<notin>| shadow_root_ptr_kinds h"
     using h2 new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M_ptr_not_in_heap new_shadow_root_ptr
     using \<open>h \<turnstile> attach_shadow_root element_ptr shadow_root_mode \<rightarrow>\<^sub>r new_shadow_root_ptr\<close> assms(4)
       returns_result_eq by metis
   ultimately
   show ?thesis
     using assms
     apply(auto simp add: is_weakly_scdom_component_safe_def Let_def)[1]
     using attach_shadow_root_is_weakly_component_safe_step
-    by (smt document_ptr_kinds_commutes local.get_scdom_component_impl select_result_I2
+    by (smt (verit) document_ptr_kinds_commutes local.get_scdom_component_impl select_result_I2
         shadow_root_ptr_kinds_commutes)
 qed
 end
 
 interpretation i_get_scdom_component_attach_shadow_root?: l_get_scdom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
   get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe to_tree_order
   get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_root_node get_root_node_locs
   get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
   set_shadow_root set_shadow_root_locs set_mode set_mode_locs attach_shadow_root get_disconnected_nodes
   get_disconnected_nodes_locs get_tag_name get_tag_name_locs get_shadow_root get_shadow_root_locs
   by(auto simp add: l_get_scdom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_scdom_component_attach_shadow_root\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsection \<open>get\_shadow\_root\<close>
 
 lemma get_shadow_root_not_weakly_scdom_component_safe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder}, 'CharacterData::{equal,linorder},
 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
     element_ptr and shadow_root_ptr_opt and h' where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> get_shadow_root_safe element_ptr \<rightarrow>\<^sub>r shadow_root_ptr_opt \<rightarrow>\<^sub>h h'" and
     "\<not> is_weakly_scdom_component_safe {cast element_ptr} (cast ` set_option shadow_root_ptr_opt) h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder}, 'CharacterData::{equal,linorder},
 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap"
   let ?P = "do {
         document_ptr \<leftarrow> create_document;
         html \<leftarrow> create_element document_ptr ''html'';
         append_child (cast document_ptr) (cast html);
         head \<leftarrow> create_element document_ptr ''head'';
         append_child (cast html) (cast head);
         body \<leftarrow> create_element document_ptr ''body'';
         append_child (cast html) (cast body);
         e1 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast body) (cast e1);
         e2 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast e1) (cast e2);
         s1 \<leftarrow> attach_shadow_root e1 Open;
         e3 \<leftarrow> create_element document_ptr ''slot'';
         append_child (cast s1) (cast e3);
         return e1
       }"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?e1 = "|?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and element_ptr="?e1"])
     by code_simp+
 qed
 
 locale l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_scdom_component +
   l_get_shadow_root_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_create_document +
   l_get_owner_document_wf\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_heap_is_wellformed\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_mode +
   l_get_scdom_component\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_shadow_root_safe\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   assumes known_ptrs_impl: "known_ptrs = a_known_ptrs"
 begin
 lemma get_shadow_root_components_disjunct:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr"
   shows "set |h \<turnstile> get_scdom_component (cast host)|\<^sub>r \<inter> set |  h \<turnstile> get_scdom_component (cast shadow_root_ptr)|\<^sub>r = {}"
 proof -
   obtain owner_document where owner_document: "h \<turnstile> get_owner_document (cast host) \<rightarrow>\<^sub>r owner_document"
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) assms(5) element_ptr_kinds_commutes
         is_OK_returns_result_E is_OK_returns_result_I local.get_dom_component_ok local.get_dom_component_ptr
         local.get_scdom_component_ok local.get_scdom_component_owner_document_same
         local.get_scdom_component_subset_get_dom_component local.get_shadow_root_ptr_in_heap node_ptr_kinds_commutes
         subset_code(1))
   have "owner_document \<noteq> cast shadow_root_ptr"
   proof
     assume "owner_document = cast shadow_root_ptr"
     then have "(cast owner_document, cast host) \<in>
 (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> a_ptr_disconnected_node_rel h)\<^sup>*"
       using get_owner_document_rel owner_document
       by (metis (no_types, lifting) assms(1) assms(2) assms(3) cast_document_ptr_not_node_ptr(2)
           in_rtrancl_UnI inf_sup_aci(6) inf_sup_aci(7))
     then have "(cast shadow_root_ptr, cast host) \<in>
 (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> a_ptr_disconnected_node_rel h)\<^sup>*"
       by (simp add: \<open>owner_document = cast shadow_root_ptr\<close>)
     moreover have "(cast host, cast shadow_root_ptr) \<in> a_host_shadow_root_rel h"
       by (metis (mono_tags, lifting) assms(5) is_OK_returns_result_I local.get_shadow_root_ptr_in_heap
           local.a_host_shadow_root_rel_def mem_Collect_eq pair_imageI prod.simps(2) select_result_I2)
     then have "(cast host, cast shadow_root_ptr) \<in>
 (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> a_ptr_disconnected_node_rel h)"
       by (simp)
     ultimately show False
       using assms(1)
       unfolding heap_is_wellformed_def \<open>owner_document = cast shadow_root_ptr\<close> acyclic_def
       by (meson rtrancl_into_trancl1)
   qed
   moreover
   have "shadow_root_ptr |\<in>| shadow_root_ptr_kinds h"
     using assms(1) assms(5) local.get_shadow_root_shadow_root_ptr_in_heap by blast
   then
   have "cast shadow_root_ptr \<in> fset (object_ptr_kinds h)"
     by auto
   have "is_shadow_root_ptr shadow_root_ptr"
     using assms(3)[unfolded known_ptrs_impl ShadowRootClass.known_ptrs_defs
         ShadowRootClass.known_ptr_defs DocumentClass.known_ptr_defs CharacterDataClass.known_ptr_defs
         ElementClass.known_ptr_defs NodeClass.known_ptr_defs, simplified, rule_format, OF
         \<open>cast shadow_root_ptr \<in> fset (object_ptr_kinds h)\<close>]
     by(auto simp add: is_document_ptr\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
         split: option.splits document_ptr.splits)
   then
   have "h \<turnstile> get_owner_document (cast shadow_root_ptr) \<rightarrow>\<^sub>r cast shadow_root_ptr"
     using \<open>shadow_root_ptr |\<in>| shadow_root_ptr_kinds h\<close>
     apply(auto simp add: get_owner_document_def a_get_owner_document_tups_def
         CD.a_get_owner_document_tups_def)[1]
     apply(split invoke_splits, (rule conjI | rule impI)+)+
     by(auto simp add: is_node_ptr_kind_none a_get_owner_document\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def
         CD.a_get_owner_document\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r_def)
   ultimately show ?thesis
     using assms(1) assms(2) assms(3) get_scdom_component_different_owner_documents owner_document
     by blast
 qed
 
 lemma get_shadow_root_is_strongly_scdom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_shadow_root_safe element_ptr \<rightarrow>\<^sub>r shadow_root_ptr_opt \<rightarrow>\<^sub>h h'"
   assumes "\<forall>shadow_root_ptr \<in> fset (shadow_root_ptr_kinds h). h \<turnstile> get_mode shadow_root_ptr \<rightarrow>\<^sub>r Closed"
   shows "is_strongly_scdom_component_safe {cast element_ptr} (cast ` set_option shadow_root_ptr_opt) h h'"
 proof -
   have "h = h'"
     using assms(4)
     by(auto simp add: returns_result_heap_def pure_returns_heap_eq)
   moreover have "shadow_root_ptr_opt = None"
     using assms(4)
     apply(auto simp add: returns_result_heap_def get_shadow_root_safe_def elim!: bind_returns_result_E2
         split: option.splits if_splits)[1]
     using get_shadow_root_shadow_root_ptr_in_heap
     by (meson assms(5) is_OK_returns_result_I local.get_mode_ptr_in_heap notin_fset returns_result_eq
         shadow_root_mode.distinct(1))
   ultimately show ?thesis
     by(simp add: is_strongly_scdom_component_safe_def preserved_def)
 qed
 end
 
 interpretation i_get_shadow_root_scope_component?: l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr known_ptrs
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe get_dom_component
   is_strongly_dom_component_safe is_weakly_dom_component_safe get_shadow_root get_shadow_root_locs
   get_child_nodes get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs get_tag_name
   get_tag_name_locs heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_host get_host_locs get_disconnected_document
   get_disconnected_document_locs to_tree_order get_parent get_parent_locs get_root_node get_root_node_locs
   get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
   remove_shadow_root remove_shadow_root_locs create_document DocumentClass.known_ptr DocumentClass.type_wf
   CD.a_get_owner_document  get_mode get_mode_locs get_shadow_root_safe get_shadow_root_safe_locs
   by(auto simp add: l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms_def instances)
 declare l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsection \<open>get\_host\<close>
 
 lemma get_host_not_weakly_scdom_component_safe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
     shadow_root_ptr and element_ptr and h' where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> get_host shadow_root_ptr \<rightarrow>\<^sub>r element_ptr \<rightarrow>\<^sub>h h'" and
     "\<not> is_weakly_scdom_component_safe {cast shadow_root_ptr} {cast element_ptr} h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
 'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
 'Shadowroot::{equal,linorder}) heap"
   let ?P = "do {
         document_ptr \<leftarrow> create_document;
         html \<leftarrow> create_element document_ptr ''html'';
         append_child (cast document_ptr) (cast html);
         head \<leftarrow> create_element document_ptr ''head'';
         append_child (cast html) (cast head);
         body \<leftarrow> create_element document_ptr ''body'';
         append_child (cast html) (cast body);
         e1 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast body) (cast e1);
         e2 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast e1) (cast e2);
         s1 \<leftarrow> attach_shadow_root e1 Open;
         e3 \<leftarrow> create_element document_ptr ''slot'';
         append_child (cast s1) (cast e3);
         return s1
       }"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?s1 = "|?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and shadow_root_ptr="?s1"])
     by code_simp+
 qed
 
 locale l_get_host_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_host_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 lemma get_host_components_disjunct:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
   assumes "h \<turnstile> get_host shadow_root_ptr \<rightarrow>\<^sub>r host"
   shows "set |h \<turnstile> get_scdom_component (cast host)|\<^sub>r \<inter> set |  h \<turnstile> get_scdom_component (cast shadow_root_ptr)|\<^sub>r = {}"
   using assms get_shadow_root_components_disjunct local.shadow_root_host_dual
   by blast
 end
 
 interpretation i_get_host_scope_component?: l_get_host_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   get_owner_document heap_is_wellformed parent_child_rel type_wf known_ptr
   known_ptrs get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe
   get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_shadow_root
   get_shadow_root_locs get_child_nodes get_child_nodes_locs get_disconnected_nodes get_disconnected_nodes_locs
   get_tag_name get_tag_name_locs heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_host get_host_locs get_disconnected_document
   get_disconnected_document_locs to_tree_order get_parent get_parent_locs get_root_node get_root_node_locs
   get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
   remove_shadow_root remove_shadow_root_locs create_document DocumentClass.known_ptr DocumentClass.type_wf
   CD.a_get_owner_document get_mode get_mode_locs get_shadow_root_safe get_shadow_root_safe_locs
   by(auto simp add: l_get_host_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_host_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsection \<open>get\_root\_node\_si\<close>
 
 lemma get_composed_root_node_not_weakly_component_safe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
     ptr and root and h' where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> get_root_node_si ptr \<rightarrow>\<^sub>r root \<rightarrow>\<^sub>h h'" and
     "\<not> is_weakly_scdom_component_safe {ptr} {root} h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
 'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
 'Shadowroot::{equal,linorder}) heap"
   let ?P = "do {
         document_ptr \<leftarrow> create_document;
         html \<leftarrow> create_element document_ptr ''html'';
         append_child (cast document_ptr) (cast html);
         head \<leftarrow> create_element document_ptr ''head'';
         append_child (cast html) (cast head);
         body \<leftarrow> create_element document_ptr ''body'';
         append_child (cast html) (cast body);
         e1 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast body) (cast e1);
         e2 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast e1) (cast e2);
         s1 \<leftarrow> attach_shadow_root e1 Closed;
         e3 \<leftarrow> create_element document_ptr ''slot'';
         append_child (cast s1) (cast e3);
         return e3
       }"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?e3 = "|?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and ptr="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e3"])
     by code_simp+
 qed
 
 locale l_get_scdom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_get_dom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_dom_component_get_scdom_component
 begin
 
 lemma get_root_node_si_is_component_unsafe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> get_root_node_si ptr' \<rightarrow>\<^sub>r root"
   shows "set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = set |h \<turnstile> get_scdom_component root|\<^sub>r \<or>
 set |h \<turnstile> get_scdom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component root|\<^sub>r = {}"
 proof -
   have "ptr' |\<in>| object_ptr_kinds h"
     using get_ancestors_si_ptr_in_heap assms(4)
     by(auto simp add: get_root_node_si_def elim!: bind_returns_result_E2)
   then
   obtain sc where "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
     by (meson assms(1) assms(2) assms(3) local.get_scdom_component_ok select_result_I)
   moreover
   have "root |\<in>| object_ptr_kinds h"
     using get_ancestors_si_ptr assms(4)
     apply(auto simp add: get_root_node_si_def elim!: bind_returns_result_E2)[1]
     by (metis (no_types, lifting) assms(1) assms(2) assms(3) empty_iff empty_set
         get_ancestors_si_ptrs_in_heap last_in_set)
   then
   obtain sc' where "h \<turnstile> get_scdom_component root \<rightarrow>\<^sub>r sc'"
     by (meson assms(1) assms(2) assms(3) local.get_scdom_component_ok select_result_I)
   ultimately show ?thesis
     by (metis (no_types, opaque_lifting) IntE \<open>\<And>thesis. (\<And>sc'. h \<turnstile> get_scdom_component root \<rightarrow>\<^sub>r sc' \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close>
         \<open>\<And>thesis. (\<And>sc. h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> assms(1) assms(2) assms(3) empty_subsetI
         local.get_scdom_component_ptrs_same_scope_component returns_result_eq select_result_I2 subsetI subset_antisym)
 qed
 end
 
 interpretation i_get_scdom_component_get_root_node_si?: l_get_scdom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   type_wf known_ptr known_ptrs get_parent get_parent_locs get_child_nodes get_child_nodes_locs get_host
   get_host_locs get_ancestors_si get_ancestors_si_locs get_root_node_si get_root_node_si_locs get_disconnected_nodes
   get_disconnected_nodes_locs get_shadow_root get_shadow_root_locs get_tag_name get_tag_name_locs heap_is_wellformed
   parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_disconnected_document get_disconnected_document_locs to_tree_order
   get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe get_root_node get_root_node_locs
   get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
   get_owner_document get_scdom_component is_strongly_scdom_component_safe
   by(auto simp add: l_get_scdom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_get_scdom_component_get_root_node_si\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 
 
 subsection \<open>get\_assigned\_nodes\<close>
 
 lemma assigned_nodes_not_weakly_scdom_component_safe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
     node_ptr and nodes and h' where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> assigned_nodes node_ptr \<rightarrow>\<^sub>r nodes \<rightarrow>\<^sub>h h'" and
     "\<not> is_weakly_scdom_component_safe {cast node_ptr} (cast ` set nodes) h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap"
   let ?P = "do {
         document_ptr \<leftarrow> create_document;
         html \<leftarrow> create_element document_ptr ''html'';
         append_child (cast document_ptr) (cast html);
         head \<leftarrow> create_element document_ptr ''head'';
         append_child (cast html) (cast head);
         body \<leftarrow> create_element document_ptr ''body'';
         append_child (cast html) (cast body);
         e1 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast body) (cast e1);
         e2 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast e1) (cast e2);
         s1 \<leftarrow> attach_shadow_root e1 Closed;
         e3 \<leftarrow> create_element document_ptr ''slot'';
         append_child (cast s1) (cast e3);
         return e3
       }"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?e3 = "|?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and node_ptr="?e3"])
     by code_simp+
 qed
 
 lemma assigned_slot_not_weakly_component_safe:
   obtains
     h :: "('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder}, 'element_ptr::{equal,linorder},
 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder}, 'shadow_root_ptr::{equal,linorder},
 'Object::{equal,linorder}, 'Node::{equal,linorder}, 'Element::{equal,linorder},
 'CharacterData::{equal,linorder}, 'Document::{equal,linorder}, 'Shadowroot::{equal,linorder}) heap" and
     node_ptr and slot_opt and h' where
     "heap_is_wellformed h" and "type_wf h" and "known_ptrs h" and
     "h \<turnstile> assigned_slot node_ptr \<rightarrow>\<^sub>r slot_opt \<rightarrow>\<^sub>h h'" and
     "\<not> is_weakly_scdom_component_safe {cast node_ptr} (cast ` set_option slot_opt) h h'"
 proof -
   let ?h0 = "Heap fmempty ::('object_ptr::{equal,linorder}, 'node_ptr::{equal,linorder},
 'element_ptr::{equal,linorder}, 'character_data_ptr::{equal,linorder}, 'document_ptr::{equal,linorder},
 'shadow_root_ptr::{equal,linorder}, 'Object::{equal,linorder}, 'Node::{equal,linorder},
 'Element::{equal,linorder}, 'CharacterData::{equal,linorder}, 'Document::{equal,linorder},
 'Shadowroot::{equal,linorder}) heap"
   let ?P = "do {
         document_ptr \<leftarrow> create_document;
         html \<leftarrow> create_element document_ptr ''html'';
         append_child (cast document_ptr) (cast html);
         head \<leftarrow> create_element document_ptr ''head'';
         append_child (cast html) (cast head);
         body \<leftarrow> create_element document_ptr ''body'';
         append_child (cast html) (cast body);
         e1 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast body) (cast e1);
         e2 \<leftarrow> create_element document_ptr ''div'';
         append_child (cast e1) (cast e2);
         s1 \<leftarrow> attach_shadow_root e1 Open;
         e3 \<leftarrow> create_element document_ptr ''slot'';
         append_child (cast s1) (cast e3);
         return e2
       }"
   let ?h1 = "|?h0 \<turnstile> ?P|\<^sub>h"
   let ?e2 = "|?h0 \<turnstile> ?P|\<^sub>r"
 
   show thesis
     apply(rule that[where h="?h1" and node_ptr="cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?e2"])
     by code_simp+
 qed
 
 locale l_assigned_nodes_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M =
   l_assigned_nodes_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_get_shadow_root_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M +
   l_find_slot\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
 begin
 
 lemma find_slot_is_component_unsafe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> find_slot open_flag node_ptr \<rightarrow>\<^sub>r Some slot"
   shows "set |h \<turnstile> get_scdom_component (cast node_ptr)|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component (cast slot)|\<^sub>r = {}"
 proof -
   obtain host shadow_root_ptr to where
     "h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some (cast host)" and
     "h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr" and
     "h \<turnstile> to_tree_order (cast shadow_root_ptr) \<rightarrow>\<^sub>r to" and
     "cast slot \<in> set to"
     using assms(4)
     apply(auto simp add: find_slot_def first_in_tree_order_def elim!: bind_returns_result_E2
         map_filter_M_pure_E[where y=slot] split: option.splits if_splits list.splits
         intro!: map_filter_M_pure bind_pure_I)[1]
     by (metis element_ptr_casts_commute3)+
 
   have "node_ptr |\<in>| node_ptr_kinds h"
     using assms(4) find_slot_ptr_in_heap by blast
   then obtain node_ptr_c where node_ptr_c: "h \<turnstile> get_scdom_component (cast node_ptr) \<rightarrow>\<^sub>r node_ptr_c"
     using assms(1) assms(2) assms(3) get_scdom_component_ok is_OK_returns_result_E
       node_ptr_kinds_commutes[symmetric]
     by metis
 
   then have "cast host \<in> set node_ptr_c"
     using \<open>h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some (cast host)\<close> assms(1) assms(2) assms(3)
     by (meson assms(4) is_OK_returns_result_E local.find_slot_ptr_in_heap local.get_dom_component_ok
         local.get_dom_component_parent_inside local.get_dom_component_ptr
         local.get_scdom_component_subset_get_dom_component node_ptr_kinds_commutes subsetCE)
 
   then have "h \<turnstile> get_scdom_component (cast host) \<rightarrow>\<^sub>r node_ptr_c"
     using \<open>h \<turnstile> get_parent node_ptr \<rightarrow>\<^sub>r Some (cast host)\<close> a_heap_is_wellformed_def assms(1) assms(2)
       assms(3) node_ptr_c
     using local.get_scdom_component_ptrs_same_scope_component by blast
 
   moreover have "slot |\<in>| element_ptr_kinds h"
     using assms(4) find_slot_slot_in_heap by blast
   then obtain slot_c where slot_c: "h \<turnstile> get_scdom_component (cast slot) \<rightarrow>\<^sub>r slot_c"
     using a_heap_is_wellformed_def assms(1) assms(2) assms(3) get_scdom_component_ok
       is_OK_returns_result_E node_ptr_kinds_commutes[symmetric] element_ptr_kinds_commutes[symmetric]
-    by smt
+    by (smt (verit, best))
   then have "cast shadow_root_ptr \<in> set slot_c"
     using \<open>h \<turnstile> to_tree_order (cast shadow_root_ptr) \<rightarrow>\<^sub>r to\<close> \<open>cast slot \<in> set to\<close> assms(1) assms(2) assms(3)
     by (meson is_OK_returns_result_E local.get_dom_component_ok local.get_dom_component_ptr
         local.get_dom_component_to_tree_order local.get_scdom_component_subset_get_dom_component local.to_tree_order_ptrs_in_heap subsetCE)
   then have "h \<turnstile> get_scdom_component (cast shadow_root_ptr) \<rightarrow>\<^sub>r slot_c"
     using  \<open>h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr\<close> assms(1) assms(2) assms(3) slot_c
     using local.get_scdom_component_ptrs_same_scope_component by blast
 
   ultimately show ?thesis
     using get_shadow_root_components_disjunct assms \<open>h \<turnstile> get_shadow_root host \<rightarrow>\<^sub>r Some shadow_root_ptr\<close>
       node_ptr_c slot_c
     by (metis (no_types, lifting) select_result_I2)
 qed
 
 
 lemma assigned_nodes_is_component_unsafe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> assigned_nodes element_ptr \<rightarrow>\<^sub>r nodes"
   assumes "node_ptr \<in> set nodes"
   shows "set |h \<turnstile> get_scdom_component (cast element_ptr)|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component (cast node_ptr)|\<^sub>r = {}"
   using assms
 proof -
   have "h \<turnstile> find_slot False node_ptr \<rightarrow>\<^sub>r Some element_ptr"
     using assms(4) assms(5)
     by(auto simp add: assigned_nodes_def elim!: bind_returns_result_E2
         dest!: filter_M_holds_for_result[where x=node_ptr] intro!: bind_pure_I split: if_splits)
   then show ?thesis
     using assms find_slot_is_component_unsafe
     by blast
 qed
 
 lemma assigned_slot_is_strongly_scdom_component_safe:
   assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
   assumes "h \<turnstile> assigned_slot element_ptr \<rightarrow>\<^sub>r slot_opt \<rightarrow>\<^sub>h h'"
   assumes "\<forall>shadow_root_ptr \<in> fset (shadow_root_ptr_kinds h). h \<turnstile> get_mode shadow_root_ptr \<rightarrow>\<^sub>r Closed"
   shows "is_strongly_scdom_component_safe {cast element_ptr} (cast ` set_option slot_opt) h h'"
 proof -
   have "h = h'"
     using assms(4) find_slot_pure
     by(auto simp add: assigned_slot_def returns_result_heap_def pure_returns_heap_eq find_slot_impl)
   moreover have "slot_opt = None"
     using assms(4) assms(5)
     apply(auto simp add: returns_result_heap_def assigned_slot_def a_find_slot_def
         elim!: bind_returns_result_E2 split: option.splits if_splits
         dest!: get_shadow_root_shadow_root_ptr_in_heap[OF assms(1)])[1]
      apply (meson finite_set_in returns_result_eq shadow_root_mode.distinct(1))
     apply (meson finite_set_in returns_result_eq shadow_root_mode.distinct(1))
     done
   ultimately show ?thesis
     by(auto simp add: is_strongly_scdom_component_safe_def preserved_def)
 qed
 end
 
 interpretation i_assigned_nodes_scope_component?: l_assigned_nodes_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   type_wf get_tag_name get_tag_name_locs known_ptr get_child_nodes get_child_nodes_locs
   get_disconnected_nodes get_disconnected_nodes_locs get_shadow_root get_shadow_root_locs
   heap_is_wellformed parent_child_rel heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M get_host get_host_locs
   get_disconnected_document get_disconnected_document_locs get_parent get_parent_locs
   get_mode get_mode_locs get_attribute get_attribute_locs first_in_tree_order find_slot
   assigned_slot known_ptrs to_tree_order assigned_nodes assigned_nodes_flatten flatten_dom
   get_root_node get_root_node_locs remove insert_before insert_before_locs append_child
   remove_shadow_root remove_shadow_root_locs set_shadow_root set_shadow_root_locs remove_child
   remove_child_locs get_dom_component is_strongly_dom_component_safe is_weakly_dom_component_safe
   get_ancestors get_ancestors_locs get_element_by_id get_elements_by_class_name get_elements_by_tag_name
   get_owner_document set_disconnected_nodes set_disconnected_nodes_locs get_ancestors_di get_ancestors_di_locs
   adopt_node adopt_node_locs adopt_node\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M adopt_node_locs\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M set_child_nodes set_child_nodes_locs
   get_scdom_component is_strongly_scdom_component_safe is_weakly_scdom_component_safe create_document
   DocumentClass.known_ptr DocumentClass.type_wf CD.a_get_owner_document get_shadow_root_safe
   get_shadow_root_safe_locs
   by(auto simp add: l_assigned_nodes_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_def instances)
 declare l_assigned_nodes_scope_component\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M_axioms [instances]
 end