diff --git a/thys/Derangements/Derangements.thy b/thys/Derangements/Derangements.thy
--- a/thys/Derangements/Derangements.thy
+++ b/thys/Derangements/Derangements.thy
@@ -1,515 +1,515 @@
 (* Author: Lukas Bulwahn <lukas.bulwahn-at-gmail.com> *)
 
 section \<open>Derangements\<close>
 
 theory Derangements
 imports
   Complex_Main
   "HOL-Library.Permutations"
 begin
 
 subsection \<open>Preliminaries\<close>
 
 subsubsection \<open>Additions to @{theory HOL.Finite_Set} Theory\<close>
 
 lemma card_product_dependent:
   assumes "finite S" "\<forall>x \<in> S. finite (T x)"
   shows "card {(x, y). x \<in> S \<and> y \<in> T x} = (\<Sum>x \<in> S. card (T x))"
 using card_SigmaI[OF assms, symmetric] by (auto intro!: arg_cong[where f=card] simp add: Sigma_def)
 
 subsubsection \<open>Additions to @{theory "HOL-Library.Permutations"} Theory\<close>
 
 lemma permutes_imp_bij':
   assumes "p permutes S"
   shows "bij p"
 using assms by (meson bij_def permutes_inj permutes_surj)
 
 lemma permutesE:
   assumes "p permutes S"
   obtains "bij p" "\<forall>x. x \<notin> S \<longrightarrow> p x = x"
 using assms by (simp add: permutes_def permutes_imp_bij')
 
 lemma bij_imp_permutes':
   assumes "bij p" "\<forall>x. x \<notin> A \<longrightarrow> p x = x"
   shows  "p permutes A"
 using assms bij_imp_permutes permutes_superset by force
 
 lemma permutes_swap:
   assumes "p permutes S"
   shows "Fun.swap x y p permutes (insert x (insert y S))"
 proof -
   from assms have "p permutes (insert x (insert y S))" by (meson permutes_subset subset_insertI)
   moreover have "Fun.swap x y id permutes (insert x (insert y S))" by (simp add: permutes_swap_id)
   ultimately show "Fun.swap x y p permutes (insert x (insert y S))"
     by (metis comp_id comp_swap permutes_compose)
 qed
 
 lemma bij_extends:
   "bij p \<Longrightarrow> p x = x \<Longrightarrow> bij (p(x := y, inv p y := x))"
 unfolding bij_def
 proof (rule conjI; erule conjE)
   assume a: "inj p" "p x = x"
   show "inj (p(x := y, inv p y := x))"
   proof (intro injI)
     fix z z'
     assume "(p(x := y, inv p y := x)) z = (p(x := y, inv p y := x)) z'"
     from this a show "z = z'"
       by (auto split: if_split_asm simp add: inv_f_eq inj_eq)
   qed
 next
   assume a: "inj p" "surj p" "p x = x"
   {
     fix x'
     from a have "(p(x := y, inv p y := x)) (((inv p)(y := x, x := inv p y)) x') = x'"
       by (auto split: if_split_asm) (metis surj_f_inv_f)+
   }
   from this show "surj (p(x := y, inv p y := x))" by (metis surjI)
 qed
 
 lemma permutes_add_one:
   assumes "p permutes S" "x \<notin> S" "y \<in> S"
   shows "p(x := y, inv p y := x) permutes (insert x S)"
 proof (rule bij_imp_permutes')
   from assms show "bij (p(x := y, inv p y := x))"
     by (meson bij_extends permutes_def permutes_imp_bij')
   from assms show "\<forall>z. z \<notin> insert x S \<longrightarrow> (p(x := y, inv p y := x)) z = z"
     by (metis fun_upd_apply insertCI permutes_def permutes_inverses(1))
 qed
 
 lemma permutations_skip_one:
   assumes "p permutes S" "x : S"
   shows "p(x := x, inv p x := p x) permutes (S - {x})"
 proof (rule bij_imp_permutes')
   from assms show "\<forall>z. z \<notin> S - {x} \<longrightarrow> (p(x := x, inv p x := p x)) z = z"
     by (auto elim: permutesE simp add: bij_inv_eq_iff)
       (simp add: assms(1) permutes_in_image permutes_inv)
   from assms have "inj (p(x := x, inv p x := p x))"
     by (intro injI) (auto split: if_split_asm; metis permutes_inverses(2))+
   from assms this show "bij (p(x := x, inv p x := p x))"
     by (metis UNIV_I bij_betw_imageI bij_betw_swap_iff permutes_inj permutes_surj surj_f_inv_f swap_def)
 qed
 
 lemma permutes_drop_cycle_size_two:
   assumes "p permutes S" "p (p x) = x"
   shows "Fun.swap x (p x) p permutes (S - {x, p x})"
 using assms by (auto intro!: bij_imp_permutes' elim!: permutesE) (metis swap_apply(1,3))
 
 subsection \<open>Fixpoint-Free Permutations\<close>
 
 definition derangements :: "nat set \<Rightarrow> (nat \<Rightarrow> nat) set"
 where
   "derangements S = {p. p permutes S \<and> (\<forall>x \<in> S. p x \<noteq> x)}"
 
 lemma derangementsI:
   assumes "p permutes S" "\<And>x. x \<in> S \<Longrightarrow> p x \<noteq> x"
   shows "p \<in> derangements S"
 using assms unfolding derangements_def by auto
 
 lemma derangementsE:
   assumes "d : derangements S"
   obtains "d permutes S" "\<forall>x\<in>S. d x \<noteq> x"
 using assms unfolding derangements_def by auto
 
 subsection \<open>Properties of Derangements\<close>
 
 lemma derangements_inv:
   assumes d: "d \<in> derangements S"
   shows "inv d \<in> derangements S"
 using assms
 by (auto intro!: derangementsI elim!: derangementsE simp add: permutes_inv permutes_inv_eq)
 
 lemma derangements_in_image:
   assumes "d \<in> derangements A" "x \<in> A"
   shows "d x \<in> A"
 using assms by (auto elim: derangementsE simp add: permutes_in_image)
 
 lemma derangements_in_image_strong:
   assumes "d \<in> derangements A" "x \<in> A"
   shows "d x \<in> A - {x}"
 using assms by (auto elim: derangementsE simp add: permutes_in_image)
 
 lemma derangements_inverse_in_image:
   assumes "d \<in> derangements A" "x \<in> A"
   shows "inv d x \<in> A"
 using assms by (auto intro: derangements_in_image derangements_inv)
 
 lemma derangements_fixpoint:
   assumes "d \<in> derangements A" "x \<notin> A"
   shows "d x = x"
 using assms by (auto elim!: derangementsE simp add: permutes_def)
 
 lemma derangements_no_fixpoint:
   assumes "d \<in> derangements A" "x \<in> A"
   shows "d x \<noteq> x"
 using assms by (auto elim: derangementsE)
 
 lemma finite_derangements:
   assumes "finite A"
   shows "finite (derangements A)"
 using assms unfolding derangements_def
 by (auto simp add: finite_permutations)
 
 subsection \<open>Construction of Derangements\<close>
 
 lemma derangements_empty[simp]:
   "derangements {} = {id}"
 unfolding derangements_def by auto
 
 lemma derangements_singleton[simp]:
   "derangements {x} = {}"
 unfolding derangements_def by auto
 
 lemma derangements_swap:
   assumes "d \<in> derangements S" "x \<notin> S" "y \<notin> S" "x \<noteq> y"
   shows "Fun.swap x y d \<in> derangements (insert x (insert y S))"
 proof (rule derangementsI)
   from assms show "Fun.swap x y d permutes (insert x (insert y S))"
     by (auto intro: permutes_swap elim: derangementsE)
   from assms have s: "d x = x" "d y = y"
     by (auto intro: derangements_fixpoint)
   {
     fix x'
     assume "x' : insert x (insert y S)"
     from s assms \<open>x \<noteq> y\<close> this show "Fun.swap x y d x' \<noteq> x'"
       by (cases "x' = x"; cases "x' = y") (auto dest: derangements_no_fixpoint)
   }
 qed
 
 lemma derangements_skip_one:
   assumes d: "d \<in> derangements S" and "x \<in> S" "d (d x) \<noteq> x"
   shows "d(x := x, inv d x := d x) \<in> derangements (S - {x})"
 proof -
   from d have bij: "bij d"
     by (auto elim: derangementsE simp add: permutes_imp_bij')
   from d \<open>x : S\<close> have that: "d x : S - {x}"
     by (auto dest: derangements_in_image derangements_no_fixpoint)
   from d \<open>d (d x) \<noteq> x\<close> bij have "\<forall>x'\<in>S - {x}. (d(x := x, inv d x := d x)) x' \<noteq> x'"
     by (auto elim!: derangementsE simp add: bij_inv_eq_iff)
   from d \<open>x : S\<close> this show derangements: "d(x:=x, inv d x:= d x) : derangements (S - {x})"
     by (meson derangementsE derangementsI permutations_skip_one)
 qed
 
 lemma derangements_add_one:
   assumes "d \<in> derangements S" "x \<notin> S" "y \<in> S"
   shows "d(x := y, inv d y := x) \<in> derangements (insert x S)"
 proof (rule derangementsI)
   from assms show "d(x := y, inv d y := x) permutes (insert x S)"
    by (auto intro: permutes_add_one elim: derangementsE)
 next
   fix z
   assume "z : insert x S"
   from assms this derangements_inverse_in_image[OF assms(1), of y]
   show "(d(x := y, inv d y := x)) z \<noteq> z" by (auto elim: derangementsE)
 qed
 
 lemma derangements_drop_minimal_cycle:
   assumes "d \<in> derangements S" "d (d x) = x"
   shows "Fun.swap x (d x) d \<in> derangements (S - {x, d x})"
 proof (rule derangementsI)
   from assms show "Fun.swap x (d x) d permutes (S - {x, d x})"
     by (meson derangementsE permutes_drop_cycle_size_two)
 next
   fix y
   assume "y \<in> S - {x, d x}"
   from assms this show "Fun.swap x (d x) d y \<noteq> y"
     by (auto elim: derangementsE)
 qed
 
 subsection \<open>Cardinality of Derangements\<close>
 
 subsubsection \<open>Recursive Characterization\<close>
 
 fun count_derangements :: "nat \<Rightarrow> nat"
 where
   "count_derangements 0 = 1"
 | "count_derangements (Suc 0) = 0"
 | "count_derangements (Suc (Suc n)) = (n + 1) * (count_derangements (Suc n) + count_derangements n)"
 
 lemma card_derangements:
   assumes "finite S" "card S = n"
   shows "card (derangements S) = count_derangements n"
 using assms
 proof (induct n arbitrary: S rule: count_derangements.induct)
   case 1
   from this show ?case by auto
 next
   case 2
   from this derangements_singleton finite_derangements show ?case
     using Finite_Set.card_0_eq card_eq_SucD count_derangements.simps(2) by fastforce
 next
   case (3 n)
   from 3(4) obtain x where "x \<in> S" using card_eq_SucD insertI1 by auto
   let ?D1 = "(\<lambda>(y, d). Fun.swap x y d) ` {(y, d). y \<in> S & y \<noteq> x & d : derangements (S - {x, y})}"
   let ?D2 = "(\<lambda>(y, f). f(x:=y, inv f y := x)) ` ((S - {x}) \<times> derangements (S - {x}))"
   from \<open>x \<in> S\<close> have subset1: "?D1 \<subseteq> derangements S"
   proof (auto)
     fix y d
     assume "y \<in> S" "y \<noteq> x"
     assume d: "d \<in> derangements (S - {x, y})"
     from \<open>x : S\<close> \<open>y : S\<close> have S: "S = insert x (insert y (S - {x, y}))" by auto
     from d \<open>x : S\<close> \<open>y : S\<close> \<open>y \<noteq> x\<close> show "Fun.swap x y d \<in> derangements S"
       by (subst S) (auto intro!: derangements_swap)
   qed
   have subset2: "?D2 \<subseteq> derangements S"
   proof (rule subsetI, erule imageE, simp split: prod.split_asm, (erule conjE)+)
     fix d y
     assume "d : derangements (S - {x})" "y : S" "y \<noteq> x"
     from this have "d(x := y, inv d y := x) \<in> derangements (insert x (S - {x}))"
       by (intro derangements_add_one) auto
     from this \<open>x : S\<close> show "d(x := y, inv d y := x) \<in> derangements S"
       using insert_Diff by fastforce
   qed
   have split: "derangements S = ?D1 \<union> ?D2"
   proof
     from subset1 subset2 show "?D1 \<union> ?D2 \<subseteq> derangements S" by simp
   next
     show "derangements S \<subseteq> ?D1 \<union> ?D2"
     proof
       fix d
       assume d: "d : derangements S"
       show "d : ?D1 \<union> ?D2"
       proof (cases "d (d x) = x")
         case True
         from \<open>x : S\<close> d have "d x \<in> S" "d x \<noteq> x"
           by (auto simp add: derangements_in_image derangements_no_fixpoint)
         from d True have "Fun.swap x (d x) d \<in> derangements (S - {x, d x})"
           by (rule derangements_drop_minimal_cycle)
         from \<open>d x \<in> S\<close> \<open>d x \<noteq> x\<close> this have "d : ?D1"
           by (auto intro: image_eqI[where x = "(d x, Fun.swap x (d x) d)"])
         from this show ?thesis by auto
       next
         case False
         from d have bij: "bij d"
           by (auto elim: derangementsE simp add: permutes_imp_bij')
         from d \<open>x : S\<close> have that: "d x : S - {x}"
           by (intro derangements_in_image_strong)
         from d \<open>x : S\<close> False have derangements: "d(x:=x, inv d x:= d x) : derangements (S - {x})"
           by (auto intro: derangements_skip_one)
         from this have "bij (d(x := x, inv d x:= d x))"
           by (metis derangementsE permutes_imp_bij')+
         from this have a: "inv (d(x := x, inv d x := d x)) (d x) = inv d x"
           by (metis bij_inv_eq_iff fun_upd_same)
         from bij have x: "d (inv d x) = x" by (meson bij_inv_eq_iff)
         from d derangements_inv[of d] \<open>x : S\<close> have "inv d x \<noteq> x" "d x \<noteq> x"
           by (auto dest: derangements_no_fixpoint)
         from this a x have d_eq: "d = d(inv d x := d x, x := d x, inv (d(x := x, inv d x := d x)) (d x) := x)"
           by auto
         from derangements that have "(d x, d(x:=x, inv d x:=d x)) : ((S - {x}) \<times> derangements (S - {x}))" by auto
         from d_eq this have "d : ?D2"
           by (auto intro: image_eqI[where x = "(d x, d(x:=x, inv d x:=d x))"])
         from this show ?thesis by auto
       qed
     qed
   qed
   have no_intersect: "?D1 \<inter> ?D2 = {}"
   proof -
     have that: "\<And>d. d \<in> ?D1 \<Longrightarrow> d (d x) = x"
       using Diff_iff Diff_insert2 derangements_fixpoint insertI1 swap_apply(2) by fastforce
     have "\<And>d. d \<in> ?D2 \<Longrightarrow> d (d x) \<noteq> x"
     proof -
       fix d
       assume a: "d \<in> ?D2"
       from a obtain y d' where d: "d = d'(x := y, inv d' y := x)"
         "d' \<in> derangements (S - {x})" "y \<in> S - {x}"
         by auto
       from d(2) have inv: "inv d' \<in> derangements (S - {x})"
         by (rule derangements_inv)
       from d have inv_x: "inv d' y \<noteq> x"
         by (auto dest: derangements_inverse_in_image)
       from inv have inv_y: "inv d' y \<noteq> y"
         using d(3) derangements_no_fixpoint by blast
       from d inv_x have 1: "d x = y" by auto
       from d inv_y have 2: "d y = d' y" by auto
       from d(2, 3) have 3: "d' y \<in> S - {x}"
         by (auto dest: derangements_in_image)
       from 1 2 3 show "d (d x) \<noteq> x" by auto
     qed
     from this that show ?thesis by blast
   qed
   have inj: "inj_on (\<lambda>(y, f). Fun.swap x y f) {(y, f). y \<in> S & y \<noteq> x & f : derangements (S - {x, y})}"
     unfolding inj_on_def
     by (clarify; metis DiffD2 derangements_fixpoint insertI1 insert_commute swap_apply(1) swap_nilpotent)
   have eq: "{(y, f). y \<in> S & y \<noteq> x & f : derangements (S - {x, y})} = {(y, f). y \<in> S - {x} & f : derangements (S - {x, y})}"
     by simp
   have eq': "{(y, f). y \<in> S & y \<noteq> x & f : derangements (S - {x, y})} = Sigma (S - {x}) (%y. derangements (S - {x, y}))"
     unfolding Sigma_def by auto
   have card: "\<And> y. y \<in> S - {x} \<Longrightarrow> card (derangements (S - {x, y})) = count_derangements n"
   proof -
     fix y
     assume "y \<in> S - {x}"
     from 3(3, 4) \<open>x \<in> S\<close> this have "card (S - {x, y}) = n"
       by (metis Diff_insert2 card_Diff_singleton diff_Suc_1 finite_Diff)
     from 3(3) 3(2)[OF _ this] show "card (derangements (S - {x, y})) = count_derangements n" by auto
   qed
   from 3(3, 4) \<open>x : S\<close> have card2: "card (S - {x}) = Suc n" by (simp add: card.insert_remove insert_absorb)
   from inj have "card ?D1 = card {(y, f). y \<in> S - {x} \<and> f \<in> derangements (S - {x, y})}"
     by (simp add: card_image)
   also from 3(3) have "... = (\<Sum>y\<in>S - {x}. card (derangements (S - {x, y})))"
     by (subst card_product_dependent) (simp add: finite_derangements)+
   finally have card_1: "card ?D1 =(Suc n) * count_derangements n"
     using card card2 by auto
   have inj_2: "inj_on (\<lambda>(y, f). f(x := y, inv f y := x)) ((S - {x}) \<times> derangements (S - {x}))"
   proof -
     {
       fix d d' y y'
       assume 1: "d \<in> derangements (S - {x})" "d' \<in> derangements (S - {x})"
       assume 2: "y \<in> S" "y \<noteq> x" "y' \<in> S" "y' \<noteq> x"
       assume eq: "d(x := y, inv d y := x) = d'(x := y', inv d' y' := x)"
       from 1 2 eq \<open>x \<in> S\<close> have y: "y = y'"
         by (metis Diff_insert_absorb derangements_in_image derangements_inv
           fun_upd_same fun_upd_twist insert_iff mk_disjoint_insert)
       have "d = d'"
       proof
         fix z
         from 1 have d_x: "d x = d' x"
           by (auto dest!: derangements_fixpoint)
         from 1 have bij: "bij d" "bij d'"
           by (metis derangementsE permutes_imp_bij')+
         from this have d_d: "d (inv d y) = y" "d' (inv d' y') = y'"
           by (simp add: bij_is_surj surj_f_inv_f)+
         from 1 2 bij have neq: "d (inv d' y') \<noteq> x \<and> d' (inv d y) \<noteq> x"
           by (metis Diff_iff bij_inv_eq_iff derangements_fixpoint singletonI)
         from eq have "(d(x := y, inv d y := x)) z = (d'(x := y', inv d' y' := x)) z" by auto
         from y d_x d_d neq this show "d z = d' z" by (auto split: if_split_asm)
       qed
       from y this have "y = y' & d = d'" by auto
     }
     from this show ?thesis
       unfolding inj_on_def by auto
   qed
   from 3(3) 3(1)[OF _ card2] have card3: "card (derangements (S - {x})) = count_derangements (Suc n)"
     by auto
   from 3(3) inj_2 have card_2: "card ?D2 = (Suc n) * count_derangements (Suc n)"
     by (simp only: card_image) (auto simp add: card_cartesian_product card3 card2)
   from \<open>finite S\<close>have finite1: "finite ?D1"
     unfolding eq' by (auto intro: finite_derangements)
   from \<open>finite S\<close> have finite2: "finite ?D2"
     by (auto intro: finite_cartesian_product finite_derangements)
   show ?case
     by (simp add: split card_Un_disjoint finite1 finite2 no_intersect card_1 card_2 field_simps)
 qed
 
 subsubsection \<open>Closed-Form Characterization\<close>
 
 lemma count_derangements:
   "real (count_derangements n) = fact n * (\<Sum>k \<in> {0..n}. (-1) ^ k / fact k)"
 proof (induct n rule: count_derangements.induct)
   case (3 n)
   let ?f = "\<lambda>n. fact n * (\<Sum>k = 0..n. (- 1) ^ k / fact k)"
   have "real (count_derangements (Suc (Suc n))) = (n + 1) * (count_derangements (n + 1) + count_derangements n)"
     unfolding count_derangements.simps by simp
   also have "... = real (n + 1) * (real (count_derangements (n + 1)) + real (count_derangements n))"
     by (simp only: of_nat_mult of_nat_add)
   also have "... = (n + 1) * (?f (n + 1) + ?f n)"
     unfolding 3(2) 3(1)[unfolded Suc_eq_plus1] ..
   also have "(n + 1) * (?f (n + 1) + ?f n) = ?f (n + 2)"
   proof -
     define f where "f n = ((fact n) :: real) * (\<Sum>k = 0..n. (- 1) ^ k / fact k)" for n
     have f_eq: "\<And>n. f (n + 1) = (n + 1) * f n + (- 1) ^ (n + 1)"
     proof -
       fix n
       have "?f (n + 1) = (n + 1) * fact n * (\<Sum>k = 0..n. (- 1) ^ k / fact k) + fact (n + 1) * ((- 1) ^ (n + 1) / fact (n + 1))"
         by (simp add: field_simps)
       also have "... = (n + 1) * ?f n + (- 1) ^ (n + 1)" by (simp del: One_nat_def)
       finally show "?thesis n" unfolding f_def by simp
     qed
     from this have f_eq': "\<And> n. (n + 1) * f n = f (n + 1) + (- 1) ^ n" by auto
     from f_eq'[of n] have "(n + 1) * (f (n + 1) + f n) = ((n + 1) * f (n + 1)) + f (n + 1) + (- 1) ^ n"
       by (simp only: distrib_left of_nat_add of_nat_1)
     also have "... = (n + 2) * f (n + 1) + (- 1) ^ (n + 2)"
       by (simp del: One_nat_def add_2_eq_Suc' add: algebra_simps) simp
     also from f_eq[of "n + 1"] have "... = f (n + 2)" by simp
     finally show ?thesis unfolding f_def by simp
   qed
   finally show ?case by simp
 qed (auto)
 
 subsubsection \<open>Approximation of Cardinality\<close>
 
 lemma two_power_fact_le_fact:
   assumes "n \<ge> 1"
   shows   "2^k * fact n \<le> (fact (n + k) :: 'a :: {semiring_char_0,linordered_semidom})"
 proof (induction k)
   case (Suc k)
   have "2 ^ Suc k * fact n = 2 * (2 ^ k * fact n)" by (simp add: algebra_simps)
   also note Suc.IH
   also from assms have "of_nat 1 + of_nat 1 \<le> of_nat n + (of_nat (Suc k) :: 'a)"
     by (intro add_mono) (unfold of_nat_le_iff, simp_all)
   hence "2 * (fact (n + k) :: 'a) \<le> of_nat (n + Suc k) * fact (n + k)"
     by (intro mult_right_mono) (simp_all add: add_ac)
   also have "\<dots> = fact (n + Suc k)" by simp
   finally show ?case by - (simp add: mult_left_mono)
 qed simp_all
 
 lemma exp1_approx:
   assumes "n > 0"
   shows   "exp (1::real) - (\<Sum>k<n. 1 / fact k) \<in> {0..2 / fact n}"
 proof (unfold atLeastAtMost_iff, safe)
   have "(\<lambda>k. 1^k / fact k) sums exp (1::real)"
     using exp_converges[of "1::real"] by (simp add: field_simps)
   from sums_split_initial_segment[OF this, of n]
     have sums: "(\<lambda>k. 1 / fact (n+k)) sums (exp 1 - (\<Sum>k<n. 1 / fact k :: real))"
     by (simp add:  algebra_simps power_add)
   from assms show "(exp 1 - (\<Sum>k<n. 1 / fact k :: real)) \<ge> 0"
     by (intro sums_le[OF _ sums_zero sums]) auto
   show "(exp 1 - (\<Sum>k<n. 1 / fact k :: real)) \<le> 2 / fact n"
-  proof (rule sums_le[OF allI])
+  proof (rule sums_le)
     from assms have "(\<lambda>k. (1 / fact n) * (1 / 2)^k :: real) sums ((1 / fact n) * (1 / (1 - 1 / 2)))"
       by (intro sums_mult geometric_sums) simp_all
     also have "\<dots> = 2 / fact n" by simp
     finally show "(\<lambda>k. 1 / fact n * (1 / 2) ^ k) sums (2 / fact n :: real)" .
   next
     fix k show "(1 / fact (n+k)) \<le> (1 / fact n) * (1 / 2 :: real)^k" for k
       using two_power_fact_le_fact[of n k] assms by (auto simp: field_simps)
   qed fact+
 qed
 
 lemma exp1_bounds: "exp 1 \<in> {8 / 3..11 / 4 :: real}"
   using exp1_approx[of 4] by (simp add: eval_nat_numeral)
 
 lemma count_derangements_approximation:
   assumes "n \<noteq> 0"
   shows "abs(real (count_derangements n) - fact n / exp 1) < 1 / 2"
 proof (cases "n \<ge> 5")
   case False
   from assms this have n: "n = 1 \<or> n = 2 \<or> n = 3 \<or> n = 4" by auto
   from exp1_bounds have 1: "abs(real (count_derangements 1) - fact 1 / exp 1) < 1 / 2"
     by simp
   from exp1_bounds have 2: "abs(real (count_derangements 2) - fact 2 / exp 1) < 1 / 2"
     by (auto simp add: eval_nat_numeral abs_real_def)
   from exp1_bounds have 3: "abs(real (count_derangements 3) - fact 3 / exp 1) < 1 / 2"
     by (auto simp add: eval_nat_numeral abs_if field_simps)
   from exp1_bounds have 4: "abs(real (count_derangements 4) - fact 4 / exp 1) < 1 / 2"
     by (auto simp: abs_if field_simps eval_nat_numeral)
   from 1 2 3 4 n show ?thesis by auto
 next
   case True
   from Maclaurin_exp_le[of "- 1" "n + 1"]
   obtain t where t: "abs (t :: real) \<le> abs (- 1)"
     and exp: "exp (- 1) = (\<Sum>m<n + 1. (- 1) ^ m / fact m) + exp t / fact (n + 1) * (- 1) ^ (n + 1)"
     by blast
   from exp have sum_eq_exp: 
     "(\<Sum>k = 0..n. (- 1) ^ k / fact k) = exp (- 1) - exp t / fact (n + 1) * (- 1) ^ (n + 1)"
     by (simp add: atLeast0AtMost ivl_disj_un(2)[symmetric])
   have fact_plus1: "fact (n + 1) = (n + 1) * fact n" by simp
   have eq: "\<bar>real (count_derangements n) - fact n / exp 1\<bar> = exp t / (n + 1)"
     by (simp del: One_nat_def 
              add: count_derangements sum_eq_exp exp_minus inverse_eq_divide algebra_simps abs_mult)
        (simp add: fact_plus1)
   from t have "exp t \<le> exp 1" by simp
   also from exp1_bounds have "\<dots> < 3" by simp
   finally show ?thesis using \<open>n \<ge> 5\<close> by (simp add: eq)
 qed
 
 theorem derangements_formula:
   assumes "n \<noteq> 0" "finite S" "card S = n"
   shows "int (card (derangements S)) = round (fact n / exp 1 :: real)"
   using count_derangements_approximation[of n] assms
   by (intro round_unique' [symmetric]) (auto simp: card_derangements abs_minus_commute)
 
 theorem derangements_formula':
   assumes "n \<noteq> 0" "finite S" "card S = n"
   shows "card (derangements S) = nat (round (fact n / exp 1 :: real))"
   using derangements_formula[OF assms] by simp
 
 end
diff --git a/thys/Dirichlet_Series/Arithmetic_Summatory_Asymptotics.thy b/thys/Dirichlet_Series/Arithmetic_Summatory_Asymptotics.thy
--- a/thys/Dirichlet_Series/Arithmetic_Summatory_Asymptotics.thy
+++ b/thys/Dirichlet_Series/Arithmetic_Summatory_Asymptotics.thy
@@ -1,822 +1,822 @@
 (*
     File:      Arithmetic_Summatory_Asymptotics.thy
     Author:    Manuel Eberl, TU München
 *)
 section \<open>Asymptotics of summatory arithmetic functions\<close>
 theory Arithmetic_Summatory_Asymptotics
   imports 
     Euler_MacLaurin.Euler_MacLaurin_Landau
     Arithmetic_Summatory 
     Dirichlet_Series_Analysis
     Landau_Symbols.Landau_More
 begin
 
 subsection \<open>Auxiliary bounds\<close>
 
 lemma sum_inverse_squares_tail_bound:
   assumes "d > 0"
   shows   "summable (\<lambda>n. 1 / (real (Suc n) + d) ^ 2)"
           "(\<Sum>n. 1 / (real (Suc n) + d) ^ 2) \<le> 1 / d"
 proof -
   show *: "summable (\<lambda>n. 1 / (real (Suc n) + d) ^ 2)"
   proof (rule summable_comparison_test, intro allI exI impI)
     fix n :: nat
     from assms show "norm (1 / (real (Suc n) + d) ^ 2) \<le> 1 / real (Suc n) ^ 2"
       unfolding norm_divide norm_one norm_power
       by (intro divide_left_mono power_mono) simp_all
   qed (insert inverse_squares_sums, simp add: sums_iff)
   show "(\<Sum>n. 1 / (real (Suc n) + d) ^ 2) \<le> 1 / d"
-  proof (rule sums_le[OF allI])
+  proof (rule sums_le)
     fix n have "1 / (real (Suc n) + d) ^ 2 \<le> 1 / ((real n + d) * (real (Suc n) + d))"
       unfolding power2_eq_square using assms
       by (intro divide_left_mono mult_mono mult_pos_pos add_nonneg_pos) simp_all
     also have "\<dots> = 1 / (real n + d) - 1 / (real (Suc n) + d)"
       using assms by (simp add: divide_simps)
     finally show "1 / (real (Suc n) + d)\<^sup>2 \<le> 1 / (real n + d) - 1 / (real (Suc n) + d)" .
   next
     show "(\<lambda>n. 1 / (real (Suc n) + d)\<^sup>2) sums (\<Sum>n. 1 / (real (Suc n) + d)\<^sup>2)"
       using * by (simp add: sums_iff)
   next
     have "(\<lambda>n. 1 / (real n + d) - 1 / (real (Suc n) + d)) sums (1 / (real 0 + d) - 0)"
       by (intro telescope_sums' real_tendsto_divide_at_top[OF tendsto_const],
           subst add.commute, rule filterlim_tendsto_add_at_top[OF tendsto_const 
             filterlim_real_sequentially])
     thus "(\<lambda>n. 1 / (real n + d) - 1 / (real (Suc n) + d)) sums (1 / d)" by simp
   qed
 qed
 
 lemma moebius_sum_tail_bound:
   assumes "d > 0"
   shows   "abs (\<Sum>n. moebius_mu (Suc n + d) / real (Suc n + d)^2) \<le> 1 / d" (is "abs ?S \<le> _")
 proof -
   have *: "summable (\<lambda>n. 1 / (real (Suc n + d))\<^sup>2)"
     by (insert sum_inverse_squares_tail_bound(1)[of "real d"] assms, simp_all add: add_ac)
   have **: "summable (\<lambda>n. abs (moebius_mu (Suc n + d) / real (Suc n + d)^2))"
   proof (rule summable_comparison_test, intro exI allI impI)
     fix n :: nat
     show "norm (\<bar>moebius_mu (Suc n + d) / (real (Suc n + d))^2\<bar>) \<le>
             1 / (real (Suc n + d))^2" 
       unfolding real_norm_def abs_abs abs_divide power_abs abs_of_nat
       by (intro divide_right_mono abs_moebius_mu_le) simp_all
   qed (insert *)   
   from ** have "abs ?S \<le> (\<Sum>n. abs (moebius_mu (Suc n + d) / real (Suc n + d)^2))"
     by (rule summable_rabs)
   also have "\<dots> \<le> (\<Sum>n. 1 / (real (Suc n) + d) ^ 2)"
   proof (intro suminf_le allI)
     fix n :: nat
     show "abs (moebius_mu (Suc n + d) / (real (Suc n + d))^2) \<le> 1 / (real (Suc n) + real d)^2"
       unfolding abs_divide abs_of_nat power_abs of_nat_add [symmetric]
       by (intro divide_right_mono abs_moebius_mu_le) simp_all
   qed (insert * **, simp_all add: add_ac)
   also from assms have "\<dots> \<le> 1 / d" by (intro sum_inverse_squares_tail_bound) simp_all
   finally show ?thesis .
 qed
 
 lemma sum_upto_inverse_bound:
   "sum_upto (\<lambda>i. 1 / real i) x \<ge> 0"
   "eventually (\<lambda>x. sum_upto (\<lambda>i. 1 / real i) x \<le> ln x + 13 / 22) at_top"
 proof -
   show "sum_upto (\<lambda>i. 1 / real i) x \<ge> 0"
     by (simp add: sum_upto_def sum_nonneg)
   from order_tendstoD(2)[OF euler_mascheroni_LIMSEQ euler_mascheroni_less_13_over_22]
   obtain N where N: "\<And>n. n \<ge> N \<Longrightarrow> harm n - ln (real n) < 13 / 22"
     unfolding eventually_at_top_linorder by blast
   show "eventually (\<lambda>x. sum_upto (\<lambda>i. 1 / real i) x \<le> ln x + 13 / 22) at_top"
     using eventually_ge_at_top[of "max (real N) 1"]
   proof eventually_elim
     case (elim x)
     have "sum_upto (\<lambda>i. 1 / real i) x = (\<Sum>i\<in>{0<..nat \<lfloor>x\<rfloor>}. 1 / real i)"
       by (simp add: sum_upto_altdef)
     also have "\<dots> = harm (nat \<lfloor>x\<rfloor>)"
       unfolding harm_def by (intro sum.cong refl) (auto simp: field_simps)
     also have "\<dots> \<le> ln (real (nat \<lfloor>x\<rfloor>)) + 13 / 22"
       using N[of "nat \<lfloor>x\<rfloor>"] elim by (auto simp: le_nat_iff le_floor_iff)
     also have "ln (real (nat \<lfloor>x\<rfloor>)) \<le> ln x" using elim by (subst ln_le_cancel_iff) auto
     finally show ?case by - simp
   qed
 qed
 
 lemma sum_upto_inverse_bigo: "sum_upto (\<lambda>i. 1 / real i) \<in> O(\<lambda>x. ln x)"
 proof -
   have "eventually (\<lambda>x. norm (sum_upto (\<lambda>i. 1 / real i) x) \<le> 1 * norm (ln x + 13/22)) at_top"
     using eventually_ge_at_top[of "1::real"] sum_upto_inverse_bound(2)
     by eventually_elim (insert sum_upto_inverse_bound(1), simp_all)
   hence "sum_upto (\<lambda>i. 1 / real i) \<in> O(\<lambda>x. ln x + 13/22)"
     by (rule bigoI)
   also have "(\<lambda>x::real. ln x + 13/22) \<in> O(\<lambda>x. ln x)" by simp
   finally show ?thesis .
 qed
 
 lemma
   defines "G \<equiv> (\<lambda>x::real. (\<Sum>n. moebius_mu (n + Suc (nat \<lfloor>x\<rfloor>)) / (n + Suc (nat \<lfloor>x\<rfloor>))^2) :: real)"
   shows   moebius_sum_tail_bound': "\<And>t. t \<ge> 2 \<Longrightarrow> \<bar>G t\<bar> \<le> 1 / (t - 1)"
     and   moebius_sum_tail_bigo:   "G \<in> O(\<lambda>t. 1 / t)"
 proof -
   show "\<bar>G t\<bar> \<le> 1 / (t - 1)" if t: "t \<ge> 2" for t
   proof -
     from t have "\<bar>G t\<bar> \<le> 1 / real (nat \<lfloor>t\<rfloor>)"
       unfolding G_def using moebius_sum_tail_bound[of "nat \<lfloor>t\<rfloor>"] by simp
     also have "t \<le> 1 + real_of_int \<lfloor>t\<rfloor>" by linarith
     hence "1 / real (nat \<lfloor>t\<rfloor>) \<le> 1 / (t - 1)" using t by (simp add: field_simps)
     finally show ?thesis .
   qed
   hence "G \<in> O(\<lambda>t. 1 / (t - 1))" 
     by (intro bigoI[of _ 1] eventually_mono[OF eventually_ge_at_top[of "2::real"]]) auto
   also have "(\<lambda>t::real. 1 / (t - 1)) \<in> \<Theta>(\<lambda>t. 1 / t)" by simp
   finally show "G \<in> O(\<lambda>t. 1 / t)" .
 qed
 
 
 subsection \<open>Summatory totient function\<close>
 
 theorem summatory_totient_asymptotics:
   "(\<lambda>x. sum_upto (\<lambda>n. real (totient n)) x - 3 / pi\<^sup>2 * x\<^sup>2) \<in> O(\<lambda>x. x * ln x)"
 proof -
   define H where "H = (\<lambda>x. of_int (floor x) * (of_int (floor x) + 1) / 2 - x ^ 2 / 2 :: real)"
   define H' where "H' = (\<lambda>x. sum_upto (\<lambda>n. moebius_mu n * H (x / real n)) x)"
   have H: "sum_upto real x = x^2/2 + H x" if "x \<ge> 0" for x
     using that by (simp add: sum_upto_real H_def)
   define G where "G = (\<lambda>x::real. (\<Sum>n. moebius_mu (n + Suc (nat \<lfloor>x\<rfloor>)) / (n + Suc (nat \<lfloor>x\<rfloor>))^2))"
   
   have H_bound: "\<bar>H t\<bar> \<le> t / 2" if "t \<ge> 0" for t
   proof -
     have "H t - t / 2 = (-(t - of_int (floor t))) * (floor t + t + 1) / 2"
       by (simp add: H_def field_simps power2_eq_square)
     also have "\<dots> \<le> 0" using that by (intro mult_nonpos_nonneg divide_nonpos_nonneg) simp_all
     finally have "H t \<le> t / 2" by simp
     have "-H t - t / 2 = (t - of_int (floor t) - 1) * (of_int (floor t) + t) / 2"
       by (simp add: H_def field_simps power2_eq_square)
     also have "\<dots> \<le> 0" using that
       by (intro divide_nonpos_nonneg mult_nonpos_nonneg) ((simp; fail) | linarith)+
     finally have "-H t \<le> t / 2" by simp
     with \<open>H t \<le> t / 2\<close> show "\<bar>H t\<bar> \<le> t / 2" by simp
   qed
   
   have H'_bound: "\<bar>H' t\<bar> \<le> t / 2 * sum_upto (\<lambda>i. 1 / real i) t" if "t \<ge> 0" for t
   proof -
     have "\<bar>H' t\<bar> \<le> (\<Sum>i | 0 < i \<and> real i \<le> t. \<bar>moebius_mu i * H (t / real i)\<bar>)"
       unfolding H'_def sum_upto_def by (rule sum_abs)
     also have "\<dots> \<le> (\<Sum>i | 0 < i \<and> real i \<le> t. 1 * ((t / real i) / 2))"
       unfolding abs_mult using that
       by (intro sum_mono mult_mono abs_moebius_mu_le H_bound) simp_all
     also have "\<dots> = t / 2 * sum_upto (\<lambda>i. 1 / real i) t"
       by (simp add: sum_upto_def sum_distrib_left sum_distrib_right mult_ac)
     finally show ?thesis .
   qed
   hence "H' \<in> O(\<lambda>t. t * sum_upto (\<lambda>i. 1 / real i) t)"
     using sum_upto_inverse_bound(1)
     by (intro bigoI[of _ "1/2"] eventually_mono[OF eventually_ge_at_top[of "0::real"]]) 
        (auto elim!: eventually_mono simp: abs_mult)
   also have "(\<lambda>t. t * sum_upto (\<lambda>i. 1 / real i) t) \<in> O(\<lambda>t. t * ln t)"
     by (intro landau_o.big.mult sum_upto_inverse_bigo) simp_all
   finally have H'_bigo: "H' \<in> O(\<lambda>x. x * ln x)" .
   
   {
     fix x :: real assume x: "x \<ge> 0"
     have "sum_upto (\<lambda>n. real (totient n)) x = sum_upto (\<lambda>n. of_int (int (totient n))) x"
       by simp
     also have "\<dots> = sum_upto (\<lambda>n. moebius_mu n * sum_upto real (x / real n)) x"
       by (subst totient_conv_moebius_mu) (simp add: sum_upto_dirichlet_prod of_int_dirichlet_prod)
     also have "\<dots> = sum_upto (\<lambda>n. moebius_mu n * ((x / real n) ^ 2 / 2 + H (x / real n))) x" using x
       by (intro sum_upto_cong) (simp_all add: H)
     also have "\<dots> = x^2 / 2 * sum_upto (\<lambda>n. moebius_mu n / real n ^ 2) x + H' x"
       by (simp add: sum_upto_def H'_def sum.distrib ring_distribs
                     sum_distrib_left sum_distrib_right power_divide mult_ac)
     also have "sum_upto (\<lambda>n. moebius_mu n / real n ^ 2) x = 
                  (\<Sum>n\<in>{..<Suc (nat \<lfloor>x\<rfloor>)}. moebius_mu n / real n ^ 2)" 
       unfolding sum_upto_altdef by (intro sum.mono_neutral_cong_left refl) auto
     also have "\<dots> = 6 / pi ^ 2 - G x"
       using sums_split_initial_segment[OF moebius_over_square_sums, of "Suc (nat \<lfloor>x\<rfloor>)"]
       by (auto simp: sums_iff algebra_simps G_def)
     finally have "sum_upto (\<lambda>n. real (totient n)) x = 3 / pi\<^sup>2 * x\<^sup>2 - x\<^sup>2 / 2 * G x + H' x"
       by (simp add: algebra_simps)
   }
   hence "(\<lambda>x. sum_upto (\<lambda>n. real (totient n)) x - 3 / pi^2 * x^2) \<in> 
             \<Theta>(\<lambda>x. (-(x^2) / 2) * G x + H' x)"
     by (intro bigthetaI_cong eventually_mono[OF eventually_ge_at_top[of "0::real"]]) 
        (auto elim!: eventually_mono)
   also have "(\<lambda>x. (-(x^2) / 2) * G x + H' x) \<in> O(\<lambda>x. x * ln x)"
   proof (intro sum_in_bigo H'_bigo)
     have "(\<lambda>x. (- (x^2) / 2) * G x) \<in> O(\<lambda>x. x^2 * (1 / x))"
       using moebius_sum_tail_bigo [folded G_def] by (intro landau_o.big.mult) simp_all
     also have "(\<lambda>x::real. x^2 * (1 / x)) \<in> O(\<lambda>x. x * ln x)" by simp
     finally show "(\<lambda>x. (- (x^2) / 2) * G x) \<in> O(\<lambda>x. x * ln x)" .
   qed
   finally show ?thesis .
 qed
 
 theorem summatory_totient_asymptotics':
   "(\<lambda>x. sum_upto (\<lambda>n. real (totient n)) x) =o (\<lambda>x. 3 / pi\<^sup>2 * x\<^sup>2) +o O(\<lambda>x. x * ln x)"
   using summatory_totient_asymptotics
   by (subst set_minus_plus [symmetric]) (simp_all add: fun_diff_def)
 
 theorem summatory_totient_asymptotics'':
   "sum_upto (\<lambda>n. real (totient n)) \<sim>[at_top] (\<lambda>x. 3 / pi\<^sup>2 * x\<^sup>2)"
 proof -
   have "(\<lambda>x. sum_upto (\<lambda>n. real (totient n)) x - 3 / pi\<^sup>2 * x\<^sup>2) \<in> O(\<lambda>x. x * ln x)"
     by (rule summatory_totient_asymptotics)
   also have "(\<lambda>x. x * ln x) \<in> o(\<lambda>x. 3 / pi ^ 2 * x ^ 2)" by simp
   finally show ?thesis by (simp add: asymp_equiv_altdef)
 qed
 
 
 subsection \<open>Asymptotic distribution of squarefree numbers\<close>
 
 lemma le_sqrt_iff: "x \<ge> 0 \<Longrightarrow> x \<le> sqrt y \<longleftrightarrow> x^2 \<le> y"
   using real_sqrt_le_iff[of "x^2" y] by (simp del: real_sqrt_le_iff)
 
 theorem squarefree_asymptotics: "(\<lambda>x. card {n. real n \<le> x \<and> squarefree n} - 6 / pi\<^sup>2 * x) \<in> O(sqrt)"
 proof -
   define f :: "nat \<Rightarrow> real" where "f = (\<lambda>n. if n = 0 then 0 else 1)"
   define g :: "nat \<Rightarrow> real" where "g = dirichlet_prod (ind squarefree) moebius_mu"
   
   interpret g: multiplicative_function g unfolding g_def
     by (intro multiplicative_dirichlet_prod squarefree.multiplicative_function_axioms 
               moebius_mu.multiplicative_function_axioms)
   interpret g: multiplicative_function' g "\<lambda>p k. if k = 2 then -1 else 0" "\<lambda>_. 0"
   proof
     interpret g': multiplicative_dirichlet_prod' "ind squarefree" moebius_mu
      "\<lambda>p k. if 1 < k then 0 else 1" "\<lambda>p k. if k = 1 then - 1 else 0" "\<lambda>_. 1" "\<lambda>_. - 1"
     by (intro multiplicative_dirichlet_prod'.intro squarefree.multiplicative_function'_axioms 
               moebius_mu.multiplicative_function'_axioms)
     fix p k :: nat assume "prime p" "k > 0"
     hence "g (p ^ k) = (\<Sum>i\<in>{0<..<k}. (if Suc 0 < i then 0 else 1) *
                            (if k - i = Suc 0 then - 1 else 0))"
       by (auto simp: g'.prime_power g_def)
     also have "\<dots> = (\<Sum>i\<in>{0<..<k}. (if k = 2 then -1 else 0))" 
       by (intro sum.cong refl) auto
     also from \<open>k > 0\<close> have "\<dots> = (if k = 2 then -1 else 0)" by simp
     finally show "g (p ^ k) = \<dots>" .
   qed simp_all
   have mult_g_square: "multiplicative_function (\<lambda>n. g (n ^ 2))"
     by standard (simp_all add: power_mult_distrib g.mult_coprime)
     
   have g_square: "g (m ^ 2) = moebius_mu m" for m
     using mult_g_square moebius_mu.multiplicative_function_axioms
   proof (rule multiplicative_function_eqI)
     fix p k :: nat assume *: "prime p" "k > 0"
     have "g ((p ^ k) ^ 2) = g (p ^ (2 * k))" by (simp add: power_mult [symmetric] mult_ac)
     also from * have "\<dots> = (if k = 1 then -1 else 0)" by (simp add: g.prime_power)
     also from * have "\<dots> = moebius_mu (p ^ k)" by (simp add: moebius_mu.prime_power)
     finally show "g ((p ^ k) ^ 2) = moebius_mu (p ^ k)" .
   qed
 
   have g_nonsquare: "g m = 0" if "\<not>is_square m" for m
   proof (cases "m = 0")
     case False
     from that False obtain p where p: "prime p" "odd (multiplicity p m)"
       using is_nth_power_conv_multiplicity_nat[of 2 m] by auto
     from p have "multiplicity p m \<noteq> 2" by auto
     moreover from p have "p \<in> prime_factors m" 
       by (auto simp: prime_factors_multiplicity intro!: Nat.gr0I)
     ultimately have "(\<Prod>p\<in>prime_factors m. if multiplicity p m = 2 then - 1 else 0 :: real) = 0"
       (is "?P = _") by auto
     also have "?P = g m" using False by (subst g.prod_prime_factors') auto
     finally show ?thesis .
   qed auto
     
   have abs_g_le: "abs (g m) \<le> 1" for m
     by (cases "is_square m")
        (auto simp: g_square g_nonsquare abs_moebius_mu_le elim!: is_nth_powerE)
     
   have fds_g: "fds g = fds_ind squarefree * fds moebius_mu"
     by (rule fds_eqI) (simp add: g_def fds_nth_mult)
   have "fds g * fds_zeta = fds_ind squarefree * (fds_zeta * fds moebius_mu)"
     by (simp add: fds_g mult_ac)
   also have "fds_zeta * fds moebius_mu = (1 :: real fds)"
     by (rule fds_zeta_times_moebius_mu)
   finally have *: "fds_ind squarefree = fds g * fds_zeta" by simp
   have ind_squarefree: "ind squarefree = dirichlet_prod g f"
   proof
     fix n :: nat
     from * show "ind squarefree n = dirichlet_prod g f n"
       by (cases "n = 0") (simp_all add: fds_eq_iff fds_nth_mult f_def)
   qed
     
   define H :: "real \<Rightarrow> real" 
     where "H = (\<lambda>x. sum_upto (\<lambda>m. g (m^2) * (real_of_int \<lfloor>x / real (m\<^sup>2)\<rfloor> - x / real (m^2))) (sqrt x))"
   define J where "J = (\<lambda>x::real. (\<Sum>n. moebius_mu (n + Suc (nat \<lfloor>x\<rfloor>)) / (n + Suc (nat \<lfloor>x\<rfloor>))^2))"
       
   have "eventually (\<lambda>x. norm (H x) \<le> 1 * norm (sqrt x)) at_top" 
     using eventually_ge_at_top[of "0::real"]
   proof eventually_elim
     case (elim x)
     have "abs (H x) \<le> sum_upto (\<lambda>m. abs (g (m^2) * (real_of_int \<lfloor>x / real (m\<^sup>2)\<rfloor> - 
                          x / real (m^2)))) (sqrt x)" (is "_ \<le> ?S") unfolding H_def sum_upto_def
       by (rule sum_abs)
     also have "x / (real m)\<^sup>2 - real_of_int \<lfloor>x / (real m)\<^sup>2\<rfloor> \<le> 1" for m by linarith
     hence "?S \<le> sum_upto (\<lambda>m. 1 * 1) (sqrt x)" unfolding abs_mult sum_upto_def
       by (intro sum_mono mult_mono abs_g_le) simp_all
     also have "\<dots> = of_int \<lfloor>sqrt x\<rfloor>" using elim by (simp add: sum_upto_altdef)
     also have "\<dots> \<le> sqrt x" by linarith
     finally show ?case using elim by simp
   qed
   hence H_bigo: "H \<in> O(\<lambda>x. sqrt x)" by (rule bigoI)
   
   let ?A = "\<lambda>x. card {n. real n \<le> x \<and> squarefree n}"
   have "eventually (\<lambda>x. ?A x - 6 / pi\<^sup>2 * x = (-x) * J (sqrt x) + H x) at_top"
     using eventually_ge_at_top[of "0::real"]
   proof eventually_elim
     fix x :: real assume x: "x \<ge> 0"
     have "{n. real n \<le> x \<and> squarefree n} = {n. n > 0 \<and> real n \<le> x \<and> squarefree n}" 
       by (auto intro!: Nat.gr0I)
     also have "card \<dots> = sum_upto (ind squarefree :: nat \<Rightarrow> real) x"
       by (rule sum_upto_ind [symmetric])
     also have "\<dots> = sum_upto (\<lambda>d. g d * sum_upto f (x / real d)) x" (is "_ = ?S")
       unfolding ind_squarefree by (rule sum_upto_dirichlet_prod)
     also have "sum f {0<..nat \<lfloor>x / real i\<rfloor>} = of_int \<lfloor>x / real i\<rfloor>" if "i > 0" for i
       using x by (simp add: f_def)
     hence "?S = sum_upto (\<lambda>d. g d * of_int \<lfloor>x / real d\<rfloor>) x"
       unfolding sum_upto_altdef by (intro sum.cong refl) simp_all
     also have "\<dots> = sum_upto (\<lambda>m. g (m ^ 2) * of_int \<lfloor>x / real (m ^ 2)\<rfloor>) (sqrt x)"
       unfolding sum_upto_def 
     proof (intro sum.reindex_bij_betw_not_neutral [symmetric])
       show "bij_betw power2 ({i. 0 < i \<and> real i \<le> sqrt x} - {}) 
               ({i. 0 < i \<and> real i \<le> x} - {i\<in>{0<..nat \<lfloor>x\<rfloor>}. \<not>is_square i})"
         by (auto simp: bij_betw_def inj_on_def power_eq_iff_eq_base le_sqrt_iff 
                        is_nth_power_def le_nat_iff le_floor_iff)
     qed (auto simp: g_nonsquare)
     also have "\<dots> = x * sum_upto (\<lambda>m. g (m ^ 2) / real m ^ 2) (sqrt x) + H x"
       by (simp add: H_def sum_upto_def sum.distrib ring_distribs sum_subtractf 
                     sum_distrib_left sum_distrib_right mult_ac)
     also have "sum_upto (\<lambda>m. g (m ^ 2) / real m ^ 2) (sqrt x) = 
                  sum_upto (\<lambda>m. moebius_mu m / real m ^ 2) (sqrt x)"
       unfolding sum_upto_altdef by (intro sum.cong refl) (simp_all add: g_square)
     also have "sum_upto (\<lambda>m. moebius_mu m / (real m)\<^sup>2) (sqrt x) =
                  (\<Sum>m<Suc (nat \<lfloor>sqrt x\<rfloor>). moebius_mu m / (real m) ^ 2)"
       unfolding sum_upto_altdef by (intro sum.mono_neutral_cong_left) auto
     also have "\<dots> = (6 / pi^2 - J (sqrt x))"
       using sums_split_initial_segment[OF moebius_over_square_sums, of "Suc (nat \<lfloor>sqrt x\<rfloor>)"]
       by (auto simp: sums_iff algebra_simps J_def sum_upto_altdef)
     finally show "?A x - 6 / pi\<^sup>2 * x = (-x) * J (sqrt x) + H x"
       by (simp add: algebra_simps)
   qed
   hence "(\<lambda>x. ?A x - 6 / pi\<^sup>2 * x) \<in> \<Theta>(\<lambda>x. (-x) * J (sqrt x) + H x)"
     by (rule bigthetaI_cong)
   also have "(\<lambda>x. (-x) * J (sqrt x) + H x) \<in> O(\<lambda>x. sqrt x)"
   proof (intro sum_in_bigo H_bigo)
     have "(\<lambda>x. J (sqrt x)) \<in> O(\<lambda>x. 1 / sqrt x)" unfolding J_def
         using moebius_sum_tail_bigo sqrt_at_top by (rule landau_o.big.compose)
     hence "(\<lambda>x. (-x) * J (sqrt x)) \<in> O(\<lambda>x. x * (1 / sqrt x))"
       by (intro landau_o.big.mult) simp_all
     also have "(\<lambda>x::real. x * (1 / sqrt x)) \<in> \<Theta>(\<lambda>x. sqrt x)"
       by (intro bigthetaI_cong eventually_mono[OF eventually_gt_at_top[of "0::real"]]) 
          (auto simp: field_simps)
     finally show "(\<lambda>x. (-x) * J (sqrt x)) \<in> O(\<lambda>x. sqrt x)" .
   qed
   finally show ?thesis .
 qed
 
 theorem squarefree_asymptotics':
   "(\<lambda>x. card {n. real n \<le> x \<and> squarefree n}) =o (\<lambda>x. 6 / pi\<^sup>2 * x) +o O(\<lambda>x. sqrt x)"
   using squarefree_asymptotics
   by (subst set_minus_plus [symmetric]) (simp_all add: fun_diff_def)
 
 theorem squarefree_asymptotics'':
   "(\<lambda>x. card {n. real n \<le> x \<and> squarefree n}) \<sim>[at_top] (\<lambda>x. 6 / pi\<^sup>2 * x)"
 proof -
   have "(\<lambda>x. card {n. real n \<le> x \<and> squarefree n} - 6 / pi\<^sup>2 * x) \<in> O(\<lambda>x. sqrt x)"
     by (rule squarefree_asymptotics)
   also have "(sqrt :: real \<Rightarrow> real) \<in> \<Theta>(\<lambda>x. x powr (1/2))" 
     by (intro bigthetaI_cong eventually_mono[OF eventually_ge_at_top[of "0::real"]]) 
        (auto simp: powr_half_sqrt)
   also have "(\<lambda>x::real. x powr (1/2)) \<in> o(\<lambda>x. 6 / pi ^ 2 * x)" by simp
   finally show ?thesis by (simp add: asymp_equiv_altdef)
 qed
 
 
 subsection \<open>The hyperbola method\<close>
 
 lemma hyperbola_method_bigo:
   fixes f g :: "nat \<Rightarrow> 'a :: real_normed_field"
   assumes "(\<lambda>x. sum_upto (\<lambda>n. f n * sum_upto g (x / real n)) (sqrt x) - R x) \<in> O(b)"
   assumes "(\<lambda>x. sum_upto (\<lambda>n. sum_upto f (x / real n) * g n) (sqrt x) - S x) \<in> O(b)"
   assumes "(\<lambda>x. sum_upto f (sqrt x) * sum_upto g (sqrt x) - T x) \<in> O(b)"
   shows   "(\<lambda>x. sum_upto (dirichlet_prod f g) x - (R x + S x - T x)) \<in> O(b)"
 proof -
   let ?A = "\<lambda>x. (sum_upto (\<lambda>n. f n * sum_upto g (x / real n)) (sqrt x) - R x) +
                 (sum_upto (\<lambda>n. sum_upto f (x / real n) * g n) (sqrt x) - S x) +
                 (-(sum_upto f (sqrt x) * sum_upto g (sqrt x) - T x))"
   have "(\<lambda>x. sum_upto (dirichlet_prod f g) x - (R x + S x - T x)) \<in> \<Theta>(?A)"
     by (intro bigthetaI_cong eventually_mono[OF eventually_ge_at_top[of "0::real"]])
        (auto simp: hyperbola_method_sqrt)
   also from assms have "?A \<in> O(b)"
     by (intro sum_in_bigo(1)) (simp_all only: landau_o.big.uminus_in_iff)
   finally show ?thesis .
 qed
 
 lemma frac_le_1: "frac x \<le> 1"
   unfolding frac_def by linarith
 
 lemma ln_minus_ln_floor_bound:
   assumes "x \<ge> 2"
   shows   "ln x - ln (floor x) \<in> {0..<1 / (x - 1)}"
 proof -
   from assms have "ln (floor x) \<ge> ln (x - 1)" by (subst ln_le_cancel_iff) simp_all
   hence "ln x - ln (floor x) \<le> ln ((x - 1) + 1) - ln (x - 1)" by simp
   also from assms have "\<dots> < 1 / (x - 1)" by (intro ln_diff_le_inverse) simp_all
   finally have "ln x - ln (floor x) < 1 / (x - 1)" by simp
   moreover from assms have "ln x \<ge> ln (of_int \<lfloor>x\<rfloor>)" by (subst ln_le_cancel_iff) simp_all
   ultimately show ?thesis by simp
 qed
   
 lemma ln_minus_ln_floor_bigo:
   "(\<lambda>x::real. ln x - ln (floor x)) \<in> O(\<lambda>x. 1 / x)"
 proof -
   have "eventually (\<lambda>x. norm (ln x - ln (floor x)) \<le> 1 * norm (1 / (x - 1))) at_top"
     using eventually_ge_at_top[of "2::real"]
   proof eventually_elim
     case (elim x)
     with ln_minus_ln_floor_bound[OF this] show ?case by auto
   qed
   hence "(\<lambda>x::real. ln x - ln (floor x)) \<in> O(\<lambda>x. 1 / (x - 1))" by (rule bigoI) 
   also have "(\<lambda>x::real. 1 / (x - 1)) \<in> O(\<lambda>x. 1 / x)" by simp
   finally show ?thesis .
 qed
 
 lemma divisor_count_asymptotics_aux:
   "(\<lambda>x. sum_upto (\<lambda>n. sum_upto (\<lambda>_. 1) (x / real n)) (sqrt x) -
                     (x * ln x / 2 + euler_mascheroni * x)) \<in> O(sqrt)"
 proof -
   define R where "R = (\<lambda>x. \<Sum>i\<in>{0<..nat \<lfloor>sqrt x\<rfloor>}. frac (x / real i))"
   define S where "S = (\<lambda>x. ln (real (nat \<lfloor>sqrt x\<rfloor>)) - ln x / 2)"
   have R_bound: "R x \<in> {0..sqrt x}" if x: "x \<ge> 0" for x
   proof -
     have "R x \<le> (\<Sum>i\<in>{0<..nat \<lfloor>sqrt x\<rfloor>}. 1)" unfolding R_def by (intro sum_mono frac_le_1)
     also from x have "\<dots> = of_int \<lfloor>sqrt x\<rfloor>" by simp
     also have "\<dots> \<le> sqrt x" by simp
     finally have "R x \<le> sqrt x" .
     moreover have "R x \<ge> 0" unfolding R_def by (intro sum_nonneg) simp_all
     ultimately show ?thesis by simp
   qed
   have R_bound': "norm (R x) \<le> 1 * norm (sqrt x)" if "x \<ge> 0" for x 
     using R_bound[OF that] that by simp
   have R_bigo: "R \<in> O(sqrt)" using eventually_ge_at_top[of "0::real"]
     by (intro bigoI[of _ 1], elim eventually_mono) (rule R_bound')
   
   have "eventually (\<lambda>x. sum_upto (\<lambda>n. sum_upto (\<lambda>_. 1 :: real) (x / real n)) (sqrt x) =
                           x * harm (nat \<lfloor>sqrt x\<rfloor>) - R x) at_top"
     using eventually_ge_at_top[of "0 :: real"]
   proof eventually_elim
     case (elim x)
     have "sum_upto (\<lambda>n. sum_upto (\<lambda>_. 1 :: real) (x / real n)) (sqrt x) = 
             (\<Sum>i\<in>{0<..nat \<lfloor>sqrt x\<rfloor>}. of_int \<lfloor>x / real i\<rfloor>)" using elim
       by (simp add: sum_upto_altdef)
     also have "\<dots> = x * (\<Sum>i\<in>{0<..nat \<lfloor>sqrt x\<rfloor>}. 1 / real i) - R x"
       by (simp add: sum_subtractf frac_def R_def sum_distrib_left)
     also have "{0<..nat \<lfloor>sqrt x\<rfloor>} = {1..nat \<lfloor>sqrt x\<rfloor>}" by auto
     also have "(\<Sum>i\<in>\<dots>. 1 / real i) = harm (nat \<lfloor>sqrt x\<rfloor>)" by (simp add: harm_def divide_simps)
     finally show ?case .
   qed
   hence "(\<lambda>x. sum_upto (\<lambda>n. sum_upto (\<lambda>_. 1 :: real) (x / real n)) (sqrt x) -
                 (x * ln x / 2 + euler_mascheroni * x)) \<in> 
          \<Theta>(\<lambda>x. x * (harm (nat \<lfloor>sqrt x\<rfloor>) - (ln (nat \<lfloor>sqrt x\<rfloor>) + euler_mascheroni)) - R x + x * S x)" 
    (is "_ \<in> \<Theta>(?A)")
    by (intro bigthetaI_cong) (elim eventually_mono, simp_all add: algebra_simps S_def)
   also have "?A \<in> O(sqrt)"
   proof (intro sum_in_bigo)
     have "(\<lambda>x. - S x) \<in> \<Theta>(\<lambda>x. ln (sqrt x) - ln (of_int \<lfloor>sqrt x\<rfloor>))"
       by (intro bigthetaI_cong eventually_mono [OF eventually_ge_at_top[of "1::real"]]) 
          (auto simp: S_def ln_sqrt)
     also have "(\<lambda>x. ln (sqrt x) - ln (of_int \<lfloor>sqrt x\<rfloor>)) \<in> O(\<lambda>x. 1 / sqrt x)"
       by (rule landau_o.big.compose[OF ln_minus_ln_floor_bigo sqrt_at_top])
     finally have "(\<lambda>x. x * S x) \<in> O(\<lambda>x. x * (1 / sqrt x))" by (intro landau_o.big.mult) simp_all
     also have "(\<lambda>x::real. x * (1 / sqrt x)) \<in> \<Theta>(\<lambda>x. sqrt x)"
       by (intro bigthetaI_cong eventually_mono [OF eventually_gt_at_top[of "0::real"]]) 
          (auto simp: field_simps)
     finally show "(\<lambda>x. x * S x) \<in> O(sqrt)" .
   next
     let ?f = "\<lambda>x::real. harm (nat \<lfloor>sqrt x\<rfloor>) - (ln (real (nat \<lfloor>sqrt x\<rfloor>)) + euler_mascheroni)"
     have "?f \<in> O(\<lambda>x. 1 / real (nat \<lfloor>sqrt x\<rfloor>))"
     proof (rule landau_o.big.compose[of _ _ _ "\<lambda>x. nat \<lfloor>sqrt x\<rfloor>"])
       show "filterlim (\<lambda>x::real. nat \<lfloor>sqrt x\<rfloor>) at_top at_top"
         by (intro filterlim_compose[OF filterlim_nat_sequentially]
                   filterlim_compose[OF filterlim_floor_sequentially] sqrt_at_top)
     next
       show "(\<lambda>a. harm a - (ln (real a) + euler_mascheroni)) \<in> O(\<lambda>a. 1 / real a)"
         by (rule harm_expansion_bigo_simple2)
     qed
     also have "(\<lambda>x. 1 / real (nat \<lfloor>sqrt x\<rfloor>)) \<in> O(\<lambda>x. 1 / (sqrt x - 1))"
     proof (rule bigoI[of _ 1], use eventually_ge_at_top[of 2] in eventually_elim)
       case (elim x)
       have "sqrt x \<le> 1 + real_of_int \<lfloor>sqrt x\<rfloor>" by linarith
       with elim show ?case by (simp add: field_simps)
     qed
     also have "(\<lambda>x::real. 1 / (sqrt x - 1)) \<in> O(\<lambda>x. 1 / sqrt x)"
       by (rule landau_o.big.compose[OF _ sqrt_at_top]) simp_all
     finally have "(\<lambda>x. x * ?f x) \<in> O(\<lambda>x. x * (1 / sqrt x))" 
       by (intro landau_o.big.mult landau_o.big_refl)
     also have "(\<lambda>x::real. x * (1 / sqrt x)) \<in> \<Theta>(\<lambda>x. sqrt x)"
       by (intro bigthetaI_cong eventually_mono[OF eventually_gt_at_top[of "0::real"]]) 
          (auto elim!: eventually_mono simp: field_simps)
     finally show "(\<lambda>x. x * ?f x) \<in> O(sqrt)" .
   qed fact+
   finally show ?thesis .
 qed
 
 lemma sum_upto_sqrt_bound:
   assumes x: "x \<ge> (0 :: real)"
   shows   "norm ((sum_upto (\<lambda>_. 1) (sqrt x))\<^sup>2 - x) \<le> 2 * norm (sqrt x)"
 proof -
   from x have "0 \<le> 2 * sqrt x * (1 - frac (sqrt x)) + frac (sqrt x) ^ 2"
     by (intro add_nonneg_nonneg mult_nonneg_nonneg) (simp_all add: frac_le_1)
   also from x have "\<dots> = (sqrt x - frac (sqrt x)) ^ 2 - x + 2 * sqrt x"
     by (simp add: algebra_simps power2_eq_square)
   also have "sqrt x - frac (sqrt x) = of_int \<lfloor>sqrt x\<rfloor>" by (simp add: frac_def)
   finally have "(of_int \<lfloor>sqrt x\<rfloor>) ^ 2 - x \<ge> -2 * sqrt x" by (simp add: algebra_simps)
   moreover from x have "of_int (\<lfloor>sqrt x\<rfloor>) ^ 2 \<le> sqrt x ^ 2"
     by (intro power_mono) simp_all
   with x have "of_int (\<lfloor>sqrt x\<rfloor>) ^ 2 - x \<le> 0" by simp
   ultimately have "sum_upto (\<lambda>_. 1) (sqrt x) ^ 2 - x \<in> {-2 * sqrt x..0}"
     using x by (simp add: sum_upto_altdef)
   with x show ?thesis by simp
 qed
 
 lemma summatory_divisor_count_asymptotics:
   "(\<lambda>x. sum_upto (\<lambda>n. real (divisor_count n)) x -
           (x * ln x + (2 * euler_mascheroni - 1) * x)) \<in> O(sqrt)"
 proof -
   let ?f = "\<lambda>x. x * ln x / 2 + euler_mascheroni * x"
   have "(\<lambda>x. sum_upto (dirichlet_prod (\<lambda>_. 1 :: real) (\<lambda>_. 1)) x - (?f x + ?f x - x)) \<in> O(sqrt)"
     (is "?g \<in> _")
   proof (rule hyperbola_method_bigo)
     have "eventually (\<lambda>x::real. norm (sum_upto (\<lambda>_. 1) (sqrt x) ^ 2 - x) \<le> 
              2 * norm (sqrt x)) at_top"
       using eventually_ge_at_top[of "0::real"] by eventually_elim (rule sum_upto_sqrt_bound)
     thus "(\<lambda>x::real. sum_upto (\<lambda>_. 1) (sqrt x) * sum_upto (\<lambda>_. 1) (sqrt x) - x) \<in> O(sqrt)"
       by (intro bigoI[of _ 2]) (simp_all add: power2_eq_square)
   next
     show "(\<lambda>x. sum_upto (\<lambda>n. 1 * sum_upto (\<lambda>_. 1) (x / real n)) (sqrt x) -
                  (x * ln x / 2 + euler_mascheroni * x)) \<in> O(sqrt)"
       using divisor_count_asymptotics_aux by simp
   next
     show "(\<lambda>x. sum_upto (\<lambda>n. sum_upto (\<lambda>_. 1) (x / real n) * 1) (sqrt x) -
                  (x * ln x / 2 + euler_mascheroni * x)) \<in> O(sqrt)"
       using divisor_count_asymptotics_aux by simp
   qed
   also have "divisor_count n = dirichlet_prod (\<lambda>_. 1) (\<lambda>_. 1) n" for n
     using fds_divisor_count
     by (cases "n = 0") (simp_all add: fds_eq_iff power2_eq_square fds_nth_mult)
   hence "?g = (\<lambda>x. sum_upto (\<lambda>n. real (divisor_count n)) x - 
                (x * ln x + (2 * euler_mascheroni - 1) * x))"
     by (intro ext) (simp_all add: algebra_simps dirichlet_prod_def)
   finally show ?thesis .
 qed
 
 theorem summatory_divisor_count_asymptotics':
   "(\<lambda>x. sum_upto (\<lambda>n. real (divisor_count n)) x) =o 
      (\<lambda>x. x * ln x + (2 * euler_mascheroni - 1) * x) +o O(\<lambda>x. sqrt x)"
   using summatory_divisor_count_asymptotics
   by (subst set_minus_plus [symmetric]) (simp_all add: fun_diff_def)
 
 theorem summatory_divisor_count_asymptotics'':
   "sum_upto (\<lambda>n. real (divisor_count n)) \<sim>[at_top] (\<lambda>x. x * ln x)"
 proof -
   have "(\<lambda>x. sum_upto (\<lambda>n. real (divisor_count n)) x - 
            (x * ln x + (2 * euler_mascheroni - 1) * x)) \<in> O(sqrt)"
     by (rule summatory_divisor_count_asymptotics)
   also have "sqrt \<in> \<Theta>(\<lambda>x. x powr (1/2))"
     by (intro bigthetaI_cong eventually_mono [OF eventually_ge_at_top[of "0::real"]]) 
        (auto elim!: eventually_mono simp: powr_half_sqrt)
   also have "(\<lambda>x::real. x powr (1/2)) \<in> o(\<lambda>x. x * ln x + (2 * euler_mascheroni - 1) * x)" by simp
   finally have "sum_upto (\<lambda>n. real (divisor_count n)) \<sim>[at_top]
                   (\<lambda>x. x * ln x + (2 * euler_mascheroni - 1) * x)"
     by (simp add: asymp_equiv_altdef)
   also have "\<dots> \<sim>[at_top] (\<lambda>x. x * ln x)" by (subst asymp_equiv_add_right) simp_all
   finally show ?thesis .
 qed
 
 lemma summatory_divisor_eq:
   "sum_upto (\<lambda>n. real (divisor_count n)) (real m) = card {(n,d). n \<in> {0<..m} \<and> d dvd n}"
 proof -
   have "sum_upto (\<lambda>n. real (divisor_count n)) m = card (SIGMA n:{0<..m}. {d. d dvd n})"
     unfolding sum_upto_altdef divisor_count_def by (subst card_SigmaI) simp_all
   also have "(SIGMA n:{0<..m}. {d. d dvd n}) = {(n,d). n \<in> {0<..m} \<and> d dvd n}" by auto
   finally show ?thesis .
 qed
 
 context
   fixes M :: "nat \<Rightarrow> real"
   defines "M \<equiv> \<lambda>m. card {(n,d). n \<in> {0<..m} \<and> d dvd n} / card {0<..m}"
 begin
 
 lemma mean_divisor_count_asymptotics:
   "(\<lambda>m. M m - (ln m + 2 * euler_mascheroni - 1)) \<in> O(\<lambda>m. 1 / sqrt m)"
 proof -
   have "(\<lambda>m. M m - (ln m + 2 * euler_mascheroni - 1)) 
           \<in> \<Theta>(\<lambda>m. (sum_upto (\<lambda>n. real (divisor_count n)) (real m) -
                  (m * ln m + (2 * euler_mascheroni - 1) * m)) / m)" (is "_ \<in> \<Theta>(?f)")
     unfolding M_def 
     by (intro bigthetaI_cong eventually_mono [OF eventually_gt_at_top[of "0::nat"]]) 
        (auto simp: summatory_divisor_eq field_simps)
   also have "?f \<in> O(\<lambda>m. sqrt m / m)"
     by (intro landau_o.big.compose[OF _ filterlim_real_sequentially] landau_o.big.divide_right
           summatory_divisor_count_asymptotics eventually_at_top_not_equal)
   also have "(\<lambda>m::nat. sqrt m / m) \<in> \<Theta>(\<lambda>m. 1 / sqrt m)"
     by (intro bigthetaI_cong eventually_mono [OF eventually_gt_at_top[of "0::nat"]]) 
        (auto simp: field_simps)
   finally show ?thesis .
 qed
 
 theorem mean_divisor_count_asymptotics':
   "M =o (\<lambda>x. ln x + 2 * euler_mascheroni - 1) +o O(\<lambda>x. 1 / sqrt x)"
   using mean_divisor_count_asymptotics
   by (subst set_minus_plus [symmetric]) (simp_all add: fun_diff_def)
 
 theorem mean_divisor_count_asymptotics'': "M \<sim>[at_top] ln"
 proof -
   have "(\<lambda>x. M x - (ln x + 2 * euler_mascheroni - 1)) \<in> O(\<lambda>x. 1 / sqrt x)"
     by (rule mean_divisor_count_asymptotics)
   also have "(\<lambda>x. 1 / sqrt (real x)) \<in> \<Theta>(\<lambda>x. x powr (-1/2))"
     using eventually_gt_at_top[of "0::nat"] 
     by (intro bigthetaI_cong) 
        (auto elim!: eventually_mono simp: powr_half_sqrt field_simps powr_minus)
   also have "(\<lambda>x::nat. x powr (-1/2)) \<in> o(\<lambda>x. ln x + 2 * euler_mascheroni - 1)"
     by (intro smallo_real_nat_transfer) simp_all
   finally have "M \<sim>[at_top] (\<lambda>x. ln x + 2 * euler_mascheroni - 1)"
     by (simp add: asymp_equiv_altdef)
   also have "\<dots> = (\<lambda>x::nat. ln x + (2 * euler_mascheroni - 1))" by (simp add: algebra_simps)
   also have "\<dots> \<sim>[at_top] (\<lambda>x::nat. ln x)" by (subst asymp_equiv_add_right) auto
   finally show ?thesis .
 qed
 
 end
 
 
 subsection \<open>The asymptotic ditribution of coprime pairs\<close>
 
 context
   fixes A :: "nat \<Rightarrow> (nat \<times> nat) set"
   defines "A \<equiv> (\<lambda>N. {(m,n) \<in> {1..N} \<times> {1..N}. coprime m n})"  
 begin
 
 lemma coprime_pairs_asymptotics:
   "(\<lambda>N. real (card (A N)) - 6 / pi\<^sup>2 * (real N)\<^sup>2) \<in> O(\<lambda>N. real N * ln (real N))"
 proof -
   define C :: "nat \<Rightarrow> (nat \<times> nat) set"
     where "C = (\<lambda>N. (\<Union>m\<in>{1..N}. (\<lambda>n. (m,n)) ` totatives m))"
   define D :: "nat \<Rightarrow> (nat \<times> nat) set"
     where "D = (\<lambda>N. (\<Union>n\<in>{1..N}. (\<lambda>m. (m,n)) ` totatives n))"
   have fin: "finite (C N)" "finite (D N)" for N unfolding C_def D_def
     by (intro finite_UN_I finite_imageI; simp)+    
   
   have *: "card (A N) = 2 * (\<Sum>m\<in>{0<..N}. totient m) - 1" if N: "N > 0" for N
   proof -
     have "A N = C N \<union> D N"
       by (auto simp add: A_def C_def D_def totatives_def image_iff ac_simps)
     also have "card \<dots> = card (C N) + card (D N) - card (C N \<inter> D N)"
       using card_Un_Int[OF fin[of N]] by arith
     also have "C N \<inter> D N = {(1, 1)}" using N by (auto simp: image_iff totatives_def C_def D_def)
     also have "D N = (\<lambda>(x,y). (y,x)) ` C N" by (simp add: image_UN image_image C_def D_def)
     also have "card \<dots> = card (C N)" by (rule card_image) (simp add: inj_on_def C_def)
     also have "card (C N) = (\<Sum>m\<in>{1..N}. card ((\<lambda>n. (m,n)) ` totatives m))"
       unfolding C_def by (intro card_UN_disjoint) auto
     also have "\<dots> = (\<Sum>m\<in>{1..N}. totient m)" unfolding totient_def
       by (subst card_image) (auto simp: inj_on_def)
     also have "\<dots> = (\<Sum>m\<in>{0<..N}. totient m)" by (intro sum.cong refl) auto
     finally show "card (A N) = 2 * \<dots> - 1" by simp
   qed
   have **: "(\<Sum>m\<in>{0<..N}. totient m) \<ge> 1" if "N \<ge> 1" for N
   proof -
     have "1 \<le> N" by fact
     also have "N = (\<Sum>m\<in>{0<..N}. 1)" by simp
     also have "(\<Sum>m\<in>{0<..N}. 1) \<le> (\<Sum>m\<in>{0<..N}. totient m)" 
       by (intro sum_mono) (simp_all add: Suc_le_eq)
     finally show ?thesis .
   qed
   
   have "(\<lambda>N. real (card (A N)) - 6 / pi\<^sup>2 * (real N)\<^sup>2) \<in>
           \<Theta>(\<lambda>N. 2 * (sum_upto (\<lambda>m. real (totient m)) (real N) - (3 / pi\<^sup>2 * (real N)\<^sup>2)) - 1)"
     (is "_ \<in> \<Theta>(?f)") using * **
     by (intro bigthetaI_cong eventually_mono [OF eventually_gt_at_top[of "0::nat"]]) 
        (auto simp: of_nat_diff sum_upto_altdef)
   also have "?f \<in> O(\<lambda>N. real N * ln (real N))"
   proof (rule landau_o.big.compose[OF _ filterlim_real_sequentially], rule sum_in_bigo)
     show " (\<lambda>x. 2 * (sum_upto (\<lambda>m. real (totient m)) x - 3 / pi\<^sup>2 * x\<^sup>2)) \<in> O(\<lambda>x. x * ln x)"
       by (subst landau_o.big.cmult_in_iff, simp, rule summatory_totient_asymptotics)
   qed simp_all
   finally show ?thesis .
 qed
 
 theorem coprime_pairs_asymptotics':
   "(\<lambda>N. real (card (A N))) =o (\<lambda>N. 6 / pi\<^sup>2 * (real N)\<^sup>2) +o O(\<lambda>N. real N * ln (real N))"
   using coprime_pairs_asymptotics
   by (subst set_minus_plus [symmetric]) (simp_all add: fun_diff_def)
 
 theorem coprime_pairs_asymptotics'':
   "(\<lambda>N. real (card (A N))) \<sim>[at_top] (\<lambda>N. 6 / pi\<^sup>2 * (real N)\<^sup>2)"
 proof -
   have "(\<lambda>N. real (card (A N)) - 6 / pi\<^sup>2 * (real N) ^ 2) \<in> O(\<lambda>N. real N * ln (real N))"
     by (rule coprime_pairs_asymptotics)
   also have "(\<lambda>N. real N * ln (real N)) \<in> o(\<lambda>N. 6 / pi ^ 2 * real N ^ 2)"
     by (rule landau_o.small.compose[OF _ filterlim_real_sequentially]) simp
   finally show ?thesis by (simp add: asymp_equiv_altdef)
 qed
 
 theorem coprime_probability_tendsto:
   "(\<lambda>N. card (A N) / card ({1..N} \<times> {1..N})) \<longlonglongrightarrow> 6 / pi\<^sup>2"
 proof -
   have "(\<lambda>N. 6 / pi ^ 2) \<sim>[at_top] (\<lambda>N. 6 / pi ^ 2 * real N ^ 2 / real N ^ 2)" 
     using eventually_gt_at_top[of "0::nat"]
     by (intro asymp_equiv_refl_ev) (auto elim!: eventually_mono)
   also have "\<dots> \<sim>[at_top] (\<lambda>N. real (card (A N)) / real N ^ 2)"
     by (intro asymp_equiv_intros asymp_equiv_symI[OF coprime_pairs_asymptotics''])
   also have "\<dots> \<sim>[at_top] (\<lambda>N. real (card (A N)) / real (card ({1..N} \<times> {1..N})))"
     by (simp add: power2_eq_square)
   finally have "\<dots> \<sim>[at_top] (\<lambda>_. 6 / pi ^ 2)" by (simp add: asymp_equiv_sym)
   thus ?thesis by (rule asymp_equivD_const)
 qed
 
 end
 
 
 subsection \<open>The asymptotics of the number of Farey fractions\<close>
 
 definition farey_fractions :: "nat \<Rightarrow> rat set" where
   "farey_fractions N = {q :: rat \<in> {0<..1}. snd (quotient_of q) \<le> int N}  "
 
 lemma Fract_eq_coprime: 
   assumes "Rat.Fract a b = Rat.Fract c d" "b > 0" "d > 0" "coprime a b" "coprime c d"
   shows   "a = c" "b = d"
 proof -
   from assms have "a * d = c * b" by (auto simp: eq_rat)
   hence "abs (a * d) = abs (c * b)" by (simp only:)
   hence "abs a * abs d = abs c * abs b" by (simp only: abs_mult)
   also have "?this \<longleftrightarrow> abs a = abs c \<and> d = b" 
     using assms by (subst coprime_crossproduct_int) simp_all
   finally show "b = d" by simp
   with \<open>a * d = c * b\<close> and \<open>b > 0\<close> show "a = c" by simp
 qed
   
 lemma quotient_of_split: 
   "P (quotient_of q) = (\<forall>a b. b > 0 \<longrightarrow> coprime a b \<longrightarrow> q = Rat.Fract a b \<longrightarrow> P (a, b))"
   by (cases q) (auto simp: quotient_of_Fract dest: Fract_eq_coprime)
 
 lemma quotient_of_split_asm: 
   "P (Rat.quotient_of q) = (\<not>(\<exists>a b. b > 0 \<and> coprime a b \<and> q = Rat.Fract a b \<and> \<not>P (a, b)))"
   using quotient_of_split[of P q] by blast
 
 lemma farey_fractions_bij:
   "bij_betw (\<lambda>(a,b). Rat.Fract (int a) (int b)) 
      {(a,b)|a b. 0 < a \<and> a \<le> b \<and> b \<le> N \<and> coprime a b} (farey_fractions N)"
 proof (rule bij_betwI[of _ _ _ "\<lambda>q. case quotient_of q of (a, b) \<Rightarrow> (nat a, nat b)"], goal_cases)
   case 1
   show ?case
     by (auto simp: farey_fractions_def Rat.zero_less_Fract_iff Rat.Fract_le_one_iff 
                    Rat.quotient_of_Fract Rat.normalize_def gcd_int_def Let_def)
 next
   case 2
   show ?case
     by (auto simp add: farey_fractions_def Rat.Fract_le_one_iff Rat.zero_less_Fract_iff split: prod.splits quotient_of_split_asm)
       (simp add: coprime_int_iff [symmetric])
 next
   case (3 x)
   thus ?case by (auto simp: Rat.quotient_of_Fract Rat.normalize_def Let_def gcd_int_def)
 next
   case (4 x)
   thus ?case unfolding farey_fractions_def
     by (split quotient_of_split) (auto simp: Rat.zero_less_Fract_iff)
 qed
 
 lemma card_farey_fractions: "card (farey_fractions N) = sum totient {0<..N}"
 proof -
   have "card (farey_fractions N) = card {(a,b)|a b. 0 < a \<and> a \<le> b \<and> b \<le> N \<and> coprime a b}"
     using farey_fractions_bij by (rule bij_betw_same_card [symmetric])
   also have "{(a,b)|a b. 0 < a \<and> a \<le> b \<and> b \<le> N \<and> coprime a b} =
                (\<Union>b\<in>{0<..N}. (\<lambda>a. (a, b)) ` totatives b)"
     by (auto simp: totatives_def image_iff)
   also have "card \<dots> = (\<Sum>b\<in>{0<..N}. card ((\<lambda>a. (a, b)) ` totatives b))"
     by (intro card_UN_disjoint) auto
   also have "\<dots> = (\<Sum>b\<in>{0<..N}. totient b)"
     unfolding totient_def by (intro sum.cong refl card_image) (auto simp: inj_on_def)
   finally show ?thesis .
 qed
 
 lemma card_farey_fractions_asymptotics:
   "(\<lambda>N. real (card (farey_fractions N)) - 3 / pi\<^sup>2 * (real N)\<^sup>2) \<in> O(\<lambda>N. real N * ln (real N))"
 proof -
   have "(\<lambda>N. sum_upto (\<lambda>n. real (totient n)) (real N) - 3 / pi\<^sup>2 * (real N)\<^sup>2) 
             \<in> O(\<lambda>N. real N * ln (real N))" (is "?f \<in> _")
     using summatory_totient_asymptotics filterlim_real_sequentially 
     by (rule landau_o.big.compose)
   also have "?f = (\<lambda>N. real (card (farey_fractions N)) - 3 / pi\<^sup>2 * (real N)\<^sup>2)"
     by (intro ext) (simp add: sum_upto_altdef card_farey_fractions)
   finally show ?thesis .
 qed
 
 theorem card_farey_fractions_asymptotics':
   "(\<lambda>N. card (farey_fractions N)) =o (\<lambda>N. 3 / pi\<^sup>2 * N^2) +o O(\<lambda>N. N * ln N)"
   using card_farey_fractions_asymptotics
   by (subst set_minus_plus [symmetric]) (simp_all add: fun_diff_def)
 
 theorem card_farey_fractions_asymptotics'':
   "(\<lambda>N. real (card (farey_fractions N))) \<sim>[at_top] (\<lambda>N. 3 / pi\<^sup>2 * (real N)\<^sup>2)"
 proof -
   have "(\<lambda>N. real (card (farey_fractions N)) - 3 / pi\<^sup>2 * (real N) ^ 2) \<in> O(\<lambda>N. real N * ln (real N))"
     by (rule card_farey_fractions_asymptotics)
   also have "(\<lambda>N. real N * ln (real N)) \<in> o(\<lambda>N. 3 / pi ^ 2 * real N ^ 2)"
     by (rule landau_o.small.compose[OF _ filterlim_real_sequentially]) simp
   finally show ?thesis by (simp add: asymp_equiv_altdef)
 qed
 
 end
diff --git a/thys/Furstenberg_Topology/Furstenberg_Topology.thy b/thys/Furstenberg_Topology/Furstenberg_Topology.thy
--- a/thys/Furstenberg_Topology/Furstenberg_Topology.thy
+++ b/thys/Furstenberg_Topology/Furstenberg_Topology.thy
@@ -1,880 +1,878 @@
 (*
   File:     Furstenberg_Topology.thy
   Author:   Manuel Eberl, TU München
 *)
 section \<open>Furstenberg's topology and his proof of the infinitude of primes\<close>
 theory Furstenberg_Topology
   imports 
     "HOL-Real_Asymp.Real_Asymp" 
     "HOL-Analysis.Analysis" 
     "HOL-Number_Theory.Number_Theory"
 begin
 
 text \<open>
   This article gives a formal version of Furstenberg's topological proof of the infinitude of
   primes~\cite{furstenberg}. He defines a topology on the integers based on arithmetic progressions
   (or, equivalently, residue classes).
 
   Apart from yielding a short proof of the infinitude of primes, this topology is also fairly
   `nice' in general: it is second countable, metrizable, and perfect. All of these (well-known)
   facts will be formally proven below.
 \<close>
 
 subsection \<open>Arithmetic progressions of integers\<close>
 
 text \<open>
   We first define `bidirectional infinite arithmetic progressions' on \<open>\<int>\<close> in the sense that 
   to an integer \<open>a\<close> and a positive integer \<open>b\<close>, we associate all the integers \<open>x\<close> such that
   $x \equiv a\ (\text{mod}\ b)$, or, equivalently, $\{a + nb\mid n\in\mathbb{Z}\}$.
 \<close>
 
 definition arith_prog :: "int \<Rightarrow> nat \<Rightarrow> int set" where
   "arith_prog a b = {x. [x = a] (mod int b)}"
 
 lemma arith_prog_0_right [simp]: "arith_prog a 0 = {a}"
   by (simp add: arith_prog_def)
 
 lemma arith_prog_Suc_0_right [simp]: "arith_prog a (Suc 0) = UNIV"
   by (auto simp: arith_prog_def)
 
 lemma in_arith_progI [intro]: "[x = a] (mod b) \<Longrightarrow> x \<in> arith_prog a b"
   by (auto simp: arith_prog_def)
 
 text \<open>
   Two arithmetic progressions with the same period and noncongruent starting points are
   disjoint.
 \<close>
 lemma arith_prog_disjoint:
   assumes "[a \<noteq> a'] (mod int b)" and "b > 0"
   shows   "arith_prog a b \<inter> arith_prog a' b = {}"
   using assms by (auto simp: arith_prog_def cong_def)
 
 text \<open>
   Multiplying the period gives us a subset of the original progression.
 \<close>
 lemma arith_prog_dvd_mono: "b dvd b' \<Longrightarrow> arith_prog a b' \<subseteq> arith_prog a b"
   by (auto simp: arith_prog_def cong_dvd_modulus)
 
 text \<open>
   The following proves the alternative definition mentioned above.
 \<close>
 lemma bij_betw_arith_prog:
   assumes "b > 0"
   shows   "bij_betw (\<lambda>n. a + int b * n) UNIV (arith_prog a b)"
 proof (rule bij_betwI[of _ _ _ "\<lambda>x. (x - a) div int b"], goal_cases)
   case 1
   thus ?case 
     by (auto simp: arith_prog_def cong_add_lcancel_0 cong_mult_self_right mult_of_nat_commute)
 next
   case 4
   thus ?case
     by (auto simp: arith_prog_def cong_iff_lin)
 qed (use \<open>b > 0\<close> in \<open>auto simp: arith_prog_def\<close>)
 
 lemma arith_prog_altdef: "arith_prog a b = range (\<lambda>n. a + int b * n)"
 proof (cases "b = 0")
   case False
   thus ?thesis
     using bij_betw_arith_prog[of b] by (auto simp: bij_betw_def)
 qed auto
 
 text \<open>
   A simple corollary from this is also that any such arithmetic progression is infinite.
 \<close>
 lemma infinite_arith_prog: "b > 0 \<Longrightarrow> infinite (arith_prog a b)"
   using bij_betw_finite[OF bij_betw_arith_prog[of b]] by simp
 
 
 subsection \<open>The Furstenberg topology on \<open>\<int>\<close>\<close>
 
 text \<open>
   The typeclass-based topology is somewhat nicer to use in Isabelle/HOL, but the integers, 
   of course, already have a topology associated to them. We therefore need to introduce a type
   copy of the integers and furnish them with the new topology. We can easily convert between
   them and the `proper' integers using Lifting and Transfer.
 \<close>
 typedef fbint = "UNIV :: int set"
   morphisms int_of_fbint fbint ..
 
 setup_lifting type_definition_fbint
 
 lift_definition arith_prog_fb :: "int \<Rightarrow> nat \<Rightarrow> fbint set" is "arith_prog" .
 
 instantiation fbint :: topological_space
 begin
 
 text \<open>
   Furstenberg defined the topology as the one generated by all arithmetic progressions.
   We use a slightly more explicit equivalent formulation that exploits the fact that
   the intersection of two arithmetic progressions is again an arithmetic progression (or empty).
 \<close>
 lift_definition open_fbint :: "fbint set \<Rightarrow> bool" is
   "\<lambda>U. (\<forall>x\<in>U. \<exists>b>0. arith_prog x b \<subseteq> U)" .
 
 text \<open>
   We now prove that this indeed forms a topology.
 \<close>
 instance proof
   show "open (UNIV :: fbint set)"
     by transfer auto
 next
   fix U V :: "fbint set"
   assume "open U" and "open V"
   show "open (U \<inter> V)"
   proof (use \<open>open U\<close> \<open>open V\<close> in transfer, safe)
     fix U V :: "int set" and x :: int
     assume U: "\<forall>x\<in>U. \<exists>b>0. arith_prog x b \<subseteq> U" and V: "\<forall>x\<in>V. \<exists>b>0. arith_prog x b \<subseteq> V"
     assume x: "x \<in> U" "x \<in> V"
     from U x obtain b1 where b1: "b1 > 0" "arith_prog x b1 \<subseteq> U" by auto
     from V x obtain b2 where b2: "b2 > 0" "arith_prog x b2 \<subseteq> V" by auto
     from b1 b2 have "lcm b1 b2 > 0" "arith_prog x (lcm b1 b2) \<subseteq> U \<inter> V"
       using arith_prog_dvd_mono[of b1 "lcm b1 b2" x] arith_prog_dvd_mono[of b2 "lcm b1 b2" x]
       by (auto simp: lcm_pos_nat)
     thus "\<exists>b>0. arith_prog x b \<subseteq> U \<inter> V" by blast
   qed
 next
   fix F :: "fbint set set"
   assume *: "\<forall>U\<in>F. open U"
   show "open (\<Union>F)"
   proof (use * in transfer, safe)
     fix F :: "int set set" and U :: "int set" and x :: int
     assume F: "\<forall>U\<in>F. \<forall>x\<in>U. \<exists>b>0. arith_prog x b \<subseteq> U"
     assume "x \<in> U" "U \<in> F"
     with F obtain b where b: "b > 0" "arith_prog x b \<subseteq> U" by blast
     with \<open>U \<in> F\<close> show "\<exists>b>0. arith_prog x b \<subseteq> \<Union>F"
       by blast
   qed
 qed
 
 end
 
 text \<open>
   Since any non-empty open set contains an arithmetic progression and arithmetic progressions
   are infinite, we obtain that all nonempty open sets are infinite.
 \<close>
 lemma open_fbint_imp_infinite:
   fixes U :: "fbint set"
   assumes "open U" and "U \<noteq> {}"
   shows   "infinite U"
   using assms
 proof transfer
   fix U :: "int set"
   assume *: "\<forall>x\<in>U. \<exists>b>0. arith_prog x b \<subseteq> U" and "U \<noteq> {}"
   from \<open>U \<noteq> {}\<close> obtain x where "x \<in> U" by auto
   with * obtain b where b: "b > 0" "arith_prog x b \<subseteq> U" by auto
   from b have "infinite (arith_prog x b)"
     using infinite_arith_prog by blast
   with b show "infinite U"
     using finite_subset by blast
 qed
 
 lemma not_open_finite_fbint [simp]:
   assumes "finite (U :: fbint set)" "U \<noteq> {}"
   shows   "\<not>open U"
   using open_fbint_imp_infinite assms by blast
 
 text \<open>
   More or less by definition, any arithmetic progression is open.
 \<close>
 lemma open_arith_prog_fb [intro]:
   assumes "b > 0"
   shows   "open (arith_prog_fb a b)"
   using assms
 proof transfer
   fix a :: int and b :: nat
   assume "b > 0"
   show "\<forall>x\<in>arith_prog a b. \<exists>b'>0. arith_prog x b' \<subseteq> arith_prog a b"
   proof (intro ballI exI[of _ b] conjI)
     fix x assume "x \<in> arith_prog a b"
     thus "arith_prog x b \<subseteq> arith_prog a b"
       using cong_trans by (auto simp: arith_prog_def )
   qed (use \<open>b > 0\<close> in auto)
 qed
 
 text \<open>
   Slightly less obviously, any arithmetic progression is also closed.
   This can be seen by realising that for a period \<open>b\<close>, we can partition the integers
   into \<open>b\<close> congruence classes and then the complement of each congruence class is the 
   union of the other \<open>b - 1\<close> classes, and unions of open sets are open.
 \<close>
 lemma closed_arith_prog_fb [intro]:
   assumes "b > 0"
   shows   "closed (arith_prog_fb a b)"
 proof -
   have "open (-arith_prog_fb a b)"
   proof -
     have "-arith_prog_fb a b = (\<Union>i\<in>{1..<b}. arith_prog_fb (a+i) b)"
     proof (transfer fixing: b)
       fix a :: int
       have disjoint: "x \<notin> arith_prog a b" if "x \<in> arith_prog (a + int i) b" "i \<in> {1..<b}" for x i
       proof -
         have "[a \<noteq> a + int i] (mod int b)"
         proof
           assume "[a = a + int i] (mod int b)"
           hence "[a + 0 = a + int i] (mod int b)" by simp
           hence "[0 = int i] (mod int b)" by (subst (asm) cong_add_lcancel) auto
           with that show False by (auto simp: cong_def)
         qed
         thus ?thesis using arith_prog_disjoint[of a "a + int i" b] \<open>b > 0\<close> that by auto
       qed
 
       have covering: "x \<in> arith_prog a b \<or> x \<in> (\<Union>i\<in>{1..<b}. arith_prog (a + int i) b)" for x
       proof -
         define i where "i = nat ((x - a) mod (int b))"
         have "[a + int i = a + (x - a) mod int b] (mod int b)"
           unfolding i_def using \<open>b > 0\<close> by simp
         also have "[a + (x - a) mod int b = a + (x - a)] (mod int b)"
           by (intro cong_add) auto
         finally have "[x = a + int i] (mod int b)"
           by (simp add: cong_sym_eq)
         hence "x \<in> arith_prog (a + int i) b"
           using \<open>b > 0\<close> by (auto simp: arith_prog_def)
         moreover have "i < b" using \<open>b > 0\<close> 
           by (auto simp: i_def nat_less_iff)
         ultimately show ?thesis using \<open>b > 0\<close>
           by (cases "i = 0") auto
       qed
 
       from disjoint and covering show "- arith_prog a b = (\<Union>i\<in>{1..<b}. arith_prog (a + int i) b)"
         by blast
     qed 
     also from \<open>b > 0\<close> have "open \<dots>"
       by auto
     finally show ?thesis .
   qed
   thus ?thesis by (simp add: closed_def)
 qed
 
 subsection \<open>The infinitude of primes\<close>
 
 text \<open>
   The infinite of the primes now follows quite obviously: The multiples of any prime form a
   closed set, so if there were only finitely many primes, the union of all of these would also
   be open. However, since any number other than \<open>\<plusminus>1\<close> has a prime divisor, the union of all these
   sets is simply \<open>\<int>\<setminus>{\<plusminus>1}\<close>, which is obviously \<^emph>\<open>not\<close> closed since the finite set \<open>{\<plusminus>1}\<close> is not
   open.
 \<close>
 theorem "infinite {p::nat. prime p}"
 proof  
   assume fin: "finite {p::nat. prime p}"
   define A where "A = (\<Union>p\<in>{p::nat. prime p}. arith_prog_fb 0 p)"
   have "closed A"
     unfolding A_def using fin by (intro closed_Union) (auto simp: prime_gt_0_nat)
   hence "open (-A)"
     by (simp add: closed_def)
   also have "A = -{fbint 1, fbint (-1)}"
     unfolding A_def
   proof transfer
     show "(\<Union>p\<in>{p::nat. prime p}. arith_prog 0 p) = - {1, - 1}"
     proof (intro equalityI subsetI)
       fix x :: int assume x: "x \<in> -{1, -1}"
       hence "\<bar>x\<bar> \<noteq> 1" by auto
       show "x \<in> (\<Union>p\<in>{p::nat. prime p}. arith_prog 0 p)"
       proof (cases "x = 0")
         case True
         thus ?thesis
           by (auto simp: A_def intro!: exI[of _ 2])
       next
         case [simp]: False
         obtain p where p: "prime p" "p dvd x"
           using prime_divisor_exists[of x] and \<open>\<bar>x\<bar> \<noteq> 1\<close> by auto
         hence "x \<in> arith_prog 0 (nat p)" using prime_gt_0_int[of p]
           by (auto simp: arith_prog_def cong_0_iff)
         thus ?thesis using p
           by (auto simp: A_def intro!: exI[of _ "nat p"])
       qed
     qed (auto simp: A_def arith_prog_def cong_0_iff)
   qed
   also have "-(-{fbint 1, fbint (-1)}) = {fbint 1, fbint (-1)}"
     by simp
   finally have "open {fbint 1, fbint (-1)}" .
   thus False by simp
 qed
 
 
 
 
 subsection \<open>Additional topological properties\<close>
 
 text \<open>
   Just for fun, let us also show a few more properties of Furstenberg's topology.
   First, we show the equivalence to the above to Furstenberg's original definition
   (the topology generated by all arithmetic progressions).
 \<close>
 
 theorem topological_basis_fbint: "topological_basis {arith_prog_fb a b |a b. b > 0}"
   unfolding topological_basis_def
 proof safe
   fix a :: int and b :: nat
   assume "b > 0"
   thus "open (arith_prog_fb a b)"
     by auto
 next
   fix U :: "fbint set" assume "open U"
   hence "\<forall>x\<in>U. \<exists>b. b > 0 \<and> arith_prog_fb (int_of_fbint x) b \<subseteq> U"
     by transfer
   hence "\<exists>f. \<forall>x\<in>U. f x > 0 \<and> arith_prog_fb (int_of_fbint x) (f x) \<subseteq> U"
     by (subst (asm) bchoice_iff)
   then obtain f where f: "\<forall>x\<in>U. f x > 0 \<and> arith_prog_fb (int_of_fbint x) (f x) \<subseteq> U" ..
   define B where "B = (\<lambda>x. arith_prog_fb (int_of_fbint x) (f x)) ` U"
   have "B \<subseteq> {arith_prog_fb a b |a b. b > 0}"
     using f by (auto simp: B_def)
   moreover have "\<Union>B = U"
   proof safe
     fix x assume "x \<in> U"
     hence "x \<in> arith_prog_fb (int_of_fbint x) (f x)"
       using f by transfer auto
     with \<open>x \<in> U\<close> show "x \<in> \<Union>B" by (auto simp: B_def)
   qed (use f in \<open>auto simp: B_def\<close>)
   ultimately show "\<exists>B'\<subseteq>{arith_prog_fb a b |a b. 0 < b}. \<Union> B' = U" by auto
 qed
     
 lemma open_fbint_altdef: "open = generate_topology {arith_prog_fb a b |a b. b > 0}"
   using topological_basis_imp_subbasis[OF topological_basis_fbint] .
 
 
 text \<open>
   From this, we can immediately see that it is second countable:
 \<close>
 instance fbint :: second_countable_topology
 proof
   have "countable ((\<lambda>(a,b). arith_prog_fb a b) ` (UNIV \<times> {b. b > 0}))"
     by (intro countable_image) auto
   also have "\<dots> = {arith_prog_fb a b |a b. b > 0}"
     by auto
   ultimately show "\<exists>B::fbint set set. countable B \<and> open = generate_topology B"
     unfolding open_fbint_altdef by auto
 qed
 
 text \<open>
   A trivial consequence of the fact that nonempty open sets in this topology are infinite
   is that it is a perfect space:
 \<close>
 instance fbint :: perfect_space
   by standard auto
 
 
 text \<open>
   It is also Hausdorff, since given any two distinct integers, we can easily
   construct two non-overlapping arithmetic progressions that each contain one of them.
   We do not \<^emph>\<open>really\<close> have to prove this since we will get it for free later on when we
   show that it is a metric space, but here is the proof anyway:
 \<close>
 instance fbint :: t2_space
 proof
   fix x y :: fbint
   assume "x \<noteq> y"
   define d where "d = nat \<bar>int_of_fbint x - int_of_fbint y\<bar> + 1"
   from \<open>x \<noteq> y\<close> have "d > 0"
     unfolding d_def by transfer auto
   define U where "U = arith_prog_fb (int_of_fbint x) d"
   define V where "V = arith_prog_fb (int_of_fbint y) d"
 
   have "U \<inter> V = {}" unfolding U_def V_def d_def
   proof (use \<open>x \<noteq> y\<close> in transfer, rule arith_prog_disjoint)
     fix x y :: int
     assume "x \<noteq> y"
     show "[x \<noteq> y] (mod int (nat \<bar>x - y\<bar> + 1))"
     proof
       assume "[x = y] (mod int (nat \<bar>x - y\<bar> + 1))"
       hence "\<bar>x - y\<bar> + 1 dvd \<bar>x - y\<bar>"
         by (auto simp: cong_iff_dvd_diff algebra_simps)
       hence "\<bar>x - y\<bar> + 1 \<le> \<bar>x - y\<bar>"
         by (rule zdvd_imp_le) (use \<open>x \<noteq> y\<close> in auto)
       thus False by simp
     qed
   qed auto
   moreover have "x \<in> U" "y \<in> V"
     unfolding U_def V_def by (use \<open>d > 0\<close> in transfer, fastforce)+
   moreover have "open U" "open V"
     using \<open>d > 0\<close> by (auto simp: U_def V_def)
   ultimately show "\<exists>U V. open U \<and> open V \<and> x \<in> U \<and> y \<in> V \<and> U \<inter> V = {}" by blast
 qed
 
 (* TODO Move? *)
 text \<open>
   Next, we need a small lemma: Given an additional assumption, a $T_2$ space is also $T_3$:
 \<close>
 lemma t2_space_t3_spaceI:
   assumes "\<And>(x :: 'a :: t2_space) U. x \<in> U \<Longrightarrow> open U \<Longrightarrow>
              \<exists>V. x \<in> V \<and> open V \<and> closure V \<subseteq> U"
   shows   "OFCLASS('a, t3_space_class)"
 proof
   fix X :: "'a set" and z :: 'a
   assume X: "closed X" "z \<notin> X"
   with assms[of z "-X"] obtain V where V: "z \<in> V" "open V" "closure V \<subseteq> -X"
     by auto
   show "\<exists>U V. open U \<and> open V \<and> z \<in> U \<and> X \<subseteq> V \<and> U \<inter> V = {}"
     by (rule exI[of _ V], rule exI[of _ "-closure V"])
        (use X V closure_subset[of V] in auto)
 qed  
 
 text \<open>
   Since the Furstenberg topology is $T_2$ and every arithmetic progression is also closed,
   we can now easily show that it is also $T_3$ (i.\,e.\ regular). 
   Again, we do not really need this proof, but here it is:
 \<close>
 instance fbint :: t3_space
 proof (rule t2_space_t3_spaceI)
   fix x :: fbint and U :: "fbint set"
   assume "x \<in> U" and "open U"
   then obtain b where b: "b > 0" "arith_prog_fb (int_of_fbint x) b \<subseteq> U"
     by transfer blast
   define V where "V = arith_prog_fb (int_of_fbint x) b"
   have "x \<in> V"
     unfolding V_def by transfer auto
   moreover have "open V" "closed V"
     using \<open>b > 0\<close> by (auto simp: V_def)
   ultimately show "\<exists>V. x \<in> V \<and> open V \<and> closure V \<subseteq> U"
     using b by (intro exI[of _ V]) (auto simp: V_def)
 qed
 
 
 subsection \<open>Metrizability\<close>
 
 text \<open>
   The metrizability of Furstenberg's topology (i.\,e.\ that it is induced by some metric) can
   be shown from the fact that it is second countable and $T_3$ using Urysohn's Metrization Theorem, 
   but this is not available in Isabelle yet. Let us therefore give an \<^emph>\<open>explicit\<close> metric, 
   as described by Zulfeqarr~\cite{zulfeqarr}. We follow the exposition by Dirmeier~\cite{dirmeier}.
 
   First, we define a kind of norm on the integers. The norm depends on a real parameter \<open>q > 1\<close>.
   The value of \<open>q\<close> does not matter in the sense that all values induce the same topology
   (which we will show). For the final definition, we then simply pick \<open>q = 2\<close>.
 \<close>
 
 locale fbnorm =
   fixes q :: "real"
   assumes q_gt_1: "q > 1"
 begin
 
 definition N :: "int \<Rightarrow> real" where
   "N n = (\<Sum>k. if k = 0 \<or> int k dvd n then 0 else 1 / q ^ k)"
 
 lemma N_summable: "summable (\<lambda>k. if k = 0 \<or> int k dvd n then 0 else 1 / q ^ k)"
   by (rule summable_comparison_test[OF _ summable_geometric[of "1/q"]])
      (use q_gt_1 in \<open>auto intro!: exI[of _ 0] simp: power_divide\<close>)
 
 lemma N_sums: "(\<lambda>k. if k = 0 \<or> int k dvd n then 0 else 1 / q ^ k) sums N n"
   using N_summable unfolding N_def by (rule summable_sums)
 
 lemma N_nonneg: "N n \<ge> 0"
   by (rule sums_le[OF _ sums_zero N_sums]) (use q_gt_1 in auto)
 
 lemma N_uminus [simp]: "N (-n) = N n"
   by (simp add: N_def)
 
 lemma N_minus_commute: "N (x - y) = N (y - x)"
   using N_uminus[of "x - y"] by (simp del: N_uminus)
 
 lemma N_zero [simp]: "N 0 = 0"
   by (simp add: N_def)
 
 lemma not_dvd_imp_N_ge:
   assumes "\<not>n dvd a" "n > 0"
   shows   "N a \<ge> 1 / q ^ n"
   by (rule sums_le[OF _ sums_single[of n] N_sums]) (use q_gt_1 assms in auto)
 
 lemma N_lt_imp_dvd:
   assumes "N a < 1 / q ^ n" and "n > 0"
   shows   "n dvd a"
   using not_dvd_imp_N_ge[of n a] assms by auto
 
 lemma N_pos:
   assumes "n \<noteq> 0"
   shows   "N n > 0"
 proof -
   have "0 < 1 / q ^ (nat \<bar>n\<bar>+1)"
     using q_gt_1 by simp
   also have "\<not>1 + \<bar>n\<bar> dvd \<bar>n\<bar>"
     using zdvd_imp_le[of "1 + \<bar>n\<bar>" "\<bar>n\<bar>"] assms by auto
   hence "1 / q ^ (nat \<bar>n\<bar>+1) \<le> N n"
     by (intro not_dvd_imp_N_ge) (use assms in auto)
   finally show ?thesis .
 qed
 
 lemma N_zero_iff [simp]: "N n = 0 \<longleftrightarrow> n = 0"
   using N_pos[of n] by (cases "n = 0") auto
 
 lemma N_triangle_ineq: "N (n + m) \<le> N n + N m"
 proof (rule sums_le)
   let ?I = "\<lambda>n k. if k = 0 \<or> int k dvd n then 0 else 1 / q ^ k"
   show "?I (n + m) sums N (n + m)"
     by (rule N_sums)
   show "(\<lambda>k. ?I n k + ?I m k) sums (N n + N m)"
     by (intro sums_add N_sums)
-  show "\<forall>k. ?I (n + m) k \<le> ?I n k + ?I m k"
-    using q_gt_1 by auto
-qed
+qed (use q_gt_1 in auto)
 
 lemma N_1: "N 1 = 1 / (q * (q - 1))"
 proof (rule sums_unique2)
   have "(\<lambda>k. if k = 0 \<or> int k dvd 1 then 0 else 1 / q ^ k) sums N 1"
     by (rule N_sums)
   also have "(\<lambda>k. if k = 0 \<or> int k dvd 1 then 0 else 1 / q ^ k) =
                (\<lambda>k. if k \<in> {0, 1} then 0 else (1 / q) ^ k)"
     by (simp add: power_divide cong: if_cong)
   finally show "(\<lambda>k. if k \<in> {0, 1} then 0 else (1 / q) ^ k) sums N 1" .
 
   have "(\<lambda>k. if k \<in> {0, 1} then 0 else (1 / q) ^ k) sums
                  (1 / (1 - 1 / q) + (- (1 / q) - 1))"
     by (rule sums_If_finite_set'[OF geometric_sums]) (use q_gt_1 in auto)
   also have "\<dots> = 1 / (q * (q - 1))"
     using q_gt_1 by (simp add: field_simps)
   finally show "(\<lambda>k. if k \<in> {0, 1} then 0 else (1 / q) ^ k) sums \<dots>" .
 qed
 
 text \<open>
   It follows directly from the definition that norms fulfil a kind of monotonicity property
   with respect to divisibility: the norm of a number is at most as large as the norm of any of
   its factors:
 \<close>
 lemma N_dvd_mono:
   assumes "m dvd n"
   shows   "N n \<le> N m"
-proof (rule sums_le[OF allI N_sums N_sums])
+proof (rule sums_le[OF _ N_sums N_sums])
   fix k :: nat
   show "(if k = 0 \<or> int k dvd n then 0 else 1 / q ^ k) \<le>
         (if k = 0 \<or> int k dvd m then 0 else 1 / q ^ k)"
     using q_gt_1 assms by auto
 qed
 
 text \<open>
   In particular, this means that 1 and -1 have the greatest norm.
 \<close>
 lemma N_le_N_1: "N n \<le> N 1"
   by (rule N_dvd_mono) auto
 
 text \<open>
   Primes have relatively large norms, almost reaching the norm of 1:
 \<close>
 lemma N_prime:
   assumes "prime p"
   shows   "N p = N 1 - 1 / q ^ nat p"
 proof (rule sums_unique2)
   define p' where "p' = nat p"
   have p: "p = int p'"
     using assms by (auto simp: p'_def prime_ge_0_int)
   have "prime p'"
     using assms by (simp add: p)
 
   have "(\<lambda>k. if k = 0 \<or> int k dvd p then 0 else 1 / q ^ k) sums N p"
     by (rule N_sums)
   also have "int k dvd p \<longleftrightarrow> k \<in> {1, p'}" for k
     using assms by (auto simp: p prime_nat_iff)
   hence "(\<lambda>k. if k = 0 \<or> int k dvd p then 0 else 1 / q ^ k) =
          (\<lambda>k. if k \<in> {0, 1, p'} then 0 else (1 / q) ^ k)"
     using assms q_gt_1 by (simp add: power_divide cong: if_cong)
   finally show "\<dots> sums N p" .
 
   have "(\<lambda>k. if k \<in> {0, 1, p'} then 0 else (1 / q) ^ k) sums
                  (1 / (1 - 1 / q) + (- (1 / q) - (1 / q) ^ p' - 1))"
     by (rule sums_If_finite_set'[OF geometric_sums])
        (use \<open>prime p'\<close> q_gt_1 prime_gt_Suc_0_nat[of p'] in \<open>auto simp: \<close>)
   also have "\<dots> = N 1 - 1 / q ^ p'"
     using q_gt_1 by (simp add: field_simps N_1)
   finally show "(\<lambda>k. if k \<in> {0, 1, p'} then 0 else (1 / q) ^ k) sums \<dots>" .
 qed
 
 lemma N_2: "N 2 = 1 / (q ^ 2 * (q - 1))"
   using q_gt_1 by (auto simp: N_prime N_1 field_simps power2_eq_square)
 
 lemma N_less_N_1:
   assumes "n \<noteq> 1" "n \<noteq> -1"
   shows   "N n < N 1"
 proof (cases "n = 0")
   case False
   then obtain p where p: "prime p" "p dvd n"
     using prime_divisor_exists[of n] assms by force
   hence "N n \<le> N p" by (intro N_dvd_mono)
   also from p have "N p < N 1"
     using q_gt_1 by (simp add: N_prime)
   finally show ?thesis .
 qed (use q_gt_1 in \<open>auto simp: N_1\<close>)
 
 text \<open>
   Composites, on the other hand, do not achieve this:
 \<close>
 lemma nonprime_imp_N_lt:
   assumes "\<not>prime_elem n" "\<bar>n\<bar> \<noteq> 1" "n \<noteq> 0"
   shows   "N n < N 1 - 1 / q ^ nat \<bar>n\<bar>"
 proof -
   obtain p where p: "prime p" "p dvd n"
     using prime_divisor_exists[of n] assms by auto
   define p' where "p' = nat p"
   have p': "p = int p'"
     using p by (auto simp: p'_def prime_ge_0_int)
   have "prime p'"
     using p by (simp add: p')
 
   define n' where "n' = nat \<bar>n\<bar>"
   have "n' > 1"
     using assms by (auto simp: n'_def)
 
   have "N n \<le> 1 / (q * (q - 1)) - 1 / q ^ p' - 1 / q ^ n'"
   proof (rule sums_le)
     show "(\<lambda>k. if k = 0 \<or> int k dvd n then 0 else 1 / q ^ k) sums N n"
       by (rule N_sums)
   next
     from assms p have "n' \<noteq> p'"
       by (auto simp: n'_def p'_def nat_eq_iff)
     hence "(\<lambda>k. if k \<in> {0, 1, p', n'} then 0 else (1 / q) ^ k) sums
                    (1 / (1 - 1 / q) + (- (1 / q) - (1 / q) ^ p' - (1 / q) ^ n' - 1))"
       by (intro sums_If_finite_set'[OF geometric_sums])
          (use \<open>prime p'\<close> q_gt_1 prime_gt_Suc_0_nat[of p'] \<open>n' > 1\<close> in \<open>auto simp: \<close>)
     also have "\<dots> = 1 / (q * (q - 1)) - 1 / q ^ p' - 1 / q ^ n'"
       using q_gt_1 by (simp add: field_simps)
     finally show "(\<lambda>k. if k \<in> {0, 1, p', n'} then 0 else (1 / q) ^ k) sums \<dots>" .
   next
-    show " \<forall>na. (if na = 0 \<or> int na dvd n then 0 else 1 / q ^ na)
-         \<le> (if na \<in> {0, 1, p', n'} then 0 else (1 / q) ^ na)"
-      using q_gt_1 assms p by (auto simp: p'_def n'_def power_divide)
+    show "\<And>k. (if k = 0 \<or> int k dvd n then 0 else 1 / q ^ k)
+         \<le> (if k \<in> {0, 1, p', n'} then 0 else (1 / q) ^ k)"
+      using q_gt_1 p by (auto simp: p'_def n'_def power_divide)
   qed
   also have "\<dots> < 1 / (q * (q - 1)) - 1 / q ^ n'"
     using q_gt_1 by simp
   finally show ?thesis by (simp add: n'_def N_1)
 qed
 
 text \<open>
   This implies that one can use the norm as a primality test:
 \<close>
 lemma prime_iff_N_eq:
   assumes "n \<noteq> 0"
   shows   "prime_elem n \<longleftrightarrow> N n = N 1 - 1 / q ^ nat \<bar>n\<bar>"
 proof -
   have *: "prime_elem n \<longleftrightarrow> N n = N 1 - 1 / q ^ nat \<bar>n\<bar>" if "n > 0" for n
   proof -
     consider "n = 1" | "prime n" | "\<not>prime n" "n > 1"
       using \<open>n > 0\<close> by force
     thus ?thesis
     proof cases
       assume "n = 1"
       thus ?thesis using q_gt_1
         by (auto simp: N_1)
     next
       assume n: "\<not>prime n" "n > 1"
       with nonprime_imp_N_lt[of n] show ?thesis by simp
     qed (auto simp: N_prime prime_ge_0_int)
   qed
 
   show ?thesis
   proof (cases "n > 0")
     case True
     with * show ?thesis by blast
   next
     case False
     with *[of "-n"] assms show ?thesis by simp
   qed
 qed
 
 text \<open>
   Factorials, on the other hand, have very small norms:
 \<close>
 lemma N_fact_le: "N (fact m) \<le> 1 / (q - 1) * 1 / q ^ m"
-proof (rule sums_le[OF allI N_sums])
+proof (rule sums_le[OF _ N_sums])
   have "(\<lambda>k. 1 / q ^ k / q ^ Suc m) sums (q / (q - 1) / q ^ Suc m)"
     using geometric_sums[of "1 / q"] q_gt_1 
     by (intro sums_divide) (auto simp: field_simps)
   also have "(q / (q - 1) / q ^ Suc m) = 1 / (q - 1) * 1 / q ^ m"
     using q_gt_1 by (simp add: field_simps)
   also have "(\<lambda>k. 1 / q ^ k / q ^ Suc m) = (\<lambda>k. 1 / q ^ (k + Suc m))"
     using q_gt_1 by (simp add: field_simps power_add)
   also have "\<dots> = (\<lambda>k. if k + Suc m \<le> m then 0 else 1 / q ^ (k + Suc m))"
     by auto
   finally have "\<dots> sums (1 / (q - 1) * 1 / q ^ m)" .
   also have "?this \<longleftrightarrow> (\<lambda>k. if k \<le> m then 0 else 1 / q ^ k) sums (1 / (q - 1) * 1 / q ^ m)"
     by (rule sums_zero_iff_shift) auto
   finally show \<dots> .
 next
   fix k :: nat
   have "int k dvd fact m" if "k > 0" "k \<le> m"
   proof -
     have "int k dvd int (fact m)"
       unfolding int_dvd_int_iff using that by (simp add: dvd_fact)
     thus "int k dvd fact m"
       unfolding of_nat_fact by simp
   qed  
   thus "(if k = 0 \<or> int k dvd fact m then 0 else 1 / q ^ k) \<le>
         (if k \<le> m then 0 else 1 / q ^ k)" using q_gt_1 by auto
 qed
 
 lemma N_prime_mono:
   assumes "prime p" "prime p'" "p \<le> p'"
   shows   "N p \<le> N p'"
   using assms q_gt_1 by (auto simp add: N_prime field_simps nat_le_iff prime_ge_0_int)
 
 lemma N_prime_ge:
   assumes "prime p"
   shows   "N p \<ge> 1 / (q\<^sup>2 * (q - 1))"
 proof -
   have "1 / (q ^ 2 * (q - 1)) = N 2"
     using q_gt_1 by (auto simp: N_prime N_1 field_simps power2_eq_square)
   also have "\<dots> \<le> N p"
     using assms by (intro N_prime_mono) (auto simp: prime_ge_2_int)
   finally show ?thesis .
 qed
 
 lemma N_prime_elem_ge:
   assumes "prime_elem p"
   shows   "N p \<ge> 1 / (q\<^sup>2 * (q - 1))"
 proof (cases "p \<ge> 0")
   case True
   with assms N_prime_ge show ?thesis by auto
 next
   case False
   with assms N_prime_ge[of "-p"] show ?thesis by auto
 qed
 
 
 text \<open>
   Next, we use this norm to derive a metric:
 \<close>
 
 lift_definition dist :: "fbint \<Rightarrow> fbint \<Rightarrow> real" is
   "\<lambda>x y. N (x - y)" .
 
 lemma dist_self [simp]: "dist x x = 0"
   by transfer simp
 
 lemma dist_sym [simp]: "dist x y = dist y x"
   by transfer (simp add: N_minus_commute)
 
 lemma dist_pos: "x \<noteq> y \<Longrightarrow> dist x y > 0"
   by transfer (use N_pos in simp)
 
 lemma dist_eq_0_iff [simp]: "dist x y = 0 \<longleftrightarrow> x = y"
   using dist_pos[of x y] by (cases "x = y") auto
 
 lemma dist_triangle_ineq: "dist x z \<le> dist x y + dist y z"
 proof transfer
   fix x y z :: int
   show "N (x - z) \<le> N (x - y) + N (y - z)"
     using N_triangle_ineq[of "x - y" "y - z"] by simp
 qed
 
 
 text \<open>
   Lastly, we show that the metric we defined indeed induces the Furstenberg topology.
 \<close>
 theorem dist_induces_open:
   "open U \<longleftrightarrow> (\<forall>x\<in>U. \<exists>e>0. \<forall>y. dist x y < e \<longrightarrow> y \<in> U)"
 proof (transfer, safe)
   fix U :: "int set" and x :: int
   assume *: "\<forall>x\<in>U. \<exists>b>0. arith_prog x b \<subseteq> U"
   assume "x \<in> U"
   with * obtain b where b: "b > 0" "arith_prog x b \<subseteq> U" by blast
   define e where "e = 1 / q ^ b"
 
   show "\<exists>e>0. \<forall>y. N (x - y) < e \<longrightarrow> y \<in> U"
   proof (rule exI; safe?)
     show "e > 0" using q_gt_1 by (simp add: e_def)
   next
     fix y assume "N (x - y) < e"
     also have "\<dots> = 1 / q ^ b" by fact
     finally have "b dvd (x - y)"
       by (rule N_lt_imp_dvd) fact
     hence "y \<in> arith_prog x b"
       by (auto simp: arith_prog_def cong_iff_dvd_diff dvd_diff_commute)
     with b show "y \<in> U" by blast
   qed
 
 next
 
   fix U :: "int set" and x :: int
   assume *: "\<forall>x\<in>U. \<exists>e>0. \<forall>y. N (x - y) < e \<longrightarrow> y \<in> U"
   assume "x \<in> U"
   with * obtain e where e: "e > 0" "\<forall>y. N (x - y) < e \<longrightarrow> y \<in> U" by blast
   have "eventually (\<lambda>N. 1 / (q - 1) * 1 / q ^ N < e) at_top"
     using q_gt_1 \<open>e > 0\<close> by real_asymp
   then obtain m where m: "1 / (q - 1) * 1 / q ^ m < e"
     by (auto simp: eventually_at_top_linorder)
   define b :: nat where "b = fact m"
 
   have "arith_prog x b \<subseteq> U"
   proof
     fix y assume "y \<in> arith_prog x b"
     show "y \<in> U"
     proof (cases "y = x")
       case False
       from \<open>y \<in> arith_prog x b\<close> obtain n where y: "y = x + int b * n"
         by (auto simp: arith_prog_altdef)
       from y and \<open>y \<noteq> x\<close> have [simp]: "n \<noteq> 0" by auto
       have "N (x - y) = N (int b * n)" by (simp add: y)
       also have "\<dots> \<le> N (int b)"
         by (rule N_dvd_mono) auto
       also have "\<dots> \<le> 1 / (q - 1) * 1 / q ^ m"
         using N_fact_le by (simp add: b_def)
       also have "\<dots> < e" by fact
       finally show "y \<in> U" using e by auto
     qed (use \<open>x \<in> U\<close> in auto)
   qed
   moreover have "b > 0" by (auto simp: b_def)
   ultimately show "\<exists>b>0. arith_prog x b \<subseteq> U"
     by blast
 qed
   
 end
 
 
 text \<open>
   We now show that the Furstenberg space is a metric space with this metric (with \<open>q = 2\<close>),
   which essentially only amounts to plugging together all the results from above.
 \<close>
 
 interpretation fb: fbnorm 2
   by standard auto
 
 
 instantiation fbint :: dist
 begin
 
 definition dist_fbint where "dist_fbint = fb.dist"
 
 instance ..
 
 end
 
 
 instantiation fbint :: uniformity_dist
 begin
 
 definition uniformity_fbint :: "(fbint \<times> fbint) filter" where
   "uniformity_fbint = (INF e\<in>{0 <..}. principal {(x, y). dist x y < e})"
 
 instance by standard (simp add: uniformity_fbint_def)
 
 end
 
 
 instance fbint :: open_uniformity
 proof
   fix U :: "fbint set"
   show "open U = (\<forall>x\<in>U. eventually (\<lambda>(x',y). x' = x \<longrightarrow> y \<in> U) uniformity)"
     unfolding eventually_uniformity_metric dist_fbint_def
     using fb.dist_induces_open by simp
 qed
 
 
 instance fbint :: metric_space
   by standard (use fb.dist_triangle_ineq in \<open>auto simp: dist_fbint_def\<close>)
 
 text \<open>
   In particular, we can now show that the sequence \<open>n!\<close> tends to 0 in the Furstenberg topology:
 \<close>
 lemma tendsto_fbint_fact: "(\<lambda>n. fbint (fact n)) \<longlonglongrightarrow> fbint 0"
 proof -
   have "(\<lambda>n. dist (fbint (fact n)) (fbint 0)) \<longlonglongrightarrow> 0"
   proof (rule tendsto_sandwich[OF always_eventually always_eventually]; safe?)
     fix n :: nat
     show "dist (fbint (fact n)) (fbint 0) \<le> 1 / 2 ^ n"
       unfolding dist_fbint_def by (transfer fixing: n) (use fb.N_fact_le[of n] in simp)
     show "dist (fbint (fact n)) (fbint 0) \<ge> 0"
       by simp
     show "(\<lambda>n. 1 / 2 ^ n :: real) \<longlonglongrightarrow> 0"
       by real_asymp
   qed simp_all
   thus ?thesis
     using tendsto_dist_iff by metis
 qed
 
 end
diff --git a/thys/Irrational_Series_Erdos_Straus/Irrational_Series_Erdos_Straus.thy b/thys/Irrational_Series_Erdos_Straus/Irrational_Series_Erdos_Straus.thy
--- a/thys/Irrational_Series_Erdos_Straus/Irrational_Series_Erdos_Straus.thy
+++ b/thys/Irrational_Series_Erdos_Straus/Irrational_Series_Erdos_Straus.thy
@@ -1,2020 +1,2017 @@
 (* Title:      Irrational_Series_Erdos_Straus.thy
    Author:     Angeliki Koutsoukou-Argyraki and Wenda Li, University of Cambridge, UK.
 
 We formalise certain irrationality criteria for infinite series by P. Erdos and E.G. Straus.
 In particular, we formalise Theorem 2.1, Corollary 2.10 and Theorem 3.1 in [1]. The latter is an 
 application of Theorem 2.1 involving the prime numbers.
 
 References:
 [1]  P. Erdos and E.G. Straus, On the irrationality of certain series, Pacific Journal of 
 Mathematics, Vol. 55, No 1, 1974  https://projecteuclid.org/euclid.pjm/1102911140
 *)
 
 theory "Irrational_Series_Erdos_Straus" imports
   Prime_Number_Theorem.Prime_Number_Theorem
   Prime_Distribution_Elementary.PNT_Consequences
 begin
 
 section \<open>Miscellaneous\<close>
 
 lemma suminf_comparison:
-  assumes "summable f" and "\<forall>n. norm (g n) \<le> f n"
+  assumes "summable f" and gf: "\<And>n. norm (g n) \<le> f n"
   shows "suminf g \<le> suminf f"
 proof (rule suminf_le)
-  show "\<forall>n. g n \<le> f n" 
-    apply rule
-    subgoal for n using assms(2)[rule_format,of n] by auto
-    done
-  show "summable g" 
-    apply (rule summable_comparison_test'[OF \<open>summable f\<close>, of 0])
-    using assms(2) by auto
+  show "g n \<le> f n" for n
+    using gf[of n] by auto
+  show "summable g"
+    using assms summable_comparison_test' by blast 
   show "summable f" using assms(1) .
 qed
 
 lemma tendsto_of_int_diff_0:
   assumes "(\<lambda>n. f n - of_int(g n)) \<longlonglongrightarrow> (0::real)" "\<forall>\<^sub>F n in sequentially. f n > 0"
   shows "\<forall>\<^sub>F n in sequentially. 0 \<le> g n"
 proof -
   have "\<forall>\<^sub>F n in sequentially. \<bar>f n - of_int(g n)\<bar> < 1 / 2" 
     using assms(1)[unfolded tendsto_iff,rule_format,of "1/2"] by auto
   then show ?thesis using assms(2)
     apply eventually_elim
     by linarith
 qed
 
 lemma eventually_mono_sequentially:
   assumes "eventually P sequentially"
   assumes "\<And>x. P (x+k) \<Longrightarrow> Q (x+k)"
   shows "eventually Q sequentially"
   using sequentially_offset[OF assms(1),of k]
   apply (subst eventually_sequentially_seg[symmetric,of _ k])
   apply (elim eventually_mono)
   by fact
 
 lemma frequently_eventually_at_top:
   fixes P Q::"'a::linorder \<Rightarrow> bool"
   assumes "frequently P at_top" "eventually Q at_top"
   shows "frequently (\<lambda>x. P x \<and> (\<forall>y\<ge>x. Q y) ) at_top"
   using assms
   unfolding frequently_def eventually_at_top_linorder 
   by (metis (mono_tags, hide_lams) le_cases order_trans)
 
 lemma eventually_at_top_mono:
   fixes P Q::"'a::linorder \<Rightarrow> bool"
   assumes event_P:"eventually P at_top"
   assumes PQ_imp:"\<And>x. x\<ge>z \<Longrightarrow> \<forall>y\<ge>x. P y \<Longrightarrow> Q x"
   shows "eventually Q at_top"
 proof -
   obtain N where N_P:"\<forall>n\<ge>N. P n"
     using event_P[unfolded eventually_at_top_linorder] by auto
   define N' where "N' = max N z"
   have "Q x" when "x\<ge>N'" for x 
     apply (rule PQ_imp)
     using N_P that unfolding N'_def by auto
   then show ?thesis unfolding eventually_at_top_linorder
     by auto
 qed
 
 lemma frequently_at_top_elim:
   fixes P Q::"'a::linorder \<Rightarrow> bool"
   assumes "\<exists>\<^sub>Fx in at_top. P x"
   assumes "\<And>i. P i \<Longrightarrow> \<exists>j>i. Q j"
   shows "\<exists>\<^sub>Fx in at_top. Q x"
   using assms unfolding frequently_def eventually_at_top_linorder 
   by (meson leD le_cases less_le_trans)
 
 lemma less_Liminf_iff:
   fixes X :: "_ \<Rightarrow> _ :: complete_linorder"
   shows "Liminf F X < C \<longleftrightarrow> (\<exists>y<C. frequently (\<lambda>x. y \<ge> X x) F)"
   apply (subst Not_eq_iff[symmetric])
   apply (simp add:not_less not_frequently not_le le_Liminf_iff)
   by force
 
 lemma sequentially_even_odd_imp:
   assumes "\<forall>\<^sub>F N in sequentially. P (2*N)" "\<forall>\<^sub>F N in sequentially. P (2*N+1)"
   shows "\<forall>\<^sub>F n in sequentially. P n"
 proof -
   obtain N where N_P:"\<forall>x\<ge>N.  P (2 * x) \<and> P (2 * x + 1)"
     using eventually_conj[OF assms] 
     unfolding eventually_at_top_linorder by auto
   define N' where "N'=2*N "
   have "P n" when "n\<ge>2*N" for n
   proof -
     define n' where "n'= n div 2"
     then have "n'\<ge>N" using that by auto
     then have "P (2 * n') \<and> P (2 * n' + 1)"
       using N_P by auto
     then show ?thesis unfolding n'_def
       apply (cases "even n")
       by auto
   qed
   then show ?thesis unfolding eventually_at_top_linorder by auto
 qed
 
 
 section \<open>Theorem 2.1 and Corollary 2.10\<close>
 
 context
   fixes a b ::"nat\<Rightarrow>int "
   assumes a_pos:"\<forall> n. a n >0 " and a_large:"\<forall>\<^sub>F n in sequentially. a n > 1" 
     and ab_tendsto: "(\<lambda>n. \<bar>b n\<bar> / (a (n-1)*a n)) \<longlonglongrightarrow> 0"
 begin
 
 private lemma aux_series_summable: "summable (\<lambda>n. b n / (\<Prod>k\<le>n. a k))" 
 proof -
   have "\<forall>e>0. \<forall>\<^sub>F x in sequentially. \<bar>b x\<bar> / (a (x-1) * a x) < e"
     using ab_tendsto[unfolded tendsto_iff] 
     apply (simp add:of_int_abs[symmetric] abs_mult del:of_int_abs)
     by (subst (asm) (2) abs_of_pos,use \<open>\<forall> n. a n > 0\<close> in auto)+                 
   from this[rule_format,of 1]
   have "\<forall>\<^sub>F x in sequentially. \<bar>real_of_int(b x)\<bar> < (a (x-1) * a x)"
     using \<open>\<forall> n. a n >0\<close> by auto
   moreover have "\<forall>n. (\<Prod>k\<le>n. real_of_int (a k)) > 0" 
     using a_pos by (auto intro!:linordered_semidom_class.prod_pos)
   ultimately have "\<forall>\<^sub>F n in sequentially. \<bar>b n\<bar> / (\<Prod>k\<le>n. a k) 
                         < (a (n-1) * a n) / (\<Prod>k\<le>n. a k)"
     apply (elim eventually_mono)
     by (auto simp add:field_simps)
   moreover have "\<bar>b n\<bar> / (\<Prod>k\<le>n. a k) = norm (b n / (\<Prod>k\<le>n. a k))" for n 
     using \<open>\<forall>n. (\<Prod>k\<le>n. real_of_int (a k)) > 0\<close>[rule_format,of n] by auto
   ultimately have "\<forall>\<^sub>F n in sequentially. norm (b n / (\<Prod>k\<le>n. a k)) 
                         < (a (n-1) * a n) / (\<Prod>k\<le>n. a k)"
     by algebra
   moreover have "summable (\<lambda>n. (a (n-1) * a n) / (\<Prod>k\<le>n. a k))" 
   proof -
     obtain s where a_gt_1:"\<forall> n\<ge>s. a n >1"
       using a_large[unfolded eventually_at_top_linorder] by auto
     define cc where "cc= (\<Prod>k<s. a k)"
     have "cc>0" 
       unfolding cc_def
       apply (rule linordered_semidom_class.prod_pos)
       using a_pos by auto
     have "(\<Prod>k\<le>n+s. a k) \<ge> cc * 2^n" for n
     proof -
       have "prod a {s..<Suc (s + n)} \<ge> 2^n"
       proof (induct n)
         case 0
         then show ?case using a_gt_1 by auto
       next
         case (Suc n)
         moreover have "a (s + Suc n) \<ge> 2" 
           using a_gt_1 by (smt le_add1)
         ultimately show ?case 
           apply (subst prod.atLeastLessThan_Suc,simp)
           using mult_mono'[of 2 "a (Suc (s + n))" " 2 ^ n" "prod a {s..<Suc (s + n)}",simplified] 
           by (simp add: mult.commute)
       qed
       moreover have "prod a {0..(n + s)} =
             prod a {..<s} * prod a {s..<Suc (s + n)} "
         using prod.atLeastLessThan_concat[of 0 s "s+n+1" a,simplified]
         apply (simp add: atLeastLessThanSuc_atLeastAtMost algebra_simps
             atLeast0LessThan)
         by (smt a_gt_1 le_add2 lessThan_atLeast0 mult.left_commute prod.last_plus zero_le)
       ultimately show ?thesis
         using \<open>cc>0\<close> unfolding cc_def by (simp add: atLeast0AtMost)
     qed
     then have "1/(\<Prod>k\<le>n+s. a k) \<le> 1/(cc * 2^n)" for n
     proof -
       assume asm:"\<And>n. cc * 2 ^ n \<le> prod a {..n + s}"
       then have "real_of_int (cc * 2 ^ n) \<le> prod a {..n + s}" using of_int_le_iff by blast
       moreover have "prod a {..n + s} >0" using \<open>cc>0\<close> by (simp add: a_pos prod_pos)
       ultimately show ?thesis using \<open>cc>0\<close> 
         by (auto simp:field_simps simp del:of_int_prod)
     qed
     moreover have "summable (\<lambda>n. 1/(cc * 2^n))"
     proof -
       have "summable (\<lambda>n. 1/(2::int)^n)"
         using summable_geometric[of "1/(2::int)"] by (simp add:power_one_over)
       from summable_mult[OF this,of "1/cc"] show ?thesis by auto
     qed
     ultimately have "summable (\<lambda>n. 1 / (\<Prod>k\<le>n+s. a k))"
       apply (elim summable_comparison_test'[where N=0])
       apply (unfold real_norm_def, subst abs_of_pos)
       by (auto simp add: \<open>\<forall>n. 0 < (\<Prod>k\<le>n. real_of_int (a k))\<close>)
     then have "summable (\<lambda>n. 1 / (\<Prod>k\<le>n. a k))"
       apply (subst summable_iff_shift[where k=s,symmetric])
       by simp
     then have "summable (\<lambda>n. (a (n+1) * a (n+2)) / (\<Prod>k\<le>n+2. a k))"
     proof -
       assume asm:"summable (\<lambda>n. 1 / real_of_int (prod a {..n}))"
       have "1 / real_of_int (prod a {..n}) = (a (n+1) * a (n+2)) / (\<Prod>k\<le>n+2. a k)" for n 
       proof -
         have "a (Suc (Suc n)) \<noteq> 0" "a (Suc n) \<noteq>0" 
           using a_pos by (metis less_irrefl)+
         then show ?thesis 
           by (simp add: atLeast0_atMost_Suc atMost_atLeast0)
       qed
       then show ?thesis using asm by auto
     qed
     then show "summable (\<lambda>n. (a (n-1) * a n) / (\<Prod>k\<le>n. a k))"
       apply (subst summable_iff_shift[symmetric,of _ 2])
       by auto
   qed
   ultimately show ?thesis 
     apply (elim summable_comparison_test_ev[rotated])
     by (simp add: eventually_mono)
 qed
 
 private fun get_c::"(nat \<Rightarrow> int) \<Rightarrow> (nat \<Rightarrow> int) \<Rightarrow> int \<Rightarrow> nat \<Rightarrow> (nat \<Rightarrow> int)" where
   "get_c a' b' B N 0 = round (B * b' N / a' N)"|
   "get_c a' b' B N (Suc n) = get_c a' b' B N n * a' (n+N) - B * b' (n+N)"
 
 lemma ab_rationality_imp:
   assumes ab_rational:"(\<Sum>n. (b n / (\<Prod>i \<le> n. a i))) \<in> \<rat>"
   shows "\<exists> (B::int)>0. \<exists> c::nat\<Rightarrow> int.
             (\<forall>\<^sub>F n in sequentially. B*b n = c n * a n - c(n+1) \<and> \<bar>c(n+1)\<bar><a n/2)
             \<and> (\<lambda>n. c (Suc n) / a n) \<longlonglongrightarrow> 0"
 proof -
   have [simp]:"a n \<noteq> 0" for n using a_pos by (metis less_numeral_extra(3))
   obtain A::int and B::int where 
     AB_eq:"(\<Sum>n. real_of_int (b n) / real_of_int (prod a {..n})) = A / B" and "B>0"
   proof -
     obtain q::rat where "(\<Sum>n. real_of_int (b n) / real_of_int (prod a {..n})) = real_of_rat q"
       using ab_rational by (rule Rats_cases) simp
     moreover obtain A::int and B::int where "q = Rat.Fract A B" "B > 0" "coprime A B"
       by (rule Rat_cases) auto
     ultimately show ?thesis by (auto intro!: that[of A B] simp:of_rat_rat)
   qed  
   define f where "f = (\<lambda>n.  b n / real_of_int (prod a {..n}))"
   define R where "R = (\<lambda>N. (\<Sum>n. B*b (n+N+1) / prod a {N..n+N+1}))"
   have all_e_ubound:"\<forall>e>0. \<forall>\<^sub>F M in sequentially. \<forall>n. \<bar>B*b (n+M+1) / prod a {M..n+M+1}\<bar> < e/4 * 1/2^n"
   proof safe
     fix e::real assume "e>0"
     obtain N where N_a2: "\<forall>n \<ge> N. a n \<ge> 2" 
       and N_ba: "\<forall>n \<ge> N. \<bar>b n\<bar> / (a (n-1) * a n)  < e/(4*B)"
     proof -
       have "\<forall>\<^sub>F n in sequentially. \<bar>b n\<bar> / (a (n - 1) * a n) < e/(4*B)" 
         using order_topology_class.order_tendstoD[OF ab_tendsto,of "e/(4*B)"] \<open>B>0\<close> \<open>e>0\<close>
         by auto
       moreover have "\<forall>\<^sub>F n in sequentially. a n \<ge> 2"
         using a_large by (auto elim: eventually_mono)
       ultimately have "\<forall>\<^sub>F n in sequentially. \<bar>b n\<bar> / (a (n - 1) * a n) < e/(4*B) \<and> a n \<ge> 2" 
         by eventually_elim auto
       then show ?thesis unfolding eventually_at_top_linorder using that
         by auto
     qed
     have geq_N_bound:"\<bar>B*b (n+M+1) / prod a {M..n+M+1}\<bar> < e/4 * 1/2^n" when "M\<ge>N" for n M   
     proof -
       define D where "D = B*b (n+M+1)/ (a (n+M) * a (n+M+1))"
       have "\<bar>B*b (n+M+1) / prod a {M..n+M+1}\<bar> = \<bar>D / prod a {M..<n+M}\<bar>"
       proof -
         have "{M..n+M+1} = {M..<n+M} \<union> {n+M,n+M+1}" by auto
         then have "prod a {M..n+M+1} = a (n+M) * a (n+M+1)* prod a {M..<n+M}" by simp
         then show ?thesis unfolding D_def by (simp add:algebra_simps)
       qed
       also have "... <  \<bar>e/4 * (1/prod a {M..<n+M})\<bar>"
       proof -
         have "\<bar>D\<bar> < e/ 4" 
           unfolding D_def using N_ba[rule_format, of "n+M+1"] \<open>B>0\<close> \<open>M \<ge> N\<close> \<open>e>0\<close> a_pos
           by (auto simp:field_simps abs_mult abs_of_pos)
         from mult_strict_right_mono[OF this,of "1/prod a {M..<n+M}"] a_pos \<open>e>0\<close>
         show ?thesis 
           apply (auto simp:abs_prod abs_mult prod_pos)
           by (subst (2) abs_of_pos,auto)+
       qed
       also have "... \<le> e/4 * 1/2^n"
       proof -
         have "prod a {M..<n+M} \<ge> 2^n"
         proof (induct n)
           case 0
           then show ?case by simp
         next
           case (Suc n)
           then show ?case 
             using \<open>M\<ge>N\<close> by (simp add: N_a2 mult.commute mult_mono' prod.atLeastLessThan_Suc)
         qed
         then have "real_of_int (prod a {M..<n+M}) \<ge> 2^n" 
           using numeral_power_le_of_int_cancel_iff by blast
         then show ?thesis using \<open>e>0\<close> by (auto simp add:divide_simps)
       qed
       finally show ?thesis .
     qed
     show "\<forall>\<^sub>F M in sequentially. \<forall>n. \<bar>real_of_int (B * b (n + M + 1)) 
                 / real_of_int (prod a {M..n + M + 1})\<bar> < e / 4 * 1 / 2 ^ n"
       apply (rule eventually_sequentiallyI[of N])
       using geq_N_bound by blast
   qed
   have R_tendsto_0:"R \<longlonglongrightarrow> 0"
   proof (rule tendstoI)
     fix e::real assume "e>0"
     show "\<forall>\<^sub>F x in sequentially. dist (R x) 0 < e" using all_e_ubound[rule_format,OF \<open>e>0\<close>]
     proof eventually_elim
       case (elim M)
       define g where "g = (\<lambda>n. B*b (n+M+1) / prod a {M..n+M+1})"
       have g_lt:"\<bar>g n\<bar> < e/4 * 1/2^n" for n
         using elim unfolding g_def by auto
       have g_abs_summable:"summable (\<lambda>n. \<bar>g n\<bar>)"
       proof -
         have "summable (\<lambda>n. e/4 * 1/2^n)" 
           using summable_geometric[of "1/2",THEN summable_mult,of "e/4",simplified]
           by (auto simp add:algebra_simps power_divide)
         then show ?thesis 
           apply (elim summable_comparison_test')
           using g_lt less_eq_real_def by auto
       qed
       have "\<bar>\<Sum>n. g n\<bar> \<le> (\<Sum>n. \<bar>g n\<bar>)" by (rule summable_rabs[OF g_abs_summable])
       also have "... \<le>(\<Sum>n. e/4 * 1/2^n)"
       proof (rule suminf_comparison)
         show "summable (\<lambda>n. e/4 * 1/2^n)" 
           using summable_geometric[of "1/2",THEN summable_mult,of "e/4",simplified]
           by (auto simp add:algebra_simps power_divide)
-        show "\<forall>n. norm \<bar>g n\<bar> \<le> e / 4 * 1 / 2 ^ n" using g_lt less_eq_real_def by auto
+        show "\<And>n. norm \<bar>g n\<bar> \<le> e / 4 * 1 / 2 ^ n" using g_lt less_eq_real_def by auto
       qed
       also have "... = (e/4) * (\<Sum>n. (1/2)^n)"
         apply (subst suminf_mult[symmetric])
         subgoal 
           apply (rule complete_algebra_summable_geometric)
           by simp
         subgoal by (auto simp:algebra_simps power_divide)
         done
       also have "... = e/2" by (simp add:suminf_geometric[of "1/2"])
       finally have "\<bar>\<Sum>n. g n\<bar> \<le> e / 2" .
       then show "dist (R M) 0 < e" unfolding R_def g_def using \<open>e>0\<close> by auto
     qed
   qed
 
   obtain N where R_N_bound:"\<forall>M \<ge> N. \<bar>R M\<bar> \<le>  1 / 4"
     and N_geometric:"\<forall>M\<ge>N. \<forall>n. \<bar>real_of_int (B * b (n + M + 1)) / (prod a {M..n + M + 1})\<bar> < 1 / 2 ^ n"
   proof -
     obtain N1 where N1:"\<forall>M \<ge> N1. \<bar>R M\<bar> \<le>  1 / 4"
       using metric_LIMSEQ_D[OF R_tendsto_0,of "1/4"] all_e_ubound[rule_format,of 4,unfolded eventually_sequentially]
       by (auto simp:less_eq_real_def)
     obtain N2 where N2:"\<forall>M\<ge>N2. \<forall>n. \<bar>real_of_int (B * b (n + M + 1)) 
                           / (prod a {M..n + M + 1})\<bar> < 1 / 2 ^ n"
       using all_e_ubound[rule_format,of 4,unfolded eventually_sequentially]
       by (auto simp:less_eq_real_def)
     define N where "N=max N1 N2"
     show ?thesis using that[of N] N1 N2 unfolding N_def by simp
   qed
 
   define C where "C = B * prod a {..<N} * (\<Sum>n<N. f n)"
   have "summable f"
     unfolding f_def using aux_series_summable .
   have "A * prod a {..<N} = C + B * b N / a N  + R N" 
   proof -
     have "A * prod a {..<N} = B * prod a {..<N} * (\<Sum>n. f n)"
       unfolding AB_eq f_def using \<open>B>0\<close> by auto
     also have "... = B * prod a {..<N} * ((\<Sum>n<N+1. f n) + (\<Sum>n. f (n+N+1)))"
       using suminf_split_initial_segment[OF \<open>summable f\<close>, of "N+1"] by auto
     also have "... = B * prod a {..<N} * ((\<Sum>n<N. f n) + f N + (\<Sum>n. f (n+N+1)))"
       using sum.atLeast0_lessThan_Suc by simp
     also have "... = C + B * b N / a N + (\<Sum>n. B*b (n+N+1) / prod a {N..n+N+1})"
     proof -
       have "B * prod a {..<N} * f N = B * b N / a N" 
       proof -
         have "{..N} =  {..<N} \<union> {N}" using ivl_disj_un_singleton(2) by blast
         then show ?thesis unfolding f_def by auto
       qed
       moreover have "B * prod a {..<N} * (\<Sum>n. f (n+N+1)) = (\<Sum>n. B*b (n+N+1) / prod a {N..n+N+1})"
       proof -
         have "summable (\<lambda>n. f (n + N + 1))" 
           using \<open>summable f\<close> summable_iff_shift[of f "N+1"] by auto
         moreover have "prod a {..<N} * f (n + N + 1) = b (n + N + 1) / prod a {N..n + N + 1}" for n
         proof -
           have "{..n + N + 1} = {..<N} \<union> {N..n + N + 1}" by auto
           then show ?thesis 
             unfolding f_def
             apply simp
             apply (subst prod.union_disjoint)
             by auto
         qed
         ultimately show ?thesis 
           apply (subst suminf_mult[symmetric])
           by (auto simp add: mult.commute mult.left_commute)
       qed
       ultimately show ?thesis unfolding C_def by (auto simp:algebra_simps)
     qed
     also have "... = C +B * b N / a N  + R N"
       unfolding R_def by simp
     finally show ?thesis .
   qed
   have R_bound:"\<bar>R M\<bar> \<le> 1 / 4" and R_Suc:"R (Suc M) = a M * R M - B * b (Suc M) / a (Suc M)" 
     when "M \<ge> N" for M
   proof -
     define g where "g = (\<lambda>n. B*b (n+M+1) / prod a {M..n+M+1})"
     have g_abs_summable:"summable (\<lambda>n. \<bar>g n\<bar>)"
     proof -
       have "summable (\<lambda>n.(1::real)/2^n)" 
         using summable_geometric[of "(1::real)/2",simplified] 
         by (auto elim!: back_subst[of "summable"] simp:field_simps)
       moreover have "\<bar>g n\<bar> < 1/2^n" for n
         using N_geometric[rule_format,OF that] unfolding g_def by simp
       ultimately show ?thesis 
         apply (elim summable_comparison_test')
         using less_eq_real_def by auto
     qed
     show "\<bar>R M\<bar> \<le> 1 / 4" using R_N_bound[rule_format,OF that] .
     have "R M = (\<Sum>n. g n)" unfolding R_def g_def by simp
     also have "... = g 0 + (\<Sum>n. g (Suc n))"
       apply (subst suminf_split_head)
       using summable_rabs_cancel[OF g_abs_summable] by auto
     also have "... = g 0 + 1/a M * (\<Sum>n. a M * g (Suc n))"
       apply (subst suminf_mult)
       by (auto simp add: g_abs_summable summable_Suc_iff summable_rabs_cancel)
     also have "... = g 0 + 1/a M * R (Suc M)"
     proof -
       have "a M * g (Suc n) = B * b (n + M + 2) / prod a {Suc M..n + M + 2}" for n
       proof -
         have "{M..Suc (Suc (M + n))} = {M} \<union> {Suc M..Suc (Suc (M + n))}" by auto
         then show ?thesis 
           unfolding g_def using \<open>B>0\<close> by (auto simp add:algebra_simps)
       qed
       then have "(\<Sum>n. a M * g (Suc n)) = R (Suc M)"
         unfolding R_def by auto
       then show ?thesis by auto
     qed
     finally have "R M = g 0 + 1 / a M * R (Suc M)" .
     then have "R (Suc M) = a M * R M - g 0 * a M" 
       by (auto simp add:algebra_simps)
     moreover have "{M..Suc M} = {M,Suc M}" by auto
     ultimately show "R (Suc M) = a M * R M - B * b (Suc M) / a (Suc M)" 
       unfolding g_def by auto
   qed
 
   define c where "c = (\<lambda>n. if n\<ge>N then get_c a b B N (n-N) else undefined)"
   have c_rec:"c (n+1) = c n * a n -  B * b n" when "n \<ge> N" for n
     unfolding c_def using that by (auto simp:Suc_diff_le)
   have c_R:"c (Suc n) / a n = R n" when "n \<ge> N" for n
     using that
   proof (induct rule:nat_induct_at_least)
     case base
     have "\<bar> c (N+1) / a N \<bar> \<le> 1/2" 
     proof -
       have "c N = round (B * b N / a N)" unfolding c_def by simp
       moreover have "c (N+1) / a N = c N - B * b N / a N"
         using a_pos[rule_format,of N]
         by (auto simp add:c_rec[of N,simplified] divide_simps)
       ultimately show ?thesis using of_int_round_abs_le by auto
     qed        
     moreover have "\<bar>R N\<bar> \<le> 1 / 4" using R_bound[of N] by simp
     ultimately have "\<bar>c (N+1) / a N - R N \<bar> < 1" by linarith
     moreover have "c (N+1) / a N - R N \<in> \<int>"
     proof -
       have "c (N+1) / a N = c N - B * b N / a N"
         using a_pos[rule_format,of N]
         by (auto simp add:c_rec[of N,simplified] divide_simps)
       moreover have " B * b N / a N + R N \<in> \<int>" 
       proof -
         have "C = B * (\<Sum>n<N. prod a {..<N} * (b n / prod a {..n}))"
           unfolding C_def f_def by (simp add:sum_distrib_left algebra_simps)
         also have "... = B * (\<Sum>n<N. prod a {n<..<N} * b n)"
         proof -
           have "{..<N} = {n<..<N} \<union> {..n}" if "n<N" for n 
             by (simp add: ivl_disj_un_one(1) sup_commute that)
           then show ?thesis
             using \<open>B>0\<close> 
             apply simp
             apply (subst prod.union_disjoint)
             by auto
         qed
         finally have "C = real_of_int (B * (\<Sum>n<N. prod a {n<..<N} * b n))" .
         then have "C \<in> \<int>" using Ints_of_int by blast
         moreover note \<open>A * prod a {..<N} = C + B * b N / a N  + R N\<close>
         ultimately show ?thesis 
           by (metis Ints_diff Ints_of_int add.assoc add_diff_cancel_left')
       qed
       ultimately show ?thesis by (simp add: diff_diff_add)
     qed
     ultimately have "c (N+1) / a N - R N = 0"
       by (metis Ints_cases less_irrefl of_int_0 of_int_lessD)
     then show ?case by simp
   next
     case (Suc n)
     have "c (Suc (Suc n)) / a (Suc n) = c (Suc n) - B * b (Suc n) / a (Suc n)"
       apply (subst c_rec[of "Suc n",simplified])
       using \<open>N \<le> n\<close> by (auto simp add: divide_simps)
     also have "... = a n * R n - B * b (Suc n) / a (Suc n)"  
       using Suc by (auto simp: divide_simps)
     also have "... = R (Suc n)"
       using R_Suc[OF \<open>N \<le> n\<close>] by simp
     finally  show ?case .
   qed
   have ca_tendsto_zero:"(\<lambda>n. c (Suc n) / a n) \<longlonglongrightarrow> 0"
     using R_tendsto_0 
     apply (elim filterlim_mono_eventually)
     using c_R by (auto intro!:eventually_sequentiallyI[of N])
   have ca_bound:"\<bar>c (n + 1)\<bar> < a n / 2" when "n \<ge> N" for n
   proof -
     have "\<bar>c (Suc n)\<bar> / a n  = \<bar>c (Suc n) / a n\<bar>" using a_pos[rule_format,of n] by auto
     also have "... = \<bar>R n\<bar>" using c_R[OF that] by auto
     also have "... < 1/2" using R_bound[OF that] by auto
     finally have "\<bar>c (Suc n)\<bar> / a n < 1/2" .
     then show ?thesis using a_pos[rule_format,of n] by auto
   qed
 
 (* (* the following part corresponds to (2.7) (2.8) in the original paper, but turns out to be
         not necessary. *)
   have c_round:"c n = round (B * b n / a n)" when "n \<ge> N" for n
   proof (cases "n=N")
     case True
     then show ?thesis unfolding c_def by simp
   next
     case False
     with \<open>n\<ge>N\<close> obtain n' where n_Suc:"n=Suc n'" and "n' \<ge> N" 
       by (metis le_eq_less_or_eq lessE less_imp_le_nat)
     have "B * b n / a n = c n - R n"
     proof -
       have "R n = c n - B * b n / a n"
         using c_R[OF \<open>n'\<ge>N\<close>,symmetric,folded n_Suc] R_Suc[OF \<open>n'\<ge>N\<close>,folded n_Suc]
         by (auto simp:field_simps)
       then show ?thesis by (auto simp:field_simps)
     qed
     then have "\<bar>B * b n / a n - c n\<bar> = \<bar>R n\<bar>" by auto
     then have "\<bar>B * b n / a n - c n\<bar> < 1/2" using R_bound[OF \<open>n \<ge> N\<close>] by auto
     from round_unique'[OF this] show ?thesis by auto
   qed
   *)
   show "\<exists>B>0. \<exists>c. (\<forall>\<^sub>F n in sequentially. B * b n = c n * a n - c (n + 1) 
             \<and> real_of_int \<bar>c (n + 1)\<bar> < a n / 2) \<and> (\<lambda>n. c (Suc n) / a n) \<longlonglongrightarrow> 0"
     unfolding eventually_at_top_linorder
     apply (rule exI[of _ B],use \<open>B>0\<close> in simp)
     apply (intro exI[of _c] exI[of _ N])
     using c_rec ca_bound ca_tendsto_zero 
     by fastforce
 qed
 
 private lemma imp_ab_rational:
   assumes "\<exists> (B::int)>0. \<exists> c::nat\<Rightarrow> int.
               (\<forall>\<^sub>F n in sequentially. B*b n = c n * a n - c(n+1) \<and> \<bar>c(n+1)\<bar><a n/2)"
   shows "(\<Sum>n. (b n / (\<Prod>i \<le> n. a i))) \<in> \<rat>"
 proof -
   obtain B::int and c::"nat\<Rightarrow>int" and N::nat where "B>0" and  
     large_n:"\<forall>n\<ge>N. B * b n = c n * a n - c (n + 1) \<and> real_of_int \<bar>c (n + 1)\<bar> < a n / 2
                       \<and> a n\<ge>2"
   proof -
     obtain B c where "B>0" and event1:"\<forall>\<^sub>F n in sequentially. B * b n = c n * a n - c (n + 1) 
               \<and> real_of_int \<bar>c (n + 1)\<bar> < real_of_int (a n) / 2"
       using assms by auto
     from eventually_conj[OF event1 a_large,unfolded eventually_at_top_linorder]
     obtain N where "\<forall>n\<ge>N. (B * b n = c n * a n - c (n + 1) 
                         \<and> real_of_int \<bar>c (n + 1)\<bar> < real_of_int (a n) / 2) \<and> 2 \<le> a n"
       by fastforce
     then show ?thesis using that[of B N c] \<open>B>0\<close> by auto
   qed
   define f where "f=(\<lambda>n. real_of_int (b n) / real_of_int (prod a {..n}))"
   define S where "S = (\<Sum>n. f n)"
   have "summable f"
     unfolding f_def by (rule aux_series_summable)
   define C where "C=B*prod a {..<N} * (\<Sum>n<N. f n)"
   have "B*prod a {..<N} * S = C + real_of_int (c N)" 
   proof -
     define h1 where "h1= (\<lambda>n. (c (n+N) * a (n+N)) / prod a {N..n+N})"
     define h2 where "h2 = (\<lambda>n. c (n+N+1) / prod a {N..n+N})"
     have f_h12:"B*prod a {..<N}*f (n+N) = h1 n - h2 n" for n 
     proof -
       define g1 where "g1 = (\<lambda>n. B * b (n+N))"
       define g2 where "g2 = (\<lambda>n. prod a {..<N} / prod a {..n + N})"
       have "B*prod a {..<N}*f (n+N) = (g1 n * g2 n)"
         unfolding f_def g1_def g2_def by (auto simp:algebra_simps)
       moreover have "g1 n = c (n+N) * a (n+N) - c (n+N+1)" 
         using large_n[rule_format,of "n+N"] unfolding g1_def by auto
       moreover have "g2 n = (1/prod a {N..n+N})" 
       proof -
         have "prod a ({..<N} \<union> {N..n + N}) = prod a {..<N} * prod a {N..n + N}"
           apply (rule prod.union_disjoint[of "{..<N}" "{N..n+N}" a])
           by auto
         moreover have "prod a ({..<N} \<union> {N..n + N}) = prod a {..n+N}"
           by (simp add: ivl_disj_un_one(4))
         ultimately show ?thesis 
           unfolding g2_def
           apply simp
           using a_pos by (metis less_irrefl)
       qed
       ultimately have "B*prod a {..<N}*f (n+N) = (c (n+N) * a (n+N) - c (n+N+1)) / prod a {N..n+N}"
         by auto
       also have "... = h1 n - h2 n"
         unfolding h1_def h2_def by (auto simp:algebra_simps diff_divide_distrib)
       finally show ?thesis by simp
     qed
     have "B*prod a {..<N} * S = B*prod a {..<N} * ((\<Sum>n<N. f n) + (\<Sum>n. f (n+N)))"
       using suminf_split_initial_segment[OF \<open>summable f\<close>,of N] 
       unfolding S_def by (auto simp:algebra_simps)
     also have "... = C + B*prod a {..<N}*(\<Sum>n. f (n+N))"
       unfolding C_def by (auto simp:algebra_simps)
     also have "... = C + (\<Sum>n. h1 n - h2 n)"
       apply (subst suminf_mult[symmetric])
       subgoal using \<open>summable f\<close> by (simp add: summable_iff_shift)
       subgoal using f_h12 by auto
       done
     also have "... = C + h1 0"
     proof -
       have "(\<lambda>n. \<Sum>i\<le>n. h1 i - h2 i) \<longlonglongrightarrow> (\<Sum>i. h1 i - h2 i)"
       proof (rule summable_LIMSEQ')
         have "(\<lambda>i. h1 i - h2 i) = (\<lambda>i.  real_of_int (B * prod a {..<N}) * f (i + N))"
           using f_h12 by auto
         then show "summable (\<lambda>i. h1 i - h2 i)"
           using \<open>summable f\<close> by (simp add: summable_iff_shift summable_mult)
       qed
       moreover have "(\<Sum>i\<le>n. h1 i - h2 i)  = h1 0 - h2 n" for n
       proof (induct n)
         case 0
         then show ?case by simp
       next
         case (Suc n)
         have "(\<Sum>i\<le>Suc n. h1 i - h2 i) = (\<Sum>i\<le>n. h1 i - h2 i) + h1 (n+1) - h2 (n+1)"
           by auto
         also have "... =  h1 0 - h2 n + h1 (n+1) - h2 (n+1)" using Suc by auto
         also have "... = h1 0 - h2 (n+1)"
         proof -
           have "h2 n = h1 (n+1)"
             unfolding h2_def h1_def 
             apply (auto simp:prod.nat_ivl_Suc')
             using a_pos by (metis less_numeral_extra(3))
           then show ?thesis by auto
         qed
         finally show ?case by simp
       qed
       ultimately have "(\<lambda>n. h1 0 - h2 n) \<longlonglongrightarrow> (\<Sum>i. h1 i - h2 i)" by simp
       then have "h2 \<longlonglongrightarrow> (h1 0 -  (\<Sum>i. h1 i - h2 i))"
         apply (elim metric_tendsto_imp_tendsto)
         by (auto intro!:eventuallyI simp add:dist_real_def)
       moreover have "h2 \<longlonglongrightarrow> 0"
       proof -
         have h2_n:"\<bar>h2 n\<bar> < (1 / 2)^(n+1)" for n 
         proof -
           have "\<bar>h2 n\<bar> = \<bar>c (n + N + 1)\<bar> / prod a {N..n + N}"
             unfolding h2_def abs_divide
             using a_pos by (simp add: abs_of_pos prod_pos)
           also have "... < (a (N+n) / 2) / prod a {N..n + N}"
             unfolding h2_def
             apply (rule divide_strict_right_mono)
             subgoal using large_n[rule_format,of "N+n"] by (auto simp add:algebra_simps)
             subgoal using a_pos by (simp add: prod_pos)
             done
           also have "... = 1 / (2*prod a {N..<n + N})"
             apply (subst ivl_disj_un(6)[of N "n+N",symmetric])
             using a_pos[rule_format,of "N+n"] by (auto simp add:algebra_simps)
           also have "... \<le> (1/2)^(n+1)"
           proof (induct n)
             case 0
             then show ?case by auto
           next
             case (Suc n)
             define P where "P=1 / real_of_int (2 * prod a {N..<n + N})"
             have "1 / real_of_int (2 * prod a {N..<Suc n + N}) = P / a (n+N)"
               unfolding P_def by (auto simp add: prod.atLeastLessThan_Suc)
             also have "... \<le>  ( (1 / 2) ^ (n + 1) ) / a (n+N) "
               apply (rule divide_right_mono)
               subgoal unfolding P_def using Suc by auto
               subgoal by (simp add: a_pos less_imp_le)
               done
             also have "... \<le> ( (1 / 2) ^ (n + 1) ) / 2 "
               apply (rule divide_left_mono)
               using large_n[rule_format,of "n+N",simplified] by auto
             also have "... = (1 / 2) ^ (n + 2)" by auto
             finally show ?case by simp
           qed
           finally show ?thesis .
         qed
         have "(\<lambda>n. (1 / 2)^(n+1)) \<longlonglongrightarrow> (0::real)" 
           using tendsto_mult_right_zero[OF LIMSEQ_abs_realpow_zero2[of "1/2",simplified],of "1/2"]
           by auto
         then show ?thesis 
           apply (elim Lim_null_comparison[rotated])
           using h2_n less_eq_real_def by (auto intro!:eventuallyI)
       qed
       ultimately have "(\<Sum>i. h1 i - h2 i) = h1 0"
         using LIMSEQ_unique by fastforce
       then show ?thesis by simp
     qed
     also have "... = C + c N"
       unfolding h1_def using a_pos 
       by auto (metis less_irrefl)
     finally show ?thesis . 
   qed
   then have "S = (C + real_of_int (c N)) / (B*prod a {..<N})" 
     by (metis \<open>0 < B\<close> a_pos less_irrefl mult.commute mult_pos_pos 
         nonzero_mult_div_cancel_right of_int_eq_0_iff prod_pos)
   moreover have "... \<in> \<rat>"
     unfolding C_def f_def by (intro Rats_divide Rats_add Rats_mult Rats_of_int Rats_sum)
   ultimately show "S \<in> \<rat>" by auto
 qed
 
 theorem theorem_2_1_Erdos_Straus :
   "(\<Sum>n. (b n / (\<Prod>i \<le> n. a i))) \<in> \<rat> \<longleftrightarrow> (\<exists> (B::int)>0. \<exists> c::nat\<Rightarrow> int.
             (\<forall>\<^sub>F n in sequentially. B*b n = c n * a n - c(n+1) \<and> \<bar>c(n+1)\<bar><a n/2))"
   using ab_rationality_imp imp_ab_rational by auto
 
 text\<open>The following is a Corollary to Theorem 2.1.  \<close>
 
 corollary corollary_2_10_Erdos_Straus:
   assumes ab_event:"\<forall>\<^sub>F n in sequentially. b n > 0 \<and> a (n+1) \<ge> a n" 
     and ba_lim_leq:"lim (\<lambda>n. (b(n+1) - b n )/a n) \<le> 0" 
     and ba_lim_exist:"convergent (\<lambda>n. (b(n+1) - b n )/a n)"
     and "liminf (\<lambda>n. a n / b n) = 0 "
   shows "(\<Sum>n. (b n / (\<Prod>i \<le> n. a i))) \<notin> \<rat>"
 proof 
   assume "(\<Sum>n. (b n / (\<Prod>i \<le> n. a i))) \<in> \<rat>"
   then obtain B c where "B>0" and abc_event:"\<forall>\<^sub>F n in sequentially. B * b n = c n * a n - c (n + 1) 
           \<and> \<bar>c (n + 1)\<bar> < a n / 2" and ca_vanish: "(\<lambda>n. c (Suc n) / a n) \<longlonglongrightarrow> 0"
     using ab_rationality_imp by auto
 
   have bac_close:"(\<lambda>n. B * b n / a n - c n) \<longlonglongrightarrow> 0"
   proof -
     have "\<forall>\<^sub>F n in sequentially. B * b n - c n * a n + c (n + 1) = 0"
       using abc_event by (auto elim!:eventually_mono)
     then have "\<forall>\<^sub>F n in sequentially. (B * b n - c n * a n + c (n+1)) / a n = 0 "
       apply eventually_elim
       by auto
     then have "\<forall>\<^sub>F n in sequentially. B * b n / a n - c n  + c (n + 1) / a n = 0"
       apply eventually_elim
       using a_pos by (auto simp:divide_simps) (metis less_irrefl)
     then have "(\<lambda>n. B * b n / a n - c n  + c (n + 1) / a n) \<longlonglongrightarrow> 0"
       by (simp add: eventually_mono tendsto_iff)
     from tendsto_diff[OF this ca_vanish]  
     show ?thesis by auto
   qed
 
   have c_pos:"\<forall>\<^sub>F n in sequentially. c n > 0" 
   proof -
     from bac_close have *:"\<forall>\<^sub>F n in sequentially. c n \<ge> 0"
       apply (elim tendsto_of_int_diff_0)
       using ab_event a_large apply (eventually_elim) 
       using \<open>B>0\<close> by auto 
     show ?thesis
     proof (rule ccontr)
       assume "\<not> (\<forall>\<^sub>F n in sequentially. c n > 0)"
       moreover have "\<forall>\<^sub>F n in sequentially. c (Suc n) \<ge> 0 \<and> c n\<ge>0"
         using * eventually_sequentially_Suc[of "\<lambda>n. c n\<ge>0"] 
         by (metis (mono_tags, lifting) eventually_at_top_linorder le_Suc_eq)
       ultimately have "\<exists>\<^sub>F n in sequentially. c n = 0 \<and> c (Suc n) \<ge> 0"
         using eventually_elim2 frequently_def by fastforce
       moreover have "\<forall>\<^sub>F n in sequentially. b n > 0 \<and> B * b n = c n * a n - c (n + 1)"
         using ab_event abc_event by eventually_elim auto
       ultimately have "\<exists>\<^sub>F n in sequentially. c n = 0 \<and> c (Suc n) \<ge> 0 \<and> b n > 0 
                           \<and> B * b n = c n * a n - c (n + 1)"
         using frequently_eventually_frequently by fastforce
       from frequently_ex[OF this] 
       obtain n where "c n = 0" "c (Suc n) \<ge> 0" "b n > 0" 
         "B * b n = c n * a n - c (n + 1)"
         by auto
       then have "B * b n \<le> 0" by auto
       then show False using \<open>b n>0\<close> \<open>B > 0\<close> using mult_pos_pos not_le by blast
     qed
   qed
 
   have bc_epsilon:"\<forall>\<^sub>F n in sequentially. b (n+1) / b n >  (c (n+1) - \<epsilon>) / c n" when "\<epsilon>>0" "\<epsilon><1" for \<epsilon>::real
   proof -
     have "\<forall>\<^sub>F x in sequentially. \<bar>c (Suc x) / a x\<bar> < \<epsilon> / 2"
       using ca_vanish[unfolded tendsto_iff,rule_format, of "\<epsilon>/2"] \<open>\<epsilon>>0\<close> by auto
     moreover then have "\<forall>\<^sub>F x in sequentially. \<bar>c (x+2) / a (x+1)\<bar> < \<epsilon> / 2"
       apply (subst (asm) eventually_sequentially_Suc[symmetric])
       by simp
     moreover have "\<forall>\<^sub>F n in sequentially. B * b (n+1) = c (n+1) * a (n+1) - c (n + 2)"
       using abc_event
       apply (subst (asm) eventually_sequentially_Suc[symmetric])
       by (auto elim:eventually_mono)
     moreover have "\<forall>\<^sub>F n in sequentially. c n > 0 \<and> c (n+1) > 0 \<and> c (n+2) > 0"
     proof -
       have "\<forall>\<^sub>F n in sequentially. 0 < c (Suc n)"
         using c_pos by (subst eventually_sequentially_Suc) simp
       moreover then have "\<forall>\<^sub>F n in sequentially. 0 < c (Suc (Suc n))"
         using c_pos by (subst eventually_sequentially_Suc) simp
       ultimately show ?thesis using c_pos by eventually_elim auto
     qed
     ultimately show ?thesis using ab_event abc_event 
     proof eventually_elim
       case (elim n)
       define \<epsilon>\<^sub>0 \<epsilon>\<^sub>1 where "\<epsilon>\<^sub>0 = c (n+1) / a n" and "\<epsilon>\<^sub>1 = c (n+2) / a (n+1)"
       have "\<epsilon>\<^sub>0 > 0" "\<epsilon>\<^sub>1 > 0" "\<epsilon>\<^sub>0 < \<epsilon>/2" "\<epsilon>\<^sub>1 < \<epsilon>/2" using a_pos elim by (auto simp add: \<epsilon>\<^sub>0_def \<epsilon>\<^sub>1_def)
       have "(\<epsilon> - \<epsilon>\<^sub>1) * c n > 0"
         apply (rule mult_pos_pos)
         using \<open>\<epsilon>\<^sub>1 > 0\<close> \<open>\<epsilon>\<^sub>1 < \<epsilon>/2\<close> \<open>\<epsilon>>0\<close> elim by auto
       moreover have "\<epsilon>\<^sub>0 * (c (n+1) - \<epsilon>) > 0"
         apply (rule mult_pos_pos[OF \<open>\<epsilon>\<^sub>0 > 0\<close>])
         using elim(4) that(2) by linarith
       ultimately have "(\<epsilon> - \<epsilon>\<^sub>1) * c n + \<epsilon>\<^sub>0 * (c (n+1) - \<epsilon>) > 0" by auto
       moreover have "c n - \<epsilon>\<^sub>0 > 0" using \<open>\<epsilon>\<^sub>0 < \<epsilon> / 2\<close> elim(4) that(2) by linarith
       moreover have "c n > 0" by (simp add: elim(4))
       ultimately have "(c (n+1) - \<epsilon>) / c n < (c (n+1) - \<epsilon>\<^sub>1) / (c n -  \<epsilon>\<^sub>0)"
         by (auto simp add: field_simps)
       also have "... \<le> (c (n+1) - \<epsilon>\<^sub>1) / (c n -  \<epsilon>\<^sub>0) * (a (n+1) / a n)"
       proof -
         have "(c (n+1) - \<epsilon>\<^sub>1) / (c n -  \<epsilon>\<^sub>0) > 0" 
           by (smt \<open>0 < (\<epsilon> - \<epsilon>\<^sub>1) * real_of_int (c n)\<close> \<open>0 < real_of_int (c n) - \<epsilon>\<^sub>0\<close> 
               divide_pos_pos elim(4) mult_le_0_iff of_int_less_1_iff that(2))
         moreover have "(a (n+1) / a n) \<ge> 1" 
           using a_pos elim(5) by auto
         ultimately show ?thesis by (metis mult_cancel_left1 real_mult_le_cancel_iff2)
       qed
       also have "... = (B * b (n+1)) / (B * b n)"
       proof -
         have "B * b n = c n * a n - c (n + 1)"
           using elim by auto
         also have "... = a n * (c n - \<epsilon>\<^sub>0)"
           using a_pos[rule_format,of n] unfolding \<epsilon>\<^sub>0_def by (auto simp:field_simps)
         finally have "B * b n = a n * (c n - \<epsilon>\<^sub>0)" .
         moreover have "B * b (n+1) = a (n+1) * (c (n+1) - \<epsilon>\<^sub>1)" 
           unfolding \<epsilon>\<^sub>1_def 
           using a_pos[rule_format,of "n+1"] 
           apply (subst \<open>B * b (n + 1) = c (n + 1) * a (n + 1) - c (n + 2)\<close>)
           by (auto simp:field_simps)
         ultimately show ?thesis by (simp add: mult.commute)
       qed
       also have "... = b (n+1) / b n" 
         using \<open>B>0\<close> by auto
       finally show ?case .
     qed
   qed
 
   have eq_2_11:"\<exists>\<^sub>F n in sequentially. b (n+1) > b n + (1 - \<epsilon>)^2 * a n / B" 
     when "\<epsilon>>0" "\<epsilon><1" "\<not> (\<forall>\<^sub>F n in sequentially. c (n+1) \<le> c n)"  for \<epsilon>::real
   proof -
     have "\<exists>\<^sub>F x in sequentially. c x < c (Suc x) " using that(3) 
       by (simp add:not_eventually frequently_elim1)
     moreover have "\<forall>\<^sub>F x in sequentially. \<bar>c (Suc x) / a x\<bar> < \<epsilon>"
       using ca_vanish[unfolded tendsto_iff,rule_format, of \<epsilon>] \<open>\<epsilon>>0\<close> by auto
     moreover have "\<forall>\<^sub>F n in sequentially. c n > 0 \<and> c (n+1) > 0"
     proof -
       have "\<forall>\<^sub>F n in sequentially. 0 < c (Suc n)"
         using c_pos by (subst eventually_sequentially_Suc) simp
       then show ?thesis using c_pos by eventually_elim auto
     qed
     ultimately show ?thesis  using ab_event abc_event bc_epsilon[OF \<open>\<epsilon>>0\<close> \<open>\<epsilon><1\<close>] 
     proof (elim frequently_rev_mp,eventually_elim)
       case (elim n)
       then have "c (n+1) / a n < \<epsilon>" 
         using a_pos[rule_format,of n] by auto
       also have "... \<le> \<epsilon> * c n" using elim(7) that(1) by auto
       finally have "c (n+1) / a n < \<epsilon> * c n" .
       then have "c (n+1) / c n < \<epsilon> * a n" 
         using a_pos[rule_format,of n] elim by (auto simp:field_simps)
       then have "(1 - \<epsilon>) * a n < a n - c (n+1) / c n"
         by (auto simp:algebra_simps)
       then have "(1 - \<epsilon>)^2 * a n / B < (1 - \<epsilon>) * (a n - c (n+1) / c n) / B"
         apply (subst (asm) real_mult_less_iff1[symmetric, of "(1-\<epsilon>)/B"])
         using \<open>\<epsilon><1\<close> \<open>B>0\<close> by (auto simp:divide_simps power2_eq_square)
       then have "b n + (1 - \<epsilon>)^2 * a n / B < b n + (1 - \<epsilon>) * (a n - c (n+1) / c n) / B"
         using \<open>B>0\<close> by auto
       also have "... = b n + (1 - \<epsilon>) * ((c n *a n - c (n+1)) / c n) / B"
         using elim by (auto simp:field_simps)
       also have "... = b n + (1 - \<epsilon>) * (b n / c n)"
       proof -
         have "B * b n = c n * a n - c (n + 1)" using elim by auto
         from this[symmetric] show ?thesis
           using \<open>B>0\<close> by simp
       qed
       also have "... = (1+(1-\<epsilon>)/c n) * b n"
         by (auto simp:algebra_simps)
       also have "... = ((c n+1-\<epsilon>)/c n) * b n"
         using elim by (auto simp:divide_simps)
       also have "... \<le> ((c (n+1) -\<epsilon>)/c n) * b n"
       proof -
         define cp where "cp = c n+1"
         have "c (n+1) \<ge> cp" unfolding cp_def using \<open>c n < c (Suc n)\<close> by auto
         moreover have "c n>0" "b n>0" using elim by auto
         ultimately show ?thesis 
           apply (fold cp_def)
           by (auto simp:divide_simps)
       qed
       also have "... < b (n+1)"
         using elim by (auto simp:divide_simps)
       finally show ?case .
     qed
   qed
 
   have "\<forall>\<^sub>F n in sequentially. c (n+1) \<le> c n"
   proof (rule ccontr)
     assume "\<not> (\<forall>\<^sub>F n in sequentially. c (n + 1) \<le> c n)"
     from eq_2_11[OF _ _ this,of "1/2"]
     have "\<exists>\<^sub>F n in sequentially. b (n+1) > b n + 1/4 * a n / B" 
       by (auto simp:algebra_simps power2_eq_square)
     then have *:"\<exists>\<^sub>F n in sequentially. (b (n+1) - b n) / a n > 1 / (B * 4)" 
       apply (elim frequently_elim1)
       subgoal for n
         using a_pos[rule_format,of n] by (auto simp:field_simps)
       done
     define f where "f = (\<lambda>n. (b (n+1) - b n) / a n)"
     have "f \<longlonglongrightarrow> lim f"
       using convergent_LIMSEQ_iff ba_lim_exist unfolding f_def by auto
     from this[unfolded tendsto_iff,rule_format, of "1 / (B*4)"] 
     have "\<forall>\<^sub>F x in sequentially. \<bar>f x - lim f\<bar> < 1 / (B * 4)"
       using \<open>B>0\<close> by (auto simp:dist_real_def)
     moreover have "\<exists>\<^sub>F n in sequentially. f n > 1 / (B * 4)" 
       using * unfolding f_def by auto
     ultimately have "\<exists>\<^sub>F n in sequentially. f n > 1 / (B * 4) \<and> \<bar>f n - lim f\<bar> < 1 / (B * 4)"
       by (auto elim:frequently_eventually_frequently[rotated])
     from frequently_ex[OF this] 
     obtain n where "f n > 1 / (B * 4)" "\<bar>f n - lim f\<bar> < 1 / (B * 4)"
       by auto
     moreover have "lim f \<le> 0" using ba_lim_leq unfolding f_def by auto
     ultimately show False by linarith
   qed
   then obtain N where N_dec:"\<forall>n\<ge>N. c (n+1) \<le> c n" by (meson eventually_at_top_linorder)
   define max_c where "max_c = (MAX n \<in> {..N}. c n)"
   have max_c:"c n \<le> max_c" for n
   proof (cases "n\<le>N")
     case True
     then show ?thesis unfolding max_c_def by simp
   next
     case False
     then have "n\<ge>N" by auto
     then have "c n\<le>c N" 
     proof (induct rule:nat_induct_at_least)
       case base
       then show ?case by simp
     next
       case (Suc n)
       then have "c (n+1) \<le> c n" using N_dec by auto
       then show ?case using \<open>c n \<le> c N\<close> by auto
     qed
     moreover have "c N \<le> max_c" unfolding max_c_def by auto
     ultimately show ?thesis by auto
   qed
   have "max_c > 0 " 
   proof -
     obtain N where "\<forall>n\<ge>N. 0 < c n" 
       using c_pos[unfolded eventually_at_top_linorder] by auto
     then have "c N > 0" by auto
     then show ?thesis using max_c[of N] by simp
   qed
   have ba_limsup_bound:"1/(B*(B+1)) \<le> limsup (\<lambda>n. b n/a n)" 
     "limsup (\<lambda>n. b n/a n) \<le> max_c / B + 1 / (B+1)"
   proof -
     define f where "f = (\<lambda>n. b n/a n)"
     from tendsto_mult_right_zero[OF bac_close,of "1/B"] 
     have "(\<lambda>n. f n - c n / B) \<longlonglongrightarrow> 0"
       unfolding f_def using  \<open>B>0\<close> by (auto simp:algebra_simps)
     from this[unfolded tendsto_iff,rule_format,of "1/(B+1)"]
     have "\<forall>\<^sub>F x in sequentially. \<bar>f x - c x / B\<bar> < 1 / (B+1)"
       using \<open>B>0\<close> by auto
     then have *:"\<forall>\<^sub>F n in sequentially. 1/(B*(B+1)) \<le> ereal (f n) \<and> ereal (f n) \<le> max_c / B + 1 / (B+1)" 
       using c_pos
     proof eventually_elim
       case (elim n)
       then have "f n - c n / B < 1 / (B+1)" by auto
       then have "f n < c n / B + 1 / (B+1)" by simp
       also have "... \<le> max_c / B + 1 / (B+1)"
         using max_c[of n] using \<open>B>0\<close> by (auto simp:divide_simps)
       finally have *:"f n < max_c / B + 1 / (B+1)" .
 
       have "1/(B*(B+1)) = 1/B - 1 / (B+1)" 
         using \<open>B>0\<close> by (auto simp:divide_simps)
       also have "... \<le> c n/B - 1 / (B+1)" 
         using \<open>0 < c n\<close> \<open>B>0\<close> by (auto,auto simp:divide_simps)
       also have "... < f n" using elim by auto
       finally have "1/(B*(B+1)) < f n" .
       with * show ?case by simp
     qed
     show "limsup f \<le> max_c / B + 1 / (B+1)"
       apply (rule Limsup_bounded)
       using * by (auto elim:eventually_mono)
     have "1/(B*(B+1)) \<le> liminf f"
       apply (rule Liminf_bounded)
       using * by (auto elim:eventually_mono)
     also have "liminf f \<le> limsup f" by (simp add: Liminf_le_Limsup)
     finally show "1/(B*(B+1)) \<le> limsup f" .
   qed
 
   have "0 < inverse (ereal (max_c / B + 1 / (B+1)))"
     using \<open>max_c > 0\<close> \<open>B>0\<close> 
     by (simp add: pos_add_strict)
   also have "... \<le> inverse (limsup (\<lambda>n. b n/a n))"
   proof (rule ereal_inverse_antimono[OF _ ba_limsup_bound(2)])
     have "0<1/(B*(B+1))" using \<open>B>0\<close> by auto
     also have "... \<le> limsup (\<lambda>n. b n/a n)" using ba_limsup_bound(1) .
     finally show "0\<le>limsup (\<lambda>n. b n/a n)" using zero_ereal_def by auto
   qed 
   also have "... = liminf (\<lambda>n. inverse (ereal ( b n/a n)))"
     apply (subst Liminf_inverse_ereal[symmetric])
     using a_pos ab_event by (auto elim!:eventually_mono simp:divide_simps)
   also have "... = liminf (\<lambda>n. ( a n/b n))"
     apply (rule Liminf_eq)
     using a_pos ab_event 
     apply (auto elim!:eventually_mono) 
     by (metis less_int_code(1))
   finally have "liminf (\<lambda>n. ( a n/b n)) > 0" .
   then show False using \<open>liminf (\<lambda>n. a n / b n) = 0\<close> by simp
 qed
 
 end
 
 section\<open>Some auxiliary results on the prime numbers. \<close>
 
 lemma nth_prime_nonzero[simp]:"nth_prime n \<noteq> 0"
   by (simp add: prime_gt_0_nat prime_nth_prime)
 
 lemma nth_prime_gt_zero[simp]:"nth_prime n >0"
   by (simp add: prime_gt_0_nat prime_nth_prime)
 
 lemma ratio_of_consecutive_primes:
   "(\<lambda>n. nth_prime (n+1)/nth_prime n) \<longlonglongrightarrow>1"
 proof -
   define f where "f=(\<lambda>x. real (nth_prime (Suc x)) /real (nth_prime x))"
   define g where "g=(\<lambda>x. (real x * ln (real x)) 
                               / (real (Suc x) * ln (real (Suc x))))"
   have p_n:"(\<lambda>x. real (nth_prime x) / (real x * ln (real x))) \<longlonglongrightarrow> 1"
     using nth_prime_asymptotics[unfolded asymp_equiv_def,simplified] .
   moreover have p_sn:"(\<lambda>n. real (nth_prime (Suc n)) 
                         / (real (Suc n) * ln (real (Suc n)))) \<longlonglongrightarrow> 1"
     using nth_prime_asymptotics[unfolded asymp_equiv_def,simplified
         ,THEN LIMSEQ_Suc] .
   ultimately have "(\<lambda>x. f x * g x) \<longlonglongrightarrow> 1"
     using tendsto_divide[OF p_sn p_n] 
     unfolding f_def g_def by (auto simp:algebra_simps)
   moreover have "g \<longlonglongrightarrow> 1" unfolding g_def
     by real_asymp
   ultimately have "(\<lambda>x. if g x = 0 then 0 else f x) \<longlonglongrightarrow> 1"
     apply (drule_tac tendsto_divide[OF _ \<open>g \<longlonglongrightarrow> 1\<close>])
     by auto
   then have "f \<longlonglongrightarrow> 1"
   proof (elim filterlim_mono_eventually)
     have "\<forall>\<^sub>F x in sequentially. (if g (x+3) = 0 then 0 
                 else f (x+3)) = f (x+3)" 
       unfolding g_def by auto
     then show "\<forall>\<^sub>F x in sequentially. (if g x = 0 then 0 else f x) = f x"
       apply (subst (asm) eventually_sequentially_seg)
       by simp
   qed auto
   then show ?thesis unfolding f_def by auto
 qed
 
 lemma nth_prime_double_sqrt_less:
   assumes "\<epsilon> > 0"
   shows "\<forall>\<^sub>F n in sequentially. (nth_prime (2*n) - nth_prime n) 
             / sqrt (nth_prime n) < n powr (1/2+\<epsilon>)"
 proof -
   define pp ll where 
     "pp=(\<lambda>n. (nth_prime (2*n) - nth_prime n) / sqrt (nth_prime n))" and
     "ll=(\<lambda>x::nat. x * ln x)"
   have pp_pos:"pp (n+1) > 0" for n
     unfolding pp_def by simp
 
   have "(\<lambda>x. nth_prime (2 * x)) \<sim>[sequentially] (\<lambda>x. (2 * x) * ln (2 * x))"
     using nth_prime_asymptotics[THEN asymp_equiv_compose
         ,of "(*) 2" sequentially,unfolded comp_def]
     using mult_nat_left_at_top pos2 by blast
   also have "... \<sim>[sequentially] (\<lambda>x. 2 *x * ln x)"
     by real_asymp
   finally have "(\<lambda>x. nth_prime (2 * x)) \<sim>[sequentially] (\<lambda>x. 2 *x * ln x)" .
   from this[unfolded asymp_equiv_def, THEN tendsto_mult_left,of 2]
   have "(\<lambda>x. nth_prime (2 * x) / (x * ln x)) \<longlonglongrightarrow> 2"
     unfolding asymp_equiv_def by auto
   moreover have *:"(\<lambda>x. nth_prime x / (x * ln x)) \<longlonglongrightarrow> 1"
     using nth_prime_asymptotics unfolding asymp_equiv_def by auto
   ultimately    
   have "(\<lambda>x. (nth_prime (2 * x) - nth_prime x) / ll x) \<longlonglongrightarrow> 1"
     unfolding ll_def
     apply -
     apply (drule (1) tendsto_diff)
     apply (subst of_nat_diff,simp)
     by (subst diff_divide_distrib,simp)
   moreover have "(\<lambda>x. sqrt (nth_prime x) / sqrt (ll x)) \<longlonglongrightarrow> 1"
     unfolding ll_def
     using tendsto_real_sqrt[OF *] 
     by (auto simp: real_sqrt_divide)
   ultimately have "(\<lambda>x. pp x * (sqrt (ll x) / (ll x))) \<longlonglongrightarrow> 1"
     apply -
     apply (drule (1) tendsto_divide,simp)
     by (auto simp:field_simps of_nat_diff pp_def)
   moreover have "\<forall>\<^sub>F x in sequentially. sqrt (ll x) / ll x = 1/sqrt (ll x)"
     apply (subst eventually_sequentially_Suc[symmetric])
     by (auto intro!:eventuallyI simp:ll_def divide_simps)
   ultimately have "(\<lambda>x. pp x / sqrt (ll x)) \<longlonglongrightarrow> 1"
     apply (elim filterlim_mono_eventually)
     by (auto elim!:eventually_mono) (metis mult.right_neutral times_divide_eq_right)
   moreover have "(\<lambda>x. sqrt (ll x) / x powr (1/2+\<epsilon>)) \<longlonglongrightarrow> 0"
     unfolding ll_def using \<open>\<epsilon>>0\<close> by real_asymp
   ultimately have "(\<lambda>x. pp x / x powr (1/2+\<epsilon>) * 
                       (sqrt (ll x) / sqrt (ll x))) \<longlonglongrightarrow> 0"
     apply -
     apply (drule (1) tendsto_mult)
     by (auto elim:filterlim_mono_eventually)
   moreover have "\<forall>\<^sub>F x in sequentially. sqrt (ll x) / sqrt (ll x) = 1"
     apply (subst eventually_sequentially_Suc[symmetric])
     by (auto intro!:eventuallyI simp:ll_def )
   ultimately have "(\<lambda>x. pp x / x powr (1/2+\<epsilon>)) \<longlonglongrightarrow> 0"
     apply (elim filterlim_mono_eventually)
     by (auto elim:eventually_mono)
   from tendstoD[OF this, of 1,simplified]
   show "\<forall>\<^sub>F x in sequentially. pp x < x powr (1 / 2 + \<epsilon>)"
     apply (elim eventually_mono_sequentially[of _ 1])
     using pp_pos by auto
 qed
 
 
 section \<open>Theorem 3.1\<close>
 
 text\<open>Theorem 3.1 is an application of Theorem 2.1 with the sequences considered involving 
 the prime numbers.\<close>
 
 theorem theorem_3_10_Erdos_Straus:
   fixes a::"nat \<Rightarrow> int"
   assumes a_pos:"\<forall> n. a n >0" and "mono a"
     and nth_1:"(\<lambda>n. nth_prime n / (a n)^2) \<longlonglongrightarrow> 0"
     and nth_2:"liminf (\<lambda>n. a n / nth_prime n) = 0"
   shows "(\<Sum>n. (nth_prime n / (\<Prod>i \<le> n. a i))) \<notin> \<rat>"
 proof
   assume asm:"(\<Sum>n. (nth_prime n / (\<Prod>i \<le> n. a i))) \<in> \<rat>"
 
   have a2_omega:"(\<lambda>n. (a n)^2) \<in> \<omega>(\<lambda>x. x * ln x)"
   proof -
     have "(\<lambda>n. real (nth_prime n)) \<in> o(\<lambda>n. real_of_int ((a n)\<^sup>2))"
       apply (rule smalloI_tendsto[OF nth_1])
       using a_pos by (metis (mono_tags, lifting) less_int_code(1) 
           not_eventuallyD of_int_0_eq_iff zero_eq_power2)
     moreover have "(\<lambda>x. real (nth_prime x)) \<in> \<Omega>(\<lambda>x. real x * ln (real x))"
       using nth_prime_bigtheta
       by blast
     ultimately show ?thesis 
       using landau_omega.small_big_trans smallo_imp_smallomega by blast
   qed
 
   have a_gt_1:"\<forall>\<^sub>F n in sequentially. 1 < a n" 
   proof -
     have "\<forall>\<^sub>F x in sequentially. \<bar>x * ln x\<bar> \<le> (a x)\<^sup>2"
       using a2_omega[unfolded smallomega_def,simplified,rule_format,of 1]
       by auto
     then have "\<forall>\<^sub>F x in sequentially. \<bar>(x+3) * ln (x+3)\<bar> \<le> (a (x+3))\<^sup>2" 
       apply (subst (asm) eventually_sequentially_seg[symmetric, of _ 3])
       by simp
     then have "\<forall>\<^sub>F n in sequentially. 1 < a ( n+3)" 
     proof (elim eventually_mono)
       fix x
       assume "\<bar>real (x + 3) * ln (real (x + 3))\<bar> \<le> real_of_int ((a (x + 3))\<^sup>2)"
       moreover have "\<bar>real (x + 3) * ln (real (x + 3))\<bar> > 3"
       proof -
         have "ln (real (x + 3)) > 1"
           apply simp using ln3_gt_1 ln_gt_1 by force
         moreover have "real(x+3) \<ge> 3" by simp
         ultimately have "(x+3)*ln (real (x + 3)) > 3*1 "
           apply (rule_tac mult_le_less_imp_less)
           by auto
         then show ?thesis by auto
       qed
       ultimately have "real_of_int ((a (x + 3))\<^sup>2) > 3"
         by auto
       then show "1 < a (x + 3)" 
         by (smt Suc3_eq_add_3 a_pos add.commute of_int_1 one_power2)
     qed
     then show ?thesis 
       apply (subst eventually_sequentially_seg[symmetric, of _ 3])
       by auto
   qed
 
   obtain B::int and c where 
     "B>0" and Bc_large:"\<forall>\<^sub>F n in sequentially. B * nth_prime n 
                 = c n * a n - c (n + 1) \<and> \<bar>c (n + 1)\<bar> <  a n / 2"
     and ca_vanish: "(\<lambda>n. c (Suc n) / real_of_int (a n)) \<longlonglongrightarrow> 0"
   proof -
     note a_gt_1
     moreover have "(\<lambda>n. real_of_int \<bar>int (nth_prime n)\<bar> 
                     / real_of_int (a (n - 1) * a n)) \<longlonglongrightarrow> 0" 
     proof -
       define f where "f=(\<lambda>n. nth_prime (n+1) / (a n * a (n+1)))"
       define g where "g=(\<lambda>n. 2*nth_prime n / (a n)^2)"
       have "\<forall>\<^sub>F x in sequentially. norm (f x) \<le> g x"
       proof -
         have "\<forall>\<^sub>F n in sequentially. nth_prime (n+1) < 2*nth_prime n" 
           using ratio_of_consecutive_primes[unfolded tendsto_iff
               ,rule_format,of 1,simplified]
           apply (elim eventually_mono)
           by (auto simp :divide_simps dist_norm)
         moreover have "\<forall>\<^sub>F n in sequentially. real_of_int (a n * a (n+1))
                            \<ge> (a n)^2"
           apply (rule eventuallyI)
           using \<open>mono a\<close> by (auto simp:power2_eq_square a_pos incseq_SucD)
         ultimately show ?thesis unfolding f_def g_def
           apply eventually_elim
           apply (subst norm_divide)
           apply (rule_tac linordered_field_class.frac_le)
           using a_pos[rule_format, THEN order.strict_implies_not_eq ]
           by auto
       qed
       moreover have "g \<longlonglongrightarrow> 0 " 
         using nth_1[THEN tendsto_mult_right_zero,of 2] unfolding g_def 
         by auto
       ultimately have "f \<longlonglongrightarrow> 0" 
         using Lim_null_comparison[of f g sequentially]
         by auto
       then show ?thesis
         unfolding f_def
         by (rule_tac LIMSEQ_imp_Suc) auto
     qed
     moreover have "(\<Sum>n. real_of_int (int (nth_prime n)) 
                     / real_of_int (prod a {..n})) \<in> \<rat>" 
       using asm by simp
     ultimately have "\<exists>B>0. \<exists>c. (\<forall>\<^sub>F n in sequentially.
               B * int (nth_prime n) = c n * a n - c (n + 1) \<and>
               real_of_int \<bar>c (n + 1)\<bar> < real_of_int (a n) / 2) \<and>
           (\<lambda>n. real_of_int (c (Suc n)) / real_of_int (a n)) \<longlonglongrightarrow> 0"
       using ab_rationality_imp[OF a_pos,of nth_prime] by fast
     then show thesis 
       apply clarify
       apply (rule_tac c=c and B=B in that)
       by auto
   qed
 
   have bac_close:"(\<lambda>n. B * nth_prime n / a n - c n) \<longlonglongrightarrow> 0"
   proof -
     have "\<forall>\<^sub>F n in sequentially. B * nth_prime n - c n * a n + c (n + 1) = 0"
       using Bc_large by (auto elim!:eventually_mono)
     then have "\<forall>\<^sub>F n in sequentially. (B * nth_prime n - c n * a n + c (n+1)) / a n = 0 "
       apply eventually_elim
       by auto
     then have "\<forall>\<^sub>F n in sequentially. B * nth_prime n / a n - c n  + c (n + 1) / a n = 0"
       apply eventually_elim
       using a_pos by (auto simp:divide_simps) (metis less_irrefl)
     then have "(\<lambda>n. B * nth_prime n / a n - c n  + c (n + 1) / a n) \<longlonglongrightarrow> 0"
       by (simp add: eventually_mono tendsto_iff)
     from tendsto_diff[OF this ca_vanish]  
     show ?thesis by auto
   qed
 
   have c_pos:"\<forall>\<^sub>F n in sequentially. c n > 0" 
   proof -
     from bac_close have *:"\<forall>\<^sub>F n in sequentially. c n \<ge> 0"
       apply (elim tendsto_of_int_diff_0)
       using a_gt_1 apply (eventually_elim) 
       using \<open>B>0\<close> by auto 
     show ?thesis
     proof (rule ccontr)
       assume "\<not> (\<forall>\<^sub>F n in sequentially. c n > 0)"
       moreover have "\<forall>\<^sub>F n in sequentially. c (Suc n) \<ge> 0 \<and> c n\<ge>0"
         using * eventually_sequentially_Suc[of "\<lambda>n. c n\<ge>0"] 
         by (metis (mono_tags, lifting) eventually_at_top_linorder le_Suc_eq)
       ultimately have "\<exists>\<^sub>F n in sequentially. c n = 0 \<and> c (Suc n) \<ge> 0"
         using eventually_elim2 frequently_def by fastforce
       moreover have "\<forall>\<^sub>F n in sequentially. nth_prime n > 0 
                         \<and> B * nth_prime n = c n * a n - c (n + 1)"
         using Bc_large by eventually_elim auto
       ultimately have "\<exists>\<^sub>F n in sequentially. c n = 0 \<and> c (Suc n) \<ge> 0 
           \<and> B * nth_prime n = c n * a n - c (n + 1)"
         using frequently_eventually_frequently by fastforce
       from frequently_ex[OF this] 
       obtain n where "c n = 0" "c (Suc n) \<ge> 0"
         "B * nth_prime n = c n * a n - c (n + 1)"
         by auto
       then have "B * nth_prime n \<le> 0" by auto
       then show False using \<open>B > 0\<close> 
         by (simp add: mult_le_0_iff)
     qed
   qed
 
   have B_nth_prime:"\<forall>\<^sub>F n in sequentially. nth_prime n > B" 
   proof -
     have "\<forall>\<^sub>F x in sequentially. B+1 \<le> nth_prime x"
       using nth_prime_at_top[unfolded filterlim_at_top_ge[where c="nat B+1"]
           ,rule_format,of "nat B + 1",simplified] 
 
       apply (elim eventually_mono)
       using \<open>B>0\<close> by auto
     then show ?thesis 
       apply (elim eventually_mono)
       by auto
   qed
 
   have bc_epsilon:"\<forall>\<^sub>F n in sequentially. nth_prime (n+1) 
             / nth_prime n >  (c (n+1) - \<epsilon>) / c n" when "\<epsilon>>0" "\<epsilon><1" for \<epsilon>::real
   proof -
     have "\<forall>\<^sub>F x in sequentially. \<bar>c (Suc x) / a x\<bar> < \<epsilon> / 2"
       using ca_vanish[unfolded tendsto_iff,rule_format, of "\<epsilon>/2"] \<open>\<epsilon>>0\<close> by auto
     moreover then have "\<forall>\<^sub>F x in sequentially. \<bar>c (x+2) / a (x+1)\<bar> < \<epsilon> / 2"
       apply (subst (asm) eventually_sequentially_Suc[symmetric])
       by simp
     moreover have "\<forall>\<^sub>F n in sequentially. B * nth_prime (n+1) = c (n+1) * a (n+1) - c (n + 2)"
       using Bc_large
       apply (subst (asm) eventually_sequentially_Suc[symmetric])
       by (auto elim:eventually_mono)
     moreover have "\<forall>\<^sub>F n in sequentially. c n > 0 \<and> c (n+1) > 0 \<and> c (n+2) > 0"
     proof -
       have "\<forall>\<^sub>F n in sequentially. 0 < c (Suc n)"
         using c_pos by (subst eventually_sequentially_Suc) simp
       moreover then have "\<forall>\<^sub>F n in sequentially. 0 < c (Suc (Suc n))"
         using c_pos by (subst eventually_sequentially_Suc) simp
       ultimately show ?thesis using c_pos by eventually_elim auto
     qed
     ultimately show ?thesis using Bc_large
     proof eventually_elim
       case (elim n)
       define \<epsilon>\<^sub>0 \<epsilon>\<^sub>1 where "\<epsilon>\<^sub>0 = c (n+1) / a n" and "\<epsilon>\<^sub>1 = c (n+2) / a (n+1)"
       have "\<epsilon>\<^sub>0 > 0" "\<epsilon>\<^sub>1 > 0" "\<epsilon>\<^sub>0 < \<epsilon>/2" "\<epsilon>\<^sub>1 < \<epsilon>/2" 
         using a_pos elim \<open>mono a\<close>
         by (auto simp add: \<epsilon>\<^sub>0_def \<epsilon>\<^sub>1_def abs_of_pos)
       have "(\<epsilon> - \<epsilon>\<^sub>1) * c n > 0"
         apply (rule mult_pos_pos)
         using \<open>\<epsilon>\<^sub>1 > 0\<close> \<open>\<epsilon>\<^sub>1 < \<epsilon>/2\<close> \<open>\<epsilon>>0\<close> elim by auto
       moreover have "\<epsilon>\<^sub>0 * (c (n+1) - \<epsilon>) > 0"
         apply (rule mult_pos_pos[OF \<open>\<epsilon>\<^sub>0 > 0\<close>])
         using elim(4) that(2) by linarith
       ultimately have "(\<epsilon> - \<epsilon>\<^sub>1) * c n + \<epsilon>\<^sub>0 * (c (n+1) - \<epsilon>) > 0" by auto
       moreover have "c n - \<epsilon>\<^sub>0 > 0" using \<open>\<epsilon>\<^sub>0 < \<epsilon> / 2\<close> elim(4) that(2) by linarith
       moreover have "c n > 0" by (simp add: elim(4))
       ultimately have "(c (n+1) - \<epsilon>) / c n < (c (n+1) - \<epsilon>\<^sub>1) / (c n -  \<epsilon>\<^sub>0)"
         by (auto simp add:field_simps)
       also have "... \<le> (c (n+1) - \<epsilon>\<^sub>1) / (c n -  \<epsilon>\<^sub>0) * (a (n+1) / a n)"
       proof -
         have "(c (n+1) - \<epsilon>\<^sub>1) / (c n -  \<epsilon>\<^sub>0) > 0" 
           by (smt \<open>0 < (\<epsilon> - \<epsilon>\<^sub>1) * real_of_int (c n)\<close> \<open>0 < real_of_int (c n) - \<epsilon>\<^sub>0\<close> 
               divide_pos_pos elim(4) mult_le_0_iff of_int_less_1_iff that(2))
         moreover have "(a (n+1) / a n) \<ge> 1" 
           using a_pos \<open>mono a\<close> by (simp add: mono_def)
         ultimately show ?thesis by (metis mult_cancel_left1 real_mult_le_cancel_iff2)
       qed
       also have "... = (B * nth_prime (n+1)) / (B * nth_prime n)"
       proof -
         have "B * nth_prime n = c n * a n - c (n + 1)"
           using elim by auto
         also have "... = a n * (c n - \<epsilon>\<^sub>0)"
           using a_pos[rule_format,of n] unfolding \<epsilon>\<^sub>0_def by (auto simp:field_simps)
         finally have "B * nth_prime n = a n * (c n - \<epsilon>\<^sub>0)" .
         moreover have "B * nth_prime (n+1) = a (n+1) * (c (n+1) - \<epsilon>\<^sub>1)" 
           unfolding \<epsilon>\<^sub>1_def 
           using a_pos[rule_format,of "n+1"] 
           apply (subst \<open>B * nth_prime (n + 1) = c (n + 1) * a (n + 1) - c (n + 2)\<close>)
           by (auto simp:field_simps)
         ultimately show ?thesis by (simp add: mult.commute)
       qed
       also have "... = nth_prime (n+1) / nth_prime n" 
         using \<open>B>0\<close> by auto
       finally show ?case .
     qed
   qed
 
 
   have c_ubound:"\<forall>x. \<exists>n. c n > x"
   proof (rule ccontr)
     assume " \<not> (\<forall>x. \<exists>n. x < c n)"
     then obtain ub where "\<forall>n. c n \<le> ub" "ub > 0"
       by (meson dual_order.trans int_one_le_iff_zero_less le_cases not_le)
     define pa where "pa = (\<lambda>n. nth_prime n / a n)"
     have pa_pos:"\<And>n. pa n > 0" unfolding pa_def by (simp add: a_pos)
     have "liminf (\<lambda>n. 1 / pa n) = 0"
       using nth_2 unfolding pa_def by auto
     then have "(\<exists>y<ereal (real_of_int B / real_of_int (ub + 1)). 
       \<exists>\<^sub>F x in sequentially. ereal (1 / pa x) \<le> y)"
       apply (subst less_Liminf_iff[symmetric])
       using \<open>0 < B\<close> \<open>0 < ub\<close> by auto
     then have "\<exists>\<^sub>F x in sequentially. 1 / pa x < B/(ub+1)"
       by (meson frequently_mono le_less_trans less_ereal.simps(1))
     then have "\<exists>\<^sub>F x in sequentially. B*pa x > (ub+1)"
       apply (elim frequently_elim1)
       by (metis \<open>0 < ub\<close> mult.left_neutral of_int_0_less_iff pa_pos pos_divide_less_eq 
           pos_less_divide_eq times_divide_eq_left zless_add1_eq)
     moreover have "\<forall>\<^sub>F x in sequentially. c x \<le> ub"
       using \<open>\<forall>n. c n \<le> ub\<close> by simp
     ultimately have "\<exists>\<^sub>F x in sequentially. B*pa x - c x > 1"
       apply (elim frequently_rev_mp eventually_mono)
       by linarith
     moreover have "(\<lambda>n. B * pa n - c n) \<longlonglongrightarrow>0" 
       unfolding pa_def using bac_close by auto
     from tendstoD[OF this,of 1] 
     have "\<forall>\<^sub>F n in sequentially.  \<bar>B * pa n - c n\<bar> < 1"
       by auto
     ultimately have "\<exists>\<^sub>F x in sequentially. B*pa x - c x > 1 \<and> \<bar>B * pa x - c x\<bar> < 1"
       using frequently_eventually_frequently by blast
     then show False 
       by (simp add: frequently_def)
   qed
 
   have eq_2_11:"\<forall>\<^sub>F n in sequentially. c (n+1)>c n \<longrightarrow> 
                   nth_prime (n+1) > nth_prime n + (1 - \<epsilon>)^2 * a n / B" 
     when "\<epsilon>>0" "\<epsilon><1" for \<epsilon>::real
   proof -
     have "\<forall>\<^sub>F x in sequentially. \<bar>c (Suc x) / a x\<bar> < \<epsilon>"
       using ca_vanish[unfolded tendsto_iff,rule_format, of \<epsilon>] \<open>\<epsilon>>0\<close> by auto
     moreover have "\<forall>\<^sub>F n in sequentially. c n > 0 \<and> c (n+1) > 0"
     proof -
       have "\<forall>\<^sub>F n in sequentially. 0 < c (Suc n)"
         using c_pos by (subst eventually_sequentially_Suc) simp
       then show ?thesis using c_pos by eventually_elim auto
     qed
     ultimately show ?thesis  using Bc_large bc_epsilon[OF \<open>\<epsilon>>0\<close> \<open>\<epsilon><1\<close>] 
     proof (eventually_elim, rule_tac impI)
       case (elim n)
       assume "c n < c (n + 1)"
       have "c (n+1) / a n < \<epsilon>" 
         using a_pos[rule_format,of n] using elim(1,2) by auto
       also have "... \<le> \<epsilon> * c n" using elim(2) that(1) by auto
       finally have "c (n+1) / a n < \<epsilon> * c n" .
       then have "c (n+1) / c n < \<epsilon> * a n" 
         using a_pos[rule_format,of n] elim by (auto simp:field_simps)
       then have "(1 - \<epsilon>) * a n < a n - c (n+1) / c n"
         by (auto simp:algebra_simps)
       then have "(1 - \<epsilon>)^2 * a n / B < (1 - \<epsilon>) * (a n - c (n+1) / c n) / B"
         apply (subst (asm) real_mult_less_iff1[symmetric, of "(1-\<epsilon>)/B"])
         using \<open>\<epsilon><1\<close> \<open>B>0\<close> by (auto simp:divide_simps power2_eq_square)
       then have "nth_prime n + (1 - \<epsilon>)^2 * a n / B < nth_prime n + (1 - \<epsilon>) * (a n - c (n+1) / c n) / B"
         using \<open>B>0\<close> by auto
       also have "... = nth_prime n + (1 - \<epsilon>) * ((c n *a n - c (n+1)) / c n) / B"
         using elim by (auto simp:field_simps)
       also have "... = nth_prime n + (1 - \<epsilon>) * (nth_prime n / c n)"
       proof -
         have "B * nth_prime n = c n * a n - c (n + 1)" using elim by auto
         from this[symmetric] show ?thesis
           using \<open>B>0\<close> by simp
       qed
       also have "... = (1+(1-\<epsilon>)/c n) * nth_prime n"
         by (auto simp:algebra_simps)
       also have "... = ((c n+1-\<epsilon>)/c n) * nth_prime n"
         using elim by (auto simp:divide_simps)
       also have "... \<le> ((c (n+1) -\<epsilon>)/c n) * nth_prime n"
       proof -
         define cp where "cp = c n+1"
         have "c (n+1) \<ge> cp" unfolding cp_def using \<open>c n < c (n + 1)\<close> by auto
         moreover have "c n>0" "nth_prime n>0" using elim by auto
         ultimately show ?thesis 
           apply (fold cp_def)
           by (auto simp:divide_simps)
       qed
       also have "... < nth_prime (n+1)"
         using elim by (auto simp:divide_simps)
       finally show "real (nth_prime n) + (1 - \<epsilon>)\<^sup>2 * real_of_int (a n) 
           / real_of_int B < real (nth_prime (n + 1))" .
     qed
   qed
 
   have c_neq_large:"\<forall>\<^sub>F n in sequentially. c (n+1) \<noteq> c n"
   proof (rule ccontr)
     assume "\<not> (\<forall>\<^sub>F n in sequentially. c (n + 1) \<noteq> c n)"
     then have that:"\<exists>\<^sub>F n in sequentially. c (n + 1) = c n"
       unfolding frequently_def .
     have "\<forall>\<^sub>F x in sequentially. (B * int (nth_prime x) = c x * a x - c (x + 1) 
         \<and> \<bar>real_of_int (c (x + 1))\<bar> < real_of_int (a x) / 2) \<and> 0 < c x \<and> B < int (nth_prime x)
         \<and> (c (x+1)>c x \<longrightarrow> nth_prime (x+1) > nth_prime x +  a x / (2* B))"
       using Bc_large c_pos B_nth_prime eq_2_11[of "1-1/ sqrt 2",simplified]
       by eventually_elim (auto simp:divide_simps)
     then have "\<exists>\<^sub>F m in sequentially. nth_prime (m+1) > (1+1/(2*B))*nth_prime m"
     proof (elim frequently_eventually_at_top[OF that, THEN frequently_at_top_elim])
       fix n
       assume "c (n + 1) = c n \<and>
            (\<forall>y\<ge>n. (B * int (nth_prime y) = c y * a y - c (y + 1) \<and>
                     \<bar>real_of_int (c (y + 1))\<bar> < real_of_int (a y) / 2) \<and>
                    0 < c y \<and> B < int (nth_prime y) \<and> (c y < c (y + 1) \<longrightarrow>
                    real (nth_prime y) + real_of_int (a y) / real_of_int (2 * B)
                    < real (nth_prime (y + 1))))"
       then have "c (n + 1) = c n" 
         and Bc_eq:"\<forall>y\<ge>n. B * int (nth_prime y) = c y * a y - c (y + 1) \<and> 0 < c y 
                             \<and> \<bar>real_of_int (c (y + 1))\<bar> < real_of_int (a y) / 2 
                             \<and> B < int (nth_prime y)
                             \<and> (c y < c (y + 1) \<longrightarrow>
                    real (nth_prime y) + real_of_int (a y) / real_of_int (2 * B)
                    < real (nth_prime (y + 1)))"
         by auto
       obtain m where "n<m" "c m \<le> c n" "c n<c (m+1)" 
       proof -
         have "\<exists>N. N > n \<and> c N > c n"
           using c_ubound[rule_format, of "MAX x\<in>{..n}. c x"] 
           by (metis Max_ge atMost_iff dual_order.trans finite_atMost finite_imageI image_eqI 
               linorder_not_le order_refl)
         then obtain N where "N>n" "c N>c n" by auto
         define A m where "A={m. n<m \<and> (m+1)\<le>N \<and> c (m+1) > c n}" and "m = Min A"
         have "finite A" unfolding A_def
           by (metis (no_types, lifting) A_def add_leE finite_nat_set_iff_bounded_le mem_Collect_eq)
         moreover have "N-1\<in>A" unfolding A_def 
           using \<open>c n < c N\<close> \<open>n < N\<close> \<open>c (n + 1) = c n\<close>
           by (smt Suc_diff_Suc Suc_eq_plus1 Suc_leI Suc_pred  add.commute 
               add_diff_inverse_nat add_leD1 diff_is_0_eq' mem_Collect_eq nat_add_left_cancel_less
               zero_less_one)
         ultimately have "m\<in>A"
           using Min_in unfolding m_def by auto
         then have "n<m"  "c n<c (m+1)" "m>0"
           unfolding m_def A_def by auto
         moreover have "c m \<le> c n"
         proof (rule ccontr)
           assume " \<not> c m \<le> c n"
           then have "m-1\<in>A" using \<open>m\<in>A\<close> \<open>c (n + 1) = c n\<close>
             unfolding A_def 
             by auto (smt One_nat_def Suc_eq_plus1 Suc_lessI less_diff_conv)
           from  Min_le[OF \<open>finite A\<close> this,folded m_def] \<open>m>0\<close> show False by auto
         qed
         ultimately show ?thesis using that[of m] by auto
       qed
       have "(1 + 1 / (2 * B)) * nth_prime m < nth_prime m + a m / (2*B)"
       proof -
         have "nth_prime m < a m"
         proof -
           have "B * int (nth_prime m) < c m * (a m - 1)"
             using Bc_eq[rule_format,of m] \<open>c m \<le> c n\<close> \<open>c n < c (m + 1)\<close> \<open>n < m\<close> 
             by (auto simp:algebra_simps)
           also have "... \<le> c n * (a m - 1)"
             by (simp add: \<open>c m \<le> c n\<close> a_pos mult_right_mono)
           finally have "B * int (nth_prime m) < c n * (a m - 1)" .
           moreover have "c n\<le>B" 
           proof -
             have " B * int (nth_prime n) = c n * (a n - 1)" "B < int (nth_prime n)"
               and c_a:"\<bar>real_of_int (c (n + 1))\<bar> < real_of_int (a n) / 2"
               using Bc_eq[rule_format,of n] \<open>c (n + 1) = c n\<close> by (auto simp:algebra_simps)
             from this(1) have " c n dvd (B * int (nth_prime n))"
               by simp
             moreover have "coprime (c n) (int (nth_prime n))"
             proof -
               have "c n < int (nth_prime n)" 
               proof (rule ccontr)
                 assume "\<not> c n < int (nth_prime n)"
                 then have asm:"c n \<ge> int (nth_prime n)" by auto
                 then have "a n > 2 * nth_prime n"
                   using c_a \<open>c (n + 1) = c n\<close> by auto
                 then have "a n -1 \<ge> 2 * nth_prime n"
                   by simp
                 then have "a n - 1 > 2 * B"
                   using \<open>B < int (nth_prime n)\<close> by auto
                 from mult_le_less_imp_less[OF asm this] \<open>B>0\<close>
                 have "int (nth_prime n) * (2 * B) < c n * (a n - 1)"
                   by auto
                 then show False using \<open>B * int (nth_prime n) = c n * (a n - 1)\<close>
                   by (smt \<open>0 < B\<close> \<open>B < int (nth_prime n)\<close> combine_common_factor 
                       mult.commute mult_pos_pos)
               qed
               then have "\<not> nth_prime n dvd c n" 
                 by (simp add: Bc_eq zdvd_not_zless)
               then have "coprime (int (nth_prime n)) (c n)" 
                 by (auto intro!:prime_imp_coprime_int)
               then show ?thesis using coprime_commute by blast
             qed
             ultimately have "c n dvd B"
               using coprime_dvd_mult_left_iff by auto
             then show ?thesis using \<open>0 < B\<close> zdvd_imp_le by blast
           qed
           moreover have "c n > 0 " using Bc_eq by blast
           ultimately show ?thesis
             using \<open>B>0\<close> by (smt a_pos mult_mono)
         qed
         then show ?thesis using \<open>B>0\<close> by (auto simp:field_simps)
       qed
       also have "... < nth_prime (m+1)"
         using Bc_eq[rule_format, of m] \<open>n<m\<close> \<open>c m \<le> c n\<close> \<open>c n < c (m+1)\<close>
         by linarith
       finally show "\<exists>j>n. (1 + 1 / real_of_int (2 * B)) * real (nth_prime j)
                        < real (nth_prime (j + 1))" using \<open>m>n\<close> by auto
     qed
     then have "\<exists>\<^sub>F m in sequentially. nth_prime (m+1)/nth_prime m > (1+1/(2*B))"
       by (auto elim:frequently_elim1 simp:field_simps)
     moreover have "\<forall>\<^sub>F m in sequentially. nth_prime (m+1)/nth_prime m < (1+1/(2*B))"
       using ratio_of_consecutive_primes[unfolded tendsto_iff,rule_format,of "1/(2*B)"]
         \<open>B>0\<close>
       unfolding dist_real_def
       by (auto elim!:eventually_mono simp:algebra_simps)
     ultimately show False by (simp add: eventually_mono frequently_def)
   qed
 
   have c_gt_half:"\<forall>\<^sub>F N in sequentially. card {n\<in>{N..<2*N}.  c n > c (n+1)} > N / 2"
   proof -
     define h where "h=(\<lambda>n. (nth_prime (2*n) - nth_prime n) 
                               /  sqrt (nth_prime n))"
     have "\<forall>\<^sub>F n in sequentially. h n < n / 2"
     proof -
       have "\<forall>\<^sub>F n in sequentially. h n < n powr (5/6)"
         using nth_prime_double_sqrt_less[of "1/3"]
         unfolding h_def by auto
       moreover have "\<forall>\<^sub>F n in sequentially. n powr (5/6) < (n /2)"
         by real_asymp
       ultimately show ?thesis 
         by eventually_elim auto 
     qed
     moreover have "\<forall>\<^sub>F n in sequentially. sqrt (nth_prime n) / a n < 1 / (2*B)"
       using nth_1[THEN tendsto_real_sqrt,unfolded tendsto_iff
           ,rule_format,of "1/(2*B)"] \<open>B>0\<close> a_pos
       by (auto simp:real_sqrt_divide abs_of_pos)
     ultimately have "\<forall>\<^sub>F x in sequentially. c (x+1) \<noteq> c x
         \<and> sqrt (nth_prime x) / a x < 1 / (2*B)
         \<and>  h x < x / 2
         \<and> (c (x+1)>c x \<longrightarrow> nth_prime (x+1) > nth_prime x +  a x / (2* B))"
       using c_neq_large B_nth_prime eq_2_11[of "1-1/ sqrt 2",simplified]
       by eventually_elim (auto simp:divide_simps)
     then show ?thesis
     proof (elim eventually_at_top_mono)
       fix N assume "N\<ge>1" and N_asm:"\<forall>y\<ge>N. c (y + 1) \<noteq> c y \<and>
                sqrt (real (nth_prime y)) / real_of_int (a y)
                < 1 / real_of_int (2 * B) \<and>  h y < y / 2 \<and>
                (c y < c (y + 1) \<longrightarrow>
                 real (nth_prime y) + real_of_int (a y) / real_of_int (2 * B)
                 < real (nth_prime (y + 1)))"
 
       define S where "S={n \<in> {N..<2 * N}. c n < c (n + 1)}"
       define g where "g=(\<lambda>n. (nth_prime (n+1) - nth_prime n) 
                               /  sqrt (nth_prime n))"
       define f where "f=(\<lambda>n. nth_prime (n+1) - nth_prime n)"
       have g_gt_1:"g n>1" when "n\<ge>N" "c n < c (n + 1)" for n
       proof -
         have "nth_prime n + sqrt (nth_prime n) < nth_prime (n+1)"
         proof -
           have "nth_prime n + sqrt (nth_prime n) < nth_prime n + a n / (2*B)"
             using N_asm[rule_format,OF \<open>n\<ge>N\<close>] a_pos
             by (auto simp:field_simps)
           also have "... < nth_prime (n+1)"
             using N_asm[rule_format,OF \<open>n\<ge>N\<close>] \<open>c n < c (n + 1)\<close> by auto
           finally show ?thesis .
         qed
         then show ?thesis unfolding g_def 
           using \<open>c n < c (n + 1)\<close> by auto
       qed
       have g_geq_0:"g n \<ge> 0" for n 
         unfolding g_def  by auto
 
       have "finite S" "\<forall>x\<in>S. x\<ge>N \<and> c x<c (x+1)"
         unfolding S_def by auto
       then have "card S \<le> sum g S" 
       proof (induct S)
         case empty
         then show ?case by auto
       next
         case (insert x F)
         moreover have "g x>1" 
         proof -
           have "c x < c (x+1)" "x\<ge>N" using insert(4) by auto
           then show ?thesis using g_gt_1 by auto
         qed
         ultimately show ?case by simp
       qed
       also have "... \<le> sum g {N..<2*N}"
         apply (rule sum_mono2)
         unfolding S_def using g_geq_0 by auto
       also have "... \<le> sum (\<lambda>n. f n/sqrt (nth_prime N)) {N..<2*N}"
         apply (rule sum_mono)
         unfolding f_def g_def by (auto intro!:divide_left_mono)
       also have "... = sum f {N..<2*N} / sqrt (nth_prime N)"
         unfolding sum_divide_distrib[symmetric] by auto
       also have "... = (nth_prime (2*N) - nth_prime N) / sqrt (nth_prime N)"
       proof -
         have "sum f {N..<2 * N} = nth_prime (2 * N) - nth_prime N"   
         proof (induct N)
           case 0
           then show ?case by simp
         next
           case (Suc N)
           have ?case if "N=0"
           proof -
             have "sum f {Suc N..<2 * Suc N} = sum f {1}"
               using that by (simp add: numeral_2_eq_2)
             also have "... = nth_prime 2 - nth_prime 1"
               unfolding f_def by (simp add:numeral_2_eq_2)
             also have "... = nth_prime (2 * Suc N) - nth_prime (Suc N)"
               using that by auto
             finally show ?thesis .
           qed
           moreover have ?case if "N\<noteq>0"
           proof -
             have "sum f {Suc N..<2 * Suc N} = sum f {N..<2 * Suc N} - f N"
               apply (subst (2) sum.atLeast_Suc_lessThan)
               using that by auto
             also have "... = sum f {N..<2 * N}+ f (2*N) + f(2*N+1) - f N"
               by auto
             also have "... = nth_prime (2 * Suc N) - nth_prime (Suc N)"
               using Suc unfolding f_def by auto
             finally show ?thesis .
           qed
           ultimately show ?case by blast
         qed
         then show ?thesis by auto
       qed
       also have "... = h N"
         unfolding h_def by auto
       also have "... < N/2"
         using N_asm by auto
       finally have "card S < N/2" .
 
       define T where "T={n \<in> {N..<2 * N}. c n > c (n + 1)}"
       have "T \<union> S = {N..<2 * N}" "T \<inter> S = {}" "finite T"
         unfolding T_def S_def using N_asm by fastforce+
 
       then have "card T + card S = card {N..<2 * N}"
         using card_Un_disjoint \<open>finite S\<close> by metis
       also have "... = N"
         by simp
       finally have "card T + card S = N" .
       with \<open>card S < N/2\<close> 
       show "card T > N/2" by linarith
     qed
   qed
 
   text\<open>Inequality (3.5) in the original paper required a slight modification: \<close>
 
   have a_gt_plus:"\<forall>\<^sub>F n in sequentially. c n > c (n+1) \<longrightarrow>a (n+1) > a n + (a n - c(n+1) - 1) / c (n+1)"
   proof -
     note a_gt_1[THEN eventually_all_ge_at_top] c_pos[THEN eventually_all_ge_at_top]
     moreover have "\<forall>\<^sub>F n in sequentially. 
               B * int (nth_prime (n+1)) = c (n+1) * a (n+1) - c (n + 2)"
       using Bc_large 
       apply (subst (asm) eventually_sequentially_Suc[symmetric])
       by (auto elim:eventually_mono)
     moreover have "\<forall>\<^sub>F n in sequentially. 
                         B * int (nth_prime n) = c n * a n - c (n + 1) \<and> \<bar>c (n + 1)\<bar> <  a n / 2"
       using Bc_large by (auto elim:eventually_mono)
     ultimately show ?thesis 
       apply (eventually_elim)
     proof (rule impI)
       fix n 
       assume "\<forall>y\<ge>n. 1 < a y" "\<forall>y\<ge>n. 0 < c y"
         and
         Suc_n_eq:"B * int (nth_prime (n + 1)) = c (n + 1) * a (n + 1) - c (n + 2)" and
         "B * int (nth_prime n) = c n * a n - c (n + 1) \<and>
                 real_of_int \<bar>c (n + 1)\<bar> < real_of_int (a n) / 2" 
         and "c (n + 1) < c n"
       then have n_eq:"B * int (nth_prime n) = c n * a n - c (n + 1)" and 
         c_less_a: "real_of_int \<bar>c (n + 1)\<bar> < real_of_int (a n) / 2" 
         by auto
       from \<open>\<forall>y\<ge>n. 1 < a y\<close> \<open>\<forall>y\<ge>n. 0 < c y\<close> 
       have *:"a n>1" "a (n+1) > 1" "c n > 0" 
         "c (n+1) > 0"  "c (n+2) > 0"
         by auto
       then have "(1+1/c (n+1))* (a n - 1)/a (n+1) = (c (n+1)+1) * ((a n - 1) / (c (n+1) * a (n+1)))"
         by (auto simp:field_simps)
       also have "... \<le> c n * ((a n - 1) / (c (n+1) * a (n+1)))"
         apply (rule mult_right_mono)
         subgoal using \<open>c (n + 1) < c n\<close> by auto
         subgoal by (smt \<open>0 < c (n + 1)\<close> a_pos divide_nonneg_pos mult_pos_pos of_int_0_le_iff 
               of_int_0_less_iff)
         done
       also have "... = (c n * (a n - 1)) / (c (n+1) * a (n+1))" by auto
       also have "... < (c n * (a n - 1)) / (c (n+1) * a (n+1)  - c (n+2))"
         apply (rule divide_strict_left_mono)
         subgoal using \<open>c (n+2) > 0\<close> by auto
         unfolding Suc_n_eq[symmetric] using * \<open>B>0\<close> by auto
       also have "... < (c n * a n - c (n+1)) / (c (n+1) * a (n+1)  - c (n+2))"
         apply (rule frac_less)
         unfolding Suc_n_eq[symmetric] using * \<open>B>0\<close> \<open>c (n + 1) < c n\<close> 
         by (auto simp:algebra_simps)
       also have "... = nth_prime n / nth_prime (n+1)"
         unfolding Suc_n_eq[symmetric] n_eq[symmetric] using \<open>B>0\<close> by auto
       also have "... < 1" by auto
       finally have "(1 + 1 / real_of_int (c (n + 1))) * real_of_int (a n - 1) 
         / real_of_int (a (n + 1)) < 1 " .
       then show "a n + (a n - c (n + 1) - 1) /  (c (n + 1)) < (a (n + 1))"
         using * by (auto simp:field_simps)
     qed
   qed
   have a_gt_1:"\<forall>\<^sub>F n in sequentially. c n > c (n+1) \<longrightarrow> a (n+1) > a n + 1"
     using Bc_large a_gt_plus c_pos[THEN eventually_all_ge_at_top]
     apply eventually_elim
   proof (rule impI)
     fix n assume  
       "c (n + 1) < c n \<longrightarrow> a n +  (a n - c (n + 1) - 1) / c (n + 1) <  a (n + 1)" 
       "c (n + 1) < c n" and B_eq:"B * int (nth_prime n) = c n * a n - c (n + 1) \<and>
          \<bar>real_of_int (c (n + 1))\<bar> < real_of_int (a n) / 2" and c_pos:"\<forall>y\<ge>n. 0 < c y"
     from this(1,2) 
     have "a n +  (a n - c (n + 1) - 1) / c (n + 1) <  a (n + 1)" by auto
     moreover have "a n - 2 * c (n+1) > 0"
       using B_eq c_pos[rule_format,of "n+1"] by auto
     then have "a n - 2 * c (n+1) \<ge> 1" by simp
     then have "(a n - c (n + 1) - 1) / c (n + 1) \<ge> 1"
       using c_pos[rule_format,of "n+1"] by (auto simp:field_simps)
     ultimately show "a n + 1 < a (n + 1)" by auto
   qed
 
   text\<open>The following corresponds to inequality (3.6) in the paper, which had to be
         slightly corrected:  \<close>
 
   have a_gt_sqrt:"\<forall>\<^sub>F n in sequentially. c n > c (n+1) \<longrightarrow> a (n+1) > a n + (sqrt n - 2)"
   proof -
     have a_2N:"\<forall>\<^sub>F N in sequentially. a (2*N) \<ge> N /2 +1" 
       using c_gt_half a_gt_1[THEN eventually_all_ge_at_top] 
     proof eventually_elim
       case (elim N)
       define S where "S={n \<in> {N..<2 * N}. c (n + 1) < c n}"
       define f where "f = (\<lambda>n. a (Suc n) - a n)"
 
       have f_1:"\<forall>x\<in>S. f x\<ge>1" and f_0:"\<forall>x. f x\<ge>0"
         subgoal using elim unfolding S_def f_def by auto
         subgoal using \<open>mono a\<close>[THEN incseq_SucD] unfolding f_def by auto
         done
       have "N / 2 < card S" 
         using elim unfolding S_def by auto
       also have "... \<le> sum f S" 
         unfolding of_int_sum
         apply (rule sum_bounded_below[of _ 1,simplified])
         using f_1 by auto
       also have "... \<le> sum f {N..<2 * N}" 
         unfolding of_int_sum
         apply (rule sum_mono2)
         unfolding S_def using f_0 by auto
       also have "... = a (2*N) - a N" 
         unfolding of_int_sum f_def of_int_diff
         apply (rule sum_Suc_diff')
         by auto
       finally have "N / 2 < a (2*N) - a N" .
       then show ?case using a_pos[rule_format,of N] by linarith
     qed
 
     have a_n4:"\<forall>\<^sub>F n in sequentially. a n > n/4" 
     proof -
       obtain N where a_N:"\<forall>n\<ge>N. a (2*n) \<ge> n /2+1"
         using a_2N unfolding eventually_at_top_linorder by auto
       have "a n>n/4" when "n\<ge>2*N" for n 
       proof -
         define n' where "n'=n div 2"
         have "n'\<ge>N" unfolding n'_def using that by auto
         have "n/4 < n' /2+1"
           unfolding n'_def by auto
         also have "... \<le> a (2*n')"
           using a_N \<open>n'\<ge>N\<close> by auto
         also have "... \<le>a n" unfolding n'_def
           apply (cases "even n")
           subgoal by simp
           subgoal by (simp add: assms(2) incseqD)
           done
         finally show ?thesis .
       qed
       then show ?thesis
         unfolding eventually_at_top_linorder by auto
     qed
 
     have c_sqrt:"\<forall>\<^sub>F n in sequentially. c n < sqrt n / 4"
     proof -
       have "\<forall>\<^sub>F x in sequentially. x>1" by simp
       moreover have "\<forall>\<^sub>F x in sequentially. real (nth_prime x) / (real x * ln (real x)) < 2"
         using nth_prime_asymptotics[unfolded asymp_equiv_def,THEN order_tendstoD(2),of 2]
         by simp
       ultimately have "\<forall>\<^sub>F n in sequentially. c n < B*8 *ln n + 1" using a_n4 Bc_large
       proof eventually_elim
         case (elim n)
         from this(4) have "c n=(B*nth_prime n+c (n+1))/a n"
           using a_pos[rule_format,of n] 
           by (auto simp:divide_simps)
         also have "... = (B*nth_prime n)/a n+c (n+1)/a n"
           by (auto simp:divide_simps)
         also have "... < (B*nth_prime n)/a n + 1"
         proof -
           have "c (n+1)/a n < 1" using elim(4) by auto
           then show ?thesis by auto
         qed
         also have "... < B*8 * ln n + 1"
         proof -
           have "B*nth_prime n < 2*B*n*ln n"
             using \<open>real (nth_prime n) / (real n * ln (real n)) < 2\<close> \<open>B>0\<close> \<open> 1 < n\<close> 
             by (auto simp:divide_simps)
           moreover have "real n / 4 < real_of_int (a n)" by fact
           ultimately have "(B*nth_prime n) / a n < (2*B*n*ln n) / (n/4)"
             apply (rule_tac frac_less)
             using \<open>B>0\<close> \<open> 1 < n\<close>  by auto
           also have "... = B*8 * ln n"
             using \<open> 1 < n\<close> by auto
           finally show ?thesis by auto
         qed
         finally show ?case .
       qed
       moreover have "\<forall>\<^sub>F n in sequentially. B*8 *ln n + 1 < sqrt n / 4"
         by real_asymp
       ultimately show ?thesis 
         by eventually_elim auto
     qed
 
     have 
       "\<forall>\<^sub>F n in sequentially. 0 < c (n+1)"
       "\<forall>\<^sub>F n in sequentially. c (n+1) < sqrt (n+1) / 4"
       "\<forall>\<^sub>F n in sequentially. n > 4"
       "\<forall>\<^sub>F n in sequentially. (n - 4) / sqrt (n + 1) + 1 > sqrt n"
       subgoal using c_pos[THEN eventually_all_ge_at_top]    
         by eventually_elim auto
       subgoal using  c_sqrt[THEN eventually_all_ge_at_top] 
         by eventually_elim (use le_add1 in blast)
       subgoal by simp
       subgoal 
         by real_asymp
       done
     then show ?thesis using a_gt_plus a_n4
       apply eventually_elim
     proof (rule impI)
       fix n assume asm:"0 < c (n + 1)" "c (n + 1) < sqrt (real (n + 1)) / 4" and
         a_ineq:"c (n + 1) < c n \<longrightarrow> a n +  (a n - c (n + 1) - 1) /  c (n + 1) < a (n + 1)" 
         "c (n + 1) < c n"  and "n / 4 < a n" "n > 4" 
         and n_neq:" sqrt (real n) < real (n - 4) / sqrt (real (n + 1)) + 1"
 
       have "(n-4) / sqrt(n+1) = (n/4 - 1)/ (sqrt (real (n + 1)) / 4)"
         using \<open>n>4\<close> by (auto simp:divide_simps)
       also have "... < (a n - 1) /  c (n + 1)" 
         apply (rule frac_less)
         using \<open>n > 4\<close> \<open>n / 4 < a n\<close> \<open>0 < c (n + 1)\<close> \<open>c (n + 1) < sqrt (real (n + 1)) / 4\<close>
         by auto
       also have "... - 1 = (a n - c (n + 1) - 1) /  c (n + 1)"
         using \<open>0 < c (n + 1)\<close> by (auto simp:field_simps)
       also have "a n + ... < a (n+1)"
         using a_ineq by auto
       finally have "a n + ((n - 4) / sqrt (n + 1) - 1) < a (n + 1)" by simp
       moreover have "(n - 4) / sqrt (n + 1) - 1 > sqrt n - 2"
         using n_neq[THEN diff_strict_right_mono,of 2] \<open>n>4\<close> 
         by (auto simp:algebra_simps of_nat_diff) 
       ultimately show "real_of_int (a n) + (sqrt (real n) - 2) < real_of_int (a (n + 1))"
         by argo
     qed
   qed
 
   text\<open>The following corresponds to inequality $ a_{2N} > N^{3/2}/2$ in the paper,
  which had to be slightly corrected: \<close>
 
   have a_2N_sqrt:"\<forall>\<^sub>F N in sequentially. a (2*N) >  real N * (sqrt (real N)/2 - 1)"
     using c_gt_half a_gt_sqrt[THEN eventually_all_ge_at_top] eventually_gt_at_top[of 4]
   proof eventually_elim
     case (elim N)
     define S where "S={n \<in> {N..<2 * N}. c (n + 1) < c n}"
     define f where "f = (\<lambda>n. a (Suc n) - a n)"
 
     have f_N:"\<forall>x\<in>S. f x\<ge>sqrt N - 2"
     proof 
       fix x assume "x\<in>S"
       then have "sqrt (real x) - 2 < f x" "x\<ge>N"
         using elim unfolding S_def f_def by auto
       moreover have "sqrt x - 2 \<ge> sqrt N - 2"
         using \<open>x\<ge>N\<close> by simp
       ultimately show  "sqrt (real N) - 2 \<le> real_of_int (f x)" by argo
     qed
     have f_0:"\<forall>x. f x\<ge>0"
       using \<open>mono a\<close>[THEN incseq_SucD] unfolding f_def by auto
 
     have "(N / 2)  * (sqrt N - 2) < card S * (sqrt N - 2)" 
       apply (rule mult_strict_right_mono)
       subgoal using elim unfolding S_def by auto
       subgoal using \<open>N>4\<close> 
         by (metis diff_gt_0_iff_gt numeral_less_real_of_nat_iff real_sqrt_four real_sqrt_less_iff)
       done
     also have "...  \<le> sum f S" 
       unfolding of_int_sum
       apply (rule sum_bounded_below)
       using f_N by auto
     also have "... \<le> sum f {N..<2 * N}" 
       unfolding of_int_sum
       apply (rule sum_mono2)
       unfolding S_def using f_0 by auto
     also have "... = a (2*N) - a N" 
       unfolding of_int_sum f_def of_int_diff
       apply (rule sum_Suc_diff')
       by auto
     finally have "real N / 2 * (sqrt (real N) - 2) < real_of_int (a (2 * N) - a N)" 
       .              
     then have "real N / 2 * (sqrt (real N) - 2) < a (2 * N)"
       using a_pos[rule_format,of N] by linarith
     then show ?case by (auto simp:field_simps)
   qed
 
   text\<open>The following part is required to derive the final contradiction of the proof.\<close>
 
   have a_n_sqrt:"\<forall>\<^sub>F n in sequentially. a n > (((n-1)/2) powr (3/2) - (n-1)) /2"
   proof (rule sequentially_even_odd_imp)
     define f where "f=(\<lambda>N. ((real (2 * N - 1) / 2) powr (3 / 2) - real (2 * N - 1)) / 2)"
     define g where "g=(\<lambda>N. real N * (sqrt (real N) / 2 - 1))"
     have "\<forall>\<^sub>F N in sequentially. g N > f N"
       unfolding f_def g_def
       by real_asymp
     moreover have "\<forall>\<^sub>F N in sequentially. a (2 * N) > g N"
       unfolding g_def using a_2N_sqrt .
     ultimately show "\<forall>\<^sub>F N in sequentially. f N < a (2 * N)"
       by eventually_elim auto
   next
     define f where "f=(\<lambda>N. ((real (2 * N + 1 - 1) / 2) powr (3 / 2) 
                                   - real (2 * N + 1 - 1)) / 2)"
     define g where "g=(\<lambda>N. real N * (sqrt (real N) / 2 - 1))"
     have "\<forall>\<^sub>F N in sequentially. g N = f N"
       using eventually_gt_at_top[of 0]
       apply eventually_elim
       unfolding f_def g_def
       by (auto simp:algebra_simps powr_half_sqrt[symmetric] powr_mult_base)
     moreover have "\<forall>\<^sub>F N in sequentially. a (2 * N) > g N"
       unfolding g_def using a_2N_sqrt .
     moreover have "\<forall>\<^sub>F N in sequentially. a (2 * N + 1) \<ge> a (2*N)"
       apply (rule eventuallyI)
       using \<open>mono a\<close> by (simp add: incseqD)
     ultimately show "\<forall>\<^sub>F N in sequentially. f N < (a (2 * N + 1))"
       apply eventually_elim
       by auto
   qed
 
   have a_nth_prime_gt:"\<forall>\<^sub>F n in sequentially. a n / nth_prime n > 1"
   proof -
     define f where "f=(\<lambda>n::nat. (((n-1)/2) powr (3/2) - (n-1)) /2)"
     have "\<forall>\<^sub>F x in sequentially. real (nth_prime x) / (real x * ln (real x)) < 2"
       using nth_prime_asymptotics[unfolded asymp_equiv_def,THEN order_tendstoD(2),of 2]
       by simp
     from this[] eventually_gt_at_top[of 1]
     have "\<forall>\<^sub>F n in sequentially. real (nth_prime n)   < 2*(real n * ln n)"
       apply eventually_elim
       by (auto simp:field_simps)
     moreover have *:"\<forall>\<^sub>F N in sequentially. f N >0 "
       unfolding f_def
       by real_asymp
     moreover have " \<forall>\<^sub>F n in sequentially. f n < a n"
       using a_n_sqrt unfolding f_def .
     ultimately have "\<forall>\<^sub>F n in sequentially. a n / nth_prime n 
                     > f n / (2*(real n * ln n))"
       apply eventually_elim
       apply (rule frac_less2)
       by auto
     moreover have "\<forall>\<^sub>F n in sequentially.
         (f n)/ (2*(real n * ln n)) > 1"
       unfolding f_def 
       by real_asymp
     ultimately show ?thesis 
       by eventually_elim argo
   qed
 
   have a_nth_prime_lt:"\<exists>\<^sub>F n in sequentially. a n / nth_prime n < 1"
   proof -
     have "liminf (\<lambda>x. a x / nth_prime x) < 1"
       using nth_2 by auto
     from this[unfolded less_Liminf_iff]
     show ?thesis
       apply (auto elim!:frequently_elim1)
       by (meson divide_less_eq_1 ereal_less_eq(7) leD leI 
           nth_prime_nonzero of_nat_eq_0_iff of_nat_less_0_iff order.trans)
   qed
 
   from a_nth_prime_gt a_nth_prime_lt show False 
     by (simp add: eventually_mono frequently_def) 
 qed
 
 section\<open>Acknowledgements\<close>
 
 text\<open>A.K.-A. and W.L. were supported by the ERC Advanced Grant ALEXANDRIA (Project 742178)
  funded by the European Research Council and led by Professor Lawrence Paulson
  at the University of Cambridge, UK.\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Irrationality_J_Hancl/Irrationality_J_Hancl.thy b/thys/Irrationality_J_Hancl/Irrationality_J_Hancl.thy
--- a/thys/Irrationality_J_Hancl/Irrationality_J_Hancl.thy
+++ b/thys/Irrationality_J_Hancl/Irrationality_J_Hancl.thy
@@ -1,1087 +1,1087 @@
 (*
   File: Irrationality_J_Hancl.thy
   Authors:  Angeliki Koutsoukou-Argyraki and Wenda Li,
             Computer Laboratory, University of Cambridge, UK.
   Email: ak2110@cam.ac.uk, wl302@cam.ac.uk  
 *)
 
 section \<open>Irrational Rapidly Convergent Series\<close>
 theory Irrationality_J_Hancl
   imports "HOL-Analysis.Analysis" "HOL-Decision_Procs.Approximation"
 begin
 
 text \<open>This is the formalisation of a proof by J. Hancl, in particular of the proof of his Theorem 3 in
 the paper: Irrational Rapidly Convergent Series, Rend. Sem. Mat. Univ. Padova, Vol 107 (2002).
 
 The statement asserts the irrationality of the sum of a series consisting of rational numbers
 defined using sequences that fulfill certain properties. Even though the statement
 is number-theoretic, the proof uses only arguments from introductory Analysis.\<close>
 
 text \<open>We show the central result (theorem Hancl3) by proof by contradiction, by making use of some of 
  the auxiliary lemmas. To this end, assuming that the sum is a rational number, for a quantity 
  $\textrm{ALPHA}(n)$ we show that $\textrm{ALPHA}(n) \geq 1$ for all $n \in \mathbb{N}$. After that we show that we can find an 
   $n \in \mathbb{N}$ for which $\textrm{ALPHA}(n) < 1$ which yields a contradiction and we thus conclude that the 
   sum of the series is a rational number. We finally give an immediate application of theorem Hancl3
  for a specific series (corollary Hancl3corollary, requiring lemma
  summable\_ln\_plus) which corresponds to Corollary 2 in the original
 paper by J. Hancl. 
 \<close>
 
 hide_const floatarith.Max
 
 subsection \<open>Misc\<close>
 
 lemma filterlim_sequentially_iff:
   "filterlim f F1 sequentially \<longleftrightarrow> filterlim (\<lambda>x. f (x+k)) F1 sequentially"
   unfolding filterlim_iff
   apply (subst eventually_sequentially_seg)
   by auto
 
 lemma filterlim_realpow_sequentially_at_top:
   "(x::real) > 1 \<Longrightarrow> filterlim ((^) x) at_top sequentially"
   apply (rule LIMSEQ_divide_realpow_zero[THEN filterlim_inverse_at_top,of _ 1,simplified])
   by auto
 
 lemma filterlim_at_top_powr_real:
   fixes g::"'b \<Rightarrow> real"
   assumes "filterlim f at_top F" "(g \<longlongrightarrow> g') F" "g'>1"
   shows "filterlim (\<lambda>x. g x powr f x) at_top F"
 proof -
   have "filterlim (\<lambda>x. ((g'+1)/2) powr f x) at_top F" 
   proof (subst filterlim_at_top_gt[of _ _ 1],rule+)
     fix Z assume "Z>(1::real)"
     have "\<forall>\<^sub>F x in F. ln Z \<le> ln (((g' + 1) / 2) powr f x)"
       using assms(1)[unfolded filterlim_at_top,rule_format,of "ln Z / ln ((g' + 1) / 2)"]
       apply (eventually_elim)
       using \<open>g'>1\<close> by (auto simp:ln_powr divide_simps)
     then show "\<forall>\<^sub>F x in F. Z \<le> ((g' + 1) / 2) powr f x"
       apply (eventually_elim)
       apply (subst (asm) ln_le_cancel_iff)
       using \<open>Z>1\<close> \<open>g'>1\<close> by auto
   qed
   moreover have "\<forall>\<^sub>F x in F. ((g'+1)/2) powr f x \<le> g x powr f x" 
   proof -
     have "\<forall>\<^sub>F x in F. g x > (g'+1)/2"
       apply (rule order_tendstoD[OF assms(2)])
       using \<open>g'>1\<close> by auto
     moreover have "\<forall>\<^sub>F x in F. f x>0" 
       using assms(1)[unfolded filterlim_at_top_dense,rule_format,of 0] .
     ultimately show ?thesis
       apply eventually_elim
       using \<open>g'>1\<close> by (auto intro!: powr_mono2)
   qed
   ultimately show ?thesis using filterlim_at_top_mono by fast
 qed
 
 lemma powrfinitesum:
   fixes a::real and s::nat assumes  "s \<le> n"
   shows " (\<Prod>j=s..(n::nat).(a powr (2^j)))  = a powr (\<Sum>j=s..(n::nat).(2^j)) "
   using \<open>s \<le> n\<close> 
 proof(induct n)
   case 0
   then show ?case by auto
 next
   case (Suc n)
   have ?case when "s\<le>n" using Suc.hyps 
     by (metis Suc.prems add.commute linorder_not_le powr_add prod.nat_ivl_Suc' sum.cl_ivl_Suc that)
   moreover have ?case when "s=Suc n"   
   proof-
     have "(\<Prod>j = s..Suc n. a powr 2 ^ j) =(a powr 2 ^(Suc n))  " 
       using \<open>s=Suc n\<close> by simp
     also have "(a powr 2 ^(Suc n) ) =  a powr sum ((^) 2) {s..Suc n}   " using that by auto
     ultimately show " (\<Prod>j = s..Suc n. a powr 2 ^ j) = a powr sum ((^) 2) {s..Suc n}"
       using \<open>s\<le>Suc n\<close> by linarith
   qed
   ultimately show ?case using \<open>s\<le>Suc n\<close> by linarith
 qed
 
 lemma summable_ratio_test_tendsto:
   fixes f :: "nat \<Rightarrow> 'a::banach"
   assumes "c < 1" and "\<forall>n. f n\<noteq>0" and "(\<lambda>n. norm (f (Suc n)) / norm (f n)) \<longlonglongrightarrow> c"
   shows "summable f"
 proof -
   obtain N where N_dist:"\<forall>n\<ge>N. dist (norm (f (Suc n)) / norm (f n)) c < (1-c)/2"
     using assms unfolding tendsto_iff eventually_sequentially 
     by (meson diff_gt_0_iff_gt zero_less_divide_iff zero_less_numeral)
   have "norm (f (Suc n)) / norm (f n) \<le> (1+c)/2" when "n\<ge>N" for n
     using N_dist[rule_format,OF that] \<open>c<1\<close> 
     apply (auto simp add:field_simps dist_norm)
     by argo
   then have "norm (f (Suc n))  \<le> (1+c)/2 * norm (f n)" when "n\<ge>N" for n
     using that assms(2)[rule_format, of n] by (auto simp add:divide_simps)
   moreover have "(1+c)/2 < 1" using \<open>c<1\<close> by auto 
   ultimately show ?thesis
     using summable_ratio_test[of _ N f] by blast
 qed
 
 lemma summable_ln_plus:
   fixes f::"nat \<Rightarrow> real" 
   assumes "summable f" "\<forall>n. f n>0"
   shows "summable (\<lambda>n. ln (1+f n))"
 proof (rule summable_comparison_test_ev[OF _ assms(1)])
   have "ln (1 + f n) > 0" for n by (simp add: assms(2) ln_gt_zero)
   moreover have "ln (1 + f n) \<le> f n" for n 
     apply (rule ln_add_one_self_le_self2)
     using assms(2)[rule_format,of n] by auto 
   ultimately show "\<forall>\<^sub>F n in sequentially. norm (ln (1 + f n)) \<le> f n"
     by (auto intro!: eventuallyI simp add:less_imp_le) 
 qed
 
 lemma suminf_real_offset_le:
   fixes f :: "nat \<Rightarrow> real"
   assumes f: "\<And>i. 0 \<le> f i" and "summable f"
   shows "(\<Sum>i. f (i + k)) \<le> suminf f"
 proof -
   have "(\<lambda>n. \<Sum>i<n. f (i + k)) \<longlonglongrightarrow> (\<Sum>i. f (i + k))"
     using summable_sums[OF \<open>summable f\<close>] 
     by (simp add: assms(2) summable_LIMSEQ summable_ignore_initial_segment)
   moreover have "(\<lambda>n. \<Sum>i<n. f i) \<longlonglongrightarrow> (\<Sum>i. f i)"
     using summable_sums[OF \<open>summable f\<close>] by (simp add: sums_def atLeast0LessThan f)
   then have "(\<lambda>n. \<Sum>i<n + k. f i) \<longlonglongrightarrow> (\<Sum>i. f i)"
     by (rule LIMSEQ_ignore_initial_segment)
   ultimately show ?thesis
   proof (rule LIMSEQ_le, safe intro!: exI[of _ k])
     fix n assume "k \<le> n"
     have "(\<Sum>i<n. f (i + k)) = (\<Sum>i<n. (f \<circ> (\<lambda>i. i + k)) i)"
       by simp
     also have "\<dots> = (\<Sum>i\<in>(\<lambda>i. i + k) ` {..<n}. f i)"
       by (subst sum.reindex) auto
     also have "\<dots> \<le> sum f {..<n + k}"
       by (intro sum_mono2) (auto simp: f)
     finally show "(\<Sum>i<n. f (i + k)) \<le> sum f {..<n + k}" .
   qed
 qed
 
 
 
 lemma factt:
   fixes s n ::nat assumes "s \<le> n" 
   shows " (\<Sum>i=s..n. 2^i) < (2^(n+1) :: real) " using assms
 proof (induct n)
   case 0
   show ?case by  auto 
 next
   case (Suc n)
   have ?case when  "s=n+1" using that by auto
   moreover have ?case when  "s \<noteq> n+1" 
   proof -
     have"(\<Sum>i=s..(n+1). 2^i ) = (\<Sum>i=s..n. 2^i ) + (2::real)^(n+1) "
       using sum.cl_ivl_Suc \<open>s \<le> Suc n \<close>
       by (auto simp add:add.commute)
     also have "... < (2) ^ (n +1) + (2)^(n+1)" 
     proof -
       have "s \<le>n" using that  \<open>s \<le> Suc n \<close> by auto
       then show ?thesis
         using Suc.hyps \<open>s \<le> n\<close> by linarith
     qed
     also have "... = 2^(n+2)" by simp
     finally show "(\<Sum>i=s..(Suc n). 2^i )< (2::real)^(Suc n+1)" by auto
   qed
   ultimately show ?case by blast
 qed
 
 subsection \<open>Auxiliary lemmas and the main proof\<close>
 
 lemma showpre7:
   fixes a b ::"nat\<Rightarrow>int " and q p::int
   assumes "q>0" and "p>0"and a: "\<forall>n. a n>0" and "\<forall>n. b n>0" and 
     assumerational:"(\<lambda> n. b (n+1) / a (n+1) )  sums (p/q)"
   shows "q*((\<Prod>j=1..n. of_int( a j)))*(suminf (\<lambda>(j::nat). (b (j+n+1)/ a (j+n+1 )))) 
         = ((\<Prod>j=1..n. of_int( a j)))*(p -q* (\<Sum>j=1..n. b j / a j))       " 
 proof -
   define aa where "aa=(\<Prod>j = 1..n. real_of_int (a j))"
   define ff where "ff=(\<lambda>i. real_of_int (b (i+1)) / real_of_int (a (i+1)))"
 
   have "(\<Sum>j. ff (j+n)) =  (\<Sum>n. ff n) - sum ff {..<n}"
     apply (rule suminf_minus_initial_segment)
     using assumerational unfolding ff_def by (simp add: sums_summable)
   also have "... = p/q - sum ff {..<n}"
     using assumerational unfolding ff_def by (simp add: sums_iff)
   also have "... = p/q - (\<Sum>j=1..n. ff (j-1))"
   proof -
     have "sum ff {..<n} = (\<Sum>j=1..n. ff (j-1))"
       apply (subst sum_bounds_lt_plus1[symmetric])
       by simp
     then show ?thesis unfolding ff_def by auto
   qed
   finally have "(\<Sum>j. ff (j + n)) = p / q - (\<Sum>j = 1..n. ff (j - 1))" .
   then have "q*(\<Sum>j. ff (j + n)) = p - q*(\<Sum>j = 1..n. ff (j - 1))"
     using \<open>q>0\<close> by (auto simp add:field_simps)
   then have "aa*q*(\<Sum>j. ff (j + n)) = aa*(p - q*(\<Sum>j = 1..n. ff (j - 1)))" 
     by auto
   then show ?thesis unfolding aa_def ff_def by auto
 qed
 
 lemma show7:
   fixes d::"nat\<Rightarrow>real" and a b::"nat\<Rightarrow>int " and q p::int
   assumes "q \<ge>1" and "p \<ge> 1" and a: "\<forall>n. a n \<ge> 1" and "\<forall>n. b n \<ge> 1"
     and assumerational:"(\<lambda> n. b (n+1) / a (n+1) ) sums (p/q)"
   shows "q*((\<Prod>j=1..n. of_int( a j)))*( suminf (\<lambda> (j::nat). (b (j+n+1)/ a (j+n+1 )))) \<ge> 1 "
     (is "?L \<ge> _")
 proof-
   define LL where "LL=?L"
   define aa where "aa=(\<Prod>j = 1..n. real_of_int (a j))"
   define ff where "ff=(\<lambda>i. real_of_int (b (i+1)) / real_of_int (a (i+1)))"
 
   have "?L > 0"
   proof -
     have "aa > 0"
       unfolding aa_def using a
       apply (induct n,auto)
       by (simp add: int_one_le_iff_zero_less prod_pos)
     moreover have "(\<Sum>j. ff (j + n)) > 0"
     proof (rule suminf_pos)
       have "summable ff" unfolding ff_def using assumerational
         using summable_def by blast
       then show " summable (\<lambda>j. ff (j + n))" using summable_iff_shift[of ff n] by auto
-      show " \<forall>i. 0 < ff (i + n)" unfolding ff_def using a assms(4) int_one_le_iff_zero_less by auto
+      show "\<And>i. 0 < ff (i + n)" unfolding ff_def using a assms(4) int_one_le_iff_zero_less by auto
     qed
     ultimately show ?thesis unfolding aa_def ff_def using \<open>q\<ge>1\<close> by auto
   qed
   moreover have "?L \<in> \<int>"
   proof -
     have "?L = aa *(p -q* ( \<Sum>j=1..n. b j / a j))"
       unfolding aa_def
       apply (rule showpre7)
       using assms int_one_le_iff_zero_less by auto
     also have "... = aa * p - q * (\<Sum>j=1..n. aa * b j / a j)"
       by (auto simp add:algebra_simps sum_distrib_left)
     also have "... = prod a {1..n} * p - q * (\<Sum>j = 1..n. b j * prod a ({1..n} - {j}))"
     proof -
       have "(\<Sum>j=1..n. aa * b j / a j) = (\<Sum>j=1..n. b j * prod a ({1..n} - {j}))"
         unfolding of_int_sum
       proof (rule sum.cong)
         fix x assume "x \<in> {1..n}"
         then have "(\<Prod>i = 1..n. real_of_int (a i)) = a x * (\<Prod>i\<in>{1..n} - {x}. real_of_int (a i))"
           apply (rule_tac prod.remove)
           by auto
         then have "aa / real_of_int (a x) = prod a ({1..n} - {x})"
           unfolding aa_def using a[rule_format,of x] by (auto simp add:field_simps)
         then show "aa * b x / a x = b x * prod a ({1..n} - {x})"
           by (metis mult.commute of_int_mult times_divide_eq_right)
       qed simp
       moreover have "aa * p = (\<Prod>j = 1..n.  (a j)) *  p"
         unfolding aa_def by auto
       ultimately show ?thesis by force
     qed
     also have "... \<in> \<int>" using Ints_of_int by blast
     finally show ?thesis .
   qed
   ultimately show ?thesis 
     apply (fold LL_def)
     by (metis Ints_cases int_one_le_iff_zero_less not_less of_int_0_less_iff of_int_less_1_iff)
 qed
 
 lemma show8:
   fixes d ::"nat\<Rightarrow>real " and a :: "nat\<Rightarrow>int" and s k::nat 
   assumes "A > 1" and d: "\<forall>n. d n> 1"  and a:"\<forall>n. a n>0" and "s>0"
     and "convergent_prod d"
     and assu2: "\<forall>n \<ge> s. ( A/ (of_int (a n)) powr(1/of_int (2^n)))> prodinf (\<lambda>j. d(n +j))"
   shows "\<forall>n\<ge>s. prodinf (\<lambda>j. d(j+n)) < A/(Max ((\<lambda>(j::nat). 
                   (of_int (a j)) powr(1 /of_int (2^j))) ` {s..n}))"
 proof(rule,rule)
   fix n assume "s \<le> n"
   define sp where "sp = (\<lambda>n. prodinf (\<lambda>j. d(j+n)))"
   define ff where "ff = (\<lambda>(j::nat). (real_of_int (a j)) powr(1 /of_int (2^j)))"
   have "sp i \<ge> sp n" when "i\<le>n" for i
   proof -
     have "(\<Prod>j. d (j + i)) = (\<Prod>ia. d (ia + (n - i) + i)) * (\<Prod>ia<n - i. d (ia + i))"
       apply (rule prodinf_split_initial_segment) 
       subgoal using \<open>convergent_prod d\<close> convergent_prod_iff_shift[of d i] by simp
       subgoal for j using d[rule_format,of "j+i"] by auto
       done
     then have "sp i = sp n * (\<Prod>j<n - i. d (i + j))"
       unfolding sp_def using \<open>n\<ge>i\<close> by (auto simp:algebra_simps)
     moreover have "sp i>1" "sp n>1" 
       unfolding sp_def using convergent_prod_iff_shift \<open>convergent_prod d\<close> d 
       by (auto intro!:less_1_prodinf)
     moreover have "(\<Prod>j<n - i. d (i + j)) \<ge>1" 
       apply (rule prod_ge_1)
       using d less_imp_le by auto
     ultimately show ?thesis by auto
   qed
   moreover have "\<forall>j\<ge>s. A / ff j > sp j" 
     unfolding ff_def sp_def using assu2 by (auto simp:algebra_simps)
   ultimately have "\<forall>j. s\<le>j \<and> j\<le>n \<longrightarrow> A / ff j > sp n" by force
   then show "sp n< A / Max (ff ` {s..n})" 
     by (metis (mono_tags, hide_lams) Max_in \<open>n\<ge>s\<close> atLeastAtMost_iff empty_iff 
         finite_atLeastAtMost finite_imageI imageE image_is_empty order_refl)
 qed
 
 lemma auxiliary1_9:
   fixes d ::"nat\<Rightarrow>real" and a::"nat\<Rightarrow>int " and s m::nat 
   assumes d: "\<forall>n. d n> 1"  and a: "\<forall>n. a n>0" and "s>0" and "n \<ge> m" and " m \<ge> s"
     and auxifalse_assu: "\<forall>n\<ge>m. (of_int (a (n+1))) powr(1 /of_int (2^(n+1))) <
               (d (n+1))* (Max ((\<lambda> (j::nat). (of_int (a j)) powr(1 /of_int (2^j))) ` {s..n} ))"
   shows "(of_int (a (n+1))) powr(1 /of_int (2^(n+1))) <
     (\<Prod>j=(m+1)..(n+1). d j) * (Max ((\<lambda> (j::nat). (of_int (a j)) powr(1 /of_int (2^j))) ` {s..m}))"
 proof-
   define ff where "ff = (\<lambda>(j::nat). (real_of_int (a j)) powr(1 /of_int (2^j)))"
   have [simp]:"ff j > 0" for j
     unfolding ff_def by (metis a less_numeral_extra(3) of_int_0_less_iff powr_gt_zero)
 
   have ff_asm:"ff (n+1) < d (n+1) * Max (ff ` {s..n})" when "n\<ge>m" for n
     using auxifalse_assu that unfolding ff_def by simp
   from \<open>n\<ge>m\<close>
   have Q: "(Max( ff ` {s..n} )) \<le> (\<Prod>j=(m+1)..n. d j)* (Max (ff ` {s..m}))"
   proof(induct n)
     case 0
     then show ?case using \<open>m\<ge>s\<close> by simp 
   next
     case (Suc n)
     have ?case when "m=Suc n"
       using that by auto
     moreover have ?case when "m\<noteq>Suc n" 
     proof -
       have "m \<le> n" using that Suc(2) by simp
       then have IH:"Max (ff ` {s..n}) \<le> prod d {m + 1..n} * Max (ff ` {s..m})"
         using Suc(1) by linarith
       have "Max (ff ` {s..Suc n}) = Max (ff ` {s..n} \<union> {ff (Suc n)})"
         using Suc.prems assms(5) atLeastAtMostSuc_conv by auto
       also have "... = max (Max (ff ` {s..n})) (ff (Suc n))"
         using Suc.prems assms(5) max_def sup_assoc that by auto
       also have "... \<le> max (Max (ff ` {s..n})) (d (n+1) * Max (ff ` {s..n}))"
         apply (rule max.mono)
         using ff_asm[of n] \<open> m \<le> Suc n\<close> that \<open>s\<le>m\<close> by auto
       also have "... \<le> Max (ff ` {s..n}) * max 1 (d (n+1))"
       proof -
         have "Max (ff ` {s..n}) \<ge>0" 
           by (metis (mono_tags, hide_lams) Max_in \<open>\<And>j. 0 < ff j\<close> \<open>m \<le> n\<close> assms(5) 
               atLeastAtMost_iff empty_iff finite_atLeastAtMost finite_imageI imageE 
               image_is_empty less_eq_real_def)
         then show ?thesis using max_mult_distrib_right 
           by (simp add: max_mult_distrib_right mult.commute)
       qed
       also have "... = Max (ff ` {s..n}) * d (n+1)"
         using d[rule_format, of "n+1"] by auto
       also have "... \<le>  prod d {m + 1..n} * Max (ff ` {s..m}) * d (n+1)"
         using IH d[rule_format, of "n+1"] by auto
       also have "... = prod d {m + 1..n+1} * Max (ff ` {s..m})"
         using \<open>n\<ge>m\<close> by (simp add:prod.nat_ivl_Suc' algebra_simps)
       finally show ?case by simp
     qed
     ultimately show ?case by blast
   qed
   then have "d (n+1) * Max (ff ` {s..n} ) \<le> (\<Prod>j=(m+1)..(n+1). d j)* (Max (ff ` {s..m}))"
     using \<open>m\<le>n\<close> d[rule_format,of "Suc n"] by (simp add:prod.nat_ivl_Suc')
   then show ?thesis using ff_asm[of n] \<open>s\<le>m\<close> \<open>m\<le>n\<close> unfolding ff_def by auto
 qed
 
 lemma show9:
   fixes d ::"nat\<Rightarrow>real " and a :: "nat\<Rightarrow>int " and s ::nat and A::real
   assumes   "A > 1" and  d: "\<forall>n. d n> 1"  and a: "\<forall>n. a n>0" and "s>0"  
     and assu1: "(( \<lambda> n. (of_int (a n)) powr(1 /of_int (2^n)))\<longlongrightarrow> A) sequentially "
     and "convergent_prod d"
     and 8: "\<forall>n\<ge>s. prodinf (\<lambda>j. d( n+j)) 
                   < A/(Max ((\<lambda>(j::nat). (of_int (a j)) powr(1 /of_int (2^j))) ` {s..n})) "
   shows "\<forall>m \<ge>s. \<exists>n\<ge>m.  ( (of_int (a (n+1))) powr(1 /of_int (2^(n+1))) \<ge>
           (d (n+1))* (Max ( ( \<lambda> (j::nat). (of_int (a j)) powr(1 /of_int (2^j))) ` {s..n} )))"
 proof (rule ccontr)
   define ff where "ff = (\<lambda>(j::nat). (real_of_int (a j)) powr(1 /of_int (2^j)))"
   assume assumptioncontra: " \<not> (\<forall>m \<ge>s. \<exists>n\<ge>m.  ( (ff (n+1)) \<ge> (d (n+1))* (Max ( ff  ` {s..n}))))"
 
   then obtain  t where "t\<ge>s" and
     ttt: "  \<forall>n\<ge>t.  ( (ff (n+1)) < (d (n+1))* (Max ( ff ` {s..n} ) ))"               
     by fastforce
   define B where "B=prodinf (\<lambda>j. d(t+1+j))"
   have "B>0" unfolding B_def 
     apply (rule less_0_prodinf)
     subgoal using convergent_prod_iff_shift[of d "t+1"] \<open>convergent_prod d\<close> 
       by (auto simp:algebra_simps)
     subgoal using d le_less_trans zero_le_one by blast
     done
 
   have "A \<le> B * Max ( ff ` {s..t})"
   proof (rule tendsto_le[of sequentially "\<lambda>n. (\<Prod>j=(t+1)..(n+1). d j) * Max ( ff ` {s..t})" _ 
         "\<lambda>n. ff (n+1)"])
     show "(\<lambda>n. ff (n + 1)) \<longlonglongrightarrow> A"
       using assu1[folded ff_def] LIMSEQ_ignore_initial_segment by blast
     have "(\<lambda>n. prod d {t + 1..n + 1}) \<longlonglongrightarrow> B"
     proof -
       have "(\<lambda>n. \<Prod>i\<le>n. d (t + 1 + i)) \<longlonglongrightarrow> B"
         apply (rule convergent_prod_LIMSEQ[of "(\<lambda>j. d(t+1+j))",folded B_def])
         using \<open>convergent_prod d\<close> convergent_prod_iff_shift[of d "t+1"] by (simp add:algebra_simps)
       then have "(\<lambda>n. \<Prod>i\<in>{0..n}. d (i+(t + 1))) \<longlonglongrightarrow> B"
         using atLeast0AtMost by (auto simp:algebra_simps)
       then have "(\<lambda>n. prod d {(t + 1)..n + (t + 1)}) \<longlonglongrightarrow> B" 
         apply (subst (asm) prod.shift_bounds_cl_nat_ivl[symmetric])
         by simp
       from seq_offset_neg[OF this,of "t"]
       show "(\<lambda>n. prod d {t + 1..n+1}) \<longlonglongrightarrow> B"
         apply (elim Lim_transform)
         apply (rule LIMSEQ_I)
         apply (rule exI[where x="t+1"])
         by auto
     qed
     then show "(\<lambda>n. prod d {t + 1..n + 1} * Max (ff ` {s..t})) \<longlonglongrightarrow> B * Max (ff ` {s..t})" 
       by (auto intro:tendsto_eq_intros)
     have "\<forall>\<^sub>F n in sequentially. (ff (n+1)) < (\<Prod>j=(t+1)..(n+1). d j) * (Max ( ff ` {s..t}))"
       unfolding eventually_sequentially ff_def
       using auxiliary1_9[OF d a \<open>s>0\<close> _ \<open>t\<ge>s\<close> ttt[unfolded ff_def]]
       by blast
     then show "\<forall>\<^sub>F n in sequentially. (ff (n+1)) \<le> (\<Prod>j=(t+1)..(n+1). d j) * (Max ( ff ` {s..t}))"
       by (eventually_elim,simp)
   qed simp
   also have "... \<le> B * Max ( ff ` {s..t+1})"
   proof -
     have "Max (ff ` {s..t}) \<le> Max (ff ` {s..t + 1})"
       apply (rule Max_mono)
       using \<open>t\<ge>s\<close> by auto
     then show ?thesis using \<open>B>0\<close> by auto
   qed
   finally have "A \<le> B * Max (ff ` {s..t + 1})" 
     unfolding B_def .
   moreover have "B < A / Max (ff ` {s..t + 1})"
     using 8[rule_format, of "t+1",folded ff_def B_def] \<open>s\<le>t\<close> by auto
   moreover have "Max (ff ` {s..t+1})>0"
     using \<open>A \<le> B * Max (ff ` {s..t + 1})\<close> \<open>B>0\<close> \<open>A>1\<close>
       zero_less_mult_pos [of B "Max (ff ` {s..Suc t})"]
     by simp
   ultimately show False by (auto simp add:field_simps)
 qed
 
 lemma show10:
   fixes d ::"nat\<Rightarrow>real " and  a ::"nat\<Rightarrow>int " and s::nat
   assumes d: "\<forall>n. d n> 1" and a: "\<forall>n. a n>0"  and " s>0"
     and 9: "\<forall>m \<ge>s. \<exists>n\<ge>m.  ((of_int (a (n+1))) powr(1 /of_int (2^(n+1))) \<ge>
           (d (n+1))* (Max ((\<lambda>(j::nat). (of_int (a j)) powr(1 /of_int (2^j))) ` {s..n} )))"
   shows "\<forall>m\<ge>s. \<exists>n\<ge>m. (((d (n+1))powr(2^(n+1))) * (\<Prod>j=1..n. of_int( a j)) * 
             (1/ (\<Prod>j=1..s-1. (of_int( a j) )))) \<le> (a (n+1)) "
 proof (rule,rule)
   fix m assume "s \<le> m" 
   from 9[rule_format,OF this]
   obtain n where "n\<ge>m" and asm_9:"( (of_int (a (n+1))) powr(1 /of_int (2^(n+1))) \<ge>
           (d (n+1))* (Max ( ( \<lambda> (j::nat). (of_int (a j)) powr(1 /of_int (2^j))) ` {s..n} )))"
     by auto
   with \<open>s\<le>m\<close> have "s\<le>n" by auto
 
   have prod:"(\<Prod>j=1..n. real_of_int( a j)) * ( 1/ (\<Prod>j=1..s-1. (of_int( a j) )))
           = (\<Prod>j=s..n. of_int( a j))"
   proof -
     define f where "f= (\<lambda>j. real_of_int( a j))"
     have "{Suc 0..n}= {Suc 0..s - Suc 0} \<union> {s..n}" using \<open>n\<ge>s\<close>  \<open>s >0\<close>
       by auto
     then have "(\<Prod>j=1..n. f j) = (\<Prod>j=1..s-1. f j) * (\<Prod>j=s..n. f j)"
       apply (subst prod.union_disjoint[symmetric])
       by auto
     moreover have "(\<Prod>j=1..s-1. f j) > 0 "
       apply (rule linordered_semidom_class.prod_pos)
       using a unfolding f_def by auto
     then have "(\<Prod>j=1..s-1. f j) \<noteq> 0" by argo
     ultimately show ?thesis unfolding f_def by auto 
   qed
   then have " (((d (n+1))powr(2^(n+1) )) * (\<Prod>j=1..n. of_int( a j)) * ( 1/ (\<Prod>j=1..s-1. (of_int( a j) ))))
                 =(((d (n+1))powr(2^(n+1) )) * (\<Prod>j=s..n. of_int( a j)))" 
   proof -
     define f where "f= (\<lambda>j. real_of_int( a j))"
     define c where "c = (d (n+1))powr(2^(n+1))"
     show ?thesis using prod
       apply (fold f_def c_def)
       by (metis mult.assoc) 
   qed
   also have
     "... \<le> ((d (n+1))powr(2^(n+1) ) * (\<Prod>i=s..n. (Max(( \<lambda> (j::nat). ( of_int( a j) powr(1 /real_of_int (2^j)) )) ` {s..n  } ))   powr(2^i)) )"
   proof (rule mult_left_mono)
     show "0 \<le> (d (n + 1)) powr 2 ^ (n + 1)"
       by auto
     show "(\<Prod>j = s..n. real_of_int (a j))
     \<le> (\<Prod>i = s..n.
            Max ((\<lambda>j. real_of_int (a j) powr (1 / real_of_int (2 ^ j))) `
                 {s..n}) powr
            2 ^ i)"
     proof (rule prod_mono)
       fix i assume i: "i \<in> {s..n}"
       have "real_of_int (a i) = (real_of_int (a i) powr (1 / real_of_int (2 ^ i))) powr 2 ^ i"
         unfolding powr_powr by (simp add: a less_eq_real_def)
       also have  "\<dots> \<le>  (Max(( \<lambda> (j::nat). ( real_of_int( a j) powr(1 /real_of_int (2^j)))) ` {s..n}))powr(2^i)" 
       proof (rule powr_mono2)
         show "real_of_int (a i) powr (1 / real_of_int (2 ^ i))
                   \<le> Max ((\<lambda>j. real_of_int (a j) powr (1 / real_of_int (2 ^ j))) ` {s..n})" 
           apply (rule Max_ge)
            apply auto
           using i by blast
       qed simp_all
       finally have "real_of_int (a i) \<le> Max ((\<lambda>j. real_of_int (a j) powr (1 / real_of_int (2 ^ j))) ` {s..n}) powr 2 ^ i" .
       then show "0 \<le> real_of_int (a i) \<and>
          real_of_int (a i)
          \<le> Max ((\<lambda>j. real_of_int (a j) powr (1 / real_of_int (2 ^ j))) `
                  {s..n}) powr
             2 ^ i"
         using a i
         by (metis \<open>real_of_int (a i) = (real_of_int (a i) powr (1 / real_of_int (2 ^ i))) powr 2 ^ i\<close> 
             powr_ge_pzero)
     qed
   qed
   also have "... = ((d (n+1))powr(2^(n+1) )) * (Max(( \<lambda> (j::nat). ( of_int( a j) powr 
                       (1 /of_int (2^j)) )) ` {s..n  } )) powr (\<Sum>i=s..n. 2^i ) "
   proof-
     have  "((d (n+1))powr(2^(n+1) ))\<ge>1  "
       by (metis Transcendental.log_one  d le_powr_iff zero_le_numeral zero_le_power zero_less_one)
     moreover have "(\<Prod>i=s..n. (Max(( \<lambda> (j::nat). ( of_int( a j) powr(1 /real_of_int (2^j)) )) ` {s..n  } ) )   powr(2^i))     = (Max(( \<lambda> (j::nat). ( of_int( a j) powr(1 /of_int (2^j)) )) ` {s..n  } )) powr (\<Sum>i=s..n. 2^i )  "
     proof -
       define ff where "ff = Max (( \<lambda> (j::nat). ( of_int( a j) powr(1 /real_of_int (2^j)) )) ` {s..n  } )"
       show ?thesis apply (fold ff_def)
         using \<open>s\<le>n\<close>  powrfinitesum by auto
     qed 
     ultimately show ?thesis by auto
   qed
   also have "... \<le>   ((d (n+1))powr(2^(n+1) )) * 
                 (Max(( \<lambda> (j::nat).( of_int( a j) powr(1 /of_int (2^j)) )) ` {s..n  })) powr(2^(n+1))   "
 
   proof -
     define ff where "ff = Max (( \<lambda> (j::nat). ( of_int( a j) powr(1 /real_of_int (2^j)) )) ` {s..n  } )"
     have " sum ((^) 2) {s..n} < (2::real) ^ (n + 1)" using factt \<open>s\<le>n\<close>  by auto
     moreover have "1 \<le> ff" 
     proof -
       define S where "S=(\<lambda>(j::nat). ( of_int( a j) powr(1 /real_of_int (2^j)) )) ` {s..n  }"
       have "finite S" unfolding S_def by auto
       moreover have "S\<noteq>{}" unfolding S_def using \<open>s\<le>n\<close>  by auto
       moreover have "\<exists>x\<in>S. x\<ge>1"
       proof-
         have " ( of_int( a s) powr(1 /real_of_int (2^s)) ) \<ge> 1  "  
           apply (rule ge_one_powr_ge_zero)
            apply auto
           by (simp add: a int_one_le_iff_zero_less)
         moreover have " ( of_int( a s) powr(1 /real_of_int (2^s)) ) \<in> S" 
           unfolding S_def
           apply (rule rev_image_eqI[where x=s])
           using \<open>s\<le>n\<close> by auto
         ultimately show ?thesis by auto
       qed
       ultimately show ?thesis 
         using Max_ge_iff[of S 1] unfolding S_def ff_def by blast
     qed
     moreover have "0 \<le> (d (n + 1)) powr 2 ^ (n + 1)" by auto
     ultimately show ?thesis
       apply(fold ff_def)
       apply (rule mult_left_mono)
        apply (rule powr_mono)
       by auto
   qed
 
   also have "... =  ((d (n+1)) * 
                       (Max((\<lambda>j. (of_int( a j) powr(1 /of_int (2^j)))) ` {s..n}))) powr(2^(n+1))"
   proof -
     define ss where "ss = (\<lambda>j. real_of_int (a j) powr (1 / real_of_int (2 ^ j))) ` {s..n}"
     have "d (n + 1) \<ge>0" using d[rule_format,of "n+1"] by argo
     moreover have "Max ss \<ge>0" 
     proof -
       have "(a s) powr (1 /  (2 ^ s)) \<ge> 0" by auto
       moreover have "(a s) powr (1 /  (2 ^ s)) \<in> ss" unfolding ss_def 
         apply (rule_tac x=s in rev_image_eqI)
         using \<open>s\<le>n\<close> by auto
       moreover have "finite ss" "ss \<noteq> {}" unfolding ss_def using \<open>s\<le>n\<close> by auto
       ultimately show ?thesis using Max_ge_iff[of ss 0] by blast
     qed
     ultimately show ?thesis 
       apply (fold ss_def)
       using powr_mult by auto
   qed
   also have "... \<le> (real_of_int (a (n + 1)) powr (1 / real_of_int (2 ^ (n + 1)))) powr 2 ^ (n + 1)"
   proof - 
     define ss where "ss = (\<lambda>j. real_of_int (a j) powr (1 / real_of_int (2 ^ j))) ` {s..n}"
     show ?thesis 
     proof (fold ss_def,rule powr_mono2)
       have "Max ss \<ge>0" \<comment> \<open>NOTE: we are repeating the same proof, so it may be a good idea to put 
                             this conclusion in an outer block so that it can be reused 
                             (without reproving).\<close>
       proof -
         have "(a s) powr (1 /  (2 ^ s)) \<ge> 0" by auto
         moreover have "(a s) powr (1 /  (2 ^ s)) \<in> ss" unfolding ss_def 
           apply (rule_tac x=s in rev_image_eqI)
           using \<open>s\<le>n\<close> by auto
         moreover have "finite ss" "ss \<noteq> {}" unfolding ss_def using \<open>s\<le>n\<close> by auto
         ultimately show ?thesis using Max_ge_iff[of ss 0] by blast
       qed
       moreover have "d (n + 1) \<ge>0" 
         using d[rule_format,of "n+1"] by argo
       ultimately show "0 \<le> (d (n + 1)) * Max ss" by auto
       show "(d (n + 1)) * Max ss \<le> real_of_int (a (n + 1)) powr (1 / real_of_int (2 ^ (n + 1)))"
         using asm_9[folded ss_def] .
     qed simp    
   qed
   also have "... =  (of_int (a (n+1)))" 
     by (simp add: a less_eq_real_def pos_add_strict powr_powr)
   finally show "\<exists>n\<ge>m. d (n + 1) powr 2 ^ (n + 1) * (\<Prod>j = 1..n. real_of_int (a j)) *
                 (1 / (\<Prod>j = 1..s - 1. real_of_int (a j)))
                 \<le> real_of_int (a (n + 1))" using \<open>n\<ge>m\<close> \<open>m\<ge>s\<close> 
     apply (rule_tac x=n in exI)
     by auto
 qed
 
 lemma lasttoshow:
   fixes d ::"nat\<Rightarrow>real " and a b ::"nat\<Rightarrow>int " and q::int and s::nat
   assumes d: "\<forall>n. d n> 1" and a:"\<forall>n. a n>0" and "s>0" and "q>0"  
     and "A > 1" and b:"\<forall>n. b n>0" and 9:
     "\<forall>m\<ge>s. \<exists>n\<ge>m. ((of_int (a (n+1))) powr(1 /of_int (2^(n+1))) \<ge>
           (d (n+1))* (Max ((\<lambda>(j::nat). (of_int (a j)) powr(1 /of_int (2^j))) ` {s..n} )))"
     and assu3: "filterlim( \<lambda> n. (d n)^(2^n)/ b n) at_top sequentially "
     and 5: "\<forall>\<^sub>F n in sequentially. (\<Sum>j. (b (n + j)) /  (a (n + j))) \<le> 2 * b n / a n"
   shows "\<exists>n. q*((\<Prod>j=1..n. real_of_int(a j))) * suminf (\<lambda>(j::nat). (b (j+n+1)/ a (j+n+1)))<1"
 proof-
   define as where "as=(\<Prod>j = 1..s - 1. real_of_int (a j))"
   obtain n where "n\<ge>s" and n_def1:"real_of_int q * as * 2 
       * real_of_int (b (n + 1)) / d (n + 1) powr 2 ^ (n + 1) < 1"
     and n_def2:"d (n + 1) powr 2 ^ (n + 1) * (\<Prod>j = 1..n. real_of_int (a j)) * (1 / as) 
           \<le> real_of_int (a (n + 1))"
     and n_def3:"(\<Sum>j. (b (n+1 + j)) /  (a (n+1 + j))) \<le> 2 * b (n+1) / a (n+1)"
   proof -
     have *:"(\<lambda>n. real_of_int (b n) / d n ^ 2 ^ n) \<longlonglongrightarrow> 0"
       using tendsto_inverse_0_at_top[OF assu3] by auto
     then have "(\<lambda>n. real_of_int (b n) / d n powr 2 ^ n) \<longlonglongrightarrow> 0"
     proof -
       have "d n ^ 2 ^ n = d n powr (of_nat (2 ^ n))" for n 
         apply (subst powr_realpow)
         using d[rule_format, of n] by auto
       then show ?thesis using * by auto
     qed
     from tendsto_mult_right_zero[OF this,of "q * as * 2"] 
     have "(\<lambda>n. q * as * 2 * b n / d n powr 2 ^ n) \<longlonglongrightarrow> 0"
       by auto
     then have "\<forall>\<^sub>F n in sequentially. q * as * 2 * b n / d n powr 2 ^ n < 1"
       by (elim order_tendstoD) simp
     then have "\<forall>\<^sub>F n in sequentially. q * as * 2 * b n / d n powr 2 ^ n < 1 
                   \<and> (\<Sum>j. (b (n + j)) /  (a (n + j))) \<le> 2 * b n / a n"
       using 5 by eventually_elim auto
     then obtain N where N_def:"\<forall>n\<ge>N. q * as * 2 * b n / d n powr 2 ^ n < 1 
             \<and> (\<Sum>j. (b (n + j)) /  (a (n + j))) \<le> 2 * b n / a n"
       unfolding eventually_sequentially by auto
     obtain n where "n\<ge>s" and "n\<ge>N" and n_def:"d (n + 1) powr 2 ^ (n + 1) 
                 * (\<Prod>j = 1..n. of_int (a j)) * (1 / as) \<le> real_of_int (a (n + 1))"
       using show10[OF d a \<open>s>0\<close> 9,folded as_def,rule_format,of "max s N"] by auto
     with N_def[rule_format, of "n+1"] that[of n]  show ?thesis by auto
   qed
 
   define pa where "pa = (\<Prod>j = 1..n. real_of_int (a j))"
   define dn where "dn = d (n + 1) powr 2 ^ (n + 1)"
   have [simp]:"dn >0" "as > 0" 
     subgoal unfolding dn_def by (metis d not_le numeral_One powr_gt_zero zero_le_numeral)
     subgoal unfolding as_def by (simp add: a prod_pos)
     done
   have [simp]:"pa>0"
     unfolding pa_def using a by (simp add: prod_pos)
 
   have K: "q* (\<Prod>j=1..n. real_of_int (a j)) * suminf (\<lambda> (j::nat). (b (j+n+1)/ a (j+n+1)))
               \<le>q* (\<Prod>j=1..n. real_of_int (a j)) *2* (b (n+1))/(a( n+1))"
     apply (fold pa_def)
     using mult_left_mono[OF n_def3,of "real_of_int q * pa"] 
       \<open>n\<ge>s\<close> \<open>pa>0\<close> \<open>q>0\<close> by (auto simp add:algebra_simps) 
   also have KK:"... \<le> 2*q* (\<Prod>j=1..n. real_of_int (a j)) * (b(n+1))*
       ((\<Prod>j=1..s-1. real_of_int( a j))/((d (n+1))powr(2^(n+1)) * (\<Prod>j=1..n. real_of_int ( a j))))" 
   proof -
     have " dn * pa * (1 / as) \<le> real_of_int (a (n + 1))"
       using n_def2 unfolding dn_def pa_def .
     then show ?thesis 
       apply (fold pa_def dn_def as_def)
       using \<open>pa>0\<close> \<open>q>0\<close> a[rule_format, of "Suc n"] b[rule_format, of "Suc n"]
       by (auto simp add:divide_simps algebra_simps)
   qed
   also have KKK: "... = (q* ((\<Prod>j=1..(s-1). real_of_int( a j)))*2
                                 * (b (n+1)))/ ((d (n+1))powr(2^(n+1)))"
     apply (fold as_def pa_def dn_def)
     apply simp
     using \<open>0 < pa\<close> by blast
   also have KKKK: "... < 1" using n_def1 unfolding as_def by simp
   finally show ?thesis by auto
 qed
 
 lemma 
   fixes d ::"nat\<Rightarrow>real " and  a b ::"nat\<Rightarrow>int " and A::real
   assumes "A > 1" and d: "\<forall>n. d n> 1" and a: "\<forall>n. a n>0" and b:"\<forall>n. b n>0" 
     and assu1: "(( \<lambda> n. (of_int (a n)) powr(1 /of_int (2^n)))\<longlongrightarrow> A) sequentially "
     and assu3: "filterlim ( \<lambda> n. (d n)^(2^n)/ b n) at_top sequentially"
     and "convergent_prod d"
   shows issummable: "summable (\<lambda>j. b j / a j)"
     and show5: "\<forall>\<^sub>F n in sequentially. (\<Sum>j. (b (n + j)) / (a (n + j))) \<le> 2 * b n / a n"
 proof-
   define c where "c = (\<lambda>j. b j / a j)"
   have c_pos:"c j>0" for j 
     using a b unfolding c_def by simp
   have c_ratio_tendsto:"(\<lambda>n. c (n+1) / c n ) \<longlonglongrightarrow> 0"
   proof -
     define nn where "nn=(\<lambda>n. (2::int)^ (Suc n))"
     define ff where "ff=(\<lambda> n. (a n / a (Suc n)) powr(1 /nn n)*(d(Suc n)))"
     have nn_pos:"nn n>0" and ff_pos:"ff n>0" for n
       subgoal unfolding nn_def by simp
       subgoal unfolding ff_def
         using d[rule_format, of "Suc n"] a[rule_format, of n] a[rule_format, of "Suc n"]
         by auto
       done
     have ff_tendsto:"ff \<longlonglongrightarrow> 1/ sqrt A" 
     proof -
       have "(of_int (a n)) powr(1 / (nn n)) = sqrt(of_int (a n) powr(1 /of_int (2^n)))" for n
         unfolding nn_def using a
         by (simp add: powr_half_sqrt [symmetric] powr_powr ac_simps)
       moreover have "(( \<lambda> n. sqrt(of_int (a n) powr(1 /of_int (2^n))))\<longlongrightarrow> sqrt A) sequentially " 
         using assu1 tendsto_real_sqrt by blast
       ultimately have "(( \<lambda> n. (of_int (a n)) powr(1 /of_int (nn n)))\<longlongrightarrow> sqrt A) sequentially " 
         by auto
       from tendsto_divide[OF this assu1[THEN LIMSEQ_ignore_initial_segment[where k=1]]] 
       have "(\<lambda>n. (a n / a (Suc n)) powr(1 /nn n)) \<longlonglongrightarrow> 1/sqrt A"
         using \<open>A>1\<close> a unfolding nn_def
         by (auto simp add:powr_divide less_imp_le inverse_eq_divide sqrt_divide_self_eq)
       moreover have "(\<lambda>n. d (Suc n))\<longlonglongrightarrow> 1" 
         apply (rule convergent_prod_imp_LIMSEQ)
         using convergent_prod_iff_shift[of d 1] \<open>convergent_prod d\<close> by auto
       ultimately show ?thesis
         unfolding ff_def by (auto intro:tendsto_eq_intros)
     qed
     have "(\<lambda>n. (ff n) powr nn n) \<longlonglongrightarrow> 0" 
     proof -
       define aa where "aa=(1+1/sqrt A) / 2"
       have "eventually (\<lambda>n. ff n<aa) sequentially"
         apply (rule order_tendstoD[OF ff_tendsto])
         unfolding aa_def using \<open>A>1\<close> by (auto simp add:field_simps)
       moreover have "(\<lambda>n. aa powr nn n) \<longlonglongrightarrow> 0" 
       proof -
         have "(\<lambda>y. aa ^ (nat \<circ> nn) y) \<longlonglongrightarrow> 0"
           apply (rule tendsto_power_zero)
           subgoal unfolding nn_def comp_def
             apply (rule filterlim_subseq)
             by (auto intro:strict_monoI)
           subgoal unfolding aa_def using \<open>A>1\<close> by auto
           done
         then show ?thesis
         proof (elim filterlim_mono_eventually)
           have "aa>0" unfolding aa_def using \<open>A>1\<close> 
             by  (auto simp add:field_simps pos_add_strict)
           then show " \<forall>\<^sub>F x in sequentially. aa ^ (nat \<circ> nn) x = aa powr real_of_int (nn x)"
             by (auto simp: powr_int order.strict_implies_order[OF nn_pos])
         qed auto
       qed
       ultimately show ?thesis
         apply (elim metric_tendsto_imp_tendsto)
         apply (auto intro!:powr_mono2 elim!:eventually_mono)
         using nn_pos ff_pos by (meson le_cases not_le)+
     qed
     then have "(\<lambda>n. (d (Suc n))^(nat (nn n)) * (a n / a (Suc n))) \<longlonglongrightarrow> 0" 
     proof (elim filterlim_mono_eventually)
       show "\<forall>\<^sub>F x in sequentially. ff x powr  (nn x) = d (Suc x) ^ nat (nn x) * (a x / a (Suc x))" 
         apply (rule eventuallyI)
         subgoal for x
           unfolding ff_def
           using a[rule_format,of x] a[rule_format,of "Suc x"] d[rule_format,of "Suc x"] nn_pos[of x]
           apply (auto simp add:field_simps powr_divide powr_powr powr_mult )
           by (simp add: powr_int)
         done
     qed auto 
     moreover have "(\<lambda>n. b (Suc n) / (d (Suc n))^(nat (nn n))) \<longlonglongrightarrow> 0"
       using tendsto_inverse_0_at_top[OF assu3,THEN LIMSEQ_ignore_initial_segment[where k=1]]
       unfolding nn_def by (auto simp add:field_simps nat_mult_distrib nat_power_eq)
     ultimately have "(\<lambda>n. b (Suc n) * (a n / a (Suc n))) \<longlonglongrightarrow> 0" 
       apply -
       subgoal premises asm
         using tendsto_mult[OF asm,simplified]
         apply (elim filterlim_mono_eventually)
         using d by (auto simp add:algebra_simps,metis (mono_tags, lifting) always_eventually 
             not_one_less_zero)
       done
     then have "(\<lambda>n. (b (Suc n) / b n) * (a n / a (Suc n))) \<longlonglongrightarrow> 0" 
       apply (elim Lim_transform_bound[rotated])
       apply (rule eventuallyI)
       subgoal for x using a[rule_format, of x] a[rule_format, of "Suc x"] 
           b[rule_format, of x] b[rule_format, of "Suc x"]
         by (auto simp add:field_simps)
       done
     then show ?thesis unfolding c_def by (auto simp add:algebra_simps)
   qed
   from c_ratio_tendsto
   have "(\<lambda>n. norm (b (Suc n) / a (Suc n)) / norm (b n / a n)) \<longlonglongrightarrow> 0" 
     unfolding c_def
     using a b by (force simp add:divide_simps abs_of_pos intro: Lim_transform_eventually)
   from summable_ratio_test_tendsto[OF _ _ this] a b 
   show "summable c" unfolding c_def
     apply auto 
     by (metis less_irrefl)
   have "\<forall>\<^sub>F n in sequentially. (\<Sum>j. c (n + j)) \<le> 2 * c n"
   proof -
     obtain N where N_ratio:"\<forall>n\<ge>N. c (n + 1) / c n < 1 / 2" 
     proof -
       have "eventually (\<lambda>n. c (n+1) / c n < 1/2) sequentially" 
         using c_ratio_tendsto[unfolded tendsto_iff,rule_format, of "1/2",simplified]
         apply eventually_elim
         subgoal for n using c_pos[of n] c_pos[of "Suc n"] by auto
         done
       then show ?thesis using that unfolding eventually_sequentially by auto
     qed
     have "(\<Sum>j. c (j + n)) \<le> 2 * c n" when "n\<ge>N" for n
     proof -
       have "(\<Sum>j<m. c (j + n)) \<le> 2*c n * (1 - 1 / 2^(m+1))" for m
       proof (induct m)
         case 0
         then show ?case using c_pos[of n] by simp
       next
         case (Suc m)
         have "(\<Sum>j<Suc m. c (j + n)) = c n + (\<Sum>i<m. c (Suc i + n)) "
           unfolding sum.lessThan_Suc_shift by simp
         also have "... \<le> c n + (\<Sum>i<m. c (i + n) / 2)"
         proof -
           have "c (Suc i + n) \<le> c (i + n) / 2" for i
             using N_ratio[rule_format,of "i+n"] \<open>n\<ge>N\<close> c_pos[of "i+n"]  by simp
           then show ?thesis by (auto intro:sum_mono)
         qed
         also have "... = c n + (\<Sum>i<m. c (i + n)) / 2"
           unfolding sum_divide_distrib by simp
         also have "... \<le> c n + c n * (1 - 1 / 2 ^ (m + 1))"
           using Suc by auto
         also have "... = 2 * c n * (1 - 1 / 2 ^ (Suc m + 1))"
           by (auto simp add:field_simps)
         finally show ?case .
       qed
       then have "(\<Sum>j<m. c (j + n)) \<le> 2*c n" for m
         using c_pos[of n] 
         by (smt divide_le_eq_1_pos divide_pos_pos nonzero_mult_div_cancel_left zero_less_power)
       moreover have "summable (\<lambda>j. c (j + n))" 
         using \<open>summable c\<close> by (simp add: summable_iff_shift)
       ultimately show ?thesis using suminf_le_const[of "\<lambda>j. c (j+n)" "2*c n"] by auto
     qed
     then show ?thesis unfolding eventually_sequentially by (auto simp add:algebra_simps)
   qed
   then show "\<forall>\<^sub>F n in sequentially. (\<Sum>j. (b (n + j)) /  (a (n + j))) \<le> 2 * b n / a n"
     unfolding c_def by simp
 qed
 
 
 theorem Hancl3:
   fixes d ::"nat\<Rightarrow>real " and  a b ::"nat\<Rightarrow>int "
   assumes "A > 1" and d:"\<forall>n. d n> 1" and a: "\<forall>n. a n>0" and b:"\<forall>n. b n>0" and "s>0"
     and assu1: "(( \<lambda> n. (of_int (a n)) powr(1 /of_int (2^n)))\<longlongrightarrow> A) sequentially "
     and assu2: "\<forall>n \<ge> s. (A/ (of_int (a n)) powr(1 /of_int (2^n)))> prodinf (\<lambda>j. d(n +j))"
     and assu3: "filterlim (\<lambda> n. (d n)^(2^n)/ b n) at_top sequentially"
     and "convergent_prod d" 
   shows "suminf(\<lambda> n. b n / a n ) \<notin> Rats"
 proof(rule ccontr)
   assume asm:"\<not> (suminf(\<lambda> n. b n / a n ) \<notin> Rats)"
   have ab_sum:"summable (\<lambda>j. b j / a j)"
     using issummable[OF \<open>A>1\<close> d a b assu1 assu3 \<open>convergent_prod d\<close>] .
   obtain p q ::int where "q>0" and pq_def:"(\<lambda> n. b (n+1) / a (n+1) ) sums (p/q)"
   proof -
     from asm have "suminf(\<lambda> n. b n / a n ) \<in> Rats" by auto
     then have "suminf(\<lambda> n. b (n+1) / a (n+1)) \<in> Rats" 
       apply (subst suminf_minus_initial_segment[OF ab_sum,of 1])
       by auto   
     then obtain p' q' ::int where "q'\<noteq>0" and pq_def:"(\<lambda> n. b (n+1) / a (n+1) ) sums (p'/q')"
       unfolding Rats_eq_int_div_int
       using summable_ignore_initial_segment[OF ab_sum,of 1,THEN summable_sums]
       by force
     define p q where "p=(if q'<0 then - p' else p')" and "q=(if q'<0 then - q' else q')"
     have "p'/q'=p/q" "q>0" using \<open>q'\<noteq>0\<close> unfolding p_def q_def by auto
     then show ?thesis using that[of q p] pq_def by auto
   qed
 
   define ALPHA where 
     "ALPHA = (\<lambda>n. (of_int q)*((\<Prod>j=1..n. of_int(a j)))*(suminf (\<lambda> (j::nat). 
                       (b (j+n+1)/a (j+n+1)))))"
   have "ALPHA n \<ge> 1" for n 
   proof -
     have "suminf(\<lambda> n. b (n+1) / a (n+1)) > 0"
       apply (rule suminf_pos)
       subgoal using summable_ignore_initial_segment[OF ab_sum,of 1] by auto
       subgoal using a b by simp
       done
     then have "p/q > 0" using sums_unique[OF pq_def,symmetric] by auto
     then have "q\<ge>1" "p\<ge>1" using \<open>q>0\<close> by (auto simp add:divide_simps)
     moreover have "\<forall>n. 1 \<le> a n" "\<forall>n. 1 \<le> b n" using a b 
       by (auto simp add: int_one_le_iff_zero_less)
     ultimately show ?thesis unfolding ALPHA_def
       using show7[OF _ _ _ _ pq_def] by auto
   qed
   moreover have "\<exists>n. ALPHA n < 1" unfolding ALPHA_def
   proof (rule lasttoshow[OF d a \<open>s>0\<close> \<open>q>0\<close> \<open>A>1\<close> b _ assu3])
     show "\<forall>\<^sub>F n in sequentially. (\<Sum>j. real_of_int (b (n + j)) / real_of_int (a (n + j)))
                     \<le> real_of_int (2 * b n) / real_of_int (a n)"
       using show5[OF \<open>A>1\<close> d a b assu1 assu3 \<open>convergent_prod d\<close>] by simp
     show "\<forall>m\<ge>s. \<exists>n\<ge>m. d (n + 1) * Max ((\<lambda>j. real_of_int (a j) powr (1 / real_of_int (2 ^ j))) ` {s..n})
                  \<le> real_of_int (a (n + 1)) powr (1 / real_of_int (2 ^ (n + 1)))"
       apply (rule show9[OF \<open>A>1\<close> d a \<open>s>0\<close> assu1 \<open>convergent_prod d\<close>])
       using show8[OF \<open>A>1\<close> d a \<open>s>0\<close> \<open>convergent_prod d\<close> assu2] by (simp add:algebra_simps)
   qed
   ultimately show False using not_le by blast
 qed
 
 corollary Hancl3corollary:
   fixes A::real and  a b ::"nat\<Rightarrow>int "
   assumes "A > 1" and a: "\<forall>n. a n>0" and b:"\<forall>n. b n>0"
     and assu1: "((\<lambda> n. (of_int (a n)) powr(1 /of_int (2^n)))\<longlongrightarrow> A) sequentially "
     and asscor2: "\<forall>n \<ge>6. (of_int (a n)) powr(1 /of_int (2^n ))*(1+ 4*(2/3)^n) \<le> A
                     \<and> (b n \<le>2 powr((4/3)^(n-1)) )   "
   shows "suminf(\<lambda> n. b n / a n ) \<notin> Rats"
 proof-
   define d::"nat\<Rightarrow>real" where "d= (\<lambda> n. 1+(2/3)^(n+1))" 
 
   have dgt1:"\<forall>n. 1 < d n " unfolding d_def by auto
   moreover have "convergent_prod d"
     unfolding d_def
     apply (rule abs_convergent_prod_imp_convergent_prod)
     apply (rule summable_imp_abs_convergent_prod)
     using summable_ignore_initial_segment[OF complete_algebra_summable_geometric
           [of "2/3::real",simplified],of 1] by simp
   moreover have "\<forall>n\<ge>6. (\<Prod>j. d (n + j)) 
                     < A / real_of_int (a n) powr (1 / real_of_int (2 ^ n))"
   proof rule+
     fix n::nat assume "6 \<le> n"
     have d_sum:"summable (\<lambda>j. ln (d j))" unfolding d_def
       apply (rule summable_ln_plus)
       apply (rule summable_ignore_initial_segment[OF complete_algebra_summable_geometric
           [of "2/3::real",simplified],of 1])
       by simp 
 
     have "(\<Sum>j. ln (d (n + j))) < ln (1+4 * (2 / 3) ^ n)"
     proof -
       define c::real where "c=(2 / 3) ^ n"
       have "0<c" "c<1/8" 
       proof -
         have "c=(2 / 3)^6 * (2 / 3)  ^ (n-6)"
           unfolding c_def using \<open>n\<ge>6\<close>
           apply (subst power_add[symmetric])
           by auto
         also have "... \<le> (2 / 3)^6" by (auto intro:power_le_one)
         also have "... < 1/8" by (auto simp add:field_simps)
         finally show "c<1/8" .
       qed (simp add:c_def)
 
       have "(\<Sum>j. ln (d (n + j))) \<le> (\<Sum>j. (2 / 3) ^ (n + j + 1))"
         apply (rule suminf_le)
         subgoal unfolding d_def 
           apply (intro allI ln_add_one_self_le_self2 )
           apply (rule order.strict_trans[of _ 0])
           by auto
         subgoal using summable_ignore_initial_segment[OF d_sum,of n] 
           by (auto simp add:algebra_simps)
         subgoal using summable_geometric[THEN summable_ignore_initial_segment,of "2/3" "n+1"]
           by (auto simp add:algebra_simps)
         done
       also have "... = (\<Sum>j. (2 / 3)^(n+1)*(2 / 3) ^ j)"
         by (auto simp add:algebra_simps power_add)
       also have "... = (2 / 3)^(n+1) * (\<Sum>j. (2 / 3) ^ j)"
         apply (rule suminf_mult)
         by (auto intro:summable_geometric)
       also have "... = 2 * c"
         unfolding c_def
         apply (subst suminf_geometric)
         by auto
       also have "... <  4 * c - (4 * c)\<^sup>2"
         using \<open>0<c\<close> \<open>c<1/8\<close>
         by (sos "((((A<0 * A<1) * R<1) + ((A<=0 * R<1) * (R<1/16 * [1]^2))))")
       also have "... \<le> ln (1 + 4 * c)"
         apply (rule ln_one_plus_pos_lower_bound)
         using \<open>0<c\<close> \<open>c<1/8\<close> by auto
       finally show ?thesis unfolding c_def by simp
     qed
     then have "exp (\<Sum>j. ln (d (n + j))) < 1 + 4 * (2 / 3) ^ n"
       by (metis Groups.mult_ac(2) add.right_neutral add_mono_thms_linordered_field(5) 
           divide_inverse divide_less_eq_numeral1(1) divide_pos_pos exp_gt_zero less_eq_real_def
           ln_exp ln_less_cancel_iff mult_zero_left rel_simps(27) rel_simps(76) zero_less_one
           zero_less_power)
     moreover have "exp (\<Sum>j. ln (d (n + j))) = (\<Prod>j. d (n + j))"
     proof (subst exp_suminf_prodinf_real [symmetric])
       show "\<And>k. 0 \<le> ln (d (n + k))" 
         using dgt1 by (simp add: less_imp_le)
       show "abs_convergent_prod (\<lambda>na. exp (ln (d (n + na))))"
         apply (subst exp_ln)
         subgoal for j using dgt1[rule_format,of "n+j"] by auto
         subgoal unfolding abs_convergent_prod_def real_norm_def
           apply (subst abs_of_nonneg)
           using convergent_prod_iff_shift[of d n] \<open>convergent_prod d\<close> 
           by (auto simp add: dgt1 less_imp_le algebra_simps)
         done
       show "(\<Prod>na. exp (ln (d (n + na)))) = (\<Prod>j. d (n + j))"
         apply (subst exp_ln)
         subgoal using dgt1 le_less_trans zero_le_one by blast
         subgoal by simp
         done
     qed
     ultimately have "(\<Prod>j. d (n + j))  < 1 + 4 * (2 / 3) ^ n"
       by simp
     also have "... \<le> A / (a n) powr (1 / of_int (2 ^ n))" 
     proof -
       have "a n powr (1 / real_of_int (2 ^ n)) > 0"
         using a[rule_format,of n] by auto
       then show ?thesis using asscor2[rule_format,OF \<open>6\<le>n\<close>] 
         by (auto simp add:field_simps)
     qed
     finally show "(\<Prod>j. d (n + j)) < A / real_of_int (a n) powr (1 / of_int (2 ^ n))" .
   qed
   moreover have "LIM n sequentially. d n ^ 2 ^ n / real_of_int (b n) :> at_top" 
   proof -
     have "LIM n sequentially. d n ^ 2 ^ n / 2 powr((4/3)^(n-1)) :> at_top"
     proof -
       define n1 where "n1=(\<lambda>n. (2::real)* (3/2)^(n-1))"
       define n2 where "n2=(\<lambda>n. ((4::real)/3)^(n-1))"
       have "LIM n sequentially. (((1+(8/9)/(n1 n)) powr (n1 n))/2) powr (n2 n) :> at_top" 
       proof (rule filterlim_at_top_powr_real[where g'="exp (8/9) / (2::real)"])
         define e1 where "e1=exp (8/9) / (2::real)"
         show "e1>1" unfolding e1_def by (approximation 4)
         show "(\<lambda>n. ((1+(8/9)/(n1 n)) powr (n1 n))/2) \<longlonglongrightarrow> e1"
         proof -
           have "(\<lambda>n. (1+(8/9)/(n1 n)) powr (n1 n)) \<longlonglongrightarrow> exp (8/9)"
             apply (rule filterlim_compose[OF tendsto_exp_limit_at_top])
             unfolding n1_def
             by (auto intro!: filterlim_tendsto_pos_mult_at_top 
                 filterlim_realpow_sequentially_at_top
                 simp:filterlim_sequentially_iff[of "\<lambda>x. (3 / 2) ^ (x - Suc 0)" _ 1])
           then show ?thesis unfolding e1_def
             by (intro tendsto_intros,auto)
         qed
         show "filterlim n2 at_top sequentially"
           unfolding n2_def
           apply (subst filterlim_sequentially_iff[of "\<lambda>n. (4 / 3) ^ (n - 1)" _ 1])
           by (auto intro:filterlim_realpow_sequentially_at_top)
       qed
       moreover have "\<forall>\<^sub>F n in sequentially. (((1+(8/9)/(n1 n)) powr (n1 n))/2) powr (n2 n)
         = d n ^ 2 ^ n / 2 powr((4/3)^(n-1))"
       proof (rule eventually_sequentiallyI[of 1])
         fix x assume "x\<ge>(1::nat)"
         have " ((1 + 8 / 9 / n1 x) powr n1 x / 2) powr n2 x 
                     = (((1 + 8 / 9 / n1 x) powr n1 x) powr n2 x) / 2 powr (4 / 3) ^ (x - 1)"
           by (simp add:n1_def n2_def powr_divide)
         also have "... = (1 + 8 / 9 / n1 x) powr (n1 x * n2 x) / 2 powr (4 / 3) ^ (x - 1)"
           by (simp add: powr_powr)
         also have "... = (1 + 8 / 9 / n1 x) powr (2 ^ x) / 2 powr (4 / 3) ^ (x - 1)"
         proof -
           have "n1 x * n2 x = 2 ^ x" 
             unfolding n1_def n2_def
             apply (subst mult.assoc)
             apply (subst power_mult_distrib[symmetric])
             using \<open>x\<ge>1\<close> by (auto simp flip:power_Suc)
           then show ?thesis by simp
         qed
         also have "... = (1 + 8 / 9 / n1 x) ^ (2 ^ x) / 2 powr (4 / 3) ^ (x - 1)"
           apply (subst (3) powr_realpow[symmetric])
            apply (simp_all add: n1_def)
           by (smt zero_le_divide_iff zero_le_power)
         also have "... = d x ^ 2 ^ x / 2 powr (4 / 3) ^ (x - 1)"
         proof -
           define x1 where "x1=x-1"
           have *:"x=x1+1" unfolding x1_def using \<open>x\<ge>1\<close> by simp
           have **: "8 / 9 / n1 x = (2 / 3) ^ (x + 1)" 
             unfolding n1_def using \<open>x\<ge>1\<close>
             apply (fold x1_def *[symmetric])
             by (auto simp add:divide_simps)
           then show ?thesis 
             unfolding d_def 
             apply (subst **)
             by auto
         qed
         finally show "((1 + 8 / 9 / n1 x) powr n1 x / 2) powr n2 x 
                         = d x ^ 2 ^ x / 2 powr (4 / 3) ^ (x - 1) " .
       qed
       ultimately show ?thesis using filterlim_cong by fast
     qed
     moreover have "\<forall>\<^sub>F n in sequentially. d n ^ 2 ^ n / 2 powr((4/3)^(n-1)) 
         \<le> d n ^ 2 ^ n / real_of_int (b n)"
       apply (rule eventually_sequentiallyI[of 6])
       apply (rule divide_left_mono)
       subgoal for x
         using asscor2[rule_format,of x] by auto
       subgoal for x
         using \<open>\<forall>n. 1 < d n\<close>[rule_format, of x] by auto
       subgoal for x
         using b by auto
       done
     ultimately show ?thesis by (auto elim: filterlim_at_top_mono)
   qed
   ultimately show ?thesis using Hancl3[OF \<open>A>1\<close> _ a b _ assu1,of d 6] by force
 qed
 
 end
diff --git a/thys/Markov_Models/Classifying_Markov_Chain_States.thy b/thys/Markov_Models/Classifying_Markov_Chain_States.thy
--- a/thys/Markov_Models/Classifying_Markov_Chain_States.thy
+++ b/thys/Markov_Models/Classifying_Markov_Chain_States.thy
@@ -1,2341 +1,2340 @@
 section \<open>Classifying Markov Chain States\<close>
 
 theory Classifying_Markov_Chain_States
   imports
     "HOL-Computational_Algebra.Group_Closure"
     Discrete_Time_Markov_Chain
 begin
 
 lemma eventually_mult_Gcd:
   fixes S :: "nat set"
   assumes S: "\<And>s t. s \<in> S \<Longrightarrow> t \<in> S \<Longrightarrow> s + t \<in> S"
   assumes s: "s \<in> S" "s > 0"
   shows "eventually (\<lambda>m. m * Gcd S \<in> S) sequentially"
 proof -
   define T where "T = insert 0 (int ` S)"
   with s S have "int s \<in> T" "0 \<in> T" and T: "r \<in> T \<Longrightarrow> t \<in> T \<Longrightarrow> r + t \<in> T" for r t
     by (auto simp del: of_nat_add simp add: of_nat_add [symmetric])
   have "Gcd T \<in> group_closure T"
     by (rule Gcd_in_group_closure)
   also have "group_closure T = {s - t | s t. s \<in> T \<and> t \<in> T}"
   proof (auto intro: group_closure.base group_closure.diff)
     fix x assume "x \<in> group_closure T"
     then show "\<exists>s t. x = s - t \<and> s \<in> T \<and> t \<in> T"
     proof induction
       case (base x) with \<open>0 \<in> T\<close> show ?case
         apply (rule_tac x=x in exI)
         apply (rule_tac x=0 in exI)
         apply auto
         done
     next
       case (diff x y)
       then obtain a b c d where
         "a \<in> T" "b \<in> T" "x = a - b"
         "c \<in> T" "d \<in> T" "y = c - d"
         by auto
       then show ?case
         apply (rule_tac x="a + d" in exI)
         apply (rule_tac x="b + c" in exI)
         apply (auto intro: T)
         done
     qed
   qed
   finally obtain s' t' :: int
     where "s' \<in> T" "t' \<in> T" "Gcd T = s' - t'"
     by blast
   moreover define s and t where "s = nat s'" and "t = nat t'"
   moreover have "int (Gcd S) = - int t \<longleftrightarrow> S \<subseteq> {0} \<and> t = 0"
     by auto (metis Gcd_dvd_nat dvd_0_right dvd_antisym nat_int nat_zminus_int) 
   ultimately have 
     st: "s = 0 \<or> s \<in> S" "t = 0 \<or> t \<in> S" and Gcd_S: "Gcd S = s - t"
     using T_def by safe simp_all
   with s
   have "t < s"
     by (rule_tac ccontr) auto
 
   { fix s n have "0 < n \<Longrightarrow> s \<in> S \<Longrightarrow> n * s \<in> S"
     proof (induct n)
       case (Suc n) then show ?case
         by (cases n) (auto intro: S)
     qed simp }
   note cmult_S = this
 
   show ?thesis
     unfolding eventually_sequentially
   proof cases
     assume "s = 0 \<or> t = 0"
     with st Gcd_S s have *: "Gcd S \<in> S"
       by (auto simp: int_eq_iff)
     then show "\<exists>N. \<forall>n\<ge>N. n * Gcd S \<in> S" by (auto intro!: exI[of _ 1] cmult_S)
   next
     assume "\<not> (s = 0 \<or> t = 0)"
     with st have "s \<in> S" "t \<in> S" "t \<noteq> 0" by auto
     then have "Gcd S dvd t" by auto
     then obtain a where a: "t = Gcd S * a" ..
     with \<open>t \<noteq> 0\<close> have "0 < a" by auto
 
     show "\<exists>N. \<forall>n\<ge>N. n * Gcd S \<in> S"
     proof (safe intro!: exI[of _ "a * a"])
       fix n
       define m where "m = (n - a * a) div a"
       define r where "r = (n - a * a) mod a"
       with \<open>0 < a\<close> have "r < a" by simp
       moreover define am where "am = a + m"
       ultimately have "r < am" by simp
       assume "a * a \<le> n" then have n: "n = a * a + (m * a + r)"
         unfolding m_def r_def by simp
       have "n * Gcd S = am * t + r * Gcd S"
         unfolding n a by (simp add: field_simps am_def)
       also have "\<dots> = r * s + (am - r) * t"
         unfolding \<open>Gcd S = s - t\<close>
         using \<open>t < s\<close> \<open>r < am\<close> by (simp add: field_simps diff_mult_distrib2)
       also have "\<dots> \<in> S"
         using \<open>s \<in> S\<close> \<open>t \<in> S\<close> \<open>r < am\<close>
         by (cases "r = 0") (auto intro!: cmult_S S)
       finally show "n * Gcd S \<in> S" .
     qed
   qed
 qed
 
 context MC_syntax
 begin
 
 subsection \<open>Expected number of visits\<close>
 
 definition "G s t = (\<integral>\<^sup>+\<omega>. scount (HLD {t}) (s ## \<omega>) \<partial>T s)"
 
 lemma G_eq: "G s t = (\<integral>\<^sup>+\<omega>. emeasure (count_space UNIV) {i. (s ## \<omega>) !! i = t} \<partial>T s)"
   by (simp add: G_def scount_eq_emeasure HLD_iff)
 
 definition "p s t n = \<P>(\<omega> in T s. (s ## \<omega>) !! n = t)"
 
 definition "gf_G s t z = (\<Sum>n. p s t n *\<^sub>R z ^ n)"
 
 definition "convergence_G s t z \<longleftrightarrow> summable (\<lambda>n. p s t n * norm z ^ n)"
 
 lemma p_nonneg[simp]: "0 \<le> p x y n"
   by (simp add: p_def)
 
 lemma p_le_1: "p x y n \<le> 1"
   by (simp add: p_def)
 
 lemma p_x_x_0[simp]: "p x x 0 = 1"
   by (simp add: p_def T.prob_space del: space_T)
 
 lemma p_0: "p x y 0 = (if x = y then 1 else 0)"
   by (simp add: p_def T.prob_space del: space_T)
 
 lemma p_in_reachable: assumes "(x, y) \<notin> (SIGMA x:UNIV. K x)\<^sup>*" shows "p x y n = 0"
   unfolding p_def
 proof (rule T.prob_eq_0_AE)
   from AE_T_reachable show "AE \<omega> in T x. (x ## \<omega>) !! n \<noteq> y"
   proof eventually_elim
     fix \<omega> assume "alw (HLD ((SIGMA \<omega>:UNIV. K \<omega>)\<^sup>* `` {x})) \<omega>"
     then have "alw (HLD (- {y})) \<omega>"
       using assms by (auto intro: alw_mono simp: HLD_iff)
     then show "(x ## \<omega>) !! n \<noteq> y"
       using assms by (cases n) (auto simp: alw_HLD_iff_streams streams_iff_snth)
   qed
 qed
 
 lemma p_Suc: "ennreal (p x y (Suc n)) = (\<integral>\<^sup>+ w. p w y n \<partial>K x)"
   unfolding p_def T.emeasure_eq_measure[symmetric] by (subst emeasure_Collect_T) simp_all
 
 lemma p_Suc':
   "p x y (Suc n) = (\<integral>x'. p x' y n \<partial>K x)"
   using p_Suc[of x y n]
   by (subst (asm) nn_integral_eq_integral)
      (auto simp: p_le_1 intro!: measure_pmf.integrable_const_bound[where B=1])
 
 lemma p_add: "p x y (n + m) = (\<integral>\<^sup>+ w. p x w n * p w y m \<partial>count_space UNIV)"
 proof (induction n arbitrary: x)
   case 0
   have [simp]: "\<And>w. (if x = w then 1 else 0) * p w y m = ennreal (p x y m) * indicator {x} w"
     by auto
   show ?case
     by (simp add: p_0 one_ennreal_def[symmetric] max_def)
 next
   case (Suc n)
   define X where "X = (SIGMA x:UNIV. K x)\<^sup>* `` K x"
   then have X: "countable X"
     by (blast intro: countable_Image countable_reachable countable_set_pmf)
 
   then interpret X: sigma_finite_measure "count_space X"
     by (rule sigma_finite_measure_count_space_countable)
   interpret XK: pair_sigma_finite "K x" "count_space X"
     by unfold_locales
 
   have "ennreal (p x y (Suc n + m)) = (\<integral>\<^sup>+t. (\<integral>\<^sup>+w. p t w n * p w y m \<partial>count_space UNIV) \<partial>K x)"
     by (simp add: p_Suc Suc)
   also have "\<dots> = (\<integral>\<^sup>+t. (\<integral>\<^sup>+w. ennreal (p t w n * p w y m) * indicator X w \<partial>count_space UNIV) \<partial>K x)"
     by (auto intro!: nn_integral_cong_AE simp: AE_measure_pmf_iff AE_count_space Image_iff p_in_reachable X_def             split: split_indicator)
   also have "\<dots> = (\<integral>\<^sup>+t. (\<integral>\<^sup>+w. p t w n * p w y m \<partial>count_space X) \<partial>K x)"
     by (subst nn_integral_restrict_space[symmetric]) (simp_all add: restrict_count_space)
   also have "\<dots> = (\<integral>\<^sup>+w. (\<integral>\<^sup>+t. p t w n * p w y m \<partial>K x) \<partial>count_space X)"
     apply (rule XK.Fubini'[symmetric])
     unfolding measurable_split_conv
     apply (rule measurable_compose_countable'[OF _ measurable_snd X])
     apply (rule measurable_compose[OF measurable_fst])
     apply simp
     done
   also have "\<dots> = (\<integral>\<^sup>+w. (\<integral>\<^sup>+t. ennreal (p t w n * p w y m) * indicator X w \<partial>K x) \<partial>count_space UNIV)"
     by (simp add: nn_integral_restrict_space[symmetric] restrict_count_space nn_integral_multc)
   also have "\<dots> = (\<integral>\<^sup>+w. (\<integral>\<^sup>+t. ennreal (p t w n * p w y m) \<partial>K x) \<partial>count_space UNIV)"
     by (auto intro!: nn_integral_cong_AE simp: AE_measure_pmf_iff AE_count_space Image_iff p_in_reachable X_def             split: split_indicator)
   also have "\<dots> = (\<integral>\<^sup>+w. (\<integral>\<^sup>+t. p t w n \<partial>K x) * p w y m \<partial>count_space UNIV)"
     by (simp add: nn_integral_multc[symmetric] ennreal_mult)
   finally show ?case
     by (simp add: ennreal_mult p_Suc)
 qed
 
 lemma prob_reachable_le:
   assumes [simp]: "m \<le> n"
   shows "p x y m * p y w (n - m) \<le> p x w n"
 proof -
   have "p x y m * p y w (n - m) = (\<integral>\<^sup>+y'. ennreal (p x y m * p y w (n - m)) * indicator {y} y' \<partial>count_space UNIV)"
     by simp
   also have "\<dots> \<le> p x w (m + (n - m))"
     by (subst p_add)
        (auto intro!: nn_integral_mono split: split_indicator simp del: nn_integral_indicator_singleton)
   finally show ?thesis
     by simp
 qed
 
 lemma G_eq_suminf: "G x y = (\<Sum>i. ennreal (p x y i))"
 proof -
   have *: "\<And>i \<omega>. indicator {\<omega> \<in> space S. (x ## \<omega>) !! i = y} \<omega> = indicator {i. (x ## \<omega>) !! i = y} i"
     by (auto simp: space_stream_space split: split_indicator)
 
   have "G x y = (\<integral>\<^sup>+ \<omega>. (\<Sum>i. indicator {\<omega>\<in>space (T x). (x ## \<omega>) !! i = y} \<omega>) \<partial>T x)"
     unfolding G_eq by (simp add: nn_integral_count_space_nat[symmetric] *)
   also have "\<dots> = (\<Sum>i. ennreal (p x y i))"
     by (simp add: T.emeasure_eq_measure[symmetric] p_def nn_integral_suminf)
   finally show ?thesis .
 qed
 
 lemma G_eq_real_suminf:
   "convergence_G x y (1::real) \<Longrightarrow> G x y = ennreal (\<Sum>i. p x y i)"
   unfolding G_eq_suminf
   by (intro suminf_ennreal ennreal_suminf_neq_top p_nonneg)
      (auto simp: convergence_G_def p_def)
 
 lemma convergence_norm_G:
   "convergence_G x y z \<Longrightarrow> summable (\<lambda>n. p x y n * norm z ^ n)"
   unfolding convergence_G_def .
 
 lemma convergence_G:
   "convergence_G x y (z::'a::{banach, real_normed_div_algebra}) \<Longrightarrow> summable (\<lambda>n. p x y n *\<^sub>R z ^ n)"
   unfolding convergence_G_def
   by (rule summable_norm_cancel) (simp add: abs_mult norm_power)
 
 lemma convergence_G_less_1:
   fixes z :: "_ :: {banach, real_normed_field}"
   assumes z: "norm z < 1" shows "convergence_G x y z"
   unfolding convergence_G_def
 proof (rule summable_comparison_test)
   have "\<And>n. p x y n * norm (z ^ n) \<le> 1 * norm (z ^ n)"
     by (intro mult_right_mono p_le_1) simp_all
   then show "\<exists>N. \<forall>n\<ge>N. norm (p x y n * norm z ^ n) \<le> norm z ^ n"
     by (simp add: norm_power)
 qed (simp add: z summable_geometric)
 
 lemma lim_gf_G: "((\<lambda>z. ennreal (gf_G x y z)) \<longlongrightarrow> G x y) (at_left (1::real))"
   unfolding gf_G_def G_eq_suminf real_scaleR_def
   by (intro power_series_tendsto_at_left p_nonneg p_le_1 summable_power_series)
 
 subsection \<open>Reachability probability\<close>
 
 definition "u x y n = \<P>(\<omega> in T x. ev_at (HLD {y}) n \<omega>)"
 
 definition "U s t = \<P>(\<omega> in T s. ev (HLD {t}) \<omega>)"
 
 definition "gf_U x y z = (\<Sum>n. u x y n *\<^sub>R z ^ Suc n)"
 
 definition "f x y n = \<P>(\<omega> in T x. ev_at (HLD {y}) n (x ## \<omega>))"
 
 definition "F s t = \<P>(\<omega> in T s. ev (HLD {t}) (s ## \<omega>))"
 
 definition "gf_F x y z = (\<Sum>n. f x y n * z ^ n)"
 
 lemma f_Suc: "x \<noteq> y \<Longrightarrow> f x y (Suc n) = u x y n"
   by (simp add: u_def f_def)
 
 lemma f_Suc_eq: "f x x (Suc n) = 0"
   by (simp add: f_def)
 
 lemma f_0: "f x y 0 = (if x = y then 1 else 0)"
   using T.prob_space by (simp add: f_def)
 
 lemma shows u_nonneg: "0 \<le> u x y n" and u_le_1: "u x y n \<le> 1"
   by (simp_all add: u_def)
 
 lemma shows f_nonneg: "0 \<le> f x y n" and f_le_1: "f x y n \<le> 1"
   by (simp_all add: f_def)
 
 lemma U_nonneg[simp]: "0 \<le> U x y"
   by (simp add: U_def)
 
 lemma U_le_1: "U s t \<le> 1"
   by (auto simp add: U_def intro!: antisym)
 
 lemma U_cases: "U s s = 1 \<or> U s s < 1"
   by (auto simp add: U_def intro!: antisym)
 
 lemma u_sums_U: "u x y sums U x y"
   unfolding u_def[abs_def] U_def ev_iff_ev_at by (intro T.prob_sums) (auto intro: ev_at_unique)
 
 lemma gf_U_eq_U: "gf_U x y 1 = U x y"
   using u_sums_U[THEN sums_unique] by (simp add: gf_U_def U_def)
 
 lemma f_sums_F: "f x y sums F x y"
   unfolding f_def[abs_def] F_def ev_iff_ev_at
   by (intro T.prob_sums) (auto intro: ev_at_unique)
 
 lemma F_nonneg[simp]: "0 \<le> F x y"
   by (auto simp: F_def)
 
 lemma F_le_1: "F x y \<le> 1"
   by (simp add: F_def)
 
 lemma gf_F_eq_F: "gf_F x y 1 = F x y"
   using f_sums_F[THEN sums_unique] by (simp add: gf_F_def F_def)
 
 lemma gf_F_le_1:
   fixes z :: real
   assumes z: "0 \<le> z" "z \<le> 1"
   shows "gf_F x y z \<le> 1"
 proof -
   have "gf_F x y z \<le> gf_F x y 1"
     using z unfolding gf_F_def
     by (intro suminf_le[OF _ summable_comparison_test[OF _ sums_summable[OF f_sums_F[of x y]]]] mult_left_mono allI f_nonneg)
        (simp_all add: power_le_one f_nonneg mult_right_le_one_le f_le_1 sums_summable[OF f_sums_F[of x y]])
   also have "\<dots> \<le> 1"
     by (simp add: gf_F_eq_F F_def)
   finally show ?thesis .
 qed
 
 lemma u_le_p: "u x y n \<le> p x y (Suc n)"
   unfolding u_def p_def by (auto intro!: T.finite_measure_mono dest: ev_at_HLD_imp_snth)
 
 lemma f_le_p: "f x y n \<le> p x y n"
   unfolding f_def p_def by (auto intro!: T.finite_measure_mono dest: ev_at_HLD_imp_snth)
 
 lemma convergence_norm_U:
   fixes z :: "_ :: real_normed_div_algebra"
   assumes z: "convergence_G x y z"
   shows "summable (\<lambda>n. u x y n * norm z ^ Suc n)"
   using summable_ignore_initial_segment[OF convergence_norm_G[OF z], of 1]
   by (rule summable_comparison_test[rotated])
      (auto simp add: u_nonneg abs_mult intro!: exI[of _ 0] mult_right_mono u_le_p)
 
 lemma convergence_norm_F:
   fixes z :: "_ :: real_normed_div_algebra"
   assumes z: "convergence_G x y z"
   shows "summable (\<lambda>n. f x y n * norm z ^ n)"
   using convergence_norm_G[OF z]
   by (rule summable_comparison_test[rotated])
      (auto simp add: f_nonneg abs_mult intro!: exI[of _ 0] mult_right_mono f_le_p)
 
 lemma gf_G_nonneg:
   fixes z :: real
   shows "0 \<le> z \<Longrightarrow> z < 1 \<Longrightarrow> 0 \<le> gf_G x y z"
   unfolding gf_G_def
   by (intro suminf_nonneg convergence_G convergence_G_less_1) simp_all
 
 lemma gf_F_nonneg:
   fixes z :: real
   shows "0 \<le> z \<Longrightarrow> z < 1 \<Longrightarrow> 0 \<le> gf_F x y z"
   unfolding gf_F_def
   using convergence_norm_F[OF convergence_G_less_1, of z x y]
   by (intro suminf_nonneg) (simp_all add: f_nonneg)
 
 lemma convergence_U:
   fixes z :: "_ :: banach"
   shows "convergence_G x y z \<Longrightarrow> summable (\<lambda>n. u x y n * z ^ Suc n)"
   by (rule summable_norm_cancel)
      (auto simp add: abs_mult u_nonneg power_abs dest!: convergence_norm_U)
 
 lemma p_eq_sum_p_u: "p x y (Suc n) = (\<Sum>i\<le>n. p y y (n - i) * u x y i)"
 proof -
   have "\<And>\<omega>. \<omega> !! n = y \<Longrightarrow> (\<exists>i. i \<le> n \<and> ev_at (HLD {y}) i \<omega>)"
   proof (induction n)
     case (Suc n)
     then obtain i where "i \<le> n" "ev_at (HLD {y}) i (stl \<omega>)"
       by auto
     then show ?case
       by (auto intro!: exI[of _ "if HLD {y} \<omega> then 0 else Suc i"])
   qed (simp add: HLD_iff)
   then have "p x y (Suc n) = (\<Sum>i\<le>n. \<P>(\<omega> in T x. ev_at (HLD {y}) i \<omega> \<and> \<omega> !! n = y))"
     unfolding p_def by (intro T.prob_sum) (auto intro: ev_at_unique)
   also have "\<dots> = (\<Sum>i\<le>n. p y y (n - i) * u x y i)"
   proof (intro sum.cong refl)
     fix i assume i: "i \<in> {.. n}"
     then have "\<And>\<omega>. (Suc i \<le> n \<longrightarrow> \<omega> !! (n - Suc i) = y) \<longleftrightarrow> ((y ## \<omega>) !! (n - i) = y)"
       by (auto simp: Stream_snth diff_Suc split: nat.split)
     from i have "i \<le> n" by auto
     then have "\<P>(\<omega> in T x. ev_at (HLD {y}) i \<omega> \<and> \<omega> !! n = y) =
       (\<integral>\<omega>'. \<P>(\<omega> in T y. (y ## \<omega>) !! (n - i) = y) *
         indicator {\<omega>'\<in>space (T x). ev_at (HLD {y}) i \<omega>' } \<omega>' \<partial>T x)"
       by (subst prob_T_split[where n="Suc i"])
          (auto simp: ev_at_shift ev_at_HLD_single_imp_snth shift_snth diff_Suc
                split: split_indicator nat.split intro!: Bochner_Integration.integral_cong arg_cong2[where f=measure]
                simp del: stake.simps integral_mult_right_zero)
     then show "\<P>(\<omega> in T x. ev_at (HLD {y}) i \<omega> \<and> \<omega> !! n = y) = p y y (n - i) * u x y i"
       by (simp add: p_def u_def)
   qed
   finally show ?thesis .
 qed
 
 lemma p_eq_sum_p_f: "p x y n = (\<Sum>i\<le>n. p y y (n - i) * f x y i)"
   by (cases n)
      (simp_all del: sum.atMost_Suc
                add: f_0 p_0 p_eq_sum_p_u atMost_Suc_eq_insert_0 zero_notin_Suc_image sum.reindex
                     f_Suc f_Suc_eq)
 
 lemma gf_G_eq_gf_F:
   assumes z: "norm z < 1"
   shows "gf_G x y z = gf_F x y z * gf_G y y z"
 proof -
   have "gf_G x y z = (\<Sum>n. \<Sum>i\<le>n. p y y (n - i) * f x y i * z^n)"
     by (simp add: gf_G_def p_eq_sum_p_f[of x y] sum_distrib_right)
   also have "\<dots> = (\<Sum>n. \<Sum>i\<le>n. (f x y i * z^i) * (p y y (n - i) * z^(n - i)))"
     by (intro arg_cong[where f=suminf] sum.cong ext atLeast0AtMost[symmetric])
        (simp_all add: power_add[symmetric])
   also have "\<dots> = (\<Sum>n. f x y n * z^n) * (\<Sum>n. p y y n * z^n)"
     using convergence_norm_F[OF convergence_G_less_1[OF z]] convergence_norm_G[OF convergence_G_less_1[OF z]]
     by (intro Cauchy_product[symmetric]) (auto simp: f_nonneg abs_mult power_abs)
   also have "\<dots> = gf_F x y z * gf_G y y z"
     by (simp add: gf_F_def gf_G_def)
   finally show ?thesis .
 qed
 
 lemma gf_G_eq_gf_U:
   fixes z :: "'z :: {banach, real_normed_field}"
   assumes z: "convergence_G x x z"
   shows "gf_G x x z = 1 / (1 - gf_U x x z)" "gf_U x x z \<noteq> 1"
 proof -
   { fix n
     have "p x x (Suc n) *\<^sub>R z^Suc n = (\<Sum>i\<le>n. (p x x (n - i) * u x x i) *\<^sub>R z^Suc n)"
       unfolding scaleR_sum_left[symmetric] by (simp add: p_eq_sum_p_u)
     also have "\<dots> = (\<Sum>i\<le>n. (u x x i *\<^sub>R z^Suc i) * (p x x (n - i) *\<^sub>R z^(n - i)))"
       by (intro sum.cong refl) (simp add: field_simps power_diff cong: disj_cong)
     finally have "p x x (Suc n) *\<^sub>R z^(Suc n) = (\<Sum>i\<le>n. (u x x i *\<^sub>R z^Suc i) * (p x x (n - i) *\<^sub>R z^(n - i)))"
       unfolding atLeast0AtMost . }
   note gfs_Suc_eq = this
 
   have "gf_G x x z = 1 + (\<Sum>n. p x x (Suc n) *\<^sub>R z^(Suc n))"
     unfolding gf_G_def
     by (subst suminf_split_initial_segment[OF convergence_G[OF z], of 1]) simp
   also have "\<dots> = 1 + (\<Sum>n. \<Sum>i\<le>n. (u x x i *\<^sub>R z^Suc i) * (p x x (n - i) *\<^sub>R z^(n - i)))"
     unfolding gfs_Suc_eq ..
   also have "\<dots> = 1 + gf_U x x z * gf_G x x z"
     unfolding gf_U_def gf_G_def
     by (subst Cauchy_product)
        (auto simp: u_nonneg norm_power simp del: power_Suc
              intro!: z convergence_norm_G convergence_norm_U)
   finally show "gf_G x x z = 1 / (1 - gf_U x x z)" "gf_U x x z \<noteq> 1"
     apply -
     apply (cases "gf_U x x z = 1")
     apply (auto simp add: field_simps)
     done
 qed
 
 lemma gf_U: "(gf_U x y \<longlongrightarrow> U x y) (at_left 1)"
 proof -
   have "((\<lambda>z. ennreal (\<Sum>n. u x y n * z ^ n)) \<longlongrightarrow> (\<Sum>n. ennreal (u x y n))) (at_left 1)"
     using u_le_1 u_nonneg by (intro power_series_tendsto_at_left summable_power_series)
   also have "(\<Sum>n. ennreal (u x y n)) = ennreal (suminf (u x y))"
     by (intro u_nonneg suminf_ennreal ennreal_suminf_neq_top sums_summable[OF u_sums_U])
   also have "suminf (u x y) = U x y"
     using u_sums_U by (rule sums_unique[symmetric])
   finally have "((\<lambda>z. \<Sum>n. u x y n * z ^ n) \<longlongrightarrow> U x y) (at_left 1)"
     by (rule tendsto_ennrealD)
        (auto simp: u_nonneg u_le_1 intro!: suminf_nonneg summable_power_series eventually_at_left_1)
   then have "((\<lambda>z. z * (\<Sum>n. u x y n * z ^ n)) \<longlongrightarrow> 1 * U x y) (at_left 1)"
     by (intro tendsto_intros) simp
   then have "((\<lambda>z. \<Sum>n. u x y n * z ^ Suc n) \<longlongrightarrow> 1 * U x y) (at_left 1)"
     apply (rule filterlim_cong[OF refl refl, THEN iffD1, rotated])
     apply (rule eventually_at_left_1)
     apply (subst suminf_mult[symmetric])
     apply (auto intro!: summable_power_series u_le_1 u_nonneg)
     apply (simp add: field_simps)
     done
   then show ?thesis
     by (simp add: gf_U_def[abs_def] U_def)
 qed
 
 lemma gf_U_le_1: assumes z: "0 < z" "z < 1" shows "gf_U x y z \<le> (1::real)"
 proof -
   note u = u_sums_U[of x y, THEN sums_summable]
   have "gf_U x y z \<le> gf_U x y 1"
     using z
     unfolding gf_U_def real_scaleR_def
     by (intro suminf_le allI mult_mono power_mono summable_comparison_test_ev[OF _ u] always_eventually)
        (auto simp: u_nonneg intro!: mult_left_le mult_le_one power_le_one)
   also have "\<dots> \<le> 1"
     unfolding gf_U_eq_U by (rule U_le_1)
   finally show ?thesis .
 qed
 
 lemma gf_F: "(gf_F x y \<longlongrightarrow> F x y) (at_left 1)"
 proof -
   have "((\<lambda>z. ennreal (\<Sum>n. f x y n * z ^ n)) \<longlongrightarrow> (\<Sum>n. ennreal (f x y n))) (at_left 1)"
     using f_le_1 f_nonneg by (intro power_series_tendsto_at_left summable_power_series)
   also have "(\<Sum>n. ennreal (f x y n)) = ennreal (suminf (f x y))"
     by (intro f_nonneg suminf_ennreal ennreal_suminf_neq_top sums_summable[OF f_sums_F])
   also have "suminf (f x y) = F x y"
     using f_sums_F by (rule sums_unique[symmetric])
   finally have "((\<lambda>z. \<Sum>n. f x y n * z ^ n) \<longlongrightarrow> F x y) (at_left 1)"
     by (rule tendsto_ennrealD)
        (auto simp: f_nonneg f_le_1 intro!: suminf_nonneg summable_power_series eventually_at_left_1)
   then show ?thesis
     by (simp add: gf_F_def[abs_def] F_def)
 qed
 
 lemma U_bounded: "0 \<le> U x y" "U x y \<le> 1"
   unfolding U_def by simp_all
 
 subsection \<open>Recurrent states\<close>
 
 definition recurrent :: "'s \<Rightarrow> bool" where
   "recurrent s \<longleftrightarrow> (AE \<omega> in T s. ev (HLD {s}) \<omega>)"
 
 lemma recurrent_iff_U_eq_1: "recurrent s \<longleftrightarrow> U s s = 1"
     unfolding recurrent_def U_def by (subst T.prob_Collect_eq_1) simp_all
 
 definition "H s t = \<P>(\<omega> in T s. alw (ev (HLD {t})) \<omega>)"
 
 lemma H_eq:
   "recurrent s \<longleftrightarrow> H s s = 1"
   "\<not> recurrent s \<longleftrightarrow> H s s = 0"
   "H s t = U s t * H t t"
 proof -
   define H' where "H' t n = {\<omega>\<in>space S. enat n \<le> scount (HLD {t::'s}) \<omega>}" for t n
   have [measurable]: "\<And>y n. H' y n \<in> sets S"
     by (simp add: H'_def)
   let ?H' = "\<lambda>s t n. measure (T s) (H' t n)"
   { fix x y :: 's and \<omega>
     have "Suc 0 \<le> scount (HLD {y}) \<omega> \<longleftrightarrow> ev (HLD {y}) \<omega>"
       using scount_eq_0_iff[of "HLD {y}" \<omega>]
       by (cases "scount (HLD {y}) \<omega>" rule: enat_coexhaust)
          (auto simp: not_ev_iff[symmetric] eSuc_enat[symmetric] enat_0 HLD_iff[abs_def]) }
   then have H'_1: "\<And>x y. ?H' x y 1 = U x y"
     unfolding H'_def U_def by simp
 
   { fix n and x y :: 's
     let ?U = "(not (HLD {y}) suntil (HLD {y} aand nxt (\<lambda>\<omega>. enat n \<le> scount (HLD {y}) \<omega>)))"
     { fix \<omega>
       have "enat (Suc n) \<le> scount (HLD {y}) \<omega> \<longleftrightarrow> ?U \<omega>"
       proof
         assume "enat (Suc n) \<le> scount (HLD {y}) \<omega>"
         with scount_eq_0_iff[of "HLD {y}" \<omega>] have "ev (HLD {y}) \<omega>" "enat (Suc n) \<le> scount (HLD {y}) \<omega>"
           by (auto simp add: not_ev_iff[symmetric] eSuc_enat[symmetric])
         then show "?U \<omega>"
           by (induction rule: ev_induct_strong)
              (auto simp: scount_simps eSuc_enat[symmetric] intro: suntil.intros)
       next
         assume "?U \<omega>" then show "enat (Suc n) \<le> scount (HLD {y}) \<omega>"
           by induction (auto simp: scount_simps  eSuc_enat[symmetric])
       qed }
     then have "emeasure (T x) (H' y (Suc n)) = emeasure (T x) {\<omega>\<in>space (T x). ?U \<omega>}"
       by (simp add: H'_def)
     also have "\<dots> = U x y * ?H' y y n"
       by (subst emeasure_suntil_HLD) (simp_all add: T.emeasure_eq_measure U_def H'_def ennreal_mult)
     finally have "?H' x y (Suc n) = U x y * ?H' y y n"
       by (simp add: T.emeasure_eq_measure) }
   note H'_Suc = this
 
   { fix m and x :: 's
     have "?H' x x (Suc m) = U x x^Suc m"
       using H'_1 H'_Suc by (induct m) auto }
   note H'_eq = this
 
   { fix x y
     have "?H' x y \<longlonglongrightarrow> measure (T x) (\<Inter>i. H' y i)"
       apply (rule T.finite_Lim_measure_decseq)
       apply safe
       apply simp
       apply (auto simp add: decseq_Suc_iff subset_eq H'_def eSuc_enat[symmetric]
                   intro: ile_eSuc order_trans)
       done
     also have "(\<Inter>i. H' y i) = {\<omega>\<in>space (T x). alw (ev (HLD {y})) \<omega>}"
       by (auto simp: H'_def scount_infinite_iff[symmetric]) (metis Suc_ile_eq enat.exhaust neq_iff)
     finally have "?H' x y \<longlonglongrightarrow> H x y"
       unfolding H_def . }
   note H'_lim = this
 
   from H'_lim[of s s, THEN LIMSEQ_Suc]
   have "(\<lambda>n. U s s ^ Suc n) \<longlonglongrightarrow> H s s"
     by (simp add: H'_eq)
   then have lim_H: "(\<lambda>n. U s s ^ n) \<longlonglongrightarrow> H s s"
     by (rule LIMSEQ_imp_Suc)
 
   have "U s s < 1 \<Longrightarrow> (\<lambda>n. U s s ^ n) \<longlonglongrightarrow> 0"
     by (rule LIMSEQ_realpow_zero) (simp_all add: U_def)
   with lim_H have "U s s < 1 \<Longrightarrow> H s s = 0"
     by (blast intro: LIMSEQ_unique)
   moreover have "U s s = 1 \<Longrightarrow> (\<lambda>n. U s s ^ n) \<longlonglongrightarrow> 1"
     by simp
   with lim_H have "U s s = 1 \<Longrightarrow> H s s = 1"
     by (blast intro: LIMSEQ_unique)
   moreover note recurrent_iff_U_eq_1 U_cases
   ultimately show "recurrent s \<longleftrightarrow> H s s = 1" "\<not> recurrent s \<longleftrightarrow> H s s = 0"
     by (metis one_neq_zero)+
 
   from H'_lim[of s t, THEN LIMSEQ_Suc] H'_Suc[of s]
   have "(\<lambda>n. U s t * ?H' t t n) \<longlonglongrightarrow> H s t"
     by simp
   moreover have "(\<lambda>n. U s t * ?H' t t n) \<longlonglongrightarrow> U s t * H t t"
     by (intro tendsto_intros H'_lim)
   ultimately show "H s t = U s t * H t t"
     by (blast intro: LIMSEQ_unique)
 qed
 
 lemma recurrent_iff_G_infinite: "recurrent x \<longleftrightarrow> G x x = \<infinity>"
 proof -
   have "((\<lambda>z. ennreal (gf_G x x z)) \<longlongrightarrow> G x x) (at_left 1)"
     by (rule lim_gf_G)
   then have G: "((\<lambda>z. ennreal (1 / (1 - gf_U x x z))) \<longlongrightarrow> G x x) (at_left (1::real))"
     apply (rule filterlim_cong[OF refl refl, THEN iffD1, rotated])
     apply (rule eventually_at_left_1)
     apply (subst gf_G_eq_gf_U)
     apply (rule convergence_G_less_1)
     apply simp
     apply simp
     done
 
   { fix z :: real assume z: "0 < z" "z < 1"
     have 1: "summable (u x x)"
       using u_sums_U by (rule sums_summable)
     have "gf_U x x z \<noteq> 1"
       using gf_G_eq_gf_U[OF convergence_G_less_1[of z]] z by simp
     moreover
     have "gf_U x x z \<le> U x x"
       unfolding gf_U_def gf_U_eq_U[symmetric]
       using z
       by (intro suminf_le)
          (auto simp add: 1 convergence_U convergence_G_less_1 u_nonneg simp del: power_Suc
                intro!: mult_right_le_one_le power_le_one)
     ultimately have "gf_U x x z < 1"
       using U_bounded[of x x] by simp }
   note strict = this
 
   { assume "U x x = 1"
     moreover have "((\<lambda>xa. 1 - gf_U x x xa :: real) \<longlongrightarrow> 1 - U x x) (at_left 1)"
       by (intro tendsto_intros gf_U)
     moreover have "eventually (\<lambda>z. gf_U x x z < 1) (at_left (1::real))"
       by (auto intro!: eventually_at_left_1 strict simp: \<open>U x x = 1\<close> gf_U_eq_U)
     ultimately have "((\<lambda>z. ennreal (1 / (1 - gf_U x x z))) \<longlongrightarrow> top) (at_left 1)"
       unfolding ennreal_tendsto_top_eq_at_top
       by (intro LIM_at_top_divide[where a=1] tendsto_const zero_less_one)
          (auto simp: field_simps)
     with G have "G x x = top"
       by (rule tendsto_unique[rotated]) simp }
   moreover
   { assume "U x x < 1"
     then have "((\<lambda>xa. ennreal (1 / (1 - gf_U x x xa))) \<longlongrightarrow> 1 / (1 - U x x)) (at_left 1)"
       by (intro tendsto_intros gf_U tendsto_ennrealI) simp
     from tendsto_unique[OF _ G this] have "G x x \<noteq> \<infinity>"
       by simp }
   ultimately show ?thesis
     using U_cases recurrent_iff_U_eq_1 by auto
 qed
 
 definition communicating :: "('s \<times> 's) set" where
   "communicating = acc \<inter> acc\<inverse>"
 
 definition essential_class :: "'s set \<Rightarrow> bool" where
   "essential_class C \<longleftrightarrow> C \<in> UNIV // communicating \<and> acc `` C \<subseteq> C"
 
 lemma accI_U:
   assumes "0 < U x y" shows "(x, y) \<in> acc"
 proof (rule ccontr)
   assume *: "(x, y) \<notin> acc"
 
   { fix \<omega> assume "ev (HLD {y}) \<omega>" "alw (HLD (acc `` {x})) \<omega>" from this * have False
       by induction (auto simp: HLD_iff) }
   with AE_T_reachable[of x] have "U x y = 0"
     unfolding U_def by (intro T.prob_eq_0_AE) auto
   with \<open>0 < U x y\<close> show False by auto
 qed
 
 lemma accD_pos:
   assumes "(x, y) \<in> acc"
   shows "\<exists>n. 0 < p x y n"
 using assms proof induction
   case base with T.prob_space[of x] show ?case
     by (auto intro!: exI[of _ 0])
 next
   have [simp]: "\<And>x y. (if x = y then 1 else 0::real) = indicator {y} x"
     by simp
   case (step w y)
   then obtain n where "0 < p x w n" and "0 < pmf (K w) y"
     by (auto simp: set_pmf_iff less_le)
   then have "0 < p x w n * pmf (K w) y"
     by (intro mult_pos_pos)
   also have "\<dots> \<le> p x w n * p w y (Suc 0)"
     by (simp add: p_Suc' p_0 pmf.rep_eq)
   also have "\<dots> \<le> p x y (Suc n)"
     using prob_reachable_le[of n "Suc n" x w y] by simp
   finally show ?case ..
 qed
 
 lemma accI_pos: "0 < p x y n \<Longrightarrow> (x, y) \<in> acc"
 proof (induct n arbitrary: x)
   case (Suc n)
   then have less: "0 < (\<integral>x'. p x' y n \<partial>K x)"
     by (simp add: p_Suc')
   have "\<exists>x'\<in>K x. 0 < p x' y n"
   proof (rule ccontr)
     assume "\<not> ?thesis"
     then have "AE x' in K x. p x' y n = 0"
       by (simp add: AE_measure_pmf_iff less_le)
     then have "(\<integral>x'. p x' y n \<partial>K x) = (\<integral>x'. 0 \<partial>K x)"
       by (intro integral_cong_AE) simp_all
     with less show False by simp
   qed
   with Suc show ?case
     by (auto intro: converse_rtrancl_into_rtrancl)
 qed (simp add: p_0 split: if_split_asm)
 
 lemma recurrent_iffI_communicating:
   assumes "(x, y) \<in> communicating"
   shows "recurrent x \<longleftrightarrow> recurrent y"
 proof -
   from assms obtain n m where "0 < p x y n" "0 < p y x m"
     by (force simp: communicating_def dest: accD_pos)
   moreover
   { fix x y n m assume "0 < p x y n" "0 < p y x m" "G y y = \<infinity>"
     then have "\<infinity> = ennreal (p x y n * p y x m) * G y y"
       by (auto intro: mult_pos_pos simp: ennreal_mult_top)
     also have "ennreal (p x y n * p y x m) * G y y = (\<Sum>i. ennreal (p x y n * p y x m) * p y y i)"
       unfolding G_eq_suminf by (rule ennreal_suminf_cmult[symmetric])
     also have "\<dots> \<le> (\<Sum>i. ennreal (p x x (n + i + m)))"
     proof (intro suminf_le allI)
       fix i
       have "(p x y n * p y y ((n + i) - n)) * p y x ((n + i + m) - (n + i)) \<le> p x y (n + i) * p y x ((n + i + m) - (n + i))"
         by (intro mult_right_mono prob_reachable_le) simp_all
       also have "\<dots> \<le> p x x (n + i + m)"
          by (intro prob_reachable_le) simp_all
       finally show "ennreal (p x y n * p y x m) * p y y i \<le> ennreal (p x x (n + i + m))"
         by (simp add: ac_simps ennreal_mult'[symmetric])
     qed auto
     also have "\<dots> \<le> (\<Sum>i. ennreal (p x x (i + (n + m))))"
       by (simp add: ac_simps)
     also have "\<dots> \<le> (\<Sum>i. ennreal (p x x i))"
       by (subst suminf_offset[of "\<lambda>i. ennreal (p x x i)" "n + m"]) auto
     also have "\<dots> \<le> G x x"
       unfolding G_eq_suminf by (auto intro!: suminf_le_pos)
     finally have "G x x = \<infinity>"
       by (simp add: top_unique) }
   ultimately show ?thesis
     using recurrent_iff_G_infinite by blast
 qed
 
 lemma recurrent_acc:
   assumes "recurrent x" "(x, y) \<in> acc"
   shows "U y x = 1" "H y x = 1" "recurrent y" "(x, y) \<in> communicating"
 proof -
   { fix w y assume step: "(x, w) \<in> acc" "y \<in> K w" "U w x = 1" "H w x = 1" "recurrent w" "x \<noteq> y"
     have "measure (K w) UNIV = U w x"
       using step measure_pmf.prob_space[of "K w"] by simp
     also have "\<dots> = (\<integral>v. indicator {x} v + U v x * indicator (- {x}) v \<partial>K w)"
       unfolding U_def
       by (subst prob_T)
          (auto intro!: Bochner_Integration.integral_cong arg_cong2[where f=measure] AE_I2
                simp: ev_Stream T.prob_eq_1 split: split_indicator)
     also have "\<dots> = measure (K w) {x} + (\<integral>v. U v x * indicator (- {x}) v \<partial>K w)"
       by (subst Bochner_Integration.integral_add)
          (auto intro!: measure_pmf.integrable_const_bound[where B=1]
                simp: abs_mult mult_le_one U_bounded(2) measure_pmf.emeasure_eq_measure)
     finally have "measure (K w) UNIV - measure (K w) {x} = (\<integral>v. U v x * indicator (- {x}) v \<partial>K w)"
       by simp
     also have "measure (K w) UNIV - measure (K w) {x} = measure (K w) (UNIV - {x})"
       by (subst measure_pmf.finite_measure_Diff) auto
     finally have "0 = (\<integral>v. indicator (- {x}) v \<partial>K w) - (\<integral>v. U v x * indicator (- {x}) v \<partial>K w)"
       by (simp add: measure_pmf.emeasure_eq_measure Compl_eq_Diff_UNIV)
     also have "\<dots> = (\<integral>v. (1 - U v x) * indicator (- {x}) v \<partial>K w)"
       by (subst Bochner_Integration.integral_diff[symmetric])
          (auto intro!: measure_pmf.integrable_const_bound[where B=1] Bochner_Integration.integral_cong
                simp: abs_mult mult_le_one U_bounded(2) split: split_indicator)
     also have "\<dots> \<ge> (\<integral>v. (1 - U y x) * indicator {y} v \<partial>K w)" (is "_ \<ge> ?rhs")
       using \<open>recurrent x\<close>
       by (intro integral_mono measure_pmf.integrable_const_bound[where B=1])
          (auto simp: abs_mult mult_le_one U_bounded(2) recurrent_iff_U_eq_1 field_simps
                split: split_indicator)
     also (xtrans) have "?rhs = (1 - U y x) * pmf (K w) y"
       by (simp add: measure_pmf.emeasure_eq_measure pmf.rep_eq)
     finally have "(1 - U y x) * pmf (K w) y = 0"
       by (auto intro!: antisym simp: U_bounded(2) mult_le_0_iff)
     with \<open>y \<in> K w\<close> have "U y x = 1"
       by (simp add: set_pmf_iff)
     then have "U y x = 1" "H y x = 1"
       using H_eq(3)[of y x] H_eq(1)[of x] by (simp_all add: \<open>recurrent x\<close>)
     then have "(y, x) \<in> acc"
       by (intro accI_U) auto
     with step have "(x, y) \<in> communicating"
       by (auto simp add: communicating_def intro: rtrancl_trans)
     with \<open>recurrent x\<close> have "recurrent y"
       by (simp add: recurrent_iffI_communicating)
     note this \<open>U y x = 1\<close> \<open>H y x = 1\<close> \<open>(x, y) \<in> communicating\<close> }
   note enabled = this
 
   from \<open>(x, y) \<in> acc\<close>
   show "U y x = 1" "H y x = 1" "recurrent y" "(x, y) \<in> communicating"
   proof induction
     case base then show "U x x = 1" "H x x = 1" "recurrent x" "(x, x) \<in> communicating"
       using \<open>recurrent x\<close> H_eq(1)[of x] by (auto simp: recurrent_iff_U_eq_1 communicating_def)
   next
     case (step w y)
     with enabled[of w y] \<open>recurrent x\<close> H_eq(1)[of x]
     have "U y x = 1 \<and> H y x = 1 \<and> recurrent y \<and> (x, y) \<in> communicating"
       by (cases "x = y") (auto simp: recurrent_iff_U_eq_1 communicating_def)
     then show "U y x = 1" "H y x = 1" "recurrent y" "(x, y) \<in> communicating"
       by auto
   qed
 qed
 
 lemma equiv_communicating: "equiv UNIV communicating"
   by (auto simp: equiv_def sym_def communicating_def refl_on_def trans_def)
 
 lemma recurrent_class:
   assumes "recurrent x"
   shows "acc `` {x} = communicating `` {x}"
   using recurrent_acc(4)[OF \<open>recurrent x\<close>] by (auto simp: communicating_def)
 
 lemma irreduccible_recurrent_class:
   assumes "recurrent x" shows "acc `` {x} \<in> UNIV // communicating"
   unfolding recurrent_class[OF \<open>recurrent x\<close>] by (rule quotientI) simp
 
 lemma essential_classI:
   assumes C: "C \<in> UNIV // communicating"
   assumes eq: "\<And>x y. x \<in> C \<Longrightarrow> (x, y) \<in> acc \<Longrightarrow> y \<in> C"
   shows "essential_class C"
   by (auto simp: essential_class_def intro: C) (metis eq)
 
 lemma essential_recurrent_class:
   assumes "recurrent x" shows "essential_class (communicating `` {x})"
   unfolding recurrent_class[OF \<open>recurrent x\<close>, symmetric]
   apply (rule essential_classI)
   apply (rule irreduccible_recurrent_class[OF assms])
   apply (auto simp: communicating_def)
   done
 
 lemma essential_classD2:
   "essential_class C \<Longrightarrow> x \<in> C \<Longrightarrow> (x, y) \<in> acc \<Longrightarrow> y \<in> C"
   unfolding essential_class_def by auto
 
 lemma essential_classD3:
   "essential_class C \<Longrightarrow> x \<in> C \<Longrightarrow> y \<in> C \<Longrightarrow> (x, y) \<in> communicating"
   unfolding essential_class_def
   by (auto elim!: quotientE simp: communicating_def)
 
 lemma AE_acc:
   shows "AE \<omega> in T x. \<forall>m. (x, (x ## \<omega>) !! m) \<in> acc"
   using AE_T_reachable
   by eventually_elim (auto simp: alw_HLD_iff_streams streams_iff_snth Stream_snth split: nat.splits)
 
 lemma finite_essential_class_imp_recurrent:
   assumes C: "essential_class C" "finite C" and x: "x \<in> C"
   shows "recurrent x"
 proof -
   have "AE \<omega> in T x. \<exists>y\<in>C. alw (ev (HLD {y})) \<omega>"
     using AE_T_reachable
   proof eventually_elim
     fix \<omega> assume "alw (HLD (acc `` {x})) \<omega>"
     then have "alw (HLD C) \<omega>"
       by (rule alw_mono) (auto simp: HLD_iff intro: assms essential_classD2)
     then show "\<exists>y\<in>C. alw (ev (HLD {y})) \<omega>"
       by (rule pigeonhole_stream) fact
   qed
   then have "1 = \<P>(\<omega> in T x. \<exists>y\<in>C. alw (ev (HLD {y})) \<omega>)"
     by (subst (asm) T.prob_Collect_eq_1[symmetric]) (auto simp: \<open>finite C\<close>)
   also have "\<dots> = measure (T x) (\<Union>y\<in>C. {\<omega>\<in>space (T x). alw (ev (HLD {y})) \<omega>})"
     by (intro arg_cong2[where f=measure]) auto
   also have "\<dots> \<le> (\<Sum>y\<in>C. H x y)"
     unfolding H_def using \<open>finite C\<close> by (rule T.finite_measure_subadditive_finite) auto
   also have "\<dots> = (\<Sum>y\<in>C. U x y * H y y)"
     by (auto intro!: sum.cong H_eq)
   finally have "\<exists>y\<in>C. recurrent y"
     by (rule_tac ccontr) (simp add: H_eq(2))
   then guess y ..
   from essential_classD3[OF C(1) x this(1)] recurrent_acc(3)[OF this(2)]
   show "recurrent x"
     by (simp add: communicating_def)
 qed
 
 lemma irreducibleD:
   "C \<in> UNIV // communicating \<Longrightarrow> a \<in> C \<Longrightarrow> b \<in> C \<Longrightarrow> (a, b) \<in> communicating"
   by (auto elim!: quotientE simp: communicating_def)
 
 lemma irreducibleD2:
   "C \<in> UNIV // communicating \<Longrightarrow> a \<in> C \<Longrightarrow> (a, b) \<in> communicating \<Longrightarrow> b \<in> C"
   by (auto elim!: quotientE simp: communicating_def)
 
 lemma essential_class_iff_recurrent:
   "finite C \<Longrightarrow> C \<in> UNIV // communicating \<Longrightarrow> essential_class C \<longleftrightarrow> (\<forall>x\<in>C. recurrent x)"
   by (metis finite_essential_class_imp_recurrent irreducibleD2 recurrent_acc(4) essential_classI)
 
 definition "U' x y = (\<integral>\<^sup>+\<omega>. eSuc (sfirst (HLD {y}) \<omega>) \<partial>T x)"
 
 lemma U'_neq_zero[simp]: "U' x y \<noteq> 0"
   unfolding U'_def by (simp add: nn_integral_add)
 
 definition "gf_U' x y z = (\<Sum>n. u x y n * Suc n * z ^ n)"
 
 definition "pos_recurrent x \<longleftrightarrow> recurrent x \<and> U' x x \<noteq> \<infinity>"
 
 lemma summable_gf_U':
   assumes z: "norm z < 1"
   shows "summable (\<lambda>n. u x y n * Suc n * z ^ n)"
 proof -
   have "summable (\<lambda>n. n * \<bar>z\<bar> ^ n)"
   proof (rule root_test_convergence)
     have "(\<lambda>n. root n n * \<bar>z\<bar>) \<longlonglongrightarrow> 1 * \<bar>z\<bar>"
       by (intro tendsto_intros LIMSEQ_root)
     then show "(\<lambda>n. root n (norm (n * \<bar>z\<bar> ^ n))) \<longlonglongrightarrow> \<bar>z\<bar>"
       by (rule filterlim_cong[THEN iffD1, rotated 3])
          (auto intro!: exI[of _ 1]
                simp add: abs_mult u_nonneg real_root_mult power_abs eventually_sequentially real_root_power)
   qed (insert z, simp add: abs_less_iff)
   note summable_mult[OF this, of "1 / \<bar>z\<bar>"]
   from summable_ignore_initial_segment[OF this, of 1]
   show "summable (\<lambda>n. u x y n * Suc n * z ^ n)"
     apply (rule summable_comparison_test[rotated])
     using z
     apply (auto intro!: exI[of _ 1]
                 simp: abs_mult u_nonneg power_abs Suc_le_eq gr0_conv_Suc field_simps le_divide_eq u_le_1
                 simp del: of_nat_Suc)
     done
 qed
 
 lemma gf_U'_nonneg[simp]: "0 < z \<Longrightarrow> z < 1 \<Longrightarrow> 0 \<le> gf_U' x y z"
   unfolding gf_U'_def
   by (intro suminf_nonneg summable_gf_U') (auto simp: u_nonneg)
 
 lemma DERIV_gf_U:
   fixes z :: real assumes z: "0 < z" "z < 1"
   shows "DERIV (gf_U x y) z :> gf_U' x y z"
   unfolding gf_U_def[abs_def]  gf_U'_def real_scaleR_def u_def[symmetric]
   using z by (intro DERIV_power_series'[where R=1] summable_gf_U') auto
 
 lemma sfirst_finiteI_recurrent:
   "recurrent x \<Longrightarrow> (x, y) \<in> acc \<Longrightarrow> AE \<omega> in T x. sfirst (HLD {y}) \<omega> < \<infinity>"
   using recurrent_acc(1)[of y x] recurrent_acc[of x y]
     T.AE_prob_1[of x "{\<omega>\<in>space (T x). ev (HLD {y}) \<omega>}"]
   unfolding sfirst_finite U_def by (simp add: space_stream_space communicating_def)
 
 lemma U'_eq_suminf:
   assumes x: "recurrent x" "(x, y) \<in> acc"
   shows "U' x y = (\<Sum>i. ennreal (u x y i * Suc i))"
 proof -
   have "(\<integral>\<^sup>+\<omega>. eSuc (sfirst (HLD {y}) \<omega>) \<partial>T x) =
       (\<integral>\<^sup>+\<omega>. (\<Sum>i. ennreal (Suc i) * indicator {\<omega>\<in>space (T y). ev_at (HLD {y}) i \<omega>} \<omega>) \<partial>T x)"
     using sfirst_finiteI_recurrent[OF x]
   proof (intro nn_integral_cong_AE, eventually_elim)
     fix \<omega> assume "sfirst (HLD {y}) \<omega> < \<infinity>"
     then obtain n :: nat where [simp]: "sfirst (HLD {y}) \<omega> = n"
       by auto
     show "eSuc (sfirst (HLD {y}) \<omega>) = (\<Sum>i. ennreal (Suc i) * indicator {\<omega>\<in>space (T y). ev_at (HLD {y}) i \<omega>} \<omega>)"
       by (subst suminf_cmult_indicator[where i=n])
          (auto simp: disjoint_family_on_def ev_at_unique space_stream_space
                      sfirst_eq_enat_iff[symmetric] ennreal_of_nat_eq_real_of_nat
                split: split_indicator)
   qed
   also have "\<dots> = (\<Sum>i. ennreal (Suc i) * emeasure (T x) {\<omega>\<in>space (T x). ev_at (HLD {y}) i \<omega>})"
     by (subst nn_integral_suminf)
        (auto intro!: arg_cong[where f=suminf] nn_integral_cmult_indicator simp: fun_eq_iff)
   finally show ?thesis
     by (simp add: U'_def u_def T.emeasure_eq_measure mult_ac ennreal_mult)
 qed
 
 lemma gf_U'_tendsto_U':
   assumes x: "recurrent x" "(x, y) \<in> acc"
   shows "((\<lambda>z. ennreal (gf_U' x y z)) \<longlongrightarrow> U' x y) (at_left 1)"
   unfolding U'_eq_suminf[OF x] gf_U'_def
   by (auto intro!: power_series_tendsto_at_left summable_gf_U' mult_nonneg_nonneg u_nonneg simp del: of_nat_Suc)
 
 lemma one_le_integral_t:
   assumes x: "recurrent x" shows "1 \<le> U' x x"
   by (simp add: nn_integral_add T.emeasure_space_1 U'_def del: space_T)
 
 lemma gf_U'_pos:
   fixes z :: real
   assumes z: "0 < z" "z < 1" and "U x y \<noteq> 0"
   shows "0 < gf_U' x y z"
   unfolding gf_U'_def
 proof (subst suminf_pos_iff)
   show "summable (\<lambda>n. u x y n * real (Suc n) * z ^ n)"
     using z by (intro summable_gf_U') simp
-  show pos: "\<forall>n. 0 \<le> u x y n * real (Suc n) * z ^ n"
-    using z by (auto intro!: mult_nonneg_nonneg u_nonneg)
+  show pos: "\<And>n. 0 \<le> u x y n * real (Suc n) * z ^ n"
+    using u_nonneg z by auto
   show "\<exists>n. 0 < u x y n * real (Suc n) * z ^ n"
   proof (rule ccontr)
     assume "\<not> (\<exists>n. 0 < u x y n * real (Suc n) * z ^ n)"
     with pos have "\<forall>n. u x y n * real (Suc n) * z ^ n = 0"
       by (intro antisym allI) (simp_all add: not_less)
     with z have "u x y = (\<lambda>n. 0)"
       by (intro ext) simp
     with u_sums_U[of x y, THEN sums_unique] \<open>U x y \<noteq> 0\<close> show False
       by simp
   qed
 qed
 
 lemma inverse_gf_U'_tendsto:
   assumes "recurrent y"
   shows "((\<lambda>x. - 1 / - gf_U' y y x) \<longlongrightarrow> enn2real (1 / U' y y)) (at_left (1::real))"
 proof cases
   assume inf: "U' y y = \<infinity>"
   with gf_U'_tendsto_U'[of y y] \<open>recurrent y\<close>
   have "LIM z (at_left 1). gf_U' y y z :> at_top"
     by (auto simp: ennreal_tendsto_top_eq_at_top U'_def)
   then have "LIM z (at_left 1). gf_U' y y z :> at_infinity"
     by (rule filterlim_mono) (auto simp: at_top_le_at_infinity)
   with inf show ?thesis
     by (auto intro!: tendsto_divide_0)
 next
   assume fin: "U' y y \<noteq> \<infinity>"
   then obtain r where r: "U' y y = ennreal r" and [simp]: "0 \<le> r"
     by (cases "U' y y") (auto simp: U'_def)
   then have eq: "enn2real (1 / U' y y) = - 1 / - r" and "1 \<le> r"
     using one_le_integral_t[OF \<open>recurrent y\<close>]
     by (auto simp add: ennreal_1[symmetric] divide_ennreal simp del: ennreal_1)
   have "((\<lambda>z. ennreal (gf_U' y y z)) \<longlongrightarrow> ennreal r) (at_left 1)"
     using gf_U'_tendsto_U'[OF \<open>recurrent y\<close>, of y] r by simp
   then have gf_U': "(gf_U' y y \<longlongrightarrow> r) (at_left (1::real))"
     by (rule tendsto_ennrealD)
        (insert summable_gf_U', auto intro!: eventually_at_left_1 suminf_nonneg simp: gf_U'_def u_nonneg)
   show ?thesis
     using \<open>1 \<le> r\<close> unfolding eq by (intro tendsto_intros gf_U') simp
 qed
 
 lemma gf_G_pos:
   fixes z :: real
   assumes z: "0 < z" "z < 1" and *: "(x, y) \<in> acc"
   shows "0 < gf_G x y z"
   unfolding gf_G_def
 proof (subst suminf_pos_iff)
   show "summable (\<lambda>n. p x y n *\<^sub>R z ^ n)"
     using z by (intro convergence_G convergence_G_less_1) simp
-  show pos: "\<forall>n. 0 \<le> p x y n *\<^sub>R z ^ n"
+  show pos: "\<And>n. 0 \<le> p x y n *\<^sub>R z ^ n"
     using z by (auto intro!: mult_nonneg_nonneg p_nonneg)
   show "\<exists>n. 0 < p x y n *\<^sub>R z ^ n"
   proof (rule ccontr)
     assume "\<not> (\<exists>n. 0 < p x y n *\<^sub>R z ^ n)"
     with pos have "\<forall>n. p x y n * z ^ n = 0"
       by (intro antisym allI) (simp_all add: not_less)
     with z have "\<And>n. p x y n = 0"
       by simp
     with *[THEN accD_pos] show False
       by simp
   qed
 qed
 
 lemma pos_recurrentI_communicating:
   assumes y: "pos_recurrent y" and x: "(y, x) \<in> communicating"
   shows "pos_recurrent x"
 proof -
   from y x have recurrent: "recurrent y" "recurrent x" and fin: "U' y y \<noteq> \<infinity>"
     by (auto simp: pos_recurrent_def recurrent_iffI_communicating nn_integral_add)
   have pos: "0 < enn2real (1 / U' y y)"
     using one_le_integral_t[OF \<open>recurrent y\<close>] fin
     by (auto simp: U'_def enn2real_positive_iff less_top[symmetric] ennreal_zero_less_divide ennreal_divide_eq_top_iff)
 
   from fin obtain r where r: "U' y y = ennreal r" and [simp]: "0 \<le> r"
     by (cases "U' y y") (auto simp: U'_def)
 
   from x obtain n m where "0 < p x y n" "0 < p y x m"
     by (auto dest!: accD_pos simp: communicating_def)
 
   let ?L = "at_left (1::real)"
   have le: "eventually (\<lambda>z. p x y n * p y x m * z^(n + m) \<le> (1 - gf_U y y z) / (1 - gf_U x x z)) ?L"
   proof (rule eventually_at_left_1)
     fix z :: real assume z: "0 < z" "z < 1"
     then have conv: "\<And>x. convergence_G x x z"
       by (intro convergence_G_less_1) simp
     have sums: "(\<lambda>i. (p x y n * p y x m * z^(n + m)) * (p y y i * z^i)) sums ((p x y n * p y x m * z^(n + m)) * gf_G y y z)"
       unfolding gf_G_def
       by (intro sums_mult summable_sums) (auto intro!: conv convergence_G[where 'a=real, simplified])
     have "(\<Sum>i. (p x y n * p y x m * z^(n + m)) * (p y y i * z^i)) \<le> (\<Sum>i. p x x (i + (n + m)) * z^(i + (n + m)))"
     proof (intro allI suminf_le sums_summable[OF sums] summable_ignore_initial_segment convergence_G[where 'a=real, simplified] convergence_G_less_1)
       show "norm z < 1" using z by simp
       fix i
       have "(p x y n * p y y ((n + i) - n)) * p y x ((n + i + m) - (n + i)) \<le> p x y (n + i) * p y x ((n + i + m) - (n + i))"
         by (intro mult_right_mono prob_reachable_le) simp_all
       also have "\<dots> \<le> p x x (n + i + m)"
          by (intro prob_reachable_le) simp_all
       finally show "p x y n * p y x m * z ^ (n + m) * (p y y i * z ^ i) \<le> p x x (i + (n + m)) * z ^ (i + (n + m))"
         using z by (auto simp add: ac_simps power_add intro!: mult_left_mono)
     qed
     also have "\<dots> \<le> gf_G x x z"
       unfolding gf_G_def
       using z
       apply (subst (2) suminf_split_initial_segment[where k="n + m"])
       apply (intro convergence_G conv)
       apply (simp add: sum_nonneg)
       done
     finally have "(p x y n * p y x m * z^(n + m)) * gf_G y y z \<le> gf_G x x z"
       using sums_unique[OF sums] by simp
     then have "(p x y n * p y x m * z^(n + m)) \<le> gf_G x x z / gf_G y y z"
       using z gf_G_pos[of z y y] by (simp add: field_simps)
     also have "\<dots> = (1 - gf_U y y z) / (1 - gf_U x x z)"
       unfolding gf_G_eq_gf_U[OF conv] using gf_G_eq_gf_U(2)[OF conv] by (simp add: field_simps )
     finally show "p x y n * p y x m * z^(n + m) \<le> (1 - gf_U y y z) / (1 - gf_U x x z)" .
   qed
 
   have "U' x x \<noteq> \<infinity>"
   proof
     assume "U' x x = \<infinity>"
     have "((\<lambda>z. (1 - gf_U y y z) / (1 - gf_U x x z)) \<longlongrightarrow> 0) ?L"
     proof (rule lhopital_left)
       show "((\<lambda>z. 1 - gf_U y y z) \<longlongrightarrow> 0) ?L"
         using gf_U[of y] recurrent_iff_U_eq_1[of y] \<open>recurrent y\<close> by (auto intro!: tendsto_eq_intros)
       show "((\<lambda>z. 1 - gf_U x x z) \<longlongrightarrow> 0) ?L"
         using gf_U[of x] recurrent_iff_U_eq_1[of x] \<open>recurrent x\<close> by (auto intro!: tendsto_eq_intros)
       show "eventually (\<lambda>z. 1 - gf_U x x z \<noteq> 0) ?L"
         by (auto intro!: eventually_at_left_1 simp: gf_G_eq_gf_U(2) convergence_G_less_1)
       show "eventually (\<lambda>z. - gf_U' x x z \<noteq> 0) ?L"
         using gf_U'_pos[of _ x x] recurrent_iff_U_eq_1[of x] \<open>recurrent x\<close>
         by (auto intro!: eventually_at_left_1) (metis less_le)
       show "eventually (\<lambda>z. DERIV (\<lambda>xa. 1 - gf_U x x xa) z :> - gf_U' x x z) ?L"
         by (auto intro!: eventually_at_left_1 derivative_eq_intros DERIV_gf_U)
       show "eventually (\<lambda>z. DERIV (\<lambda>xa. 1 - gf_U y y xa) z :> - gf_U' y y z) ?L"
         by (auto intro!: eventually_at_left_1 derivative_eq_intros DERIV_gf_U)
 
       have "(gf_U' y y \<longlongrightarrow> U' y y) ?L"
         using \<open>recurrent y\<close> by (rule gf_U'_tendsto_U') simp
       then have *: "(gf_U' y y \<longlongrightarrow> r) ?L"
         by (auto simp add: r eventually_at_left_1 dest!: tendsto_ennrealD)
       moreover
       have "(gf_U' x x \<longlongrightarrow> U' x x) ?L"
         using \<open>recurrent x\<close> by (rule gf_U'_tendsto_U') simp
       then have "LIM z ?L. - gf_U' x x z :> at_bot"
         by (simp add: ennreal_tendsto_top_eq_at_top \<open>U' x x = \<infinity>\<close> filterlim_uminus_at_top
                  del: ennreal_of_enat_eSuc)
       then have "LIM z ?L. - gf_U' x x z :> at_infinity"
         by (rule filterlim_mono) (auto simp: at_bot_le_at_infinity)
       ultimately show "((\<lambda>z. - gf_U' y y z / - gf_U' x x z) \<longlongrightarrow> 0) ?L"
         by (intro tendsto_divide_0[where c="- r"] tendsto_intros)
     qed
     moreover
     have "((\<lambda>z. p x y n * p y x m * z^(n + m)) \<longlongrightarrow> p x y n * p y x m) ?L"
       by (auto intro!: tendsto_eq_intros)
     ultimately have "p x y n * p y x m \<le> 0"
       using le by (rule tendsto_le[OF trivial_limit_at_left_real])
     with \<open>0 < p x y n\<close> \<open>0 < p y x m\<close> show False
       by (auto simp add: mult_le_0_iff)
   qed
   with \<open>recurrent x\<close> show ?thesis
     by (simp add: pos_recurrent_def nn_integral_add)
 qed
 
 lemma pos_recurrent_iffI_communicating:
   "(y, x) \<in> communicating \<Longrightarrow> pos_recurrent y \<longleftrightarrow> pos_recurrent x"
   using pos_recurrentI_communicating[of x y] pos_recurrentI_communicating[of y x]
   by (auto simp add: communicating_def)
 
 lemma U_le_F: "U x y \<le> F x y"
   by (auto simp: U_def F_def intro!: T.finite_measure_mono)
 
 lemma not_empty_irreducible: "C \<in> UNIV // communicating \<Longrightarrow> C \<noteq> {}"
   by (auto simp: quotient_def Image_def communicating_def)
 
 subsection \<open>Stationary distribution\<close>
 
 definition stat :: "'s set \<Rightarrow> 's measure" where
   "stat C = point_measure UNIV (\<lambda>x. indicator C x / U' x x)"
 
 lemma sets_stat[simp]: "sets (stat C) = sets (count_space UNIV)"
   by (simp add: stat_def sets_point_measure)
 
 lemma space_stat[simp]: "space (stat C) = UNIV"
   by (simp add: stat_def space_point_measure)
 
 lemma stat_subprob:
   assumes C: "essential_class C" and "countable C" and pos: "\<forall>c\<in>C. pos_recurrent c"
   shows "emeasure (stat C) C \<le> 1"
 proof -
   let ?L = "at_left (1::real)"
   from finite_sequence_to_countable_set[OF \<open>countable C\<close>] guess A . note A = this
   then have "(\<lambda>n. emeasure (stat C) (A n)) \<longlonglongrightarrow> emeasure (stat C) (\<Union>i. A i)"
     by (intro Lim_emeasure_incseq) (auto simp: incseq_Suc_iff)
   then have "emeasure (stat C) (\<Union>i. A i) \<le> 1"
   proof (rule LIMSEQ_le[OF _ tendsto_const], intro exI allI impI)
     fix n
     from A(1,3) have A_n: "finite (A n)"
       by auto
 
     from C have "C \<noteq> {}"
       by (simp add: essential_class_def not_empty_irreducible)
     then obtain x where "x \<in> C" by auto
 
     have "((\<lambda>z. (\<Sum>y\<in>A n. gf_F x y z * ((1 - z) / (1 - gf_U y y z)))) \<longlongrightarrow> (\<Sum>y\<in>A n. F x y * enn2real (1 / U' y y))) ?L"
     proof (intro tendsto_intros gf_F, rule lhopital_left)
       fix y assume "y \<in> A n"
       with \<open>A n \<subseteq> C\<close> have "y \<in> C"
         by auto
       show "((-) 1 \<longlongrightarrow> 0) ?L"
         by (intro tendsto_eq_intros) simp_all
       have "recurrent y"
         using pos[THEN bspec, OF \<open>y\<in>C\<close>] by (simp add: pos_recurrent_def)
       then have "U y y = 1"
         by (simp add: recurrent_iff_U_eq_1)
 
       show "((\<lambda>x. 1 - gf_U y y x) \<longlongrightarrow> 0) ?L"
         using gf_U[of y y] \<open>U y y = 1\<close> by (intro tendsto_eq_intros) auto
       show "eventually (\<lambda>x. 1 - gf_U y y x \<noteq> 0) ?L"
         using gf_G_eq_gf_U(2)[OF convergence_G_less_1, where 'z=real] by (auto intro!: eventually_at_left_1)
       have "eventually (\<lambda>x. 0 < gf_U' y y x) ?L"
         by (intro eventually_at_left_1 gf_U'_pos) (simp_all add: \<open>U y y = 1\<close>)
       then show "eventually (\<lambda>x. - gf_U' y y x \<noteq> 0) ?L"
         by eventually_elim simp
       show "eventually (\<lambda>x. DERIV (\<lambda>x. 1 - gf_U y y x) x :> - gf_U' y y x) ?L"
         by (auto intro!: eventually_at_left_1 derivative_eq_intros DERIV_gf_U)
       show "eventually (\<lambda>x. DERIV ((-) 1) x :> - 1) ?L"
         by (auto intro!: eventually_at_left_1 derivative_eq_intros)
       show "((\<lambda>x. - 1 / - gf_U' y y x) \<longlongrightarrow> enn2real (1 / U' y y)) ?L"
         using \<open>recurrent y\<close> by (rule inverse_gf_U'_tendsto)
     qed
     also have "(\<Sum>y\<in>A n. F x y * enn2real (1 / U' y y)) = (\<Sum>y\<in>A n. enn2real (1 / U' y y))"
     proof (intro sum.cong refl)
       fix y assume "y \<in> A n"
       with \<open>A n \<subseteq> C\<close> have "y \<in> C" by auto
       with \<open>x \<in> C\<close> have "(x, y) \<in> communicating"
         by (rule essential_classD3[OF C])
       with \<open>y\<in>C\<close> have "recurrent y" "(y, x) \<in> acc"
         using pos[THEN bspec, of y] by (auto simp add: pos_recurrent_def communicating_def)
       then have "U x y = 1"
         by (rule recurrent_acc)
       with F_le_1[of x y] U_le_F[of x y] have "F x y = 1" by simp
       then show "F x y * enn2real (1 / U' y y) = enn2real (1 / U' y y)"
         by simp
     qed
     finally have le: "(\<Sum>y\<in>A n. enn2real (1 / U' y y)) \<le> 1"
     proof (rule tendsto_le[OF trivial_limit_at_left_real tendsto_const], intro eventually_at_left_1)
       fix z :: real assume z: "0 < z" "z < 1"
       with \<open>x \<in> C\<close> have "norm z < 1"
         by auto
       then have conv: "\<And>x y. convergence_G x y z"
         by (simp add: convergence_G_less_1)
       have "(\<Sum>y\<in>A n. gf_F x y z / (1 - gf_U y y z)) = (\<Sum>y\<in>A n. gf_G x y z)"
         using \<open>norm z < 1\<close>
         apply (intro sum.cong refl)
         apply (subst gf_G_eq_gf_F)
         apply assumption
         apply (subst gf_G_eq_gf_U(1)[OF conv])
         apply auto
         done
       also have "\<dots> = (\<Sum>y\<in>A n. \<Sum>n. p x y n * z^n)"
         by (simp add: gf_G_def)
       also have "\<dots>  = (\<Sum>i. \<Sum>y\<in>A n. p x y i *\<^sub>R z^i)"
         by (subst suminf_sum[OF convergence_G[OF conv]]) simp
       also have "\<dots>  \<le> (\<Sum>i. z^i)"
       proof (intro suminf_le summable_sum convergence_G conv summable_geometric allI)
         fix l
         have "(\<Sum>y\<in>A n. p x y l *\<^sub>R z ^ l) = (\<Sum>y\<in>A n. p x y l) * z ^ l"
           by (simp add: sum_distrib_right)
         also have "\<dots> \<le> z ^ l"
         proof (intro mult_left_le_one_le)
           have "(\<Sum>y\<in>A n. p x y l) = \<P>(\<omega> in T x. (x ## \<omega>) !! l \<in> A n)"
             unfolding p_def using \<open>finite (A n)\<close>
             by (subst T.finite_measure_finite_Union[symmetric])
                (auto simp: disjoint_family_on_def intro!: arg_cong2[where f=measure])
           then show "(\<Sum>y\<in>A n. p x y l) \<le> 1"
             by simp
         qed (insert z, auto simp: sum_nonneg)
         finally show "(\<Sum>y\<in>A n. p x y l *\<^sub>R z ^ l) \<le> z ^ l" .
       qed fact
       also have "\<dots> = 1 / (1 - z)"
         using sums_unique[OF geometric_sums, OF \<open>norm z < 1\<close>] ..
       finally have "(\<Sum>y\<in>A n. gf_F x y z / (1 - gf_U y y z)) \<le> 1 / (1 - z)" .
       then have "(\<Sum>y\<in>A n. gf_F x y z / (1 - gf_U y y z)) * (1 - z) \<le> 1"
         using z by (simp add: field_simps)
       then have "(\<Sum>y\<in>A n. gf_F x y z / (1 - gf_U y y z) * (1 - z)) \<le> 1"
         by (simp add: sum_distrib_right)
       then show "(\<Sum>y\<in>A n. gf_F x y z * ((1 - z) / (1 - gf_U y y z))) \<le> 1"
         by simp
     qed
 
     from A_n have "emeasure (stat C) (A n) = (\<Sum>y\<in>A n. emeasure (stat C) {y})"
       by (intro emeasure_eq_sum_singleton) simp_all
     also have "\<dots> = (\<Sum>y\<in>A n. inverse (U' y y))"
       unfolding stat_def U'_def using A(1)[of n]
       apply (intro sum.cong refl)
       apply (subst emeasure_point_measure_finite2)
         apply (auto simp: divide_ennreal_def Collect_conv_if)
       done
     also have "\<dots> = ennreal (\<Sum>y\<in>A n. enn2real (1 / U' y y))"
       apply (subst sum_ennreal[symmetric], simp)
     proof (intro sum.cong refl)
       fix y assume "y \<in> A n"
       with \<open>A n \<subseteq> C\<close> pos have "pos_recurrent y"
         by auto
       with one_le_integral_t[of y] obtain r where "U' y y = ennreal r" "1 \<le> U' y y" and [simp]: "0 \<le> r"
         by (cases "U' y y") (auto simp: pos_recurrent_def nn_integral_add)
       then show "inverse (U' y y) = ennreal (enn2real (1 / U' y y))"
         by (simp add: ennreal_1[symmetric] divide_ennreal inverse_ennreal inverse_eq_divide del: ennreal_1)
     qed
     also have "\<dots> \<le> 1"
       using le by simp
     finally show "emeasure (stat C) (A n) \<le> 1" .
   qed
   with A show ?thesis
     by simp
 qed
 
 lemma emeasure_stat_not_C:
   assumes "y \<notin> C"
   shows "emeasure (stat C) {y} = 0"
   unfolding stat_def using \<open>y \<notin> C\<close>
   by (subst emeasure_point_measure_finite2) auto
 
 definition stationary_distribution :: "'s pmf \<Rightarrow> bool" where
   "stationary_distribution N \<longleftrightarrow> N = bind_pmf N K"
 
 lemma stationary_distributionI:
   assumes le: "\<And>y. (\<integral>x. pmf (K x) y \<partial>measure_pmf N) \<le> pmf N y"
   shows "stationary_distribution N"
   unfolding stationary_distribution_def
 proof (rule pmf_eqI antisym)+
   fix i
   show "pmf (bind_pmf N K) i \<le> pmf N i"
     by (simp add: pmf_bind le)
 
   define \<Omega> where "\<Omega> = N \<union> (\<Union>i\<in>N. set_pmf (K i))"
   then have \<Omega>: "countable \<Omega>"
     by (auto intro: countable_set_pmf)
   then interpret N: sigma_finite_measure "count_space \<Omega>"
     by (rule sigma_finite_measure_count_space_countable)
   interpret pN: pair_sigma_finite N "count_space \<Omega>"
     by unfold_locales
 
   have measurable_pmf[measurable]: "(\<lambda>(x, y). pmf (K x) y) \<in> borel_measurable (N \<Otimes>\<^sub>M count_space \<Omega>)"
     unfolding measurable_split_conv
     apply (rule measurable_compose_countable'[OF _ measurable_snd])
     apply (rule measurable_compose[OF measurable_fst])
     apply (simp_all add: \<Omega>)
     done
 
   { assume *: "(\<integral>y. pmf (K y) i \<partial>N) < pmf N i"
     have "0 \<le> (\<integral>y. pmf (K y) i \<partial>N)"
       by (intro integral_nonneg_AE) simp
     with * have i: "i \<in> set_pmf N" "i \<in> \<Omega>"
       by (auto simp: set_pmf_iff \<Omega>_def not_le[symmetric])
     from * have "0 < pmf N i - (\<integral>y. pmf (K y) i \<partial>N)"
       by (simp add: field_simps)
     also have "\<dots> = (\<integral>t. (pmf N i - (\<integral>y. pmf (K y) i \<partial>N)) * indicator {i} t \<partial>count_space \<Omega>)"
       by (simp add: i)
     also have "\<dots> \<le> (\<integral>t. pmf N t - \<integral>y. pmf (K y) t \<partial>N \<partial>count_space \<Omega>)"
       using le
       by (intro integral_mono integrable_diff)
          (auto simp: i pmf_bind[symmetric] integrable_pmf field_simps split: split_indicator)
     also have "\<dots> = (\<integral>t. pmf N t \<partial>count_space \<Omega>) - (\<integral>t. \<integral>y. pmf (K y) t \<partial>N \<partial>count_space \<Omega>)"
       by (subst Bochner_Integration.integral_diff) (auto intro!: integrable_pmf simp: pmf_bind[symmetric])
     also have "(\<integral>t. \<integral>y. pmf (K y) t \<partial>N \<partial>count_space \<Omega>) = (\<integral>y. \<integral>t. pmf (K y) t \<partial>count_space \<Omega> \<partial>N)"
       apply (intro pN.Fubini_integral integrable_iff_bounded[THEN iffD2] conjI)
       apply (auto simp add: N.nn_integral_fst[symmetric] nn_integral_eq_integral integrable_pmf)
       unfolding less_top[symmetric] unfolding infinity_ennreal_def[symmetric]
       apply (intro integrableD)
       apply (auto intro!: measure_pmf.integrable_const_bound[where B=1]
                   simp: AE_measure_pmf_iff integral_nonneg_AE integral_pmf)
       done
     also have "(\<integral>y. \<integral>t. pmf (K y) t \<partial>count_space \<Omega> \<partial>N) = (\<integral>y. 1 \<partial>N)"
       by (intro integral_cong_AE)
          (auto simp: AE_measure_pmf_iff integral_pmf \<Omega>_def intro!: measure_pmf.prob_eq_1[THEN iffD2])
     finally have False
       using measure_pmf.prob_space[of N] by (simp add: integral_pmf field_simps not_le[symmetric]) }
   then show "pmf N i \<le> pmf (bind_pmf N K) i"
     by (auto simp: pmf_bind not_le[symmetric])
 qed
 
 lemma stationary_distribution_iterate:
   assumes N: "stationary_distribution N"
   shows "ennreal (pmf N y) = (\<integral>\<^sup>+x. p x y n \<partial>N)"
 proof (induct n arbitrary: y)
   have [simp]: "\<And>x y. ennreal (if x = y then 1 else 0) = indicator {y} x"
     by simp
   case 0 then show ?case
     by (simp add: p_0 pmf.rep_eq measure_pmf.emeasure_eq_measure)
 next
   case (Suc n) with N show ?case
     apply (simp add: nn_integral_eq_integral[symmetric] p_le_1 p_Suc'
                      measure_pmf.integrable_const_bound[where B=1])
     apply (subst nn_integral_bind[symmetric, where B="count_space UNIV"])
     apply (auto simp: stationary_distribution_def measure_pmf_bind[symmetric]
                 simp del: measurable_pmf_measure1)
     done
 qed
 
 lemma stationary_distribution_iterate':
   assumes "stationary_distribution N"
   shows "measure N {y} = (\<integral>x. p x y n \<partial>N)"
   using stationary_distribution_iterate[OF assms]
   by (subst (asm) nn_integral_eq_integral)
      (auto intro!: measure_pmf.integrable_const_bound[where B=1] simp: p_le_1 pmf.rep_eq)
 
 lemma stationary_distributionD:
   assumes C: "essential_class C" "countable C"
   assumes N: "stationary_distribution N" "N \<subseteq> C"
   shows "\<forall>x\<in>C. pos_recurrent x" "measure_pmf N = stat C"
 proof -
   have integrable_K: "\<And>f x. integrable N (\<lambda>s. pmf (K s) (f x))"
     by (rule measure_pmf.integrable_const_bound[where B=1]) (simp_all add: pmf_le_1)
 
   have measure_C: "measure N C = 1" and ae_C: "AE x in N. x \<in> C"
     using N C measure_pmf.prob_eq_1[of C] by (auto simp: AE_measure_pmf_iff)
 
   have integrable_p: "\<And>n y. integrable N (\<lambda>x. p x y n)"
     by (rule measure_pmf.integrable_const_bound[where B=1]) (simp_all add: p_le_1)
 
   { fix e :: real assume "0 < e"
     then have [simp]: "0 \<le> e" by simp
     have "\<exists>A\<subseteq>C. finite A \<and> 1 - e < measure N A"
     proof (rule ccontr)
       assume contr: "\<not> (\<exists>A \<subseteq> C. finite A \<and> 1 - e < measure N A)"
       from finite_sequence_to_countable_set[OF \<open>countable C\<close>] guess F . note F = this
       then have *: "(\<lambda>n. measure N (F n)) \<longlonglongrightarrow> measure N (\<Union>i. F i)"
         by (intro measure_pmf.finite_Lim_measure_incseq) (auto simp: incseq_Suc_iff)
       with F contr have "measure N (\<Union>i. F i) \<le> 1 - e"
         by (intro LIMSEQ_le[OF * tendsto_const]) (auto simp: not_less)
       with F \<open>0 < e\<close> show False
         by (simp add: measure_C)
     qed
     then obtain A where "A \<subseteq> C" "finite A" and e: "1 - e < measure N A" by auto
 
     { fix y n assume "y \<in> C"
       from N(1) have "measure N {y} = (\<integral>x. p x y n \<partial>N)"
         by (rule stationary_distribution_iterate')
       also have "\<dots> \<le> (\<integral>x. p x y n * indicator A x + indicator (C - A) x \<partial>N)"
         using ae_C \<open>A \<subseteq> C\<close>
         by (intro integral_mono_AE)
            (auto elim!: eventually_mono
                  intro!: integral_add integral_indicator p_le_1 integrable_real_mult_indicator
                    integrable_add
                  split: split_indicator simp: integrable_p less_top[symmetric] top_unique)
       also have "\<dots> = (\<integral>x. p x y n * indicator A x \<partial>N) + measure N (C - A)"
         using ae_C \<open>A \<subseteq> C\<close>
         apply (subst Bochner_Integration.integral_add)
         apply (auto elim!: eventually_mono
                     intro!: integral_add integral_indicator p_le_1 integrable_real_mult_indicator
                     split: split_indicator simp: integrable_p less_top[symmetric] top_unique)
         done
       also have "\<dots> \<le> (\<integral>x. p x y n * indicator A x \<partial>N) + e"
         using e \<open>A \<subseteq> C\<close>  by (simp add: measure_pmf.finite_measure_Diff measure_C)
       finally have "measure N {y} \<le> (\<integral>x. p x y n * indicator A x \<partial>N) + e" .
       then have "emeasure N {y} \<le> ennreal (\<integral>x. p x y n * indicator A x \<partial>N) + e"
         by (simp add: measure_pmf.emeasure_eq_measure ennreal_plus[symmetric] del: ennreal_plus)
       also have "\<dots> = (\<integral>\<^sup>+x. ennreal (p x y n) * indicator A x \<partial>N) + e"
         by (subst nn_integral_eq_integral[symmetric])
            (auto intro!: measure_pmf.integrable_const_bound[where B=1]
                  simp: abs_mult p_le_1 mult_le_one ennreal_indicator ennreal_mult)
       finally have "emeasure N {y} \<le> (\<integral>\<^sup>+x. ennreal (p x y n) * indicator A x \<partial>N) + e" . }
     note v_le = this
 
     { fix y and z :: real assume y: "y \<in> C" and z: "0 < z" "z < 1"
       have summable_int_p: "summable (\<lambda>n. (\<integral> x. p x y n * indicator A x \<partial>N) * (1 - z) * z ^ n)"
         using \<open>y\<in>C\<close> z \<open>A \<subseteq> C\<close>
         by (auto intro!: summable_comparison_test[OF _ summable_mult[OF summable_geometric[of z], of 1]] exI[of _ 0] mult_le_one
                             measure_pmf.integral_le_const integrable_real_mult_indicator integrable_p AE_I2 p_le_1
                     simp: abs_mult integral_nonneg_AE)
 
       from y z have sums_y: "(\<lambda>n. measure N {y} * (1 - z) * z ^ n) sums measure N {y}"
         using sums_mult[OF geometric_sums[of z], of "measure N {y} * (1 - z)"] by simp
       then have "emeasure N {y} = ennreal (\<Sum>n. (measure N {y} * (1 - z)) * z ^ n)"
         by (auto simp add: sums_unique[symmetric] measure_pmf.emeasure_eq_measure)
       also have "\<dots> = (\<Sum>n. emeasure N {y} * (1 - z) * z ^ n)"
         using z  summable_mult[OF summable_geometric[of z], of "measure_pmf.prob N {y} * (1 - z)"]
         by (subst suminf_ennreal[symmetric])
            (auto simp: measure_pmf.emeasure_eq_measure ennreal_mult[symmetric] ennreal_suminf_neq_top)
       also have "\<dots> \<le> (\<Sum>n. ((\<integral>\<^sup>+x. ennreal (p x y n) * indicator A x \<partial>N) + e) * (1 - z) * z ^ n)"
         using \<open>y\<in>C\<close> z \<open>A \<subseteq> C\<close>
         by (intro suminf_le mult_right_mono v_le allI)
            (auto simp: measure_pmf.emeasure_eq_measure)
       also have "\<dots> = (\<Sum>n. (\<integral>\<^sup>+x. ennreal (p x y n) * indicator A x \<partial>N) * (1 - z) * z ^ n) + e"
         using \<open>0 < e\<close> z sums_mult[OF geometric_sums[of z], of "e * (1 - z)"] \<open>0<z\<close> \<open>z<1\<close>
         by (simp add: distrib_right suminf_add[symmetric] ennreal_suminf_cmult[symmetric]
                       ennreal_mult[symmetric] suminf_ennreal_eq sums_unique[symmetric]
                  del: ennreal_suminf_cmult)
       also have "\<dots> = (\<Sum>n. ennreal (1 - z) * ((\<integral>\<^sup>+x. ennreal (p x y n) * indicator A x \<partial>N) * z ^ n)) + e"
         by (simp add: ac_simps)
       also have "\<dots> = ennreal (1 - z) * (\<Sum>n. ((\<integral>\<^sup>+x. ennreal (p x y n) * indicator A x \<partial>N) * z ^ n)) + e"
         using z by (subst ennreal_suminf_cmult) simp_all
       also have "(\<Sum>n. ((\<integral>\<^sup>+x. ennreal (p x y n) * indicator A x \<partial>N) * z ^ n)) =
           (\<Sum>n. (\<integral>\<^sup>+x. ennreal (p x y n * z ^ n) * indicator A x \<partial>N))"
         using z by (simp add: ac_simps nn_integral_cmult[symmetric] ennreal_mult)
       also have "\<dots> = (\<integral>\<^sup>+x. ennreal (gf_G x y z) * indicator A x \<partial>N)"
         using z
         apply (subst nn_integral_suminf[symmetric])
         apply (auto simp add: gf_G_def simp del: suminf_ennreal
                     intro!: ennreal_mult_right_cong suminf_ennreal2 nn_integral_cong)
         apply (intro summable_comparison_test[OF _ summable_mult[OF summable_geometric[of z], of 1]] impI)
         apply (simp_all add: abs_mult p_le_1 mult_le_one power_le_one split: split_indicator)
         done
       also have "\<dots> = (\<integral>\<^sup>+x. ennreal (gf_F x y z * gf_G y y z) * indicator A x \<partial>N)"
         using z by (intro nn_integral_cong) (simp add: gf_G_eq_gf_F[symmetric])
       also have "\<dots> = ennreal (gf_G y y z) * (\<integral>\<^sup>+x. ennreal (gf_F x y z) * indicator A x \<partial>N)"
         using z by (subst nn_integral_cmult[symmetric]) (simp_all add: gf_G_nonneg gf_F_nonneg ac_simps ennreal_mult)
       also have "\<dots> = ennreal (1 / (1 - gf_U y y z)) * (\<integral>\<^sup>+x. ennreal (gf_F x y z) * indicator A x \<partial>N)"
         using z \<open>y \<in> C\<close> by (subst gf_G_eq_gf_U) (auto intro!: convergence_G_less_1)
       finally have "emeasure N {y} \<le> ennreal ((1 - z) / (1 - gf_U y y z)) * (\<integral>\<^sup>+x. gf_F x y z * indicator A x \<partial>N) + e"
         using z
         by (subst (asm) mult.assoc[symmetric])
            (simp add: ennreal_indicator[symmetric] ennreal_mult'[symmetric] gf_F_nonneg)
       then have "measure N {y} \<le> (1 - z) / (1 - gf_U y y z) * (\<integral>x. gf_F x y z * indicator A x \<partial>N) + e"
         using z
         by (subst (asm) nn_integral_eq_integral[OF measure_pmf.integrable_const_bound[where B=1]])
            (auto simp: gf_F_nonneg gf_U_le_1 gf_F_le_1 measure_pmf.emeasure_eq_measure mult_le_one
                        ennreal_mult''[symmetric] ennreal_plus[symmetric]
                  simp del: ennreal_plus) }
     then have "\<exists>A \<subseteq> C. finite A \<and> (\<forall>y\<in>C. \<forall>z. 0 < z \<longrightarrow> z < 1 \<longrightarrow> measure N {y} \<le> (1 - z) / (1 - gf_U y y z) * (\<integral>x. gf_F x y z * indicator A x \<partial>N) + e)"
       using \<open>A \<subseteq> C\<close> \<open>finite A\<close> by auto }
   note eps = this
 
   { fix y A assume "y \<in> C" "finite A" "A \<subseteq> C"
     then have "((\<lambda>z. \<integral>x. gf_F x y z * indicator A x \<partial>N) \<longlongrightarrow> \<integral>x. F x y * indicator A x \<partial>N) (at_left 1)"
       by (subst (1 2) integral_measure_pmf[of A]) (auto intro!: tendsto_intros gf_F simp: indicator_eq_0_iff) }
   note int_gf_F = this
 
   have all_recurrent: "\<forall>y\<in>C. recurrent y"
   proof (rule ccontr)
     assume "\<not> (\<forall>y\<in>C. recurrent y)"
     then obtain x where "x \<in> C" "\<not> recurrent x" by auto
     then have transient: "\<And>x. x \<in> C \<Longrightarrow> \<not> recurrent x"
       using C by (auto simp: essential_class_def recurrent_iffI_communicating[symmetric] elim!: quotientE)
 
     { fix y assume "y \<in> C"
       with transient have "U y y < 1"
         by (metis recurrent_iff_U_eq_1 U_cases)
       have "measure N {y} \<le> 0"
       proof (rule dense_ge)
         fix e :: real assume "0 < e"
         from eps[OF this] \<open>y \<in> C\<close> obtain A where
           A: "finite A" "A \<subseteq> C" and
           le: "\<And>z. 0 < z \<Longrightarrow> z < 1 \<Longrightarrow> measure N {y} \<le> (1 - z) / (1 - gf_U y y z) * (\<integral>x. gf_F x y z * indicator A x \<partial>N) + e"
           by auto
         have "((\<lambda>z. (1 - z) / (1 - gf_U y y z) * (\<integral>x. gf_F x y z * indicator A x \<partial>N) + e) \<longlongrightarrow>
           (1 - 1) / (1 - U y y) * (\<integral>x. F x y * indicator A x \<partial>N) + e) (at_left (1::real))"
           using A \<open>U y y < 1\<close> \<open>y \<in> C\<close> by (intro tendsto_intros gf_U int_gf_F) auto
         then have 1: "((\<lambda>z. (1 - z) / (1 - gf_U y y z) * (\<integral>x. gf_F x y z * indicator A x \<partial>N) + e) \<longlongrightarrow> e) (at_left (1::real))"
           by simp
         with le show "measure N {y} \<le> e"
           by (intro tendsto_le[OF trivial_limit_at_left_real _ tendsto_const])
              (auto simp: eventually_at_left_1)
       qed
       then have "measure N {y} = 0"
         by (intro antisym measure_nonneg) }
     then have "emeasure N C = 0"
       by (subst emeasure_countable_singleton) (auto simp: measure_pmf.emeasure_eq_measure nn_integral_0_iff_AE ae_C C)
     then show False
       using \<open>measure N C = 1\<close> by (simp add: measure_pmf.emeasure_eq_measure)
   qed
   then have "\<And>x. x \<in> C \<Longrightarrow> U x x = 1"
     by (metis recurrent_iff_U_eq_1)
 
   { fix y assume "y \<in> C"
     then have "U y y = 1" "recurrent y"
       using \<open>y \<in> C \<Longrightarrow> U y y = 1\<close> all_recurrent by auto
     have "measure N {y} \<le> enn2real (1 / U' y y)"
     proof (rule field_le_epsilon)
       fix e :: real assume "0 < e"
       from eps[OF \<open>0 < e\<close>] \<open>y \<in> C\<close> obtain A where
         A: "finite A" "A \<subseteq> C" and
         le: "\<And>z. 0 < z \<Longrightarrow> z < 1 \<Longrightarrow> measure N {y} \<le> (1 - z) / (1 - gf_U y y z) * (\<integral>x. gf_F x y z * indicator A x \<partial>N) + e"
         by auto
       let ?L = "at_left (1::real)"
       have "((\<lambda>z. (1 - z) / (1 - gf_U y y z) * (\<integral>x. gf_F x y z * indicator A x \<partial>N) + e) \<longlongrightarrow>
           enn2real (1 / U' y y) * (\<integral>x. F x y * indicator A x \<partial>N) + e) ?L"
       proof (intro tendsto_add tendsto_const tendsto_mult int_gf_F,
              rule lhopital_left[where f'="\<lambda>x. - 1" and g'="\<lambda>z. - gf_U' y y z"])
         show "((-) 1 \<longlongrightarrow> 0) ?L" "((\<lambda>x. 1 - gf_U y y x) \<longlongrightarrow> 0) ?L"
           using gf_U[of y y] by (auto intro!: tendsto_eq_intros simp: \<open>U y y = 1\<close>)
         show "y \<in> C" "finite A" "A \<subseteq> C" by fact+
         show "eventually (\<lambda>x. 1 - gf_U y y x \<noteq> 0) ?L"
           using gf_G_eq_gf_U(2)[OF convergence_G_less_1, where 'z=real] by (auto intro!: eventually_at_left_1)
         show "((\<lambda>x. - 1 / - gf_U' y y x) \<longlongrightarrow> enn2real (1 / U' y y)) ?L"
           using \<open>recurrent y\<close> by (rule inverse_gf_U'_tendsto)
         have "eventually (\<lambda>x. 0 < gf_U' y y x) ?L"
           by (intro eventually_at_left_1 gf_U'_pos) (simp_all add: \<open>U y y = 1\<close>)
         then show "eventually (\<lambda>x. - gf_U' y y x \<noteq> 0) ?L"
           by eventually_elim simp
         show "eventually (\<lambda>x. DERIV (\<lambda>x. 1 - gf_U y y x) x :> - gf_U' y y x) ?L"
           by (auto intro!: eventually_at_left_1 derivative_eq_intros DERIV_gf_U)
         show "eventually (\<lambda>x. DERIV ((-) 1) x :> - 1) ?L"
           by (auto intro!: eventually_at_left_1 derivative_eq_intros)
       qed
       then have "measure N {y} \<le> enn2real (1 / U' y y) * (\<integral>x. F x y * indicator A x \<partial>N) + e"
         by (rule tendsto_le[OF trivial_limit_at_left_real _ tendsto_const]) (intro eventually_at_left_1 le)
       then have "measure N {y} - e \<le> enn2real (1 / U' y y) * (\<integral>x. F x y * indicator A x \<partial>N)"
         by simp
       also have "\<dots> \<le> enn2real (1 / U' y y)"
         using A
         by (intro mult_left_le measure_pmf.integral_le_const measure_pmf.integrable_const_bound[where B=1])
            (auto simp: mult_le_one F_le_1 U'_def)
       finally show "measure N {y} \<le> enn2real (1 / U' y y) + e"
         by simp
     qed }
   note measure_y_le = this
 
   show pos: "\<forall>y\<in>C. pos_recurrent y"
   proof (rule ccontr)
     assume "\<not> (\<forall>y\<in>C. pos_recurrent y)"
     then obtain x where x: "x \<in> C" "\<not> pos_recurrent x" by auto
     { fix y assume "y \<in> C"
       with x have "\<not> pos_recurrent y"
         using C by (auto simp: essential_class_def pos_recurrent_iffI_communicating[symmetric] elim!: quotientE)
       with all_recurrent \<open>y \<in> C\<close> have "enn2real (1 / U' y y) = 0"
         by (simp add: pos_recurrent_def nn_integral_add)
       with measure_y_le[OF \<open>y \<in> C\<close>] have "measure N {y} = 0"
         by (auto intro!: antisym simp: pos_recurrent_def) }
     then have "emeasure N C = 0"
       by (subst emeasure_countable_singleton) (auto simp: C ae_C measure_pmf.emeasure_eq_measure nn_integral_0_iff_AE)
     then show False
       using \<open>measure N C = 1\<close> by (simp add: measure_pmf.emeasure_eq_measure)
   qed
 
   { fix A :: "'s set" assume [simp]: "countable A"
     have "emeasure N A = (\<integral>\<^sup>+x. emeasure N {x} \<partial>count_space A)"
       by (intro emeasure_countable_singleton) auto
     also have "\<dots> \<le> (\<integral>\<^sup>+x. emeasure (stat C) {x} \<partial>count_space A)"
     proof (intro nn_integral_mono)
       fix y assume "y \<in> space (count_space A)"
       show "emeasure N {y} \<le> emeasure (stat C) {y}"
       proof cases
         assume "y \<in> C"
         with pos have "pos_recurrent y"
           by auto
         with one_le_integral_t[of y] obtain r where r: "U' y y = ennreal r" "1 \<le> U' y y" and [simp]: "0 \<le> r"
           by (cases "U' y y") (auto simp: pos_recurrent_def nn_integral_add)
 
         from measure_y_le[OF \<open>y \<in> C\<close>]
         have "emeasure N {y} \<le> ennreal (enn2real (1 / U' y y))"
           by (simp add: measure_pmf.emeasure_eq_measure)
         also have "\<dots> = emeasure (stat C) {y}"
           unfolding stat_def using \<open>y \<in> C\<close> r
           by (subst emeasure_point_measure_finite2)
              (auto simp add: ennreal_1[symmetric] divide_ennreal inverse_ennreal inverse_eq_divide ennreal_mult[symmetric]
                    simp del: ennreal_1)
         finally show "emeasure N {y} \<le> emeasure (stat C) {y}"
           by simp
       next
         assume "y \<notin> C"
         with ae_C have "emeasure N {y} = 0"
           by (subst AE_iff_measurable[symmetric, where P="\<lambda>x. x \<noteq> y"]) (auto elim!: eventually_mono)
         moreover have "emeasure (stat C) {y} = 0"
           using emeasure_stat_not_C[OF \<open>y \<notin> C\<close>] .
         ultimately show ?thesis by simp
       qed
     qed
     also have "\<dots> = emeasure (stat C) A"
       by (intro emeasure_countable_singleton[symmetric]) auto
     finally have "emeasure N A \<le> emeasure (stat C) A" . }
   note N_le_C = this
 
   from stat_subprob[OF C(1) \<open>countable C\<close> pos] N_le_C[OF \<open>countable C\<close>] \<open>measure N C = 1\<close>
   have stat_C_eq_1: "emeasure (stat C) C = 1"
     by (auto simp add: measure_pmf.emeasure_eq_measure one_ennreal_def)
   moreover have "emeasure (stat C) (UNIV - C) = 0"
     by (subst AE_iff_measurable[symmetric, where P="\<lambda>x. x \<in> C"])
        (auto simp: stat_def AE_point_measure sets_point_measure space_point_measure
                 split: split_indicator cong del: AE_cong)
   ultimately have "emeasure (stat C) (space (stat C)) = 1"
     using plus_emeasure[of C "stat C" "UNIV - C"] by (simp add: Un_absorb1)
   interpret stat: prob_space "stat C"
     by standard fact
 
   show "measure_pmf N = stat C"
   proof (rule measure_eqI_countable_AE)
     show "sets N = UNIV" "sets (stat C) = UNIV"
       by auto
     show "countable C" "AE x in N. x \<in> C" and ae_stat: "AE x in stat C. x \<in> C"
       using C ae_C stat_C_eq_1 by (auto intro!: stat.AE_prob_1 simp: stat.emeasure_eq_measure)
 
     { assume "\<exists>x. emeasure N {x} \<noteq> emeasure (stat C) {x}"
       then obtain x where [simp]: "emeasure N {x} \<noteq> emeasure (stat C) {x}" by auto
       with N_le_C[of "{x}"] have x: "emeasure N {x} < emeasure (stat C) {x}"
         by (auto simp: less_le)
       have "1 = emeasure N {x} + emeasure N (C - {x})"
         using ae_C
         by (subst plus_emeasure) (auto intro!: measure_pmf.emeasure_eq_1_AE)
       also have "\<dots> < emeasure (stat C) {x} + emeasure (stat C) (C - {x})"
         using x N_le_C[of "C - {x}"] C ae_C
         by (simp add: stat.emeasure_eq_measure measure_pmf.emeasure_eq_measure
                       ennreal_plus[symmetric] ennreal_less_iff
                  del: ennreal_plus)
       also have "\<dots> = 1"
         using ae_stat by (subst plus_emeasure) (auto intro!: stat.emeasure_eq_1_AE)
       finally have False by simp }
     then show "\<And>x. emeasure N {x} = emeasure (stat C) {x}" by auto
   qed
 qed
 
 lemma measure_point_measure_singleton:
   "x \<in> A \<Longrightarrow> measure (point_measure A X) {x} = enn2real (X x)"
   unfolding measure_def by (subst emeasure_point_measure_finite2) auto
 
 lemma stationary_distribution_imp_int_t:
   assumes C: "essential_class C" "countable C" "stationary_distribution N" "N \<subseteq> C"
   assumes x: "x \<in> C" shows "U' x x = 1 / ennreal (pmf N x)"
 proof -
   from stationary_distributionD[OF C]
   have "measure_pmf N = stat C" and *: "\<forall>x\<in>C. pos_recurrent x" by auto
   show ?thesis
     unfolding \<open>measure_pmf N = stat C\<close> pmf.rep_eq stat_def
     using *[THEN bspec, OF x] x
     apply (simp add: measure_point_measure_singleton)
     apply (cases "U' x x")
     subgoal for r
       by (cases "r = 0")
          (simp_all add: divide_ennreal_def inverse_ennreal)
     apply simp
     done
 qed
 
 definition "period_set x = {i. 0 < i \<and> 0 < p x x i }"
 definition "period C = (SOME d. \<forall>x\<in>C. d = Gcd (period_set x))"
 
 lemma Gcd_period_set_invariant:
   assumes c: "(x, y) \<in> communicating"
   shows "Gcd (period_set x) = Gcd (period_set y)"
 proof -
   { fix x y n assume c: "(x, y) \<in> communicating" "x \<noteq> y" and n: "n \<in> period_set x"
     from c obtain l k where "0 < p x y l" "0 < p y x k"
       by (auto simp: communicating_def dest!: accD_pos)
     moreover with \<open>x \<noteq> y\<close> have "l \<noteq> 0 \<and> k \<noteq> 0"
       by (intro notI conjI) (auto simp: p_0)
     ultimately have pos: "0 < l" "0 < k" and l: "0 < p x y l" and k: "0 < p y x k"
       by auto
 
     from mult_pos_pos[OF k l] prob_reachable_le[of k "k + l" y x y] c
     have k_l: "0 < p y y (k + l)"
       by simp
     then have "Gcd (period_set y) dvd k + l"
       using pos by (auto intro!: Gcd_dvd_nat simp: period_set_def)
     moreover
     from n have "0 < p x x n" "0 < n" by (auto simp: period_set_def)
     from mult_pos_pos[OF k this(1)] prob_reachable_le[of k "k + n" y x x] c
     have "0 < p y x (k + n)"
       by simp
     from mult_pos_pos[OF this(1) l] prob_reachable_le[of "k + n" "(k + n) + l" y x y] c
     have "0 < p y y (k + n + l)"
       by simp
     then have "Gcd (period_set y) dvd (k + l) + n"
       using pos by (auto intro!: Gcd_dvd_nat simp: period_set_def ac_simps)
     ultimately have "Gcd (period_set y) dvd n"
       by (metis dvd_add_left_iff add.commute) }
   note this[of x y] this[of y x] c
   moreover have "(y, x) \<in> communicating"
     using c by (simp add: communicating_def)
   ultimately show ?thesis
     by (auto intro: dvd_antisym Gcd_greatest Gcd_dvd)
 qed
 
 lemma period_eq:
   assumes "C \<in> UNIV // communicating" "x \<in> C"
   shows "period C = Gcd (period_set x)"
   unfolding period_def
   using assms
   by (rule_tac someI2[where a="Gcd (period_set x)"])
      (auto intro!: Gcd_period_set_invariant irreducibleD)
 
 definition "aperiodic C \<longleftrightarrow> C \<in> UNIV // communicating \<and> period C = 1"
 
 definition "not_ephemeral C \<longleftrightarrow> C \<in> UNIV // communicating \<and> \<not> (\<exists>x. C = {x} \<and> p x x 1 = 0)"
 
 lemma not_ephemeralD:
   assumes C: "not_ephemeral C" "x \<in> C"
   shows "\<exists>n>0. 0 < p x x n"
 proof cases
   assume "\<exists>x. C = {x}"
   with \<open>x \<in> C\<close> have "C = {x}" by auto
   with C p_nonneg[of x x 1] have "0 < p x x 1"
     by (auto simp: not_ephemeral_def less_le)
   with \<open>C = {x}\<close> show ?thesis by auto
 next
   from C have irr: "C \<in> UNIV // communicating"
     by (auto simp: not_ephemeral_def)
   assume "\<not>(\<exists>x. C = {x})"
   then have "\<forall>x. C \<noteq> {x}" by auto
   with \<open>x \<in> C\<close> obtain y where "y \<in> C" "x \<noteq> y"
     by blast
   with irreducibleD[OF irr, of x y] C \<open>x \<in> C\<close> have c: "(x, y) \<in> communicating" by auto
   with accD_pos[of x y] accD_pos[of y x]
   obtain k l where pos: "0 < p x y k" "0 < p y x l"
     by (auto simp: communicating_def)
   with \<open>x \<noteq> y\<close> have "l \<noteq> 0"
     by (intro notI) (auto simp: p_0)
   have "0 < p x y k * p y x (k + l - k)"
     using pos by auto
   also have "p x y k * p y x (k + l - k) \<le> p x x (k + l)"
     using prob_reachable_le[of "k" "k + l" x y x] c by auto
   finally show ?thesis
     using \<open>l \<noteq> 0\<close> \<open>x \<in> C\<close> by (auto intro!: exI[of _ "k + l"])
 qed
 
 lemma not_ephemeralD_pos_period:
   assumes C: "not_ephemeral C"
   shows "0 < period C"
 proof -
   from C not_empty_irreducible[of C] obtain x where "x \<in> C"
     by (auto simp: not_ephemeral_def)
   from not_ephemeralD[OF C this]
   obtain n where n: "0 < p x x n" "0 < n" by auto
   have C': "C \<in> UNIV // communicating"
     using C by (auto simp: not_ephemeral_def)
 
   have "period C \<noteq> 0"
     unfolding period_eq [OF C' \<open>x \<in> C\<close>]
     using n by (auto simp: period_set_def)
   then show ?thesis by auto
 qed
 
 
 lemma period_posD:
   assumes C: "C \<in> UNIV // communicating" and "0 < period C" "x \<in> C"
   shows "\<exists>n>0. 0 < p x x n"
 proof -
   from \<open>0 < period C\<close> have "period C \<noteq> 0"
     by auto
   then show ?thesis
     unfolding period_eq [OF C \<open>x \<in> C\<close>]
     unfolding period_set_def by auto
 qed
 
 lemma not_ephemeralD_pos_period':
   assumes C: "C \<in> UNIV // communicating"
   shows "not_ephemeral C \<longleftrightarrow> 0 < period C"
 proof (auto dest!: not_ephemeralD_pos_period intro: C)
   from C not_empty_irreducible[of C] obtain x where "x \<in> C"
     by (auto simp: not_ephemeral_def)
 
   assume "0 < period C"
   then show "not_ephemeral C"
     apply (auto simp: not_ephemeral_def C)
 oops \<comment> \<open>should be easy to finish\<close>
 
 
 lemma eventually_periodic:
   assumes C: "C \<in> UNIV // communicating" "0 < period C" "x \<in> C"
   shows "eventually (\<lambda>m. 0 < p x x (m * period C)) sequentially"
 proof -
   from period_posD[OF assms] obtain n where n: "0 < p x x n" "0 < n" by auto
   have C': "C \<in> UNIV // communicating"
     using C by auto
 
   have "period C \<noteq> 0"
     unfolding period_eq [OF C' \<open>x \<in> C\<close>]
     using n by (auto simp: period_set_def)
   have "eventually (\<lambda>m. m * Gcd (period_set x) \<in> (period_set x)) sequentially"
   proof (rule eventually_mult_Gcd)
     show "n > 0" "n \<in> period_set x"
       using n by (auto simp add: period_set_def)
     fix k l  assume "k \<in> period_set x" "l \<in> period_set x"
     then have "0 < p x x k * p x x l" "0 < l" "0 < k"
       by (auto simp: period_set_def)
     moreover have "p x x k * p x x l \<le> p x x (k + l)"
       using prob_reachable_le[of k "k + l" x x x] \<open>x \<in> C\<close>
       by auto
     ultimately show "k + l \<in> period_set x"
       using \<open>0 < l\<close> by (auto simp: period_set_def)
   qed
   with eventually_ge_at_top[of 1] show "eventually (\<lambda>m. 0 < p x x (m * period C)) sequentially"
     by eventually_elim 
        (insert \<open>period C \<noteq> 0\<close> period_eq[OF C' \<open>x \<in> C\<close>, symmetric], auto simp: period_set_def)
 qed
 
 
 lemma aperiodic_eventually_recurrent:
   "aperiodic C \<longleftrightarrow> C \<in> UNIV // communicating \<and> (\<forall>x\<in>C. eventually (\<lambda>m. 0 < p x x m) sequentially)"
 proof safe
   fix x assume "x \<in> C" "aperiodic C"
   with eventually_periodic[of C x]
   show "eventually (\<lambda>m. 0 < p x x m) sequentially"
     by (auto simp add: aperiodic_def)
 next
   assume "\<forall>x\<in>C. eventually (\<lambda>m. 0 < p x x m) sequentially" and C: "C \<in> UNIV // communicating"
   moreover from not_empty_irreducible[OF C] obtain x where "x \<in> C" by auto
   ultimately obtain N where "\<And>M.  M\<ge>N \<Longrightarrow> 0 < p x x M"
     by (auto simp: eventually_sequentially)
   then have "{N <..} \<subseteq> period_set x"
     by (auto simp: period_set_def)
   from C show "aperiodic C"
     unfolding period_eq [OF C \<open>x \<in> C\<close>] aperiodic_def
   proof
     show "Gcd (period_set x) = 1"
     proof (rule Gcd_eqI)
       from one_dvd show "1 dvd q" for q :: nat .
       fix m
       assume "\<And>q. q \<in> period_set x \<Longrightarrow> m dvd q"
       moreover from \<open>{N <..} \<subseteq> period_set x\<close>
       have "{Suc N, Suc (Suc N)} \<subseteq> period_set x"
         by auto
       ultimately have "m dvd Suc (Suc N)" and "m dvd Suc N"
         by auto
       then have "m dvd Suc (Suc N) - Suc N"
         by (rule dvd_diff_nat)
       then show "is_unit m"
         by simp
     qed simp
   qed
 qed (simp add: aperiodic_def)
 
 lemma stationary_distributionD_emeasure:
   assumes N: "stationary_distribution N"
   shows "emeasure N A = (\<integral>\<^sup>+s. emeasure (K s) A \<partial>N)"
 proof -
   have "prob_space (measure_pmf N)"
     by intro_locales
   then interpret subprob_space "measure_pmf N"
     by (rule prob_space_imp_subprob_space)
   show ?thesis
     unfolding measure_pmf.emeasure_eq_measure
     apply (subst N[unfolded stationary_distribution_def])
     apply (simp add: measure_pmf_bind)
     apply (subst measure_pmf.measure_bind[where N="count_space UNIV"])
     apply (rule measurable_compose[OF _ measurable_measure_pmf])
     apply (auto intro!: nn_integral_eq_integral[symmetric] measure_pmf.integrable_const_bound[where B=1])
     done
 qed
 
 lemma communicatingD1:
   "C \<in> UNIV // communicating \<Longrightarrow> (a, b) \<in> communicating \<Longrightarrow> a \<in> C \<Longrightarrow> b \<in> C"
   by (auto elim!: quotientE) (auto simp add: communicating_def)
 
 lemma communicatingD2:
   "C \<in> UNIV // communicating \<Longrightarrow> (a, b) \<in> communicating \<Longrightarrow> b \<in> C \<Longrightarrow> a \<in> C"
   by (auto elim!: quotientE) (auto simp add: communicating_def)
 
 lemma acc_iff: "(x, y) \<in> acc \<longleftrightarrow> (\<exists>n. 0 < p x y n)"
   by (blast intro: accD_pos accI_pos)
 
 lemma communicating_iff: "(x, y) \<in> communicating \<longleftrightarrow> (\<exists>n. 0 < p x y n) \<and> (\<exists>n. 0 < p y x n)"
   by (auto simp add: acc_iff communicating_def)
 
 end
 
 context MC_pair
 begin
 
 lemma p_eq_p1_p2:
   "p (x1, x2) (y1, y2) n = K1.p x1 y1 n * K2.p x2 y2 n"
   unfolding p_def K1.p_def K2.p_def
   by (subst prod_eq_prob_T)
      (auto intro!: arg_cong2[where f=measure] split: nat.splits simp: Stream_snth)
 
 lemma P_accD:
   assumes "((x1, x2), (y1, y2)) \<in> acc"shows "(x1, y1) \<in> K1.acc" "(x2, y2) \<in> K2.acc"
   using assms by (auto simp: acc_iff K1.acc_iff K2.acc_iff p_eq_p1_p2 zero_less_mult_iff not_le[of 0, symmetric]
                        cong: conj_cong)
 
 lemma aperiodicI_pair:
   assumes C1: "K1.aperiodic C1" and C2: "K2.aperiodic C2"
   shows "aperiodic (C1 \<times> C2)"
   unfolding aperiodic_eventually_recurrent
 proof safe
   from C1[unfolded K1.aperiodic_eventually_recurrent] C2[unfolded K2.aperiodic_eventually_recurrent]
   have C1: "C1 \<in> UNIV // K1.communicating" and C2: "C2 \<in> UNIV // K2.communicating" and
     ev: "\<And>x. x \<in> C1 \<Longrightarrow> eventually (\<lambda>m. 0 < K1.p x x m) sequentially" "\<And>x. x \<in> C2 \<Longrightarrow> eventually (\<lambda>m. 0 < K2.p x x m) sequentially"
     by auto
   { fix x1 x2 assume x: "x1 \<in> C1" "x2 \<in> C2"
     from ev(1)[OF x(1)] ev(2)[OF x(2)]
     show "eventually (\<lambda>m. 0 < p (x1, x2) (x1, x2) m) sequentially"
        by eventually_elim  (simp add: p_eq_p1_p2 x) }
 
   { fix x1 x2 y1 y2
     assume acc: "(x1, y1) \<in> K1.acc" "(x2, y2) \<in> K2.acc" "x1 \<in> C1" "y1 \<in> C1" "x2 \<in> C2" "y2 \<in> C2"
     then obtain k l where "0 < K1.p x1 y1 l" "0 < K2.p x2 y2 k"
       by (auto dest!: K1.accD_pos K2.accD_pos)
     with acc ev(1)[of y1] ev(2)[of y2]
     have "eventually (\<lambda>m. 0 < K1.p x1 y1 l * K1.p y1 y1 m \<and> 0 < K2.p x2 y2 k * K2.p y2 y2 m) sequentially"
       by (auto elim: eventually_elim2)
     then have "eventually (\<lambda>m. 0 < K1.p x1 y1 (m + l) \<and> 0 < K2.p x2 y2 (m + k)) sequentially"
     proof eventually_elim
       fix m assume "0 < K1.p x1 y1 l * K1.p y1 y1 m \<and> 0 < K2.p x2 y2 k * K2.p y2 y2 m"
       with acc
         K1.prob_reachable_le[of l "l + m" x1 y1 y1]
         K2.prob_reachable_le[of k "k + m" x2 y2 y2]
       show "0 < K1.p x1 y1 (m + l) \<and> 0 < K2.p x2 y2 (m + k)"
         by (auto simp add: ac_simps)
     qed
     then have "eventually (\<lambda>m. 0 < K1.p x1 y1 m \<and> 0 < K2.p x2 y2 m) sequentially"
       unfolding eventually_conj_iff by (subst (asm) (1 2) eventually_sequentially_seg) (auto elim: eventually_elim2)
     then obtain N where "0 < K1.p x1 y1 N" "0 < K2.p x2 y2 N"
       by (auto simp: eventually_sequentially)
     with acc have "0 < p (x1, x2) (y1, y2) N"
       by (auto simp add: p_eq_p1_p2)
     with acc have "((x1, x2), (y1, y2)) \<in> acc"
       by (auto intro!: accI_pos) }
   note 1 = this
 
   { fix x1 x2 y1 y2 assume acc:"((x1, x2), (y1, y2)) \<in> acc"
     moreover from acc obtain k where "0 < p (x1, x2) (y1, y2) k" by (auto dest!: accD_pos)
     ultimately have "(x1, y1) \<in> K1.acc \<and> (x2, y2) \<in> K2.acc"
       by (subst (asm) p_eq_p1_p2)
          (auto intro!: K1.accI_pos K2.accI_pos simp: zero_less_mult_iff not_le[of 0, symmetric]) }
   note 2 = this
 
   from K1.not_empty_irreducible[OF C1] K2.not_empty_irreducible[OF C2]
   obtain x1 x2 where xC: "x1 \<in> C1" "x2 \<in> C2" by auto
   show "C1 \<times> C2 \<in> UNIV // communicating"
     apply (simp add: quotient_def Image_def)
     apply (safe intro!: exI[of _ x1] exI[of _ x2])
   proof -
     fix y1 y2 assume yC: "y1 \<in> C1" "y2 \<in> C2"
     from K1.irreducibleD[OF C1 \<open>x1 \<in> C1\<close> \<open>y1 \<in> C1\<close>] K2.irreducibleD[OF C2 \<open>x2 \<in> C2\<close> \<open>y2 \<in> C2\<close>]
     show "((x1, x2), (y1, y2)) \<in> communicating"
       using 1[of x1 y1 x2 y2] 1[of y1 x1 y2 x2] xC yC
       by (auto simp: communicating_def K1.communicating_def K2.communicating_def)
   next
     fix y1 y2 assume "((x1, x2), (y1, y2)) \<in> communicating"
     with 2[of x1 x2 y1 y2] 2[of y1 y2 x1 x2]
     have "(x1, y1) \<in> K1.communicating" "(x2, y2) \<in> K2.communicating"
       by (auto simp: communicating_def K1.communicating_def K2.communicating_def)
     with xC show "y1 \<in> C1" "y2 \<in> C2"
       using K1.communicatingD1[OF C1] K2.communicatingD1[OF C2] by auto
   qed
 qed
 
 lemma stationary_distributionI_pair:
   assumes N1: "K1.stationary_distribution N1"
   assumes N2: "K2.stationary_distribution N2"
   shows "stationary_distribution (pair_pmf N1 N2)"
   unfolding stationary_distribution_def
   unfolding Kp_def pair_pmf_def
   apply (subst N1[unfolded K1.stationary_distribution_def])
   apply (subst N2[unfolded K2.stationary_distribution_def])
   apply (simp add: bind_assoc_pmf bind_return_pmf)
   apply (subst bind_commute_pmf[of N2])
   apply simp
   done
 
 end
 
 context MC_syntax
 begin
 
 lemma stationary_distribution_imp_limit:
   assumes C: "aperiodic C" "essential_class C" "countable C" and N: "stationary_distribution N" "N \<subseteq> C"
   assumes [simp]: "y \<in> C"
   shows "(\<lambda>n. \<integral>x. \<bar>p y x n - pmf N x\<bar> \<partial>count_space C) \<longlonglongrightarrow> 0"
     (is "?L \<longlonglongrightarrow> 0")
 proof -
   from \<open>essential_class C\<close> have C_comm: "C \<in> UNIV // communicating"
     by (simp add: essential_class_def)
 
   define K' where "K' = (\<lambda>Some x \<Rightarrow> map_pmf Some (K x) | None \<Rightarrow> map_pmf Some N)"
 
   interpret K2: MC_syntax K' .
   interpret KN: MC_pair K K' .
 
   from stationary_distributionD[OF C(2,3) N]
   have pos: "\<And>x. x \<in> C \<Longrightarrow> pos_recurrent x" and "measure_pmf N = stat C" by auto
 
   have pos: "\<And>x. x \<in> C \<Longrightarrow> 0 < emeasure N {x}"
     using pos unfolding stat_def \<open>measure_pmf N = stat C\<close>
     by (subst emeasure_point_measure_finite2)
        (auto simp: U'_def pos_recurrent_def nn_integral_add ennreal_zero_less_divide less_top)
   then have rpos: "\<And>x. x \<in> C \<Longrightarrow> 0 < pmf N x"
     by (simp add: measure_pmf.emeasure_eq_measure pmf.rep_eq)
 
   have eq: "\<And>x y. (if x = y then 1 else 0) = indicator {y} x" by auto
 
   have intK: "\<And>f x. (\<integral>x. (f x :: real) \<partial>K' (Some x)) = (\<integral>x. f (Some x) \<partial>K x)"
     by (simp add: K'_def integral_distr map_pmf_rep_eq)
 
   { fix m and x y :: 's
     have "K2.p (Some x) (Some y) m = p x y m"
       by (induct m arbitrary: x)
          (auto intro!: integral_cong simp add: K2.p_Suc' p_Suc' intK K2.p_0 p_0) }
   note K_p_eq = this
 
   { fix n and x :: 's have "K2.p (Some x) None n = 0"
       by (induct n arbitrary: x) (auto simp: K2.p_Suc' K2.p_0 intK cong: integral_cong) }
   note K_S_None = this
 
   from not_empty_irreducible[OF C_comm] obtain c0 where c0: "c0 \<in> C" by auto
 
   have K2_acc: "\<And>x y. (Some x, y) \<in> K2.acc \<longleftrightarrow> (\<exists>z. y = Some z \<and> (x, z) \<in> acc)"
     apply (auto simp: K2.acc_iff acc_iff K_p_eq)
     apply (case_tac y)
     apply (auto simp: K_p_eq K_S_None)
     done
 
   have K2_communicating: "\<And>c x. c \<in> C \<Longrightarrow> (Some c, x) \<in> K2.communicating \<longleftrightarrow> (\<exists>c'\<in>C. x = Some c')"
   proof safe
     fix x c assume "c \<in> C" "(Some c, x) \<in> K2.communicating"
     then show "\<exists>c'\<in>C. x = Some c'"
       by (cases x)
          (auto simp: communicating_iff K2.communicating_iff K_p_eq K_S_None intro!: irreducibleD2[OF C_comm \<open>c\<in>C\<close>])
   next
     fix c c' x assume "c \<in> C" "c' \<in> C"
     with irreducibleD[OF C_comm this] show "(Some c, Some c') \<in> K2.communicating"
       by (auto simp: K2.communicating_iff communicating_iff K_p_eq)
   qed
 
   have "Some ` C \<in> UNIV // K2.communicating"
     by (auto simp add: quotient_def Image_def c0 K2_communicating
              intro!: exI[of _ "Some c0"])
   then have "K2.essential_class (Some ` C)"
     by (rule K2.essential_classI)
        (auto simp: K2_acc essential_classD2[OF \<open>essential_class C\<close>])
 
   have "K2.aperiodic (Some ` C)"
     unfolding K2.aperiodic_eventually_recurrent
   proof safe
     fix x assume "x \<in> C" then show "eventually (\<lambda>m. 0 < K2.p (Some x) (Some x) m) sequentially"
       using \<open>aperiodic C\<close> unfolding aperiodic_eventually_recurrent
       by (auto elim!: eventually_mono simp: K_p_eq)
   qed fact
   then have aperiodic: "KN.aperiodic (C \<times> Some ` C)"
     by (rule KN.aperiodicI_pair[OF \<open>aperiodic C\<close>])
 
   have KN_essential: "KN.essential_class (C \<times> Some ` C)"
   proof (rule KN.essential_classI)
     show "C \<times> Some ` C \<in> UNIV // KN.communicating"
       using aperiodic by (simp add: KN.aperiodic_def)
   next
     fix x y assume "x \<in> C \<times> Some ` C" "(x, y) \<in> KN.acc"
     with KN.P_accD[of "fst x" "snd x" "fst y" "snd y"]
     show "y \<in> C \<times> Some ` C"
       by (cases x y rule: prod.exhaust[case_product prod.exhaust])
          (auto simp: K2_acc essential_classD2[OF \<open>essential_class C\<close>])
   qed
 
   { fix n and x y :: 's
     have "measure N {y} = \<P>(\<omega> in K2.T None. (None ## \<omega>) !! (Suc n) = Some y)"
       unfolding stationary_distribution_iterate'[OF N(1), of y n]
       apply (subst K2.p_def[symmetric])
       apply (subst K2.p_Suc')
       apply (subst K'_def)
       apply (simp add: map_pmf_rep_eq integral_distr K_p_eq)
       done
     then have "measure N {y} = \<P>(\<omega> in K2.T None. \<omega> !! n = Some y)"
       by simp }
   note measure_y_eq = this
 
   define D where "D = {x::'s \<times> 's option. Some (fst x) = snd x}"
 
   have [measurable]:
     "\<And>P::('s \<times> 's option \<Rightarrow> bool). P \<in> measurable (count_space UNIV) (count_space UNIV)"
     by simp
 
   { fix n and x :: 's
     have "\<P>(\<omega> in KN.T (y, None). \<exists>i<n. snd (\<omega> !! n) = Some x \<and> ev_at (HLD D) i \<omega>) =
       (\<Sum>i<n. \<P>(\<omega> in KN.T (y, None). snd (\<omega> !! n) = Some x \<and> ev_at (HLD D) i \<omega>))"
       by (subst KN.T.finite_measure_finite_Union[symmetric])
          (auto simp: disjoint_family_on_def intro!: arg_cong2[where f=measure] dest: ev_at_unique)
     also have "\<dots> = (\<Sum>i<n. \<P>(\<omega> in KN.T (y, None). fst (\<omega> !! n) = x \<and> ev_at (HLD D) i \<omega>))"
     proof (intro sum.cong refl)
       fix i assume i: "i \<in> {..< n}"
       show "\<P>(\<omega> in KN.T (y, None). snd (\<omega> !! n) = Some x \<and> ev_at (HLD D) i \<omega>) =
         \<P>(\<omega> in KN.T (y, None). fst (\<omega> !! n) = x \<and> ev_at (HLD D) i \<omega>)"
         apply (subst (1 2) KN.prob_T_split[where n="Suc i"])
         apply (simp_all add: ev_at_shift snth_Stream del: stake.simps KN.space_T)
         unfolding ev_at_shift snth_Stream
       proof (intro Bochner_Integration.integral_cong refl)
         fix \<omega> :: "('s \<times> 's option) stream" let ?s = "\<lambda>\<omega>'. stake (Suc i) \<omega> @- \<omega>'"
         show "\<P>(\<omega>' in KN.T (\<omega> !! i). snd (?s \<omega>' !! n) = Some x \<and> ev_at (HLD D) i \<omega>) =
           \<P>(\<omega>' in KN.T (\<omega> !! i). fst (?s \<omega>' !! n) = x \<and> ev_at (HLD D) i \<omega>)"
         proof cases
           assume "ev_at (HLD D) i \<omega>"
           from ev_at_imp_snth[OF this]
           have eq: "snd (\<omega> !! i) = Some (fst (\<omega> !! i))"
             by (simp add: D_def HLD_iff)
 
           have "\<P>(\<omega>' in KN.T (\<omega> !! i). fst (\<omega>' !! (n - Suc i)) = x) =
             \<P>(\<omega>' in T (fst (\<omega> !! i)). \<omega>' !! (n - Suc i) = x) * \<P>(\<omega>' in K2.T (snd (\<omega> !! i)). True)"
             by (subst KN.prod_eq_prob_T) simp_all
           also have "\<dots> = p (fst (\<omega> !! i)) x (Suc (n - Suc i))"
             using K2.T.prob_space by (simp add: p_def)
           also have "\<dots> = K2.p (snd (\<omega> !! i)) (Some x) (Suc (n - Suc i))"
             by (simp add: K_p_eq eq)
           also have "\<dots> = \<P>(\<omega>' in T (fst (\<omega> !! i)). True) * \<P>(\<omega>' in K2.T (snd (\<omega> !! i)). \<omega>' !! (n - Suc i) = Some x)"
             using T.prob_space by (simp add: K2.p_def)
           also have "\<dots> = \<P>(\<omega>' in KN.T (\<omega> !! i). snd (\<omega>' !! (n - Suc i)) = Some x)"
             by (subst KN.prod_eq_prob_T) simp_all
           finally show ?thesis using \<open>ev_at (HLD D) i \<omega>\<close> i
             by (simp del: stake.simps)
         qed simp
       qed
     qed
     also have "\<dots> = \<P>(\<omega> in KN.T (y, None). (\<exists>i<n. fst (\<omega> !! n) = x \<and> ev_at (HLD D) i \<omega>))"
       by (subst KN.T.finite_measure_finite_Union[symmetric])
          (auto simp add: disjoint_family_on_def dest: ev_at_unique
                intro!: arg_cong2[where f=measure])
     finally have eq: "\<P>(\<omega> in KN.T (y, None). (\<exists>i<n. snd (\<omega> !! n) = Some x \<and> ev_at (HLD D) i \<omega>)) =
       \<P>(\<omega> in KN.T (y, None). (\<exists>i<n. fst (\<omega> !! n) = x \<and> ev_at (HLD D) i \<omega>))" .
 
     have "p y x (Suc n) - measure N {x} = \<P>(\<omega> in T y. \<omega> !! n = x) - \<P>(\<omega> in K2.T None. \<omega> !! n = Some x)"
       unfolding p_def by (subst measure_y_eq) simp_all
     also have "\<P>(\<omega> in T y. \<omega> !! n = x) = \<P>(\<omega> in T y. \<omega> !! n = x) * \<P>(\<omega> in K2.T None. True)"
       using K2.T.prob_space by simp
     also have "\<dots> = \<P>(\<omega> in KN.T (y, None). fst (\<omega> !! n) = x)"
       by (subst KN.prod_eq_prob_T) auto
     also have "\<dots> = \<P>(\<omega> in KN.T (y, None). (\<exists>i<n. fst (\<omega> !! n) = x \<and> ev_at (HLD D) i \<omega>)) +
       \<P>(\<omega> in KN.T (y, None). fst (\<omega> !! n) = x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>))"
       by (subst KN.T.finite_measure_Union[symmetric])
          (auto intro!: arg_cong2[where f=measure])
     also have "\<P>(\<omega> in K2.T None. \<omega> !! n = Some x) = \<P>(\<omega> in T y. True) * \<P>(\<omega> in K2.T None. \<omega> !! n = Some x)"
       using T.prob_space by simp
     also have "\<dots> = \<P>(\<omega> in KN.T (y, None). snd (\<omega> !! n) = Some x)"
       by (subst KN.prod_eq_prob_T) auto
     also have "\<dots> = \<P>(\<omega> in KN.T (y, None). (\<exists>i<n. snd (\<omega> !! n) = Some x \<and> ev_at (HLD D) i \<omega>)) +
       \<P>(\<omega> in KN.T (y, None). snd (\<omega> !! n) = Some x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>))"
       by (subst KN.T.finite_measure_Union[symmetric])
          (auto intro!: arg_cong2[where f=measure])
     finally have "\<bar> p y x (Suc n) - measure N {x} \<bar> =
       \<bar> \<P>(\<omega> in KN.T (y, None). fst (\<omega> !! n) = x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>)) -
       \<P>(\<omega> in KN.T (y, None). snd (\<omega> !! n) = Some x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>)) \<bar>"
       unfolding eq by (simp add: field_simps)
     also have "\<dots> \<le> \<bar> \<P>(\<omega> in KN.T (y, None). fst (\<omega> !! n) = x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>)) \<bar> +
       \<bar> \<P>(\<omega> in KN.T (y, None). snd (\<omega> !! n) = Some x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>)) \<bar>"
       by (rule abs_triangle_ineq4)
     also have "\<dots> \<le> \<P>(\<omega> in KN.T (y, None). fst (\<omega> !! n) = x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>)) +
       \<P>(\<omega> in KN.T (y, None). snd (\<omega> !! n) = Some x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>))"
       by simp
     finally have "\<bar> p y x (Suc n) - measure N {x} \<bar> \<le> \<dots>" . }
   note mono = this
 
   { fix n :: nat
     have "(\<integral>\<^sup>+x. \<bar> p y x (Suc n) - measure N {x} \<bar> \<partial>count_space C) \<le>
       (\<integral>\<^sup>+x. ennreal (\<P>(\<omega> in KN.T (y, None). fst (\<omega> !! n) = x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>))) +
       ennreal (\<P>(\<omega> in KN.T (y, None). snd (\<omega> !! n) = Some x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>))) \<partial>count_space C)"
       using mono by (intro nn_integral_mono) (simp add: ennreal_plus[symmetric] del: ennreal_plus)
     also have "\<dots> = (\<integral>\<^sup>+x. \<P>(\<omega> in KN.T (y, None). fst (\<omega> !! n) = x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>)) \<partial>count_space C) +
       (\<integral>\<^sup>+x. \<P>(\<omega> in KN.T (y, None). snd (\<omega> !! n) = Some x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>)) \<partial>count_space C)"
       by (subst nn_integral_add) auto
     also have "\<dots> = emeasure (KN.T (y, None)) (\<Union>x\<in>C. {\<omega>\<in>space (KN.T (y, None)). fst (\<omega> !! n) = x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>)}) +
       emeasure (KN.T (y, None)) (\<Union>x\<in>C. {\<omega>\<in>space (KN.T (y, None)). snd (\<omega> !! n) = Some x \<and> \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>)})"
       by (subst (1 2) emeasure_UN_countable)
          (auto simp add: disjoint_family_on_def KN.T.emeasure_eq_measure C)
     also have "\<dots> \<le> ennreal (\<P>(\<omega> in KN.T (y, None). \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>))) + ennreal (\<P>(\<omega> in KN.T (y, None). \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>)))"
       unfolding KN.T.emeasure_eq_measure
       by (intro add_mono) (auto intro!: KN.T.finite_measure_mono)
     also have "\<dots> \<le> 2 * \<P>(\<omega> in KN.T (y, None). \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>))"
       by (simp add: ennreal_plus[symmetric] del: ennreal_plus)
     finally have "?L (Suc n) \<le> 2 * \<P>(\<omega> in KN.T (y, None). \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>))"
       by (auto intro!: integral_real_bounded simp add: pmf.rep_eq) }
   note le_2 = this
 
   have c0_D: "(c0, Some c0) \<in> D"
     by (simp add: D_def c0)
 
   let ?N' = "map_pmf Some N"
   interpret NP: pair_prob_space N ?N' ..
 
   have pos_recurrent: "\<forall>x\<in>C \<times> Some ` C. KN.pos_recurrent x"
   proof (rule KN.stationary_distributionD(1)[OF KN_essential _ KN.stationary_distributionI_pair[OF N(1)]])
     show "K2.stationary_distribution ?N'"
       unfolding K2.stationary_distribution_def
       by (subst N(1)[unfolded stationary_distribution_def])
          (auto intro!: bind_pmf_cong simp: K'_def map_pmf_def bind_assoc_pmf bind_return_pmf)
     show "countable (C \<times> Some`C)"
       using C by auto
     show "set_pmf (pair_pmf N (map_pmf Some N)) \<subseteq> C \<times> Some ` C"
       using \<open>N \<subseteq> C\<close> by auto
   qed
 
   from c0_D have "\<P>(\<omega> in KN.T (y, None). alw (not (HLD D)) \<omega>) \<le> \<P>(\<omega> in KN.T (y, None). alw (not (HLD {(c0, Some c0)})) \<omega>)"
     apply (auto intro!: KN.T.finite_measure_mono)
     apply (rule alw_mono, assumption)
     apply (auto simp: HLD_iff)
     done
   also have "\<dots> = 0"
     apply (rule KN.T.prob_eq_0_AE)
     apply (simp add: not_ev_iff[symmetric])
     apply (subst KN.AE_T_iff)
     apply simp
   proof
     fix t assume t: "t \<in> KN.Kp (y, None)"
     then obtain a b where t_eq: "t = (a, Some b)" "a \<in> K y" "b \<in> N"
       unfolding KN.Kp_def by (auto simp: K'_def)
     with \<open>y \<in> C\<close> have "a \<in> C"
       using essential_classD2[OF \<open>essential_class C\<close> \<open>y \<in> C\<close>] by auto
     have "b \<in> C"
       using \<open>N \<subseteq> C\<close> \<open>b \<in> N\<close> by auto
 
     from pos_recurrent[THEN bspec, of "(c0, Some c0)"]
     have recurrent_c0: "KN.recurrent (c0, Some c0)"
       by (simp add: KN.pos_recurrent_def c0)
     have "C \<times> Some ` C \<in> UNIV // KN.communicating"
       using aperiodic by (simp add: KN.aperiodic_def)
     then have "((c0, Some c0), t) \<in> KN.communicating"
       by (rule KN.irreducibleD) (simp_all add: t_eq c0 \<open>b \<in> C\<close> \<open>a \<in> C\<close>)
     then have "((c0, Some c0), t) \<in> KN.acc"
       by (simp add: KN.communicating_def)
     then have "KN.U t (c0, Some c0) = 1"
       by (rule KN.recurrent_acc(1)[OF recurrent_c0])
     then show "AE \<omega> in KN.T t. ev (HLD {(c0, Some c0)}) (t ## \<omega>)"
       unfolding KN.U_def by (subst (asm) KN.T.prob_Collect_eq_1) (auto simp add: ev_Stream)
   qed
   finally have "\<P>(\<omega> in KN.T (y, None). alw (not (HLD D)) \<omega>) = 0"
     by (intro antisym measure_nonneg)
 
   have "(\<lambda>n. \<P>(\<omega> in KN.T (y, None). \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>))) \<longlonglongrightarrow>
     measure (KN.T (y, None)) (\<Inter>n. {\<omega>\<in>space (KN.T (y, None)). \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>)})"
     by (rule KN.T.finite_Lim_measure_decseq) (auto simp: decseq_def)
   also have "(\<Inter>n. {\<omega>\<in>space (KN.T (y, None)). \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>)}) =
     {\<omega>\<in>space (KN.T (y, None)). alw (not (HLD D)) \<omega>}"
     by (auto simp: not_ev_iff[symmetric] ev_iff_ev_at)
   also have "\<P>(\<omega> in KN.T (y, None). alw (not (HLD D)) \<omega>) = 0" by fact
   finally have *: "(\<lambda>n. 2 * \<P>(\<omega> in KN.T (y, None). \<not> (\<exists>i<n. ev_at (HLD D) i \<omega>))) \<longlonglongrightarrow> 0"
     by (intro tendsto_eq_intros) auto
 
   show ?thesis
     apply (rule LIMSEQ_imp_Suc)
     apply (rule tendsto_sandwich[OF _ _ tendsto_const *])
     using le_2
     apply (simp_all add: integral_nonneg_AE)
     done
 qed
 
 lemma stationary_distribution_imp_p_limit:
   assumes "aperiodic C" "essential_class C" and [simp]: "countable C"
   assumes N: "stationary_distribution N" "N \<subseteq> C"
   assumes [simp]: "x \<in> C" "y \<in> C"
   shows "p x y \<longlonglongrightarrow> pmf N y"
 proof -
   define D where "D y n = \<bar>p x y n - pmf N y\<bar>" for y n
 
   from stationary_distribution_imp_limit[OF assms(1,2,3,4,5,6)]
   have INT: "(\<lambda>n. \<integral>y. D y n \<partial>count_space C) \<longlonglongrightarrow> 0"
     unfolding D_def .
 
   { fix n
     have "D y n \<le> (\<integral>z. D y n * indicator {y} z \<partial>count_space C)"
       by simp
     also have "\<dots> \<le> (\<integral>y. D y n \<partial>count_space C)"
       by (intro integral_mono)
          (auto split: split_indicator simp: D_def p_def disjoint_family_on_def
                intro!: Bochner_Integration.integrable_diff integrable_pmf T.integrable_measure)
     finally have "D y n \<le> (\<integral>y. D y n \<partial>count_space C)" . }
   note * = this
 
   have D_nonneg: "\<And>n. 0 \<le> D y n" by (simp add: D_def)
 
   have "D y \<longlonglongrightarrow> 0"
     by (rule tendsto_sandwich[OF _ _ tendsto_const INT])
        (auto simp: eventually_sequentially * D_nonneg)
   then show ?thesis
     using Lim_null[where l="pmf N y" and net=sequentially and f="p x y"]
     by (simp add: D_def [abs_def] tendsto_rabs_zero_iff)
 qed
 
 end
 
 lemma (in MC_syntax) essential_classI2:
   assumes "X \<noteq> {}"
   assumes accI: "\<And>x y. x \<in> X \<Longrightarrow> y \<in> X \<Longrightarrow> (x, y) \<in> acc"
   assumes ED: "\<And>x y. x \<in> X \<Longrightarrow> y \<in> set_pmf (K x) \<Longrightarrow> y \<in> X"
   shows "essential_class X"
 proof (rule essential_classI)
   { fix x y assume "(x, y) \<in> acc" "x \<in> X"
     then show "y \<in> X"
       by induct (auto dest: ED)}
   note accD = this
-
   from \<open>X \<noteq> {}\<close> obtain x where "x \<in> X" by auto
   from \<open>x \<in> X\<close> show "X \<in> UNIV // communicating"
     by (auto simp add: quotient_def Image_def communicating_def accI dest: accD intro!: exI[of _ x])
 qed
 
 end
diff --git a/thys/Ordinary_Differential_Equations/IVP/Poincare_Map.thy b/thys/Ordinary_Differential_Equations/IVP/Poincare_Map.thy
--- a/thys/Ordinary_Differential_Equations/IVP/Poincare_Map.thy
+++ b/thys/Ordinary_Differential_Equations/IVP/Poincare_Map.thy
@@ -1,2499 +1,2504 @@
 theory Poincare_Map
 imports
   Flow
 begin
 
 abbreviation "plane n c \<equiv> {x. x \<bullet> n = c}"
 
 lemma
   eventually_tendsto_compose_within:
   assumes "eventually P (at l within S)"
   assumes "P l"
   assumes "(f \<longlongrightarrow> l) (at x within T)"
   assumes "eventually (\<lambda>x. f x \<in> S) (at x within T)"
   shows "eventually (\<lambda>x. P (f x)) (at x within T)"
 proof -
   from assms(1) assms(2) obtain U where U:
     "open U" "l \<in> U" "\<And>x. x \<in> U \<Longrightarrow> x \<in> S \<Longrightarrow> P x"
     by (force simp: eventually_at_topological)
   from topological_tendstoD[OF assms(3) \<open>open U\<close> \<open>l \<in> U\<close>]
   have "\<forall>\<^sub>F x in at x within T. f x \<in> U" by auto
   then show ?thesis using assms(4)
     by eventually_elim (auto intro!: U)
 qed
 
 lemma
   eventually_eventually_withinI:\<comment> \<open>aha...\<close>
   assumes "\<forall>\<^sub>F x in at x within A. P x" "P x"
   shows "\<forall>\<^sub>F a in at x within S. \<forall>\<^sub>F x in at a within A. P x"
   using assms
   unfolding eventually_at_topological
   by force
 
 lemma eventually_not_in_closed:
   assumes "closed P"
   assumes "f t \<notin> P" "t \<in> T"
   assumes "continuous_on T f"
   shows "\<forall>\<^sub>F t in at t within T. f t \<notin> P"
   using assms
   unfolding Compl_iff[symmetric] closed_def continuous_on_topological eventually_at_topological
   by metis
 
 context ll_on_open_it begin
 
 lemma
   existence_ivl_trans':
   assumes "t + s \<in> existence_ivl t0 x0"
     "t \<in> existence_ivl t0 x0"
   shows "t + s \<in> existence_ivl t (flow t0 x0 t)"
   by (meson assms(1) assms(2) general.existence_ivl_reverse general.flow_solves_ode
       general.is_interval_existence_ivl general.maximal_existence_flow(1)
       general.mem_existence_ivl_iv_defined(2) general.mem_existence_ivl_subset
       local.existence_ivl_subset subsetD)
 
 end
 
 context auto_ll_on_open\<comment> \<open>TODO: generalize to continuous systems\<close>
 begin
 
 definition returns_to ::"'a set \<Rightarrow> 'a \<Rightarrow> bool"
   where "returns_to P x \<longleftrightarrow> (\<forall>\<^sub>F t in at_right 0. flow0 x t \<notin> P) \<and> (\<exists>t>0. t \<in> existence_ivl0 x \<and> flow0 x t \<in> P)"
 
 definition return_time :: "'a set \<Rightarrow> 'a \<Rightarrow> real"
   where "return_time P x =
     (if returns_to P x then (SOME t.
       t > 0 \<and>
       t \<in> existence_ivl0 x \<and>
       flow0 x t \<in> P \<and>
       (\<forall>s \<in> {0<..<t}. flow0 x s \<notin> P)) else 0)"
 
 lemma returns_toI:
   assumes t: "t > 0" "t \<in> existence_ivl0 x" "flow0 x t \<in> P"
   assumes ev: "\<forall>\<^sub>F t in at_right 0. flow0 x t \<notin> P"
   assumes "closed P"
   shows "returns_to P x"
   using assms
   by (auto simp: returns_to_def)
 
 lemma returns_to_outsideI:
   assumes t: "t \<ge> 0" "t \<in> existence_ivl0 x" "flow0 x t \<in> P"
   assumes ev: "x \<notin> P"
   assumes "closed P"
   shows "returns_to P x"
 proof cases
   assume "t > 0"
   moreover
   have "\<forall>\<^sub>F s in at 0 within {0 .. t}. flow0 x s \<notin> P"
     using assms mem_existence_ivl_iv_defined ivl_subset_existence_ivl[OF \<open>t \<in> _\<close>] \<open>0 < t\<close>
     by (auto intro!: eventually_not_in_closed flow_continuous_on continuous_intros
         simp: eventually_conj_iff)
   with order_tendstoD(2)[OF tendsto_ident_at \<open>0 < t\<close>, of "{0<..}"]
   have "\<forall>\<^sub>F t in at_right 0. flow0 x t \<notin> P"
     unfolding eventually_at_filter
     by eventually_elim (use \<open>t > 0\<close> in auto)
   then show ?thesis
     by (auto intro!: returns_toI assms \<open>0 < t\<close>)
 qed (use assms in simp)
 
 lemma returns_toE:
   assumes "returns_to P x"
   obtains t0 t1 where
     "0 < t0"
     "t0 \<le> t1"
     "t1 \<in> existence_ivl0 x"
     "flow0 x t1 \<in> P"
     "\<And>t. 0 < t \<Longrightarrow> t < t0 \<Longrightarrow> flow0 x t \<notin> P"
 proof -
   obtain t0 t1 where t0: "t0 > 0" "\<And>t. 0 < t \<Longrightarrow> t < t0 \<Longrightarrow> flow0 x t \<notin> P"
     and t1: "t1 > 0" "t1 \<in> existence_ivl0 x" "flow0 x t1 \<in> P"
     using assms
     by (auto simp: returns_to_def eventually_at_right[OF zero_less_one])
   moreover
   have "t0 \<le> t1"
     using t0(2)[of t1] t1 t0(1)
     by force
   ultimately show ?thesis by (blast intro: that)
 qed
 
 lemma return_time_some:
   assumes "returns_to P x"
   shows "return_time P x =
     (SOME t. t > 0 \<and> t \<in> existence_ivl0 x \<and> flow0 x t \<in> P \<and> (\<forall>s \<in> {0<..<t}. flow0 x s \<notin> P))"
   using assms by (auto simp: return_time_def)
 
 lemma return_time_ex1:
   assumes "returns_to P x"
   assumes "closed P"
   shows "\<exists>!t. t > 0 \<and> t \<in> existence_ivl0 x \<and> flow0 x t \<in> P \<and> (\<forall>s \<in> {0<..<t}. flow0 x s \<notin> P)"
 proof -
   from returns_toE[OF \<open>returns_to P x\<close>]
   obtain t0 t1 where
     t1: "t1 \<ge> t0" "t1 \<in> existence_ivl0 x" "flow0 x t1 \<in> P"
     and t0: "t0 > 0" "\<And>t. 0 < t \<Longrightarrow> t < t0 \<Longrightarrow> flow0 x t \<notin> P"
     by metis
   from flow_continuous_on have cont: "continuous_on {0 .. t1} (flow0 x)"
     by (rule continuous_on_subset) (intro ivl_subset_existence_ivl t1)
   from cont have cont': "continuous_on {t0 .. t1} (flow0 x)"
     by (rule continuous_on_subset) (use \<open>0 < t0\<close> in auto)
   have "compact (flow0 x -` P \<inter> {t0 .. t1})"
     using \<open>closed P\<close> cont'
     by (auto simp: compact_eq_bounded_closed bounded_Int bounded_closed_interval
         intro!: closed_vimage_Int)
 
   have "flow0 x -` P \<inter> {t0..t1} \<noteq> {}"
     using t1 t0 by auto
   from compact_attains_inf[OF \<open>compact _\<close> this] t0 t1
   obtain rt where rt: "t0 \<le> rt" "rt \<le> t1" "flow0 x rt \<in> P"
     and least: "\<And>t'. flow0 x t' \<in> P \<Longrightarrow> t0 \<le> t' \<Longrightarrow> t' \<le> t1 \<Longrightarrow> rt \<le> t'"
     by auto
   have "0 < rt" "flow0 x rt \<in> P" "rt \<in> existence_ivl0 x"
     and "0 < t' \<Longrightarrow> t' < rt \<Longrightarrow> flow0 x t' \<notin> P" for t'
     using ivl_subset_existence_ivl[OF \<open>t1 \<in> existence_ivl0 x\<close>] t0 t1 rt least[of t']
     by force+
   then show ?thesis
     by (intro ex_ex1I) force+
 qed
 
 lemma
   return_time_pos_returns_to:
   "return_time P x > 0 \<Longrightarrow> returns_to P x"
   by (auto simp: return_time_def split: if_splits)
 
 lemma
   assumes ret: "returns_to P x"
   assumes "closed P"
   shows return_time_pos: "return_time P x > 0"
   using someI_ex[OF return_time_ex1[OF assms, THEN ex1_implies_ex]]
   unfolding return_time_some[OF ret, symmetric]
   by auto
 
 lemma returns_to_return_time_pos:
   assumes "closed P"
   shows "returns_to P x \<longleftrightarrow> return_time P x > 0"
   by (auto intro!: return_time_pos assms) (auto simp: return_time_def split: if_splits)
 
 lemma return_time:
   assumes ret: "returns_to P x"
   assumes "closed P"
   shows "return_time P x > 0"
     and return_time_exivl: "return_time P x \<in> existence_ivl0 x"
     and return_time_returns: "flow0 x (return_time P x) \<in> P"
     and return_time_least: "\<And>s. 0 < s \<Longrightarrow> s < return_time P x \<Longrightarrow> flow0 x s \<notin> P"
   using someI_ex[OF return_time_ex1[OF assms, THEN ex1_implies_ex]]
   unfolding return_time_some[OF ret, symmetric]
   by auto
 
 lemma returns_to_earlierI:
   assumes ret: "returns_to P (flow0 x t)" "closed P"
   assumes "t \<ge> 0" "t \<in> existence_ivl0 x"
   assumes ev: "\<forall>\<^sub>F t in at_right 0. flow0 x t \<notin> P"
   shows "returns_to P x"
 proof -
   from return_time[OF ret]
   have rt: "0 < return_time P (flow0 x t)" "flow0 (flow0 x t) (return_time P (flow0 x t)) \<in> P"
     and "0 < s \<Longrightarrow> s < return_time P (flow0 x t) \<Longrightarrow> flow0 (flow0 x t) s \<notin> P" for s
     by auto
   let ?t = "t + return_time P  (flow0 x t)"
   show ?thesis
   proof (rule returns_toI[of ?t])
     show "0 < ?t" by (auto intro!: add_nonneg_pos rt \<open>t \<ge> 0\<close>)
     show "?t \<in> existence_ivl0 x"
       by (intro existence_ivl_trans return_time_exivl assms)
     have "flow0 x (t + return_time P (flow0 x t)) = flow0 (flow0 x t) (return_time P (flow0 x t))"
       by (intro flow_trans assms return_time_exivl)
     also have "\<dots> \<in> P"
       by (rule return_time_returns[OF ret])
     finally show "flow0 x (t + return_time P (flow0 x t)) \<in> P" .
     show "closed P" by fact
     show "\<forall>\<^sub>F t in at_right 0. flow0 x t \<notin> P" by fact
   qed
 qed
 
 lemma return_time_gt:
   assumes ret: "returns_to P x" "closed P"
   assumes flow_not: "\<And>s. 0 < s \<Longrightarrow> s \<le> t \<Longrightarrow> flow0 x s \<notin> P"
   shows "t < return_time P x"
   using flow_not[of "return_time P x"] return_time_pos[OF ret] return_time_returns[OF ret] by force
 
 lemma return_time_le:
   assumes ret: "returns_to P x" "closed P"
   assumes flow_not: "flow0 x t \<in> P" "t > 0"
   shows "return_time P x \<le> t"
   using return_time_least[OF assms(1,2), of t] flow_not
   by force
 
 lemma returns_to_laterI:
   assumes ret: "returns_to P x" "closed P"
   assumes t: "t > 0" "t \<in> existence_ivl0 x"
   assumes flow_not: "\<And>s. 0 < s \<Longrightarrow> s \<le> t \<Longrightarrow> flow0 x s \<notin> P"
   shows "returns_to P (flow0 x t)"
   apply (rule returns_toI[of "return_time P x - t"])
   subgoal using flow_not by (auto intro!: return_time_gt ret)
   subgoal by (auto intro!: existence_ivl_trans' return_time_exivl ret t)
   subgoal by (subst flow_trans[symmetric])
       (auto intro!: existence_ivl_trans' return_time_exivl ret t return_time_returns)
   subgoal
   proof -
     have "\<forall>\<^sub>F y in nhds 0. y \<in> existence_ivl0 (flow0 x t)"
       apply (rule eventually_nhds_in_open[OF open_existence_ivl[of "flow0 x t"] existence_ivl_zero])
       apply (rule flow_in_domain)
       apply fact
       done
     then have "\<forall>\<^sub>F s in at_right 0. s \<in> existence_ivl0 (flow0 x t)"
       unfolding eventually_at_filter
       by eventually_elim auto
     moreover
     have "\<forall>\<^sub>F s in at_right 0. t + s < return_time P x"
       using return_time_gt[OF ret flow_not, of t]
       by (auto simp: eventually_at_right[OF zero_less_one] intro!: exI[of _ "return_time P x - t"])
     moreover
     have "\<forall>\<^sub>F s in at_right 0. 0 < t + s"
       by (metis (mono_tags) eventually_at_rightI greaterThanLessThan_iff pos_add_strict t(1))
     ultimately show ?thesis
       apply eventually_elim
       apply (subst flow_trans[symmetric])
       using return_time_least[OF ret]
       by (auto intro!: existence_ivl_trans' t)
     qed
   subgoal by fact
   done
 
 lemma never_returns:
   assumes "\<not>returns_to P x"
   assumes "closed P" "t \<ge> 0" "t \<in> existence_ivl0 x"
   assumes ev: "\<forall>\<^sub>F t in at_right 0. flow0 x t \<notin> P"
   shows "\<not>returns_to P (flow0 x t)"
   using returns_to_earlierI[OF _ assms(2-5)] assms(1)
   by blast
 
 lemma return_time_eqI:
   assumes "closed P"
     and t_pos: "t > 0"
     and ex: "t \<in> existence_ivl0 x"
     and ret: "flow0 x t \<in> P"
     and least: "\<And>s. 0 < s \<Longrightarrow> s < t \<Longrightarrow> flow0 x s \<notin> P"
   shows "return_time P x = t"
 proof -
   from least t_pos have "\<forall>\<^sub>F t in at_right 0. flow0 x t \<notin> P"
     by (auto simp: eventually_at_right[OF zero_less_one])
   then have "returns_to P x"
     by (auto intro!: returns_toI[of t] assms)
   then show ?thesis
     using least
     by (auto simp: return_time_def t_pos ex ret
         intro!: some1_equality[OF return_time_ex1[OF \<open>returns_to _ _\<close> \<open>closed _\<close>]])
 qed
 
 lemma return_time_step:
   assumes "returns_to P (flow0 x t)"
   assumes "closed P"
   assumes flow_not: "\<And>s. 0 < s \<Longrightarrow> s \<le> t \<Longrightarrow> flow0 x s \<notin> P"
   assumes t: "t > 0" "t \<in> existence_ivl0 x"
   shows "return_time P (flow0 x t) = return_time P x - t"
 proof -
   from flow_not t have "\<forall>\<^sub>F t in at_right 0. flow0 x t \<notin> P"
     by (auto simp: eventually_at_right[OF zero_less_one])
   from returns_to_earlierI[OF assms(1,2) less_imp_le, OF t this]
   have ret: "returns_to P x" .
   from return_time_gt[OF ret \<open>closed P\<close> flow_not]
   have "t < return_time P x" by simp
   moreover
   have "0 < s \<Longrightarrow> s < return_time P x - t \<Longrightarrow> flow0 (flow0 x t) s = flow0 x (t + s)" for s
     using ivl_subset_existence_ivl[OF return_time_exivl[OF ret \<open>closed _\<close>]] t
     by (subst flow_trans) (auto intro!: existence_ivl_trans')
   ultimately show ?thesis
     using flow_not assms(1) ret return_time_least t(1)
     by (auto intro!: return_time_eqI return_time_returns ret
         simp: flow_trans[symmetric] \<open>closed P\<close> t(2) existence_ivl_trans' return_time_exivl)
 qed
 
 definition "poincare_map P x = flow0 x (return_time P x)"
 
 lemma poincare_map_step_flow:
   assumes ret: "returns_to P x" "closed P"
   assumes flow_not: "\<And>s. 0 < s \<Longrightarrow> s \<le> t \<Longrightarrow> flow0 x s \<notin> P"
   assumes t: "t > 0" "t \<in> existence_ivl0 x"
   shows "poincare_map P (flow0 x t) = poincare_map P x"
   unfolding poincare_map_def
   apply (subst flow_trans[symmetric])
   subgoal by fact
   subgoal using flow_not by (auto intro!: return_time_exivl returns_to_laterI t ret)
   subgoal
     using flow_not
     by (subst return_time_step) (auto intro!: return_time_exivl returns_to_laterI t ret)
   done
 
 lemma poincare_map_returns:
   assumes "returns_to P x" "closed P"
   shows "poincare_map P x \<in> P"
   by (auto intro!: return_time_returns assms simp: poincare_map_def)
 
 lemma poincare_map_onto:
   assumes "closed P"
   assumes "0 < t" "t \<in> existence_ivl0 x" "\<forall>\<^sub>F t in at_right 0. flow0 x t \<notin> P"
   assumes "flow0 x t \<in> P"
   shows "poincare_map P x \<in> flow0 x ` {0 <.. t} \<inter> P"
 proof (rule IntI)
   have "returns_to P x"
     by (rule returns_toI) (rule assms)+
   then have "return_time P x \<in> {0<..t}"
     by (auto intro!: return_time_pos assms return_time_le)
   then show "poincare_map P x \<in> flow0 x ` {0<..t}"
     by (auto simp: poincare_map_def)
   show "poincare_map P x \<in> P"
     by (auto intro!: poincare_map_returns \<open>returns_to _ _\<close> \<open>closed _\<close>)
 qed
 
 end
 
 
 lemma isCont_blinfunD:
   fixes f'::"'a::metric_space \<Rightarrow> 'b::real_normed_vector \<Rightarrow>\<^sub>L 'c::real_normed_vector"
   assumes "isCont f' a" "0 < e"
   shows "\<exists>d>0. \<forall>x. dist a x < d \<longrightarrow> onorm (\<lambda>v. blinfun_apply (f' x) v - blinfun_apply (f' a) v) < e"
 proof -
   have "\<forall>\<^sub>F x in at a. dist (f' x) (f' a) < e"
     using assms isCont_def tendsto_iff by blast
   then show ?thesis
     using \<open>e > 0\<close> norm_eq_zero
     by (force simp: eventually_at dist_commute dist_norm norm_blinfun.rep_eq
         simp flip: blinfun.bilinear_simps)
 qed
 
 proposition has_derivative_locally_injective_blinfun:
   fixes f :: "'n::euclidean_space \<Rightarrow> 'm::euclidean_space"
     and f'::"'n \<Rightarrow> 'n \<Rightarrow>\<^sub>L 'm"
     and g'::"'m \<Rightarrow>\<^sub>L 'n"
   assumes "a \<in> s"
       and "open s"
       and g': "g' o\<^sub>L (f' a) = 1\<^sub>L"
       and f': "\<And>x. x \<in> s \<Longrightarrow> (f has_derivative f' x) (at x)"
       and c: "isCont f' a"
     obtains r where "r > 0" "ball a r \<subseteq> s" "inj_on f (ball a r)"
 proof -
   have bl: "bounded_linear (blinfun_apply g')"
     by (auto simp: blinfun.bounded_linear_right)
   from g' have g': "blinfun_apply g' \<circ> blinfun_apply (f' a) = id"
     by transfer (simp add: id_def)
   from has_derivative_locally_injective[OF \<open>a \<in> s\<close> \<open>open s\<close> bl g' f' isCont_blinfunD[OF c]]
   obtain r where "0 < r" "ball a r \<subseteq> s" "inj_on f (ball a r)"
     by auto
   then show ?thesis ..
 qed
 
 lift_definition embed1_blinfun::"'a::real_normed_vector \<Rightarrow>\<^sub>L ('a*'b::real_normed_vector)" is "\<lambda>x. (x, 0)"
   by standard (auto intro!: exI[where x=1])
 lemma blinfun_apply_embed1_blinfun[simp]: "blinfun_apply embed1_blinfun x = (x, 0)"
   by transfer simp
 
 lift_definition embed2_blinfun::"'a::real_normed_vector \<Rightarrow>\<^sub>L ('b::real_normed_vector*'a)" is "\<lambda>x. (0, x)"
   by standard (auto intro!: exI[where x=1])
 lemma blinfun_apply_embed2_blinfun[simp]: "blinfun_apply embed2_blinfun x = (0, x)"
   by transfer simp
 
 lemma blinfun_inverseD: "f o\<^sub>L f' = 1\<^sub>L \<Longrightarrow> f (f' x) = x"
   apply transfer
   unfolding o_def
   by meson
 
 lemmas continuous_on_open_vimageI = continuous_on_open_vimage[THEN iffD1, rule_format]
 lemmas continuous_on_closed_vimageI = continuous_on_closed_vimage[THEN iffD1, rule_format]
 
 lemma ball_times_subset: "ball a (c/2) \<times> ball b (c/2) \<subseteq> ball (a, b) c"
 proof -
   {
     fix a' b'
     have "sqrt ((dist a a')\<^sup>2 + (dist b b')\<^sup>2) \<le> dist a a' + dist b b'"
       by (rule real_le_lsqrt) (auto simp: power2_eq_square algebra_simps)
     also assume "a' \<in> ball a (c / 2)"
     then have "dist a a' < c / 2" by (simp add:)
     also assume "b' \<in> ball b (c / 2)"
     then have "dist b b' < c / 2" by (simp add:)
     finally have "sqrt ((dist a a')\<^sup>2 + (dist b b')\<^sup>2) < c"
       by simp
   } thus ?thesis by (auto simp: dist_prod_def mem_cball)
 qed
 
 lemma linear_inverse_blinop_lemma:
   fixes w::"'a::{banach, perfect_space} blinop"
   assumes "norm w < 1"
   shows
     "summable (\<lambda>n. (-1)^n *\<^sub>R w^n)" (is ?C)
     "(\<Sum>n. (-1)^n *\<^sub>R w^n) * (1 + w) = 1" (is ?I1)
     "(1 + w) * (\<Sum>n. (-1)^n *\<^sub>R w^n) = 1" (is ?I2)
     "norm ((\<Sum>n. (-1)^n *\<^sub>R w^n) - 1 + w) \<le> (norm w)\<^sup>2/(1 - norm (w))" (is ?L)
 proof -
   have "summable (\<lambda>n. norm w ^ n)"
     apply (rule summable_geometric)
     using assms by auto
   then have "summable (\<lambda>n. norm (w ^ n))"
     by (rule summable_comparison_test'[where N=0]) (auto intro!: norm_power_ineq)
   then show ?C
     by (rule summable_comparison_test'[where N=0]) (auto simp: norm_power )
   {
     fix N
     have 1: "(1 + w) * sum (\<lambda>n. (-1)^n *\<^sub>R w^n) {..<N} = sum (\<lambda>n. (-1)^n *\<^sub>R w^n) {..<N} * (1 + w)"
       by (auto simp: algebra_simps sum_distrib_left sum_distrib_right sum.distrib power_commutes)
     also have "\<dots> = sum (\<lambda>n. (-1)^n *\<^sub>R w^n - (-1)^Suc n *\<^sub>R w^ Suc n) {..<N}"
       by (auto simp: algebra_simps sum_distrib_left sum_distrib_right sum.distrib power_commutes)
     also have "\<dots> = 1 - (-1)^N *\<^sub>R w^N"
       by (subst sum_lessThan_telescope') (auto simp: algebra_simps)
     finally have "(1 + w) * (\<Sum>n<N. (- 1) ^ n *\<^sub>R w ^ n) = 1 - (- 1) ^ N *\<^sub>R w ^ N" .
     note 1 this
   } note nu = this
   show "?I1"
     apply (subst suminf_mult2, fact)
     apply (subst suminf_eq_lim)
     apply (subst sum_distrib_right[symmetric])
     apply (rule limI)
     apply (subst nu(1)[symmetric])
     apply (subst nu(2))
     apply (rule tendsto_eq_intros)
       apply (rule tendsto_intros)
      apply (rule tendsto_norm_zero_cancel)
      apply auto
     apply (rule Lim_transform_bound[where g="\<lambda>i. norm w ^ i"])
      apply (rule eventuallyI)
     apply simp apply (rule norm_power_ineq)
     apply (auto intro!: LIMSEQ_power_zero assms)
     done
   show "?I2"
     apply (subst suminf_mult[symmetric], fact)
     apply (subst suminf_eq_lim)
     apply (subst sum_distrib_left[symmetric])
     apply (rule limI)
     apply (subst nu(2))
     apply (rule tendsto_eq_intros)
       apply (rule tendsto_intros)
      apply (rule tendsto_norm_zero_cancel)
      apply auto
     apply (rule Lim_transform_bound[where g="\<lambda>i. norm w ^ i"])
      apply (rule eventuallyI)
     apply simp apply (rule norm_power_ineq)
     apply (auto intro!: LIMSEQ_power_zero assms)
     done
   have *: "(\<Sum>n. (- 1) ^ n *\<^sub>R w ^ n) - 1 + w = (w\<^sup>2 * (\<Sum>n. (- 1) ^ n *\<^sub>R w ^ n))"
     apply (subst suminf_split_initial_segment[where k=2], fact)
     apply (subst suminf_mult[symmetric], fact)
     by (auto simp: power2_eq_square algebra_simps eval_nat_numeral)
   also have "norm \<dots> \<le> (norm w)\<^sup>2 / (1 - norm w)"
-    apply (rule order_trans[OF norm_mult_ineq])
-    apply (subst divide_inverse)
-    apply (rule mult_mono)
-       apply (auto simp: norm_power_ineq inverse_eq_divide assms )
-    apply (rule order_trans[OF summable_norm])
-     apply auto
-     apply fact
-    apply (rule order_trans[OF suminf_le])
-       apply (rule allI) apply (rule norm_power_ineq)
-      apply fact
-     apply fact
-    by (auto simp: suminf_geometric assms)
+  proof -
+    have \<section>: "norm (\<Sum>n. (- 1) ^ n *\<^sub>R w ^ n) \<le> 1 / (1 - norm w)"
+      apply (rule order_trans[OF summable_norm])
+       apply auto
+       apply fact
+      apply (rule order_trans[OF suminf_le])
+         apply (rule norm_power_ineq)
+        apply fact
+       apply fact
+      by (auto simp: suminf_geometric assms)
+    show ?thesis
+      apply (rule order_trans[OF norm_mult_ineq])
+      apply (subst divide_inverse)
+      apply (rule mult_mono)
+         apply (auto simp: norm_power_ineq inverse_eq_divide assms \<section>)
+      done
+  qed
   finally show ?L .
 qed
 
 lemma linear_inverse_blinfun_lemma:
   fixes w::"'a \<Rightarrow>\<^sub>L 'a::{banach, perfect_space}"
   assumes "norm w < 1"
   obtains I where
     "I o\<^sub>L (1\<^sub>L + w) = 1\<^sub>L" "(1\<^sub>L + w) o\<^sub>L I = 1\<^sub>L"
     "norm (I - 1\<^sub>L + w) \<le> (norm w)\<^sup>2/(1 - norm (w))"
 proof -
   define v::"'a blinop" where "v = Blinop w"
   have "norm v = norm w"
     unfolding v_def
     apply transfer
     by (simp add: bounded_linear_Blinfun_apply norm_blinfun.rep_eq)
   with assms have "norm v < 1" by simp
   from linear_inverse_blinop_lemma[OF this]
   have v: "(\<Sum>n. (- 1) ^ n *\<^sub>R v ^ n) * (1 + v) = 1"
     "(1 + v) * (\<Sum>n. (- 1) ^ n *\<^sub>R v ^ n) = 1"
     "norm ((\<Sum>n. (- 1) ^ n *\<^sub>R v ^ n) - 1 + v) \<le> (norm v)\<^sup>2 / (1 - norm v)"
     by auto
   define J::"'a blinop" where "J = (\<Sum>n. (- 1) ^ n *\<^sub>R v ^ n)"
   define I::"'a \<Rightarrow>\<^sub>L 'a" where "I = Blinfun J"
   have "Blinfun (blinop_apply J) - 1\<^sub>L + w = Rep_blinop (J - 1 + Blinop (blinfun_apply w))"
     by transfer' (auto simp: blinfun_apply_inverse)
   then have ne: "norm (Blinfun (blinop_apply J) - 1\<^sub>L + w) =
     norm (J - 1 + Blinop (blinfun_apply w))"
     by (auto simp: norm_blinfun_def norm_blinop_def)
   from v have
     "I o\<^sub>L (1\<^sub>L + w) = 1\<^sub>L" "(1\<^sub>L + w) o\<^sub>L I = 1\<^sub>L"
     "norm (I - 1\<^sub>L + w) \<le> (norm w)\<^sup>2/(1 - norm (w))"
       apply (auto simp: I_def J_def[symmetric])
     unfolding v_def
       apply (auto simp: blinop.bounded_linear_right bounded_linear_Blinfun_apply
         intro!: blinfun_eqI)
     subgoal by transfer
        (auto simp: blinfun_ext blinfun.bilinear_simps bounded_linear_Blinfun_apply)
     subgoal
       by transfer (auto simp: Transfer.Rel_def
           blinfun_ext blinfun.bilinear_simps bounded_linear_Blinfun_apply)
     subgoal
       apply (auto simp: ne)
       apply transfer
       by (auto simp: norm_blinfun_def bounded_linear_Blinfun_apply)
     done
   then show ?thesis ..
 qed
 
 definition "invertibles_blinfun = {w. \<exists>wi. w o\<^sub>L wi = 1\<^sub>L \<and> wi o\<^sub>L w = 1\<^sub>L}"
 
 lemma blinfun_inverse_open:\<comment> \<open>8.3.2 in Dieudonne, TODO: add continuity and derivative\<close>
   shows "open (invertibles_blinfun::
       ('a::{banach, perfect_space} \<Rightarrow>\<^sub>L 'b::banach) set)"
 proof (rule openI)
   fix u0::"'a \<Rightarrow>\<^sub>L 'b"
   assume "u0 \<in> invertibles_blinfun"
   then obtain u0i where u0i: "u0 o\<^sub>L u0i = 1\<^sub>L" "u0i o\<^sub>L u0 = 1\<^sub>L"
     by (auto simp: invertibles_blinfun_def)
   then have [simp]: "u0i \<noteq> 0"
     apply (auto)
     by (metis one_blinop.abs_eq zero_blinop.abs_eq zero_neq_one)
   let ?e = "inverse (norm u0i)"
   show "\<exists>e>0. ball u0 e \<subseteq> invertibles_blinfun"
     apply (clarsimp intro!: exI[where x = ?e] simp: invertibles_blinfun_def)
     subgoal premises prems for u0s
     proof -
       define s where "s = u0s - u0"
       have u0s: "u0s = u0 + s"
         by (auto simp: s_def)
       have "norm (u0i o\<^sub>L s) < 1"
         using prems by (auto simp: dist_norm u0s
         divide_simps ac_simps intro!: le_less_trans[OF norm_blinfun_compose])
       from linear_inverse_blinfun_lemma[OF this]
       obtain I where I:
         "I o\<^sub>L 1\<^sub>L + (u0i o\<^sub>L s) = 1\<^sub>L"
         "1\<^sub>L + (u0i o\<^sub>L s) o\<^sub>L I = 1\<^sub>L"
         "norm (I - 1\<^sub>L + (u0i o\<^sub>L s)) \<le> (norm (u0i o\<^sub>L s))\<^sup>2 / (1 - norm (u0i o\<^sub>L s))"
         by auto
       have u0s_eq: "u0s = u0 o\<^sub>L (1\<^sub>L + (u0i o\<^sub>L s))"
         using u0i
         by (auto simp: s_def blinfun.bilinear_simps blinfun_ext)
       show ?thesis
         apply (rule exI[where x="I o\<^sub>L u0i"])
         using I u0i
         apply (auto simp: u0s_eq)
         by (auto simp:  algebra_simps blinfun_ext blinfun.bilinear_simps)
     qed
     done
   qed
 
 lemma blinfun_compose_assoc[ac_simps]: "a o\<^sub>L b o\<^sub>L c = a o\<^sub>L (b o\<^sub>L c)"
   by (auto intro!: blinfun_eqI)
 
 text \<open>TODO: move @{thm norm_minus_cancel} to class!\<close>
 lemma (in real_normed_vector) norm_minus_cancel [simp]: "norm (- x) = norm x"
 proof -
   have scaleR_minus_left: "- a *\<^sub>R x = - (a *\<^sub>R x)" for a x
   proof -
     have "\<forall>x1 x2. (x2::real) + x1 = x1 + x2"
       by auto
     then have f1: "\<forall>r ra a. (ra + r) *\<^sub>R (a::'a) = r *\<^sub>R a + ra *\<^sub>R a"
       using local.scaleR_add_left by presburger
     have f2: "a + a = 2 * a"
       by force
     have f3: "2 * a + - 1 * a = a"
       by auto
     have "- a = - 1 * a"
       by auto
     then show ?thesis
       using f3 f2 f1 by (metis local.add_minus_cancel local.add_right_imp_eq)
   qed
   have "norm (- x) = norm (scaleR (- 1) x)"
     by (simp only: scaleR_minus_left scaleR_one)
   also have "\<dots> = \<bar>- 1\<bar> * norm x"
     by (rule norm_scaleR)
   finally show ?thesis by simp
 qed
 
 text \<open>TODO: move @{thm norm_minus_commute} to class!\<close>
 lemma (in real_normed_vector) norm_minus_commute: "norm (a - b) = norm (b - a)"
 proof -
   have "norm (- (b - a)) = norm (b - a)"
     by (rule norm_minus_cancel)
   then show ?thesis by simp
 qed
 
 instance euclidean_space \<subseteq> banach
   by standard
 
 lemma blinfun_apply_Pair_split:
   "blinfun_apply g (a, b) = blinfun_apply g (a, 0) + blinfun_apply g (0, b)"
   unfolding blinfun.bilinear_simps[symmetric] by simp
 
 lemma blinfun_apply_Pair_add2: "blinfun_apply f (0, a + b) = blinfun_apply f (0, a) + blinfun_apply f (0, b)"
   unfolding blinfun.bilinear_simps[symmetric] by simp
 
 lemma blinfun_apply_Pair_add1: "blinfun_apply f (a + b, 0) = blinfun_apply f (a, 0) + blinfun_apply f (b, 0)"
   unfolding blinfun.bilinear_simps[symmetric] by simp
 
 lemma blinfun_apply_Pair_minus2: "blinfun_apply f (0, a - b) = blinfun_apply f (0, a) - blinfun_apply f (0, b)"
   unfolding blinfun.bilinear_simps[symmetric] by simp
 
 lemma blinfun_apply_Pair_minus1: "blinfun_apply f (a - b, 0) = blinfun_apply f (a, 0) - blinfun_apply f (b, 0)"
   unfolding blinfun.bilinear_simps[symmetric] by simp
 
 lemma implicit_function_theorem:
   fixes f::"'a::euclidean_space * 'b::euclidean_space \<Rightarrow> 'c::euclidean_space"\<comment> \<open>TODO: generalize?!\<close>
   assumes [derivative_intros]: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative blinfun_apply (f' x)) (at x)"
   assumes S: "(x, y) \<in> S" "open S"
   assumes "DIM('c) \<le> DIM('b)"
   assumes f'C: "isCont f' (x, y)"
   assumes "f (x, y) = 0"
   assumes T2: "T o\<^sub>L (f' (x, y) o\<^sub>L embed2_blinfun) = 1\<^sub>L"
   assumes T1: "(f' (x, y) o\<^sub>L embed2_blinfun) o\<^sub>L T = 1\<^sub>L"\<comment> \<open>TODO: reduce?!\<close>
   obtains u e r
   where "f (x, u x) = 0" "u x = y"
     "\<And>s. s \<in> cball x e \<Longrightarrow> f (s, u s) = 0"
     "continuous_on (cball x e) u"
     "(\<lambda>t. (t, u t)) ` cball x e \<subseteq> S"
     "e > 0"
     "(u has_derivative - T o\<^sub>L f' (x, y) o\<^sub>L embed1_blinfun) (at x)"
 
     "r > 0"
     "\<And>U v s. v x = y \<Longrightarrow> (\<And>s. s \<in> U \<Longrightarrow> f (s, v s) = 0) \<Longrightarrow> U \<subseteq> cball x e \<Longrightarrow>
       continuous_on U v \<Longrightarrow> s \<in> U \<Longrightarrow> (s, v s) \<in> ball (x, y) r \<Longrightarrow> u s = v s"
 proof -
   define H where "H \<equiv> \<lambda>(x, y). (x, f (x, y))"
   define H' where "H' \<equiv> \<lambda>x. (embed1_blinfun o\<^sub>L fst_blinfun) + (embed2_blinfun o\<^sub>L (f' x))"
   have f'_inv: "f' (x, y) o\<^sub>L embed2_blinfun \<in> invertibles_blinfun"
     using T1 T2 by (auto simp: invertibles_blinfun_def ac_simps intro!: exI[where x=T])
   from openE[OF blinfun_inverse_open this]
   obtain d0 where e0: "0 < d0"
     "ball (f' (x, y) o\<^sub>L embed2_blinfun) d0 \<subseteq> invertibles_blinfun"
     by auto
   have "isCont (\<lambda>s. f' s o\<^sub>L embed2_blinfun) (x, y)"
     by (auto intro!: continuous_intros f'C)
   from this[unfolded isCont_def, THEN tendstoD, OF \<open>0 < d0\<close>]
   have "\<forall>\<^sub>F s in at (x, y). f' s o\<^sub>L embed2_blinfun \<in> invertibles_blinfun"
     apply eventually_elim
     using e0 by (auto simp: subset_iff dist_commute)
   then obtain e0 where "e0 > 0"
       "xa \<noteq> (x, y) \<Longrightarrow> dist xa (x, y) < e0 \<Longrightarrow>
         f' xa o\<^sub>L embed2_blinfun \<in> invertibles_blinfun" for xa
     unfolding eventually_at
     by auto
   then have e0: "e0 > 0"
     "dist xa (x, y) < e0 \<Longrightarrow> f' xa o\<^sub>L embed2_blinfun \<in> invertibles_blinfun" for xa
     apply -
     subgoal by simp
     using f'_inv
     apply (cases "xa = (x, y)")
     by auto
 
   have H': "x \<in> S \<Longrightarrow> (H has_derivative H' x) (at x)" for x
     unfolding H_def  H'_def
     by (auto intro!: derivative_eq_intros ext simp: blinfun.bilinear_simps)
   have cH': "isCont H' (x, y)"
     unfolding H'_def
     by (auto intro!: continuous_intros assms)
   have linear_H': "\<And>s. s \<in> S \<Longrightarrow> linear (H' s)"
     using H' assms(2) has_derivative_linear by blast
   have *: "blinfun_apply T (blinfun_apply (f' (x, y)) (0, b)) = b" for b
     using blinfun_inverseD[OF T2, of b]
     by simp
   have "inj (f' (x, y) o\<^sub>L embed2_blinfun)"
     by (metis (no_types, lifting) "*" blinfun_apply_blinfun_compose embed2_blinfun.rep_eq injI)
   then have [simp]: "blinfun_apply (f' (x, y)) (0, b) = 0 \<Longrightarrow> b = 0" for b
     apply (subst (asm) linear_injective_0)
     subgoal
       apply (rule bounded_linear.linear)
       apply (rule blinfun.bounded_linear_right)
       done
     subgoal by simp
     done
   have "inj (H' (x, y))"
     apply (subst linear_injective_0)
      apply (rule linear_H')
      apply fact
     apply (auto simp: H'_def blinfun.bilinear_simps zero_prod_def)
     done
   define Hi where "Hi = (embed1_blinfun o\<^sub>L fst_blinfun) + ((embed2_blinfun o\<^sub>L T o\<^sub>L (snd_blinfun - (f' (x, y) o\<^sub>L embed1_blinfun o\<^sub>L fst_blinfun))))"
   have Hi': "(\<lambda>u. snd (blinfun_apply Hi (u, 0))) = - T o\<^sub>L f' (x, y) o\<^sub>L embed1_blinfun"
     by (auto simp: Hi_def blinfun.bilinear_simps)
   have Hi: "Hi o\<^sub>L H' (x, y) = 1\<^sub>L"
     apply (auto simp: H'_def fun_eq_iff blinfun.bilinear_simps Hi_def
         intro!: ext blinfun_eqI)
     apply (subst blinfun_apply_Pair_split)
     by (auto simp: * blinfun.bilinear_simps)
   from has_derivative_locally_injective_blinfun[OF S this H' cH']
   obtain r0 where r0: "0 < r0" "ball (x, y) r0 \<subseteq> S" and inj: "inj_on H (ball (x, y) r0)"
     by auto
   define r where "r = min r0 e0"
   have r: "0 < r" "ball (x, y) r \<subseteq> S" and inj: "inj_on H (ball (x, y) r)"
     and r_inv: "\<And>s. s \<in> ball (x, y) r \<Longrightarrow> f' s o\<^sub>L embed2_blinfun \<in> invertibles_blinfun"
     subgoal using e0 r0 by (auto simp: r_def)
     subgoal using e0 r0 by (auto simp: r_def)
     subgoal using inj apply (rule inj_on_subset)
       using e0 r0 by (auto simp: r_def)
     subgoal for s
       using e0 r0 by (auto simp: r_def dist_commute)
     done
   obtain i::'a where "i \<in> Basis"
     using nonempty_Basis by blast
   define undef where "undef \<equiv> (x, y) + r *\<^sub>R (i, 0)"\<comment> \<open>really??\<close>
   have ud: "\<not> dist (x, y) undef < r"
     using \<open>r > 0\<close> \<open>i \<in> Basis\<close> by (auto simp: undef_def dist_norm)
   define G where "G \<equiv> the_inv_into (ball (x, y) r) H"
   {
     fix u v
     assume [simp]: "(u, v) \<in> H ` ball (x, y) r"
     note [simp] = inj
     have "(u, v) = H (G (u, v))"
       unfolding G_def
       by (subst f_the_inv_into_f[where f=H]) auto
     moreover have "\<dots> = H (G (u, v))"
       by (auto simp: G_def)
     moreover have "\<dots> = (fst (G (u, v)), f (G (u, v)))"
       by (auto simp: H_def split_beta')
     ultimately have "u = fst (G (u, v))" "v = f (G (u, v))" by simp_all
     then have "f (u, snd (G(u, v))) = v" "u = fst (G (u, v))"
       by (metis prod.collapse)+
   } note uvs = this
   note uv = uvs(1)
   moreover
   have "f (x, snd (G (x, 0))) = 0"
     apply (rule uv)
     by (metis (mono_tags, lifting) H_def assms(6) case_prod_beta' centre_in_ball fst_conv image_iff r(1) snd_conv)
   moreover
   have cH: "continuous_on S H"
     apply (rule has_derivative_continuous_on)
     apply (subst at_within_open)
       apply (auto intro!: H' assms)
     done
   have inj2: "inj_on H (ball (x, y) (r / 2))"
     apply (rule inj_on_subset, rule inj)
     using r by auto
   have oH: "open (H ` ball (x, y) (r/2))"
     apply (rule invariance_of_domain_gen)
        apply (auto simp: assms inj)
     apply (rule continuous_on_subset)
       apply fact
     using r
      apply auto
     using inj2 apply simp
     done
   have "(x, f (x, y)) \<in> H ` ball (x, y) (r/2)"
     using \<open>r > 0\<close> by (auto simp: H_def)
   from open_contains_cball[THEN iffD1, OF oH, rule_format, OF this]
   obtain e' where e': "e' > 0" "cball (x, f (x, y)) e' \<subseteq> H ` ball (x, y) (r/2)"
     by auto
 
   have inv_subset: "the_inv_into (ball (x, y) r) H a = the_inv_into R H a"
     if "a \<in> H ` R" "R \<subseteq> (ball (x, y) r)"
     for a R
     apply (rule the_inv_into_f_eq[OF inj])
      apply (rule f_the_inv_into_f)
       apply (rule inj_on_subset[OF inj])
       apply fact
      apply fact
     apply (rule the_inv_into_into)
       apply (rule inj_on_subset[OF inj])
       apply fact
      apply fact
     apply (rule order_trans)
      apply fact
     using r apply auto
     done
   have GH: "G (H z) = z" if "dist (x, y) z < r" for z
     by (auto simp: G_def the_inv_into_f_f inj that)
   define e where "e = min (e' / 2) e0"
   define r2 where "r2 = r / 2"
   have r2: "r2 > 0" "r2 < r"
     using \<open>r > 0\<close> by (auto simp: r2_def)
   have "e > 0" using e' e0 by (auto simp: e_def)
   from cball_times_subset[of "x" e' "f (x, y)"] e'
   have "cball x e \<times> cball (f (x, y)) e \<subseteq> H ` ball (x, y) (r/2)"
     by (force simp: e_def)
   then have e_r_subset: "z \<in> cball x e \<Longrightarrow> (z, 0) \<in> H ` ball (x, y) (r/2)" for z
     using \<open>0 < e\<close> assms(6)
     by (auto simp: H_def subset_iff)
   have u0: "(u, 0) \<in> H ` ball (x, y) r" if "u \<in> cball x e" for u
     apply (rule rev_subsetD)
      apply (rule e_r_subset)
      apply fact
     unfolding r2_def using r2 by auto
   have G_r: "G (u, 0) \<in> ball (x, y) r" if "u \<in> cball x e" for u
     unfolding G_def
     apply (rule the_inv_into_into)
       apply fact
      apply (auto)
     apply (rule u0, fact)
     done
   note e_r_subset
   ultimately have G2:
     "f (x, snd (G (x, 0))) = 0" "snd (G (x, 0)) = y"
     "\<And>u. u \<in> cball x e \<Longrightarrow> f (u, snd (G (u, 0))) = 0"
     "continuous_on (cball x e) (\<lambda>u. snd (G (u, 0)))"
     "(\<lambda>t. (t, snd (G (t, 0)))) ` cball x e \<subseteq> S"
     "e > 0"
     "((\<lambda>u. snd (G (u, 0))) has_derivative (\<lambda>u. snd (Hi (u, 0)))) (at x)"
        apply (auto simp: G_def split_beta'
         intro!: continuous_intros continuous_on_compose2[OF cH])
     subgoal premises prems
     proof -
       have "the_inv_into (ball (x, y) r) H (x, 0) = (x, y)"
         apply (rule the_inv_into_f_eq)
           apply fact
          by (auto simp: H_def assms \<open>r > 0\<close>)
        then show ?thesis
          by auto
     qed
     using r2(2) r2_def apply fastforce
     apply (subst continuous_on_cong[OF refl])
      apply (rule inv_subset[where R="cball (x, y) r2"])
     subgoal
       using r2
       apply auto
       using r2_def by force
     subgoal using r2 by (force simp:)
     subgoal
       apply (rule continuous_on_compose2[OF continuous_on_inv_into])
       using r(2) r2(2)
         apply (auto simp: r2_def[symmetric]
           intro!: continuous_on_compose2[OF cH] continuous_intros)
        apply (rule inj_on_subset)
         apply (rule inj)
       using r(2) r2(2) apply force
       apply force
       done
     subgoal premises prems for u
     proof -
       from prems have u: "u \<in> cball x e" by auto
       note G_r[OF u]
       also have "ball (x, y) r \<subseteq> S"
         using r by simp
       finally have "(G (u, 0)) \<in> S" .
       then show ?thesis
         unfolding G_def[symmetric]
         using uvs(2)[OF u0, OF u]
         by (metis prod.collapse)
     qed
     subgoal using \<open>e > 0\<close> by simp
     subgoal premises prems
     proof -
       have "(x, y) \<in> cball (x, y) r2"
         using r2
         by auto
       moreover
       have "H (x, y) \<in> interior (H ` cball (x, y) r2)"
         apply (rule interiorI[OF oH])
         using r2 by (auto simp: r2_def)
       moreover
       have "cball (x, y) r2 \<subseteq> S"
         using r r2 by auto
       moreover have "\<And>z. z \<in> cball (x, y) r2 \<Longrightarrow> G (H z) = z"
         using r2 by (auto intro!: GH)
       ultimately have "(G has_derivative Hi) (at (H (x, y)))"
       proof (rule has_derivative_inverse[where g = G and f = H,
               OF compact_cball _ _ continuous_on_subset[OF cH] _ H' _ _])
         show "blinfun_apply Hi \<circ> blinfun_apply (H' (x, y)) = id"
           using Hi by transfer auto
       qed (use S blinfun.bounded_linear_right in auto)
       then have g': "(G has_derivative Hi) (at (x, 0))"
         by (auto simp: H_def assms)
       show ?thesis
         unfolding G_def[symmetric] H_def[symmetric]
         apply (auto intro!: derivative_eq_intros)
          apply (rule has_derivative_compose[where g=G and f="\<lambda>x. (x, 0)"])
          apply (auto intro!: g' derivative_eq_intros)
         done
     qed
     done
   moreover
   note \<open>r > 0\<close>
   moreover
   define u where "u \<equiv> \<lambda>x. snd (G (x, 0))"
   have local_unique: "u s = v s"
     if solves: "(\<And>s. s \<in> U \<Longrightarrow> f (s, v s) = 0)"
     and i: "v x = y"
     and v: "continuous_on U v"
     and s: "s \<in> U"
     and s': "(s, v s) \<in> ball (x, y) r"
     and U: "U \<subseteq> cball x e"
     for U v s
   proof -
     have H_eq: "H (s, v s) = H (s, u s)"
       apply (auto simp: H_def solves[OF s])
       unfolding u_def
       apply (rule G2)
       apply (rule subsetD; fact)
       done
     have "(s, snd (G (s, 0))) = (G (s, 0))"
       using GH H_def s s' solves by fastforce
     also have "\<dots> \<in> ball (x, y) r"
       unfolding G_def
       apply (rule the_inv_into_into)
         apply fact
        apply (rule u0)
        apply (rule subsetD; fact)
       apply (rule order_refl)
       done
     finally have "(s, u s) \<in> ball (x, y) r" unfolding u_def .
     from inj_onD[OF inj H_eq s' this]
     show "u s = v s"
       by auto
   qed
   ultimately show ?thesis
     unfolding u_def Hi' ..
 qed
 
 lemma implicit_function_theorem_unique:
   fixes f::"'a::euclidean_space * 'b::euclidean_space \<Rightarrow> 'c::euclidean_space"\<comment> \<open>TODO: generalize?!\<close>
   assumes f'[derivative_intros]: "\<And>x. x \<in> S \<Longrightarrow> (f has_derivative blinfun_apply (f' x)) (at x)"
   assumes S: "(x, y) \<in> S" "open S"
   assumes D: "DIM('c) \<le> DIM('b)"
   assumes f'C: "continuous_on S f'"
   assumes z: "f (x, y) = 0"
   assumes T2: "T o\<^sub>L (f' (x, y) o\<^sub>L embed2_blinfun) = 1\<^sub>L"
   assumes T1: "(f' (x, y) o\<^sub>L embed2_blinfun) o\<^sub>L T = 1\<^sub>L"\<comment> \<open>TODO: reduce?!\<close>
   obtains u e
   where "f (x, u x) = 0" "u x = y"
     "\<And>s. s \<in> cball x e \<Longrightarrow> f (s, u s) = 0"
     "continuous_on (cball x e) u"
     "(\<lambda>t. (t, u t)) ` cball x e \<subseteq> S"
     "e > 0"
     "(u has_derivative (- T o\<^sub>L f' (x, y) o\<^sub>L embed1_blinfun)) (at x)"
     "\<And>s. s \<in> cball x e \<Longrightarrow> f' (s, u s) o\<^sub>L embed2_blinfun \<in> invertibles_blinfun"
     "\<And>U v s. (\<And>s. s \<in> U \<Longrightarrow> f (s, v s) = 0) \<Longrightarrow>
       u x = v x \<Longrightarrow>
       continuous_on U v \<Longrightarrow> s \<in> U \<Longrightarrow> x \<in> U \<Longrightarrow> U \<subseteq> cball x e \<Longrightarrow> connected U \<Longrightarrow> open U \<Longrightarrow> u s = v s"
 proof -
   from T1 T2 have f'I: "f' (x, y) o\<^sub>L embed2_blinfun \<in> invertibles_blinfun"
     by (auto simp: invertibles_blinfun_def)
   from assms have f'Cg: "s \<in> S \<Longrightarrow> isCont f' s" for s
     by (auto simp: continuous_on_eq_continuous_at[OF \<open>open S\<close>])
   then have f'C: "isCont f' (x, y)" by (auto simp: S)
   obtain u e1 r
     where u: "f (x, u x) = 0" "u x = y"
       "\<And>s. s \<in> cball x e1 \<Longrightarrow> f (s, u s) = 0"
       "continuous_on (cball x e1) u"
       "(\<lambda>t. (t, u t)) ` cball x e1 \<subseteq> S"
       "e1 > 0"
     "(u has_derivative (- T o\<^sub>L f' (x, y) o\<^sub>L embed1_blinfun)) (at x)"
     and unique_u: "r > 0"
       "(\<And>v s U. v x = y \<Longrightarrow>
         (\<And>s. s \<in> U \<Longrightarrow> f (s, v s) = 0) \<Longrightarrow>
         continuous_on U v \<Longrightarrow> s \<in> U \<Longrightarrow> U \<subseteq> cball x e1 \<Longrightarrow> (s, v s) \<in> ball (x, y) r \<Longrightarrow> u s = v s)"
     by (rule implicit_function_theorem[OF f' S D f'C z T2 T1]; blast)
 
   from openE[OF blinfun_inverse_open f'I] obtain d where d:
     "0 < d" "ball (f' (x, y) o\<^sub>L embed2_blinfun) d \<subseteq> invertibles_blinfun"
     by auto
   note [continuous_intros] = continuous_at_compose[OF _ f'Cg, unfolded o_def]
   from \<open>continuous_on _ u\<close>
   have "continuous_on (ball x e1) u" by (rule continuous_on_subset) auto
   then have "\<And>s. s \<in> ball x e1 \<Longrightarrow> isCont u s"
     unfolding continuous_on_eq_continuous_at[OF open_ball] by auto
   note [continuous_intros] = continuous_at_compose[OF _ this, unfolded o_def]
   from assms have f'Ce: "isCont (\<lambda>s. f' (s, u s) o\<^sub>L embed2_blinfun) x"
     by (auto simp: u intro!: continuous_intros)
   from f'Ce[unfolded isCont_def, THEN tendstoD, OF \<open>0 < d\<close>] d
   obtain e0 where "e0 > 0" "\<And>s. s \<noteq> x \<Longrightarrow> s \<in> ball x e0 \<Longrightarrow>
       (f' (s, u s) o\<^sub>L embed2_blinfun) \<in> invertibles_blinfun"
     by (auto simp: eventually_at dist_commute subset_iff u)
   then have e0: "s \<in> ball x e0 \<Longrightarrow> (f' (s, u s) o\<^sub>L embed2_blinfun) \<in> invertibles_blinfun" for s
     by (cases "s = x") (auto simp: f'I \<open>0 < d\<close> u)
 
 
   define e where "e = min (e0/2) (e1/2)"
   have e: "f (x, u x) = 0"
       "u x = y"
       "\<And>s. s \<in> cball x e \<Longrightarrow> f (s, u s) = 0"
       "continuous_on (cball x e) u"
       "(\<lambda>t. (t, u t)) ` cball x e \<subseteq> S"
       "e > 0"
       "(u has_derivative (- T o\<^sub>L f' (x, y) o\<^sub>L embed1_blinfun)) (at x)"
       "\<And>s. s \<in> cball x e \<Longrightarrow> f' (s, u s) o\<^sub>L embed2_blinfun \<in> invertibles_blinfun"
     using e0 u \<open>e0 > 0\<close> by (auto simp: e_def intro: continuous_on_subset)
 
   from u(4) have "continuous_on (ball x e1) u"
     apply (rule continuous_on_subset)
     using \<open>e1 > 0\<close>
     by (auto simp: e_def)
   then have "\<And>s. s \<in> cball x e \<Longrightarrow> isCont u s"
     using \<open>e0 > 0\<close> \<open>e1 > 0\<close>
     unfolding continuous_on_eq_continuous_at[OF open_ball] by (auto simp: e_def Ball_def dist_commute)
   note [continuous_intros] = continuous_at_compose[OF _ this, unfolded o_def]
 
   have "u s = v s"
     if solves: "(\<And>s. s \<in> U \<Longrightarrow> f (s, v s) = 0)"
     and i: "u x = v x"
     and v: "continuous_on U v"
     and s: "s \<in> U" and U: "x \<in> U" "U \<subseteq> cball x e" "connected U" "open U"
     for U v s
   proof -
     define M where "M = {s \<in> U. u s = v s}"
     have "x \<in> M" using i U by (auto simp: M_def)
     moreover
     have "continuous_on U (\<lambda>s. u s - v s)"
       by (auto intro!: continuous_intros v continuous_on_subset[OF e(4) U(2)])
     from continuous_closedin_preimage[OF this closed_singleton[where a=0]]
     have "closedin (top_of_set U) M"
       by (auto simp: M_def vimage_def Collect_conj_eq)
     moreover
     have "\<And>s. s \<in> U  \<Longrightarrow> isCont v s"
       using v
       unfolding continuous_on_eq_continuous_at[OF \<open>open U\<close>] by auto
     note [continuous_intros] = continuous_at_compose[OF _ this, unfolded o_def]
     {
       fix a assume "a \<in> M"
       then have aU: "a \<in> U" and u_v: "u a = v a"
         by (auto simp: M_def)
       then have a_ball: "a \<in> cball x e" and a_dist: "dist x a \<le> e" using U by auto
       then have a_S: "(a, u a) \<in> S"
         using e by auto
       have fa_z: "f (a, u a) = 0"
         using \<open>a \<in> cball x e\<close> by (auto intro!: e)
       from e(8)[OF \<open>a \<in> cball _ _\<close>]
       obtain Ta where Ta: "Ta o\<^sub>L (f' (a, u a) o\<^sub>L embed2_blinfun) = 1\<^sub>L" "f' (a, u a) o\<^sub>L embed2_blinfun o\<^sub>L Ta = 1\<^sub>L"
         by (auto simp: invertibles_blinfun_def ac_simps)
       obtain u' e' r'
         where "r' > 0" "e' > 0"
         and u': "\<And>v s U. v a = u a \<Longrightarrow>
              (\<And>s. s \<in> U \<Longrightarrow> f (s, v s) = 0) \<Longrightarrow>
              continuous_on U v \<Longrightarrow> s \<in> U \<Longrightarrow> U \<subseteq> cball a e' \<Longrightarrow> (s, v s) \<in> ball (a, u a) r' \<Longrightarrow> u' s = v s"
         by (rule implicit_function_theorem[OF f' a_S \<open>open S\<close> D f'Cg[OF a_S] fa_z Ta]; blast)
       from openE[OF \<open>open U\<close> aU] obtain dU where dU: "dU > 0" "\<And>s. s \<in> ball a dU \<Longrightarrow> s \<in> U"
         by (auto simp: dist_commute subset_iff)
 
       have v_tendsto: "((\<lambda>s. (s, v s)) \<longlongrightarrow> (a, u a)) (at a)"
         unfolding u_v
         by (subst continuous_at[symmetric]) (auto intro!: continuous_intros aU)
       from tendstoD[OF v_tendsto \<open>0 < r'\<close>, unfolded eventually_at]
       obtain dv where "dv > 0" "s \<noteq> a \<Longrightarrow> dist s a < dv \<Longrightarrow> (s, v s) \<in> ball (a, u a) r'" for s
         by (auto simp: dist_commute)
       then have dv: "dist s a < dv \<Longrightarrow> (s, v s) \<in> ball (a, u a) r'" for s
         by (cases "s = a") (auto simp: u_v \<open>0 < r'\<close>)
 
       have v_tendsto: "((\<lambda>s. (s, u s)) \<longlongrightarrow> (a, u a)) (at a)"
         using a_dist
         by (subst continuous_at[symmetric]) (auto intro!: continuous_intros)
       from tendstoD[OF v_tendsto \<open>0 < r'\<close>, unfolded eventually_at]
       obtain du where "du > 0" "s \<noteq> a \<Longrightarrow> dist s a < du \<Longrightarrow> (s, u s) \<in> ball (a, u a) r'" for s
         by (auto simp: dist_commute)
       then have du: "dist s a < du \<Longrightarrow> (s, u s) \<in> ball (a, u a) r'" for s
         by (cases "s = a") (auto simp: u_v \<open>0 < r'\<close>)
       {
         fix s assume s: "s \<in> ball a (Min {dU, e', dv, du})"
         let ?U = "ball a (Min {dU, e', dv, du})"
         have balls: "ball a (Min {dU, e', dv, du}) \<subseteq> cball a e'" by auto
         have dsadv: "dist s a < dv"
           using s by (auto simp: dist_commute)
         have dsadu: "dist s a < du"
           using s by (auto simp: dist_commute)
         have U_U: "\<And>s. s \<in> ball a (Min {dU, e', dv, du}) \<Longrightarrow> s \<in> U"
           using dU by auto
         have U_e: "\<And>s. s \<in> ball a (Min {dU, e', dv, du}) \<Longrightarrow> s \<in> cball x e"
           using dU U by (auto simp: dist_commute subset_iff)
         have cv: "continuous_on ?U v"
           using v
           apply (rule continuous_on_subset)
           using dU
           by auto
         have cu: "continuous_on ?U u"
           using e(4)
           apply (rule continuous_on_subset)
           using dU U(2)
           by auto
         from u'[where v=v, OF u_v[symmetric] solves[OF U_U] cv s balls dv[OF dsadv]]
           u'[where v=u, OF refl              e(3)[OF U_e]   cu s balls du[OF dsadu]]
         have "v s = u s" by auto
       } then have "\<exists>dv>0. \<forall>s \<in> ball a dv. v s = u s"
         using \<open>0 < dU\<close> \<open>0 < e'\<close> \<open>0 < dv\<close> \<open>0 < du\<close>
         by (auto intro!: exI[where x="(Min {dU, e', dv, du})"])
     } note ex = this
     have "openin (top_of_set U) M"
       unfolding openin_contains_ball
       apply (rule conjI)
       subgoal using U by (auto simp: M_def)
       apply (auto simp:)
       apply (drule ex)
       apply auto
       subgoal for x d
         by (rule exI[where x=d]) (auto simp: M_def)
       done
     ultimately have "M = U"
       using \<open>connected U\<close>
       by (auto simp: connected_clopen)
     with \<open>s \<in> U\<close> show ?thesis by (auto simp: M_def)
   qed
   from e this
   show ?thesis ..
 qed
 
 lemma uniform_limit_compose:
   assumes ul: "uniform_limit T f l F"
   assumes uc: "uniformly_continuous_on S s"
   assumes ev: "\<forall>\<^sub>F x in F. f x ` T \<subseteq> S"
   assumes subs: "l ` T \<subseteq> S"
   shows  "uniform_limit T (\<lambda>i x. s (f i x)) (\<lambda>x. s (l x)) F"
 proof (rule uniform_limitI)
   fix e::real assume "e > 0"
   from uniformly_continuous_onE[OF uc \<open>e > 0\<close>]
   obtain d where d: "0 < d" "\<And>t t'. t \<in> S \<Longrightarrow> t' \<in> S \<Longrightarrow> dist t' t < d \<Longrightarrow> dist (s t') (s t) < e"
     by auto
   from uniform_limitD[OF ul \<open>0 < d\<close>] have "\<forall>\<^sub>F n in F. \<forall>x\<in>T. dist (f n x) (l x) < d" .
   then show "\<forall>\<^sub>F n in F. \<forall>x\<in>T. dist (s (f n x)) (s (l x)) < e"
     using ev
     by eventually_elim (use d subs in force)
 qed
 
 lemma
   uniform_limit_in_open:
   fixes l::"'a::topological_space\<Rightarrow>'b::heine_borel"
   assumes ul: "uniform_limit T f l (at x)"
   assumes cont: "continuous_on T l"
   assumes compact: "compact T" and T_ne: "T \<noteq> {}"
   assumes B: "open B"
   assumes mem: "l ` T \<subseteq> B"
   shows "\<forall>\<^sub>F y in at x. \<forall>t \<in> T. f y t \<in> B"
 proof -
   have l_ne: "l ` T \<noteq> {}" using T_ne by auto
   have "compact (l ` T)"
     by (auto intro!: compact_continuous_image cont compact)
   from compact_in_open_separated[OF l_ne this B mem]
   obtain e where "e > 0" "{x. infdist x (l ` T) \<le> e} \<subseteq> B"
     by auto
   from uniform_limitD[OF ul \<open>0 < e\<close>]
   have "\<forall>\<^sub>F n in at x. \<forall>x\<in>T. dist (f n x) (l x) < e" .
   then show ?thesis
   proof eventually_elim
     case (elim y)
     show ?case
     proof safe
       fix t assume "t \<in> T"
       have "infdist (f y t) (l ` T) \<le> dist (f y t) (l t)"
         by (rule infdist_le) (use \<open>t \<in> T\<close> in auto)
       also have "\<dots> < e" using elim \<open>t \<in> T\<close> by auto
       finally have "infdist (f y t) (l ` T) \<le> e" by simp
       then have "(f y t) \<in> {x. infdist x (l ` T) \<le> e}"
         by (auto )
       also note \<open>\<dots> \<subseteq> B\<close>
       finally show "f y t \<in> B" .
     qed
   qed
 qed
 
 lemma
   order_uniform_limitD1:
   fixes l::"'a::topological_space\<Rightarrow>real"\<comment> \<open>TODO: generalize?!\<close>
   assumes ul: "uniform_limit T f l (at x)"
   assumes cont: "continuous_on T l"
   assumes compact: "compact T"
   assumes less: "\<And>t. t \<in> T \<Longrightarrow> l t < b"
   shows "\<forall>\<^sub>F y in at x. \<forall>t \<in> T. f y t < b"
 proof cases
   assume ne: "T \<noteq> {}"
   from compact_attains_sup[OF compact_continuous_image[OF cont compact], unfolded image_is_empty, OF ne]
   obtain tmax where tmax: "tmax \<in> T" "\<And>s. s \<in> T \<Longrightarrow> l s \<le> l tmax"
     by auto
   have "b - l tmax > 0"
     using ne tmax less by auto
   from uniform_limitD[OF ul this]
   have "\<forall>\<^sub>F n in at x. \<forall>x\<in>T. dist (f n x) (l x) < b - l tmax"
     by auto
   then show ?thesis
     apply eventually_elim
     using tmax
     by (force simp: dist_real_def abs_real_def split: if_splits)
 qed auto
 
 lemma
   order_uniform_limitD2:
   fixes l::"'a::topological_space\<Rightarrow>real"\<comment> \<open>TODO: generalize?!\<close>
   assumes ul: "uniform_limit T f l (at x)"
   assumes cont: "continuous_on T l"
   assumes compact: "compact T"
   assumes less: "\<And>t. t \<in> T \<Longrightarrow> l t > b"
   shows "\<forall>\<^sub>F y in at x. \<forall>t \<in> T. f y t > b"
 proof -
   have "\<forall>\<^sub>F y in at x. \<forall>t\<in>T. (- f) y t < - b"
     by (rule order_uniform_limitD1[of "- f" T "-l" x "- b"])
       (auto simp: assms fun_Compl_def intro!: uniform_limit_eq_intros continuous_intros)
   then show ?thesis by auto
 qed
 
 lemma continuous_on_avoid_cases:
   fixes l::"'b::topological_space \<Rightarrow> 'a::linear_continuum_topology"\<comment> \<open>TODO: generalize!\<close>
   assumes cont: "continuous_on T l" and conn: "connected T"
   assumes avoid: "\<And>t. t \<in> T \<Longrightarrow> l t \<noteq> b"
   obtains "\<And>t. t \<in> T \<Longrightarrow> l t < b" | "\<And>t. t \<in> T \<Longrightarrow> l t > b"
   apply atomize_elim
   using connected_continuous_image[OF cont conn] using avoid
   unfolding connected_iff_interval
   apply (auto simp: image_iff)
   using leI by blast
 
 lemma
   order_uniform_limit_ne:
   fixes l::"'a::topological_space\<Rightarrow>real"\<comment> \<open>TODO: generalize?!\<close>
   assumes ul: "uniform_limit T f l (at x)"
   assumes cont: "continuous_on T l"
   assumes compact: "compact T" and conn: "connected T"
   assumes ne: "\<And>t. t \<in> T \<Longrightarrow> l t \<noteq> b"
   shows "\<forall>\<^sub>F y in at x. \<forall>t \<in> T. f y t \<noteq> b"
 proof -
   from continuous_on_avoid_cases[OF cont conn ne]
   consider "(\<And>t. t \<in> T \<Longrightarrow> l t < b)" | "(\<And>t. t \<in> T \<Longrightarrow> l t > b)"
     by blast
   then show ?thesis
   proof cases
     case 1
     from order_uniform_limitD1[OF ul cont compact 1]
     have "\<forall>\<^sub>F y in at x. \<forall>t\<in>T. f y t < b" by simp
     then show ?thesis
       by eventually_elim auto
   next
     case 2
     from order_uniform_limitD2[OF ul cont compact 2]
     have "\<forall>\<^sub>F y in at x. \<forall>t\<in>T. f y t > b" by simp
     then show ?thesis
       by eventually_elim auto
   qed
 qed
 
 lemma open_cballE:
   assumes "open S" "x\<in>S"
   obtains e where "e>0" "cball x e \<subseteq> S"
   using assms unfolding open_contains_cball by auto
 
 lemma pos_half_less: fixes x::real shows "x > 0 \<Longrightarrow> x / 2 < x"
   by auto
 
 lemma closed_levelset: "closed {x. s x = (c::'a::t1_space)}" if "continuous_on UNIV s"
 proof -
   have "{x. s x = c} = s -` {c}" by auto
   also have "closed \<dots>"
     apply (rule closed_vimage)
      apply (rule closed_singleton)
     apply (rule that)
     done
   finally show ?thesis .
 qed
 
 lemma closed_levelset_within: "closed {x \<in> S. s x = (c::'a::t1_space)}" if "continuous_on S s" "closed S"
 proof -
   have "{x \<in> S. s x = c} = s -` {c} \<inter> S" by auto
   also have "closed \<dots>"
     apply (rule continuous_on_closed_vimageI)
       apply (rule that)
      apply (rule that)
     apply simp
     done
   finally show ?thesis .
 qed
 
 context c1_on_open_euclidean
 begin
 
 lemma open_existence_ivlE:
   assumes "t \<in> existence_ivl0 x" "t \<ge> 0"
   obtains e where "e > 0" "cball x e \<times> {0 .. t + e} \<subseteq> Sigma X existence_ivl0"
 proof -
   from assms have "(x, t) \<in> Sigma X existence_ivl0"
     by auto
   from open_cballE[OF open_state_space this]
   obtain e0' where e0: "0 < e0'" "cball (x, t) e0' \<subseteq> Sigma X existence_ivl0"
     by auto
   define e0 where "e0 = (e0' / 2)"
   from cball_times_subset[of x e0' t] pos_half_less[OF \<open>0 < e0'\<close>] half_gt_zero[OF \<open>0 < e0'\<close>] e0
   have "cball x e0 \<times> cball t e0 \<subseteq> Sigma X existence_ivl0" "0 < e0" "e0 < e0'"
     unfolding e0_def by auto
   then have "e0 > 0" "cball x e0 \<times> {0..t + e0} \<subseteq> Sigma X existence_ivl0"
     apply (auto simp: subset_iff dest!: spec[where x=t])
     subgoal for a b
       apply (rule in_existence_between_zeroI)
       apply (drule spec[where x=a])
        apply (drule spec[where x="t + e0"])
        apply (auto simp: dist_real_def closed_segment_eq_real_ivl)
       done
     done
   then show ?thesis ..
 qed
 
 lemmas [derivative_intros] = flow0_comp_has_derivative
 
 lemma flow_isCont_state_space_comp[continuous_intros]:
   "t x \<in> existence_ivl0 (s x) \<Longrightarrow> isCont s x \<Longrightarrow> isCont t x \<Longrightarrow> isCont (\<lambda>x. flow0 (s x) (t x)) x"
   using continuous_within_compose3[where g="\<lambda>(x, t). flow0 x t"
       and f="\<lambda>x. (s x, t x)" and x = x and s = UNIV]
   flow_isCont_state_space
   by auto
 
 lemma closed_plane[simp]: "closed {x. x \<bullet> i = c}"
   using closed_hyperplane[of i c] by (auto simp: inner_commute)
 
 lemma flow_tendsto_compose[tendsto_intros]:
   assumes "(x \<longlongrightarrow> xs) F" "(t \<longlongrightarrow> ts) F"
   assumes "ts \<in> existence_ivl0 xs"
   shows "((\<lambda>s. flow0 (x s) (t s)) \<longlongrightarrow> flow0 xs ts) F"
 proof -
   have ev: "\<forall>\<^sub>F s in F. (x s, t s) \<in> Sigma X existence_ivl0"
     using tendsto_Pair[OF assms(1,2), THEN topological_tendstoD, OF open_state_space]
       assms
     by auto
   show ?thesis
     by (rule continuous_on_tendsto_compose[OF flow_continuous_on_state_space tendsto_Pair, unfolded split_beta' fst_conv snd_conv])
       (use assms ev in auto)
 qed
 
 lemma returns_to_implicit_function:
   fixes s::"'a::euclidean_space \<Rightarrow> real"
   assumes rt: "returns_to {x \<in> S. s x = 0} x" (is "returns_to ?P x")
   assumes cS: "closed S"
   assumes Ds: "\<And>x. (s has_derivative blinfun_apply (Ds x)) (at x)"
   assumes DsC: "isCont Ds (poincare_map ?P x)"
   assumes nz: "Ds (poincare_map ?P x) (f (poincare_map ?P x)) \<noteq> 0"
   obtains u e
   where "s (flow0 x (u x)) = 0"
       "u x = return_time ?P x"
       "(\<And>y. y \<in> cball x e \<Longrightarrow> s (flow0 y (u y)) = 0)"
       "continuous_on (cball x e) u"
       "(\<lambda>t. (t, u t)) ` cball x e \<subseteq> Sigma X existence_ivl0"
       "0 < e" "(u has_derivative (- blinfun_scaleR_left
                    (inverse (blinfun_apply (Ds (poincare_map ?P x)) (f (poincare_map ?P x)))) o\<^sub>L
                       (Ds (poincare_map ?P x) o\<^sub>L flowderiv x (return_time ?P x)) o\<^sub>L embed1_blinfun)) (at x)"
 proof -
   note [derivative_intros] = has_derivative_compose[OF _ Ds]
   have cont_s: "continuous_on UNIV s" by (rule has_derivative_continuous_on[OF Ds])
   note cls[simp, intro] = closed_levelset[OF cont_s]
   let ?t1 = "return_time ?P x"
   have cls[simp, intro]: "closed {x \<in> S. s x = 0}"
     by (rule closed_levelset_within) (auto intro!: cS continuous_on_subset[OF cont_s])
   then have xt1: "(x, ?t1) \<in> Sigma X existence_ivl0"
     by (auto intro!: return_time_exivl rt)
   have D: "(\<And>x. x \<in> Sigma X existence_ivl0 \<Longrightarrow>
       ((\<lambda>(x, t). s (flow0 x t)) has_derivative
        blinfun_apply (Ds (flow0 (fst x) (snd x)) o\<^sub>L (flowderiv (fst x) (snd x))))
        (at x))"
     by (auto intro!: derivative_eq_intros)
   have C: "isCont (\<lambda>x. Ds (flow0 (fst x) (snd x)) o\<^sub>L flowderiv (fst x) (snd x))
    (x, ?t1)"
     using flowderiv_continuous_on[unfolded continuous_on_eq_continuous_within,
         rule_format, OF xt1]
     using at_within_open[OF xt1 open_state_space]
     by (auto intro!: continuous_intros tendsto_eq_intros return_time_exivl rt
           isCont_tendsto_compose[OF DsC, unfolded poincare_map_def]
         simp: split_beta' isCont_def)
   from return_time_returns[OF rt cls]
   have Z: "(case (x, ?t1) of (x, t) \<Rightarrow> s (flow0 x t)) = 0"
     by (auto simp: )
   have I1: "blinfun_scaleR_left (inverse (Ds (flow0 x (?t1))(f (flow0 x (?t1))))) o\<^sub>L 
     ((Ds (flow0 (fst (x, return_time {x \<in> S. s x = 0} x))
             (snd (x, return_time {x \<in> S. s x = 0} x))) o\<^sub>L
        flowderiv (fst (x, return_time {x \<in> S. s x = 0} x))
         (snd (x, return_time {x \<in> S. s x = 0} x))) o\<^sub>L
       embed2_blinfun)
      = 1\<^sub>L"
     using nz
     by (auto intro!: blinfun_eqI
         simp: rt flowderiv_def blinfun.bilinear_simps inverse_eq_divide poincare_map_def)
   have I2: "((Ds (flow0 (fst (x, return_time {x \<in> S. s x = 0} x))
             (snd (x, return_time {x \<in> S. s x = 0} x))) o\<^sub>L
        flowderiv (fst (x, return_time {x \<in> S. s x = 0} x))
         (snd (x, return_time {x \<in> S. s x = 0} x))) o\<^sub>L
       embed2_blinfun) o\<^sub>L blinfun_scaleR_left (inverse (Ds (flow0 x (?t1))(f (flow0 x (?t1)))))
      = 1\<^sub>L"
     using nz
     by (auto intro!: blinfun_eqI
         simp: rt flowderiv_def blinfun.bilinear_simps inverse_eq_divide poincare_map_def)
   show ?thesis
     apply (rule implicit_function_theorem[where f="\<lambda>(x, t). s (flow0 x t)"
           and S="Sigma X existence_ivl0", OF D xt1 open_state_space order_refl C Z I1 I2])
      apply blast
     unfolding split_beta' fst_conv snd_conv poincare_map_def[symmetric]
     ..
 qed
 
 lemma (in auto_ll_on_open) f_tendsto[tendsto_intros]:
   assumes g1: "(g1 \<longlongrightarrow> b1) (at s within S)" and "b1 \<in> X"
   shows "((\<lambda>x. f (g1 x)) \<longlongrightarrow> f b1) (at s within S)"
   apply (rule continuous_on_tendsto_compose[OF continuous tendsto_Pair[OF tendsto_const],
       unfolded split_beta fst_conv snd_conv, OF g1])
   by (auto simp: \<open>b1 \<in> X\<close> intro!: topological_tendstoD[OF g1])
 
 lemma flow_avoids_surface_eventually_at_right_pos:
   assumes "s x > 0 \<or> s x = 0 \<and> blinfun_apply (Ds x) (f x) > 0"
   assumes x: "x \<in> X"
   assumes Ds: "\<And>x. (s has_derivative Ds x) (at x)"
   assumes DsC: "\<And>x. isCont Ds x"
   shows "\<forall>\<^sub>F t in at_right 0. s (flow0 x t) > (0::real)"
 proof -
   have cont_s: "continuous_on UNIV s" by (rule has_derivative_continuous_on[OF Ds])
   then have [THEN continuous_on_compose2, continuous_intros]: "continuous_on S s" for S by (rule continuous_on_subset) simp
   note [derivative_intros] = has_derivative_compose[OF _ Ds]
   note [tendsto_intros] = continuous_on_tendsto_compose[OF cont_s]
     isCont_tendsto_compose[OF DsC]
   from assms(1)
   consider "s x > 0" | "s x = 0" "blinfun_apply (Ds x) (f x) > 0"
     by auto
   then show ?thesis
   proof cases
     assume s: "s x > 0"
     then have "((\<lambda>t. s (flow0 x t)) \<longlongrightarrow> s x) (at_right 0)"
       by (auto intro!: tendsto_eq_intros simp: split_beta' x)
     from order_tendstoD(1)[OF this s]
     show ?thesis .
   next
     assume sz: "s x = 0" and pos: "blinfun_apply (Ds x) (f x) > 0"
     from x have "0 \<in> existence_ivl0 x" "open (existence_ivl0 x)" by simp_all
     then have evex: "\<forall>\<^sub>F t in at_right 0. t \<in> existence_ivl0 x"
       using eventually_at_topological by blast
     moreover
     from evex have "\<forall>\<^sub>F xa in at_right 0. flow0 x xa \<in> X"
       by (eventually_elim) (auto intro!: )
     then have "((\<lambda>t. (Ds (flow0 x t)) (f (flow0 x t))) \<longlongrightarrow> blinfun_apply (Ds x) (f x)) (at_right 0)"
       by (auto intro!: tendsto_eq_intros simp: split_beta' x)
     from order_tendstoD(1)[OF this pos]
     have "\<forall>\<^sub>F z in at_right 0. blinfun_apply (Ds (flow0 x z)) (f (flow0 x z)) > 0" .
     then obtain t where t: "t > 0" "\<And>z. 0 < z \<Longrightarrow> z < t \<Longrightarrow> blinfun_apply (Ds (flow0 x z)) (f (flow0 x z)) > 0"
       by (auto simp: eventually_at)
     have "\<forall>\<^sub>F z in at_right 0. z < t" using \<open>t > 0\<close> order_tendstoD(2)[OF tendsto_ident_at \<open>0 < t\<close>] by auto
     moreover have "\<forall>\<^sub>F z in at_right 0. 0 < z" by (simp add: eventually_at_filter)
     ultimately show ?thesis
     proof eventually_elim
       case (elim z)
       from closed_segment_subset_existence_ivl[OF \<open>z \<in> existence_ivl0 x\<close>]
       have csi: "{0..z} \<subseteq> existence_ivl0 x" by (auto simp add: closed_segment_eq_real_ivl)
       then have cont: "continuous_on {0..z} (\<lambda>t. s (flow0 x t))"
         by (auto intro!: continuous_intros)
       have "\<And>u. \<lbrakk>0 < u; u < z\<rbrakk> \<Longrightarrow> ((\<lambda>t. s (flow0 x t)) has_derivative (\<lambda>t. t * blinfun_apply (Ds (flow0 x u)) (f (flow0 x u)))) (at u)"
         using csi
         by (auto intro!: derivative_eq_intros simp: flowderiv_def blinfun.bilinear_simps)
       from mvt[OF \<open>0 < z\<close> cont this]
       obtain w where w: "0 < w" "w < z" and sDs: "s (flow0 x z) = z * blinfun_apply (Ds (flow0 x w)) (f (flow0 x w))"
         using x sz
         by auto
       note sDs
       also have "\<dots> > 0"
         using elim t(2)[of w] w by simp
       finally show ?case .
     qed
   qed
 qed
 
 lemma flow_avoids_surface_eventually_at_right_neg:
   assumes "s x < 0 \<or> s x = 0 \<and> blinfun_apply (Ds x) (f x) < 0"
   assumes x: "x \<in> X"
   assumes Ds: "\<And>x. (s has_derivative Ds x) (at x)"
   assumes DsC: "\<And>x. isCont Ds x"
   shows "\<forall>\<^sub>F t in at_right 0. s (flow0 x t) < (0::real)"
   apply (rule flow_avoids_surface_eventually_at_right_pos[of "-s" x "-Ds", simplified])
   using assms
   by (auto intro!: derivative_eq_intros simp: blinfun.bilinear_simps fun_Compl_def)
 
 lemma flow_avoids_surface_eventually_at_right:
   assumes "x \<notin> S \<or> s x \<noteq> 0 \<or> blinfun_apply (Ds x) (f x) \<noteq> 0"
   assumes x: "x \<in> X" and cS: "closed S"
   assumes Ds: "\<And>x. (s has_derivative Ds x) (at x)"
   assumes DsC: "\<And>x. isCont Ds x"
   shows "\<forall>\<^sub>F t in at_right 0. (flow0 x t) \<notin> {x \<in> S. s x = (0::real)}"
 proof -
   from assms(1)
   consider
       "s x > 0 \<or> s x = 0 \<and> blinfun_apply (Ds x) (f x) > 0"
     | "s x < 0 \<or> s x = 0 \<and> blinfun_apply (Ds x) (f x) < 0"
     | "x \<notin> S"
     by arith
   then show ?thesis
   proof cases
     case 1
     from flow_avoids_surface_eventually_at_right_pos[of s x Ds, OF 1 x Ds DsC]
     show ?thesis by eventually_elim auto
   next
     case 2
     from flow_avoids_surface_eventually_at_right_neg[of s x Ds, OF 2 x Ds DsC]
     show ?thesis by eventually_elim auto
   next
     case 3
     then have nS: "open (- S)" "x \<in> - S" using cS by auto
     have "\<forall>\<^sub>F t in at_right 0. (flow0 x t) \<in> - S"
       by (rule topological_tendstoD[OF _ nS]) (auto intro!: tendsto_eq_intros simp: x)
     then show ?thesis by eventually_elim auto
   qed
 qed
 
 lemma eventually_returns_to:
   fixes s::"'a::euclidean_space \<Rightarrow> real"
   assumes rt: "returns_to {x \<in> S. s x = 0} x" (is "returns_to ?P x")
   assumes cS: "closed S"
   assumes Ds: "\<And>x. (s has_derivative blinfun_apply (Ds x)) (at x)"
   assumes DsC: "\<And>x. isCont Ds x"
   assumes eventually_inside: "\<forall>\<^sub>F x in at (poincare_map ?P x). s x = 0 \<longrightarrow> x \<in> S"
   assumes nz: "Ds (poincare_map ?P x) (f (poincare_map ?P x)) \<noteq> 0"
   assumes nz0: "x \<notin> S \<or> s x \<noteq> 0 \<or> Ds x (f x) \<noteq> 0"
   shows "\<forall>\<^sub>F x in at x. returns_to ?P x"
 proof -
   let ?t1 = "return_time ?P x"
   have cont_s: "continuous_on UNIV s" by (rule has_derivative_continuous_on[OF Ds])
   have cont_s': "continuous_on S s" for S by (rule continuous_on_subset[OF cont_s subset_UNIV])
   note s_tendsto[tendsto_intros] = continuous_on_tendsto_compose[OF cont_s, THEN tendsto_eq_rhs]
   note cls[simp, intro] = closed_levelset_within[OF cont_s' cS, of 0]
   note [tendsto_intros] = continuous_on_tendsto_compose[OF cont_s]
     isCont_tendsto_compose[OF DsC]
   obtain u e
     where "s (flow0 x (u x)) = 0"
       "u x = return_time ?P x"
       "(\<And>y. y \<in> cball x e \<Longrightarrow> s (flow0 y (u y)) = 0)"
       "continuous_on (cball x e) u"
       "(\<lambda>t. (t, u t)) ` cball x e \<subseteq> Sigma X existence_ivl0"
       "0 < e"
     by (rule returns_to_implicit_function[OF rt cS Ds DsC nz]; blast)
   then have u:
     "s (flow0 x (u x)) = 0" "u x = ?t1"
     "(\<And>y. y \<in> cball x e \<Longrightarrow> s (flow0 y (u y)) = 0)"
     "continuous_on (cball x e) u"
     "\<And>z. z \<in> cball x e \<Longrightarrow> u z \<in> existence_ivl0 z"
     "e > 0"
     by (force simp: split_beta')+
   have "\<forall>\<^sub>F y in at x. y \<in> ball x e"
     using eventually_at_ball[OF \<open>0 < e\<close>]
     by eventually_elim auto
   then have ev_cball: "\<forall>\<^sub>F y in at x. y \<in> cball x e"
     by eventually_elim (use \<open>e > 0\<close> in auto)
   moreover
   have "continuous_on (ball x e) u"
     using u by (auto simp: continuous_on_subset)
   then have [tendsto_intros]: "(u \<longlongrightarrow> u x) (at x)"
     using \<open>e > 0\<close> at_within_open[of y "ball x e" for y]
     by (auto simp: continuous_on_def)
   then have flow0_u_tendsto: "(\<lambda>x. flow0 x (u x)) \<midarrow>x\<rightarrow> poincare_map ?P x"
     by (auto intro!: tendsto_eq_intros u return_time_exivl rt simp: poincare_map_def)
   have s_imp: "s (poincare_map {x \<in> S. s x = 0} x) = 0 \<longrightarrow> poincare_map {x \<in> S. s x = 0} x \<in> S"
     using poincare_map_returns[OF rt]
     by auto
   from eventually_tendsto_compose_within[OF eventually_inside s_imp flow0_u_tendsto]
   have "\<forall>\<^sub>F x in at x. s (flow0 x (u x)) = 0 \<longrightarrow> flow0 x (u x) \<in> S" by auto
   with ev_cball
   have "\<forall>\<^sub>F x in at x. flow0 x (u x) \<in> S"
     by eventually_elim (auto simp: u)
   moreover
   {
     have "x \<in> X"
       using u(5) u(6) by force
     from ev_cball
     have ev_X: "\<forall>\<^sub>F y in at x. y \<in> X"\<comment> \<open>eigentlich ist das \<open>open X\<close>\<close>
       apply eventually_elim
       apply (rule)
       by (rule u)
     moreover
     {
       {
         assume a: "x \<notin> S" then have "open (-S)" "x \<in> - S" using cS by auto
         from topological_tendstoD[OF tendsto_ident_at this]
         have "(\<forall>\<^sub>F y in at x. y \<notin> S)" by auto
       } moreover {
         assume a: "s x \<noteq> 0"
         have "(\<forall>\<^sub>F y in at x. s y \<noteq> 0)"
           by (rule tendsto_imp_eventually_ne[OF _ a]) (auto intro!: tendsto_eq_intros)
       } moreover {
         assume a: "(Ds x) (f x) \<noteq> 0"
         have "(\<forall>\<^sub>F y in at x. blinfun_apply (Ds y) (f y) \<noteq> 0)"
           by (rule tendsto_imp_eventually_ne[OF _ a]) (auto intro!: tendsto_eq_intros ev_X \<open>x \<in> X\<close>)
       } ultimately have "(\<forall>\<^sub>F y in at x. y \<notin> S) \<or> (\<forall>\<^sub>F y in at x. s y \<noteq> 0) \<or> (\<forall>\<^sub>F y in at x. blinfun_apply (Ds y) (f y) \<noteq> 0)"
         using nz0 by auto
       then have "\<forall>\<^sub>F y in at x. y \<notin> S \<or> s y \<noteq> 0 \<or> blinfun_apply (Ds y) (f y) \<noteq> 0"
         apply -
         apply (erule disjE)
         subgoal by (rule eventually_elim2, assumption, assumption, blast)
         subgoal
           apply (erule disjE)
           subgoal by (rule eventually_elim2, assumption, assumption, blast)
           subgoal by (rule eventually_elim2, assumption, assumption, blast)
           done
         done
     }
     ultimately
     have "\<forall>\<^sub>F y in at x. (y \<notin> S \<or> s y \<noteq> 0 \<or> blinfun_apply (Ds y) (f y) \<noteq> 0) \<and> y \<in> X"
       by eventually_elim auto
   }
   then have "\<forall>\<^sub>F y in at x. \<forall>\<^sub>F t in at_right 0. flow0 y t \<notin> {x \<in> S. s x = 0}"
     apply eventually_elim
     by (rule flow_avoids_surface_eventually_at_right[where Ds=Ds]) (auto intro!: Ds DsC cS)
   moreover
   have at_eq: "(at x within cball x e) = at x"
     apply (rule at_within_interior)
     apply (auto simp: \<open>e > 0\<close>)
     done
   have "u x > 0"
     using u(1) by (auto simp: u rt cont_s' intro!: return_time_pos closed_levelset_within cS)
   then have "\<forall>\<^sub>F y in at x. u y > 0"
     apply (rule order_tendstoD[rotated])
     using u(4)
     apply (auto simp: continuous_on_def)
     apply (drule bspec[where x=x])
     using \<open>e > 0\<close>
     by (auto simp: at_eq)
   ultimately
   show "\<forall>\<^sub>F y in at x. returns_to ?P y"
     apply eventually_elim
     subgoal premises prems for y
       apply (rule returns_toI[where t="u y"])
       subgoal using prems  by auto
       subgoal apply (rule u) apply (rule prems) done
       subgoal using u(3)[of y] prems by auto
       subgoal using prems(3) by eventually_elim auto
       subgoal by simp
       done
     done
 qed
 
 lemma
   return_time_isCont_outside:
   fixes s::"'a::euclidean_space \<Rightarrow> real"
   assumes rt: "returns_to {x \<in> S. s x = 0} x" (is "returns_to ?P x")
   assumes cS: "closed S"
   assumes Ds: "\<And>x. (s has_derivative blinfun_apply (Ds x)) (at x)"
   assumes DsC: "\<And>x. isCont Ds x"
   assumes through: "(Ds (poincare_map ?P x)) (f (poincare_map ?P x)) \<noteq> 0"
   assumes eventually_inside: "\<forall>\<^sub>F x in at (poincare_map ?P x). s x = 0 \<longrightarrow> x \<in> S"
   assumes outside: "x \<notin> S \<or> s x \<noteq> 0"
   shows "isCont (return_time ?P) x"
   unfolding isCont_def
 proof (rule tendstoI)
   fix e_orig::real assume "e_orig > 0"
   define e where "e = e_orig / 2"
   have "e > 0" using \<open>e_orig > 0\<close> by (simp add: e_def)
 
   have cont_s: "continuous_on UNIV s" by (rule has_derivative_continuous_on[OF Ds])
   then have s_tendsto: "(s \<longlongrightarrow> s x) (at x)" for x
     by (auto simp: continuous_on_def)
   have cont_s': "continuous_on S s" by (rule continuous_on_subset[OF cont_s subset_UNIV])
   note cls[simp, intro] = closed_levelset_within[OF cont_s' cS(1)]
   have "{x. s x = 0} = s -` {0}" by auto
   have ret_exivl: "return_time ?P x \<in> existence_ivl0 x"
     by (rule return_time_exivl; fact)
   then have [intro, simp]: "x \<in> X" by auto
   have isCont_Ds_f: "isCont (\<lambda>s. Ds s (f s)) (poincare_map ?P x)"
     apply (auto intro!: continuous_intros DsC)
     apply (rule has_derivative_continuous)
     apply (rule derivative_rhs)
     by (auto simp: poincare_map_def intro!: flow_in_domain return_time_exivl assms)
 
   obtain u eu where u:
       "s (flow0 x (u x)) = 0"
       "u x = return_time ?P x"
       "(\<And>y. y \<in> cball x eu \<Longrightarrow> s (flow0 y (u y)) = 0)"
       "continuous_on (cball x eu) u"
       "(\<lambda>t. (t, u t)) ` cball x eu \<subseteq> Sigma X existence_ivl0"
       "0 < eu"
     by (rule returns_to_implicit_function[OF rt cS(1) Ds DsC through]; blast)
   have u_tendsto: "(u \<longlongrightarrow> u x) (at x)"
     unfolding isCont_def[symmetric]
     apply (rule continuous_on_interior[OF u(4)])
     using \<open>0 < eu\<close> by auto
   have "u x > 0" by (auto simp: u intro!: return_time_pos rt)
   from order_tendstoD(1)[OF u_tendsto this] have "\<forall>\<^sub>F x in at x. 0 < u x" .
   moreover have "\<forall>\<^sub>F y in at x. y \<in> cball x eu"
     using eventually_at_ball[OF \<open>0 < eu\<close>, of x]
     by eventually_elim auto
   moreover
   have "x \<notin> S \<or> s x \<noteq> 0 \<or> blinfun_apply (Ds x) (f x) \<noteq> 0" using outside by auto
   have returns: "\<forall>\<^sub>F y in at x. returns_to ?P y"
     by (rule eventually_returns_to; fact)
   moreover
   have "\<forall>\<^sub>F y in at x. y \<in> ball x eu"
     using eventually_at_ball[OF \<open>0 < eu\<close>]
     by eventually_elim simp
   then have ev_cball: "\<forall>\<^sub>F y in at x. y \<in> cball x eu"
     by eventually_elim (use \<open>e > 0\<close> in auto)
   have "continuous_on (ball x eu) u"
     using u by (auto simp: continuous_on_subset)
   then have [tendsto_intros]: "(u \<longlongrightarrow> u x) (at x)"
     using \<open>eu > 0\<close> at_within_open[of y "ball x eu" for y]
     by (auto simp: continuous_on_def)
   then have flow0_u_tendsto: "(\<lambda>x. flow0 x (u x)) \<midarrow>x\<rightarrow> poincare_map ?P x"
     by (auto intro!: tendsto_eq_intros u return_time_exivl rt simp: poincare_map_def)
   have s_imp: "s (poincare_map {x \<in> S. s x = 0} x) = 0 \<longrightarrow> poincare_map {x \<in> S. s x = 0} x \<in> S"
     using poincare_map_returns[OF rt]
     by auto
   from eventually_tendsto_compose_within[OF eventually_inside s_imp flow0_u_tendsto]
   have "\<forall>\<^sub>F x in at x. s (flow0 x (u x)) = 0 \<longrightarrow> flow0 x (u x) \<in> S" by auto
   with ev_cball
   have "\<forall>\<^sub>F x in at x. flow0 x (u x) \<in> S"
     by eventually_elim (auto simp: u)
   ultimately have u_returns_ge: "\<forall>\<^sub>F y in at x. returns_to ?P y \<and> return_time ?P y \<le> u y"
   proof eventually_elim
     case (elim y)
     then show ?case
       using u elim by (auto intro!: return_time_le[OF _ cls])
   qed
   moreover
   have "\<forall>\<^sub>F y in at x. u y - return_time ?P x < e"
     using tendstoD[OF u_tendsto \<open>0 < e\<close>, unfolded u] u_returns_ge
     by eventually_elim (auto simp: dist_real_def)
   moreover
   note 1 = outside
   define ml where "ml = max (return_time ?P x / 2) (return_time ?P x - e)"
   have [intro, simp, arith]: "0 < ml" "ml < return_time ?P x" "ml \<le> return_time ?P x"
     using return_time_pos[OF rt cls] \<open>0 < e\<close>
     by (auto simp: ml_def)
   have mt_in: "ml \<in> existence_ivl0 x"
     using \<open>0 < e\<close>
     by (auto intro!: mem_existence_ivl_iv_defined in_existence_between_zeroI[OF ret_exivl]
         simp: closed_segment_eq_real_ivl ml_def)
   from open_existence_ivlE[OF mt_in]
   obtain e0 where e0: "e0 > 0" "cball x e0 \<times> {0..ml + e0} \<subseteq> Sigma X existence_ivl0" (is "?D \<subseteq> _")
     by auto
   have uc: "uniformly_continuous_on ((\<lambda>(x, t). flow0 x t) ` ?D) s"
     apply (auto intro!: compact_uniformly_continuous continuous_on_subset[OF cont_s])
     apply (rule compact_continuous_image)
      apply (rule continuous_on_subset)
       apply (rule flow_continuous_on_state_space)
      apply (rule e0)
     apply (rule compact_Times)
      apply (rule compact_cball)
     apply (rule compact_Icc)
     done
   let ?T = "{0..ml}"
   have ul: "uniform_limit ?T flow0 (flow0 x) (at x)"
     using \<open>0 < e\<close>
     by (intro uniform_limit_flow)
       (auto intro!: mem_existence_ivl_iv_defined in_existence_between_zeroI[OF ret_exivl]
         simp: closed_segment_eq_real_ivl )
   have "\<forall>\<^sub>F y in at x. \<forall>t\<in>{0..ml}. flow0 y t \<in> - {x \<in> S. s x = 0}"
     apply (rule uniform_limit_in_open)
     apply (rule ul)
        apply (auto intro!: continuous_intros continuous_on_compose2[OF cont_s] simp:
         split: if_splits)
      apply (meson atLeastAtMost_iff contra_subsetD local.ivl_subset_existence_ivl mt_in)
     subgoal for t
       apply (cases "t = 0")
       subgoal using 1 by (simp)
       subgoal
         using return_time_least[OF rt cls, of t] \<open>ml < return_time {x \<in> S. s x = 0} x\<close>
         by auto
       done
     done
   then have "\<forall>\<^sub>F y in at x. return_time ?P y \<ge> return_time ?P x - e"
     using u_returns_ge
   proof eventually_elim
     case (elim y)
     have "return_time ?P x - e \<le> ml"
       by (auto simp: ml_def)
     also
     have ry: "returns_to ?P y" "return_time ?P y \<le> u y"
       using elim
       by auto
     have "ml < return_time ?P y"
       apply (rule return_time_gt[OF ry(1) cls])
       using elim
       by (auto simp: Ball_def)
     finally show ?case by simp
   qed
   ultimately
   have "\<forall>\<^sub>F y in at x. dist (return_time ?P y) (return_time ?P x) \<le> e"
     by eventually_elim (auto simp: dist_real_def abs_real_def algebra_simps)
   then show "\<forall>\<^sub>F y in at x. dist (return_time ?P y) (return_time ?P x) < e_orig"
     by eventually_elim (use \<open>e_orig > 0\<close> in \<open>auto simp: e_def\<close>)
 qed
 
 lemma isCont_poincare_map:
   assumes "isCont (return_time P) x"
     "returns_to P x" "closed P"
   shows "isCont (poincare_map P) x"
   unfolding poincare_map_def
   by (auto intro!: continuous_intros assms return_time_exivl)
 
 lemma poincare_map_tendsto:
   assumes "(return_time P \<longlongrightarrow> return_time P x) (at x within S)"
     "returns_to P x" "closed P"
   shows "(poincare_map P \<longlongrightarrow> poincare_map P x) (at x within S)"
   unfolding poincare_map_def
   by (rule tendsto_eq_intros refl assms return_time_exivl)+
 
 lemma
   return_time_continuous_below:
   fixes s::"'a::euclidean_space \<Rightarrow> real"
   assumes rt: "returns_to {x \<in> S. s x = 0} x" (is "returns_to ?P x")
   assumes Ds: "\<And>x. (s has_derivative blinfun_apply (Ds x)) (at x)"
   assumes cS: "closed S"
   assumes eventually_inside: "\<forall>\<^sub>F x in at (poincare_map ?P x). s x = 0 \<longrightarrow> x \<in> S"
   assumes DsC: "\<And>x. isCont Ds x"
   assumes through: "(Ds (poincare_map ?P x)) (f (poincare_map ?P x)) \<noteq> 0"
   assumes inside: "x \<in> S" "s x = 0" "Ds x (f x) < 0"
   shows "continuous (at x within {x. s x \<le> 0}) (return_time ?P)"
   unfolding continuous_within
 proof (rule tendstoI)
   fix e_orig::real assume "e_orig > 0"
   define e where "e = e_orig / 2"
   have "e > 0" using \<open>e_orig > 0\<close> by (simp add: e_def)
 
   note DsC_tendso[tendsto_intros] = isCont_tendsto_compose[OF DsC]
   have cont_s: "continuous_on UNIV s" by (rule has_derivative_continuous_on[OF Ds])
   then have s_tendsto: "(s \<longlongrightarrow> s x) (at x)" for x
     by (auto simp: continuous_on_def)
   note [continuous_intros] = continuous_on_compose2[OF cont_s _ subset_UNIV]
   note [derivative_intros] = has_derivative_compose[OF _ Ds]
   have cont_s': "continuous_on S s" by (rule continuous_on_subset[OF cont_s subset_UNIV])
   note cls[simp, intro] = closed_levelset_within[OF cont_s' cS(1)]
   have "{x. s x = 0} = s -` {0}" by auto
   have ret_exivl: "return_time ?P x \<in> existence_ivl0 x"
     by (rule return_time_exivl; fact)
   then have [intro, simp]: "x \<in> X" by auto
   have isCont_Ds_f: "isCont (\<lambda>s. Ds s (f s)) (poincare_map ?P x)"
     apply (auto intro!: continuous_intros DsC)
     apply (rule has_derivative_continuous)
     apply (rule derivative_rhs)
     by (auto simp: poincare_map_def intro!: flow_in_domain return_time_exivl assms)
 
   have "\<forall>\<^sub>F yt in at (x, 0) within UNIV \<times> {0<..}. (Ds (flow0 (fst yt) (snd yt))) (f (flow0 (fst yt) (snd yt))) < 0"
     by (rule order_tendstoD) (auto intro!: tendsto_eq_intros inside)
   moreover
   have "(x, 0) \<in> Sigma X existence_ivl0" by auto
   from topological_tendstoD[OF tendsto_ident_at open_state_space this, of "UNIV \<times> {0<..}"]
   have "\<forall>\<^sub>F yt in at (x, 0) within UNIV \<times> {0<..}. snd yt \<in> existence_ivl0 (fst yt)"
     by eventually_elim auto
   moreover
   from topological_tendstoD[OF tendsto_ident_at open_Times[OF open_dom open_UNIV], of "(x, 0)" "UNIV \<times> {0<..}"]
   have "\<forall>\<^sub>F yt in at (x, 0) within UNIV \<times> {0<..}. fst yt \<in> X"
     by (auto simp: mem_Times_iff)
   ultimately
   have "\<forall>\<^sub>F yt in at (x, 0) within UNIV \<times> {0<..}. (Ds (flow0 (fst yt) (snd yt))) (f (flow0 (fst yt) (snd yt))) < 0 \<and>
     snd yt \<in> existence_ivl0 (fst yt) \<and>
     0 \<in> existence_ivl0 (fst yt)"
     by eventually_elim auto
   then obtain d2 where "0 < d2" and
     d2_neg: "\<And>y t. (y, t) \<in> cball (x, 0) d2 \<Longrightarrow> 0 < t \<Longrightarrow> (Ds (flow0 y t)) (f (flow0 y t)) < 0"
     and d2_ex: "\<And>y t. (y, t) \<in> cball (x, 0) d2 \<Longrightarrow> 0 < t \<Longrightarrow> t \<in> existence_ivl0 y"
     and d2_ex0: "\<And>y t. (y, t::real) \<in> cball (x, 0) d2 \<Longrightarrow> 0 < t \<Longrightarrow> y \<in> X"
     by (auto simp: eventually_at_le dist_commute)
   define d where "d \<equiv> d2 / 2"
   from \<open>0 < d2\<close> have "d > 0" by (simp add: d_def)
   have d_neg: "dist y x< d \<Longrightarrow> 0 < t \<Longrightarrow> t \<le> d \<Longrightarrow> (Ds (flow0 y t)) (f (flow0 y t)) < 0" for y t
     using d2_neg[of y t, OF subsetD[OF cball_times_subset[of x d2 0]]]
     by (auto simp: d_def dist_commute)
   have d_ex: "t \<in> existence_ivl0 y" if "dist y x< d" "0 \<le> t" "t \<le> d" for y t
   proof cases
     assume "t = 0"
     have "sqrt ((dist x y)\<^sup>2 + (d2 / 2)\<^sup>2) \<le> dist x y + d2/2"
       using \<open>0 < d2\<close>
       by (intro sqrt_sum_squares_le_sum) auto
     also have "dist x y \<le> d2 / 2"
       using that by (simp add: d_def dist_commute)
     finally have "sqrt ((dist x y)\<^sup>2 + (d2 / 2)\<^sup>2) \<le> d2" by simp
     with \<open>t = 0\<close> show ?thesis
       using d2_ex[of y t, OF subsetD[OF cball_times_subset[of x d2 0]]] d2_ex0[of y d] \<open>0 < d2\<close>
       by (auto simp: d_def dist_commute dist_prod_def)
   next
     assume "t \<noteq> 0"
     then show ?thesis
       using d2_ex[of y t, OF subsetD[OF cball_times_subset[of x d2 0]]] that
       by (auto simp: d_def dist_commute)
   qed
   have d_mvt: "s (flow0 y t) < s y" if "0 < t" "t \<le> d" "dist y x < d" for y t
   proof -
     have c: "continuous_on {0 .. t} (\<lambda>t. s (flow0 y t))"
       using that
       by (auto intro!: continuous_intros d_ex)
     have d: "\<And>x. \<lbrakk>0 < x; x < t\<rbrakk> \<Longrightarrow> ((\<lambda>t. s (flow0 y t)) has_derivative (\<lambda>t. t * blinfun_apply (Ds (flow0 y x)) (f (flow0 y x)))) (at x)"
       using that
       by (auto intro!: derivative_eq_intros d_ex simp: flowderiv_def blinfun.bilinear_simps)
     from mvt[OF \<open>0 < t\<close> c d]
     obtain xi where xi: "0 < xi" "xi < t" and "s (flow0 y t) - s (flow0 y 0) = t * blinfun_apply (Ds (flow0 y xi)) (f (flow0 y xi))"
       by auto
     note this(3)
     also have "\<dots> < 0"
       using \<open>0 < t\<close>
       apply (rule mult_pos_neg)
       apply (rule d_neg)
       using that xi by auto
     also have "flow0 y 0 = y"
       apply (rule flow_initial_time)
       apply auto
       using \<open>0 < d\<close> d_ex that(3) by fastforce
     finally show ?thesis
       by (auto simp: )
   qed
   obtain u eu where u:
       "s (flow0 x (u x)) = 0"
       "u x = return_time ?P x"
       "(\<And>y. y \<in> cball x eu \<Longrightarrow> s (flow0 y (u y)) = 0)"
       "continuous_on (cball x eu) u"
       "(\<lambda>t. (t, u t)) ` cball x eu \<subseteq> Sigma X existence_ivl0"
       "0 < eu"
     by (rule returns_to_implicit_function[OF rt cS(1) Ds DsC through]; blast)
   have u_tendsto: "(u \<longlongrightarrow> u x) (at x)"
     unfolding isCont_def[symmetric]
     apply (rule continuous_on_interior[OF u(4)])
     using \<open>0 < eu\<close> by auto
   have "u x > 0" by (auto simp: u intro!: return_time_pos rt)
   from order_tendstoD(1)[OF u_tendsto this] have "\<forall>\<^sub>F x in at x. 0 < u x" .
   moreover have "\<forall>\<^sub>F y in at x. y \<in> cball x eu"
     using eventually_at_ball[OF \<open>0 < eu\<close>, of x]
     by eventually_elim auto
   moreover
   have "x \<notin> S \<or> s x \<noteq> 0 \<or> blinfun_apply (Ds x) (f x) \<noteq> 0" using inside by auto
   have returns: "\<forall>\<^sub>F y in at x. returns_to ?P y"
     by (rule eventually_returns_to; fact)
   moreover
   have "\<forall>\<^sub>F y in at x. y \<in> ball x eu"
     using eventually_at_ball[OF \<open>0 < eu\<close>]
     by eventually_elim simp
   then have ev_cball: "\<forall>\<^sub>F y in at x. y \<in> cball x eu"
     by eventually_elim (use \<open>e > 0\<close> in auto)
   have "continuous_on (ball x eu) u"
     using u by (auto simp: continuous_on_subset)
   then have [tendsto_intros]: "(u \<longlongrightarrow> u x) (at x)"
     using \<open>eu > 0\<close> at_within_open[of y "ball x eu" for y]
     by (auto simp: continuous_on_def)
   then have flow0_u_tendsto: "(\<lambda>x. flow0 x (u x)) \<midarrow>x\<rightarrow> poincare_map ?P x"
     by (auto intro!: tendsto_eq_intros u return_time_exivl rt simp: poincare_map_def)
   have s_imp: "s (poincare_map {x \<in> S. s x = 0} x) = 0 \<longrightarrow> poincare_map {x \<in> S. s x = 0} x \<in> S"
     using poincare_map_returns[OF rt]
     by auto
   from eventually_tendsto_compose_within[OF eventually_inside s_imp flow0_u_tendsto]
   have "\<forall>\<^sub>F x in at x. s (flow0 x (u x)) = 0 \<longrightarrow> flow0 x (u x) \<in> S" by auto
   with ev_cball
   have "\<forall>\<^sub>F x in at x. flow0 x (u x) \<in> S"
     by eventually_elim (auto simp: u)
   ultimately have u_returns_ge: "\<forall>\<^sub>F y in at x. returns_to ?P y \<and> return_time ?P y \<le> u y"
   proof eventually_elim
     case (elim y)
     then show ?case
       using u elim by (auto intro!: return_time_le[OF _ cls])
   qed
   moreover
   have "\<forall>\<^sub>F y in at x. u y - return_time ?P x < e"
     using tendstoD[OF u_tendsto \<open>0 < e\<close>, unfolded u] u_returns_ge
     by eventually_elim (auto simp: dist_real_def)
   moreover
   have d_less: "d < return_time ?P x"
     apply (rule return_time_gt)
       apply fact apply fact
     subgoal for t
       using d_mvt[of t x] \<open>s x = 0\<close> \<open>0 < d\<close>
       by auto
     done
   note 1 = inside
   define ml where "ml = Max {return_time ?P x / 2, return_time ?P x - e, d}"
   have [intro, simp, arith]: "0 < ml" "ml < return_time ?P x" "ml \<le> return_time ?P x" "d \<le> ml"
     using return_time_pos[OF rt cls] \<open>0 < e\<close> d_less
     by (auto simp: ml_def)
   have mt_in: "ml \<in> existence_ivl0 x"
     using \<open>0 < e\<close> \<open>0 < d\<close> d_less
     by (auto intro!: mem_existence_ivl_iv_defined in_existence_between_zeroI[OF ret_exivl]
         simp: closed_segment_eq_real_ivl ml_def)
   from open_existence_ivlE[OF mt_in]
   obtain e0 where e0: "e0 > 0" "cball x e0 \<times> {0..ml + e0} \<subseteq> Sigma X existence_ivl0" (is "?D \<subseteq> _")
     by auto
   have uc: "uniformly_continuous_on ((\<lambda>(x, t). flow0 x t) ` ?D) s"
     apply (auto intro!: compact_uniformly_continuous continuous_on_subset[OF cont_s])
     apply (rule compact_continuous_image)
      apply (rule continuous_on_subset)
       apply (rule flow_continuous_on_state_space)
      apply (rule e0)
     apply (rule compact_Times)
      apply (rule compact_cball)
     apply (rule compact_Icc)
     done
   let ?T = "{d..ml}"
   have ul: "uniform_limit ?T flow0 (flow0 x) (at x)"
     using \<open>0 < e\<close> \<open>0 < d\<close> d_less
     by (intro uniform_limit_flow)
       (auto intro!: mem_existence_ivl_iv_defined in_existence_between_zeroI[OF ret_exivl]
         simp: closed_segment_eq_real_ivl )
   {
     have "\<forall>\<^sub>F y in at x within {x. s x \<le> 0}. y \<in> X"
       by (rule topological_tendstoD[OF tendsto_ident_at open_dom \<open>x \<in> X\<close>])
     moreover
     have "\<forall>\<^sub>F y in at x within {x. s x \<le> 0}. s y \<le> 0"
       by (auto simp: eventually_at)
     moreover
     have "\<forall>\<^sub>F y in at x within {x. s x \<le> 0}. Ds y (f y) < 0"
       by (rule order_tendstoD) (auto intro!: tendsto_eq_intros inside)
     moreover
     from tendstoD[OF tendsto_ident_at \<open>0 < d\<close>]
     have "\<forall>\<^sub>F y in at x within {x. s x \<le> 0}. dist y x < d"
       by (auto simp: )
     moreover
     have "d \<in> existence_ivl0 x"
       using d_ex[of x d] \<open>0 < d\<close> by auto
     have dret: "returns_to {x\<in>S. s x = 0} (flow0 x d)"
       apply (rule returns_to_laterI)
           apply fact+
       subgoal for u
         using d_mvt[of u x] \<open>s x = 0\<close>
         by auto
       done
     have "\<forall>\<^sub>F y in at x. \<forall>t\<in>{d..ml}. flow0 y t \<in> - {x \<in> S. s x = 0}"
       apply (rule uniform_limit_in_open)
            apply (rule ul)
           apply (auto intro!: continuous_intros continuous_on_compose2[OF cont_s] simp:
           split: if_splits)
       using \<open>d \<in> existence_ivl0 x\<close> mem_is_interval_1_I mt_in apply blast
       subgoal for t
         using return_time_least[OF rt cls, of t] \<open>ml < return_time {x \<in> S. s x = 0} x\<close> \<open>0 < d\<close>
         by auto
       done
     then have "\<forall>\<^sub>F y in at x within {x. s x \<le> 0}. \<forall>t\<in>{d .. ml}. flow0 y t \<in> - {x \<in> S. s x = 0}"
       by (auto simp add: eventually_at; force)
     ultimately
     have "\<forall>\<^sub>F y in at x within {x. s x \<le> 0}. \<forall>t\<in>{0<..ml}. flow0 y t \<in> - {x \<in> S. s x = 0}"
       apply eventually_elim
       apply auto
       using d_mvt
       by fastforce
     moreover
     have "\<forall>\<^sub>F y in at x. returns_to ?P y"
       by fact
     then have "\<forall>\<^sub>F y in at x within {x. s x \<le> 0}. returns_to ?P y"
       by (auto simp: eventually_at)
     ultimately
     have "\<forall>\<^sub>F y in at x within {x. s x \<le> 0}. return_time ?P y > ml"
       apply eventually_elim
       apply (rule return_time_gt)
       by auto
   }
   then have "\<forall>\<^sub>F y in at x within {x. s x \<le> 0}. return_time ?P y \<ge> return_time ?P x - e"
     by eventually_elim (auto simp: ml_def)
   ultimately
   have "\<forall>\<^sub>F y in at x within {x . s x \<le> 0}. dist (return_time ?P y) (return_time ?P x) \<le> e"
     unfolding eventually_at_filter
     by eventually_elim (auto simp: dist_real_def abs_real_def algebra_simps)
   then show "\<forall>\<^sub>F y in at x within {x. s x \<le> 0}. dist (return_time ?P y) (return_time ?P x) < e_orig"
     by eventually_elim (use \<open>e_orig > 0\<close> in \<open>auto simp: e_def\<close>)
 qed
 
 lemma
   return_time_continuous_below_plane:
   fixes s::"'a::euclidean_space \<Rightarrow> real"
   assumes rt: "returns_to {x \<in> R. x \<bullet> n = c} x" (is "returns_to ?P x")
   assumes cR: "closed R"
   assumes through: "f (poincare_map ?P x) \<bullet> n \<noteq> 0"
   assumes R: "x \<in> R"
   assumes inside: "x \<bullet> n = c" "f x \<bullet> n < 0"
   assumes eventually_inside: "\<forall>\<^sub>F x in at (poincare_map ?P x). x \<bullet> n = c \<longrightarrow> x \<in> R"
   shows "continuous (at x within {x. x \<bullet> n \<le> c}) (return_time ?P)"
   apply (rule return_time_continuous_below[of R "\<lambda>x. x \<bullet> n - c", simplified])
   using through rt inside cR R eventually_inside
   by (auto intro!: derivative_eq_intros blinfun_inner_left.rep_eq[symmetric])
 
 lemma
   poincare_map_in_interior_eventually_return_time_equal:
   assumes RP: "R \<subseteq> P"
   assumes cP: "closed P"
   assumes cR: "closed R"
   assumes ret: "returns_to P x"
   assumes evret: "\<forall>\<^sub>F x in at x within S. returns_to P x"
   assumes evR: "\<forall>\<^sub>F x in at x within S. poincare_map P x \<in> R"
   shows "\<forall>\<^sub>F x in at x within S. returns_to R x \<and> return_time P x = return_time R x"
 proof -
   from evret evR
   show ?thesis
   proof eventually_elim
     case (elim x)
     from return_time_least[OF elim(1) cP] RP
     have rtl: "\<And>s. 0 < s \<Longrightarrow> s < return_time P x \<Longrightarrow> flow0 x s \<notin> R"
       by auto
     from elim(2) have pR: "poincare_map P x \<in> R"
       by auto
     have "\<forall>\<^sub>F t in at_right 0. 0 < t"
       by (simp add: eventually_at_filter)
     moreover have "\<forall>\<^sub>F t in at_right 0. t < return_time P x"
       using return_time_pos[OF elim(1) cP]
       by (rule order_tendstoD[OF tendsto_ident_at])
     ultimately have evR: "\<forall>\<^sub>F t in at_right 0. flow0 x t \<notin> R"
     proof eventually_elim
       case et: (elim t)
       from return_time_least[OF elim(1) cP et] show ?case using RP by auto
     qed
     have rtp: "0 < return_time P x" by (intro return_time_pos cP elim)
     have rtex: "return_time P x \<in> existence_ivl0 x" by (intro return_time_exivl elim cP)
     have frR: "flow0 x (return_time P x) \<in> R"
       unfolding poincare_map_def[symmetric] by (rule pR)
     have "returns_to R x"
       by (rule returns_toI[where t="return_time P x"]; fact)
     moreover have "return_time R x = return_time P x"
       by (rule return_time_eqI) fact+
     ultimately show ?case by auto
   qed
 qed
 
 lemma poincare_map_in_planeI:
   assumes "returns_to (plane n c) x0"
   shows "poincare_map (plane n c) x0 \<bullet> n = c"
   using poincare_map_returns[OF assms]
   by fastforce
 
 lemma less_return_time_imp_exivl:
   "h \<in> existence_ivl0 x'" if "h \<le> return_time P x'" "returns_to P x'" "closed P" "0 \<le> h"
 proof -
   from return_time_exivl[OF that(2,3)]
   have "return_time P x' \<in> existence_ivl0 x'" by auto
   from ivl_subset_existence_ivl[OF this] that show ?thesis
     by auto
 qed
 
 lemma eventually_returns_to_continuousI:
   assumes "returns_to P x"
   assumes "closed P"
   assumes "continuous (at x within S) (return_time P)"
   shows "\<forall>\<^sub>F x in at x within S. returns_to P x"
 proof -
   have "return_time P x > 0"
     using assms by (auto simp: return_time_pos)
   from order_tendstoD(1)[OF assms(3)[unfolded continuous_within] this]
   have "\<forall>\<^sub>F x in at x within S. 0 < return_time P x" .
   then show ?thesis
     by eventually_elim (auto simp: return_time_pos_returns_to)
 qed
 
 lemma return_time_implicit_functionE:
   fixes s::"'a::euclidean_space \<Rightarrow> real"
   assumes rt: "returns_to {x \<in> S. s x = 0} x" (is "returns_to ?P _")
   assumes cS: "closed S"
   assumes Ds: "\<And>x. (s has_derivative blinfun_apply (Ds x)) (at x)"
   assumes DsC: "\<And>x. isCont Ds x"
   assumes Ds_through: "(Ds (poincare_map ?P x)) (f (poincare_map ?P x)) \<noteq> 0"
   assumes eventually_inside: "\<forall>\<^sub>F x in at (poincare_map ?P x). s x = 0 \<longrightarrow> x \<in> S"
   assumes outside: "x \<notin> S \<or> s x \<noteq> 0"
   obtains e' where
     "0 < e'"
     "\<And>y. y \<in> ball x e' \<Longrightarrow> returns_to ?P y"
     "\<And>y. y \<in> ball x e' \<Longrightarrow> s (flow0 y (return_time ?P y)) = 0"
     "continuous_on (ball x e') (return_time ?P)"
     "(\<And>y. y \<in> ball x e' \<Longrightarrow> Ds (poincare_map ?P y) o\<^sub>L flowderiv y (return_time ?P y) o\<^sub>L embed2_blinfun \<in> invertibles_blinfun)"
     "(\<And>U v sa.
        (\<And>sa. sa \<in> U \<Longrightarrow> s (flow0 sa (v sa)) = 0) \<Longrightarrow>
        return_time ?P x = v x \<Longrightarrow>
        continuous_on U v \<Longrightarrow> sa \<in> U \<Longrightarrow> x \<in> U \<Longrightarrow> U \<subseteq> ball x e' \<Longrightarrow> connected U \<Longrightarrow> open U \<Longrightarrow> return_time ?P sa = v sa)"
     "(return_time ?P has_derivative
         - blinfun_scaleR_left (inverse ((Ds (poincare_map ?P x)) (f (poincare_map ?P x)))) o\<^sub>L
               (Ds (poincare_map ?P x) o\<^sub>L Dflow x (return_time ?P x)))
             (at x)"
 proof -
   have cont_s: "continuous_on UNIV s" by (rule has_derivative_continuous_on[OF Ds])
   then have s_tendsto: "(s \<longlongrightarrow> s x) (at x)" for x
     by (auto simp: continuous_on_def)
   have cls[simp, intro]: "closed {x \<in> S. s x = 0}"
     by (rule closed_levelset_within) (auto intro!: cS continuous_on_subset[OF cont_s])
 
   have cont_Ds: "continuous_on UNIV Ds"
     using DsC by (auto simp: continuous_on_def isCont_def)
   note [tendsto_intros] = continuous_on_tendsto_compose[OF cont_Ds _ UNIV_I, simplified]
   note [continuous_intros] = continuous_on_compose2[OF cont_Ds _ subset_UNIV]
 
   have "\<forall>\<^sub>F x in at (poincare_map ?P x). s x = 0 \<longrightarrow> x \<in> S"
     using eventually_inside
     by auto
   then obtain U where "open U" "poincare_map ?P x \<in> U" "\<And>x. x \<in> U \<Longrightarrow> s x = 0 \<Longrightarrow> x \<in> S"
     using poincare_map_returns[OF rt cls]
     by (force simp: eventually_at_topological)
   have s_imp: "s (poincare_map ?P x) = 0 \<longrightarrow> poincare_map ?P x \<in> S"
     using poincare_map_returns[OF rt cls]
     by auto
   have outside_disj: "x \<notin> S \<or> s x \<noteq> 0 \<or> blinfun_apply (Ds x) (f x) \<noteq> 0"
     using outside by auto
   have pm_tendsto: "(poincare_map ?P \<longlongrightarrow> poincare_map ?P x) (at x)"
     apply (rule poincare_map_tendsto)
     unfolding isCont_def[symmetric]
       apply (rule return_time_isCont_outside)
     using assms
     by (auto intro!: cls )
   have evmemS: "\<forall>\<^sub>F x in at x. poincare_map ?P x \<in> S"
     using eventually_returns_to[OF rt cS Ds DsC eventually_inside Ds_through outside_disj]
     apply eventually_elim
     using poincare_map_returns
     by auto
   have "\<forall>\<^sub>F x in at x. \<forall>\<^sub>F x in at (poincare_map ?P x). s x = 0 \<longrightarrow> x \<in> S"
     apply (rule eventually_tendsto_compose_within[OF _ _ pm_tendsto])
       apply (rule eventually_eventually_withinI)
        apply (rule eventually_inside)
       apply (rule s_imp)
      apply (rule eventually_inside)
     apply (rule evmemS)
     done
   moreover
   have "eventually (\<lambda>x. x \<in> - ?P) (at x)"
     apply (rule topological_tendstoD)
     using outside
     by (auto intro!: )
   then have "eventually (\<lambda>x. x \<notin> S \<or> s x \<noteq> 0) (at x)"
     by auto
   moreover
   have "eventually (\<lambda>x. (Ds (poincare_map ?P x)) (f (poincare_map ?P x)) \<noteq> 0) (at x)"
     apply (rule tendsto_imp_eventually_ne)
      apply (rule tendsto_intros)
      apply (rule tendsto_intros)
     unfolding poincare_map_def
       apply (rule tendsto_intros)
         apply (rule tendsto_intros)
        apply (subst isCont_def[symmetric])
        apply (rule return_time_isCont_outside[OF rt cS Ds DsC Ds_through eventually_inside outside])
       apply (rule return_time_exivl[OF rt cls])
       apply (rule tendsto_intros)
         apply (rule tendsto_intros)
         apply (rule tendsto_intros)
        apply (subst isCont_def[symmetric])
        apply (rule return_time_isCont_outside[OF rt cS Ds DsC Ds_through eventually_inside outside])
       apply (rule return_time_exivl[OF rt cls])
      apply (rule flow_in_domain)
      apply (rule return_time_exivl[OF rt cls])
     unfolding poincare_map_def[symmetric]
     apply (rule Ds_through)
     done
   ultimately
   have "eventually (\<lambda>y. returns_to ?P y \<and> (\<forall>\<^sub>F x in at (poincare_map ?P y). s x = 0 \<longrightarrow> x \<in> S) \<and>
     (y \<notin> S \<or> s y \<noteq> 0) \<and> (Ds (poincare_map ?P y)) (f (poincare_map ?P y)) \<noteq> 0) (at x)"
     using eventually_returns_to[OF rt cS Ds DsC eventually_inside Ds_through outside_disj]
     by eventually_elim auto
   then obtain Y' where Y': "open Y'" "x \<in> Y'" "\<And>y. y \<in> Y' \<Longrightarrow> returns_to ?P y"
       "\<And>y. y \<in> Y' \<Longrightarrow> (\<forall>\<^sub>F x in at (poincare_map ?P y). s x = 0 \<longrightarrow> x \<in> S)"
       "\<And>y. y \<in> Y' \<Longrightarrow> y \<notin> S \<or> s y \<noteq> 0"
       "\<And>y. y \<in> Y' \<Longrightarrow> blinfun_apply (Ds (poincare_map ?P y)) (f (poincare_map ?P y)) \<noteq> 0"
     apply (subst (asm) (3) eventually_at_topological)
     using rt outside Ds_through eventually_inside
     by fastforce
   from openE[OF \<open>open Y'\<close> \<open>x \<in> Y'\<close>] obtain eY where eY: "0 < eY" "ball x eY \<subseteq> Y'" by auto
   define Y where "Y = ball x eY"
   then have Y: "open Y" and x: "x \<in> Y"
       and Yr: "\<And>y. y \<in> Y \<Longrightarrow> returns_to ?P y"
       and Y_mem: "\<And>y. y \<in> Y \<Longrightarrow> (\<forall>\<^sub>F x in at (poincare_map ?P y). s x = 0 \<longrightarrow> x \<in> S)"
       and Y_nz: "\<And>y. y \<in> Y \<Longrightarrow> y \<notin> S \<or> s y \<noteq> 0"
       and Y_fnz: "\<And>y. y \<in> Y \<Longrightarrow> Ds (poincare_map ?P y) (f (poincare_map ?P y)) \<noteq> 0"
       and Y_convex: "convex Y"
     using Y' eY
     by (auto simp: subset_iff dist_commute)
   have "isCont (return_time ?P) y" if "y \<in> Y" for y
     using return_time_isCont_outside[OF Yr[OF that] cS Ds DsC Y_fnz Y_mem Y_nz, OF that that that] .
   then have cY: "continuous_on Y (return_time ?P)"
     by (auto simp: continuous_on_def isCont_def Lim_at_imp_Lim_at_within)
 
   note [derivative_intros] = has_derivative_compose[OF _ Ds]
   let ?t1 = "return_time ?P x"
   have t1_exivl: "?t1 \<in> existence_ivl0 x"
     by (auto intro!: return_time_exivl rt)
   then have [simp]: "x \<in> X" by auto
   have xt1: "(x, ?t1) \<in> Sigma Y existence_ivl0"
     by (auto intro!: return_time_exivl rt x)
   have "Sigma Y existence_ivl0 = Sigma X existence_ivl0 \<inter> fst -` Y" by auto
   also have "open \<dots>"
     by (rule open_Int[OF open_state_space open_vimage_fst[OF \<open>open Y\<close>]])
   finally have "open (Sigma Y existence_ivl0)" .
   have D: "(\<And>x. x \<in> Sigma Y existence_ivl0 \<Longrightarrow>
       ((\<lambda>(x, t). s (flow0 x t)) has_derivative
        blinfun_apply (Ds (flow0 (fst x) (snd x)) o\<^sub>L (flowderiv (fst x) (snd x))))
        (at x))"
     by (auto intro!: derivative_eq_intros)
   have C: "continuous_on (Sigma Y existence_ivl0) (\<lambda>x. Ds (flow0 (fst x) (snd x)) o\<^sub>L flowderiv (fst x) (snd x))"
     by (auto intro!: continuous_intros)
   from return_time_returns[OF rt cls]
   have Z: "(case (x, ?t1) of (x, t) \<Rightarrow> s (flow0 x t)) = 0"
     by (auto simp: x)
   have I1: "blinfun_scaleR_left (inverse (Ds (flow0 x (?t1))(f (flow0 x (?t1))))) o\<^sub>L 
     ((Ds (flow0 (fst (x, return_time ?P x))
             (snd (x, return_time ?P x))) o\<^sub>L
        flowderiv (fst (x, return_time ?P x))
         (snd (x, return_time ?P x))) o\<^sub>L
       embed2_blinfun)
      = 1\<^sub>L"
     using Ds_through
     by (auto intro!: blinfun_eqI
         simp: rt flowderiv_def blinfun.bilinear_simps inverse_eq_divide poincare_map_def)
   have I2: "((Ds (flow0 (fst (x, return_time ?P x))
             (snd (x, return_time ?P x))) o\<^sub>L
        flowderiv (fst (x, return_time ?P x))
         (snd (x, return_time ?P x))) o\<^sub>L
       embed2_blinfun) o\<^sub>L blinfun_scaleR_left (inverse (Ds (flow0 x (?t1))(f (flow0 x (?t1)))))
      = 1\<^sub>L"
     using Ds_through
     by (auto intro!: blinfun_eqI
         simp: rt flowderiv_def blinfun.bilinear_simps inverse_eq_divide poincare_map_def)
   obtain u e where u:
       "s (flow0 x (u x)) = 0"
        "u x = return_time ?P x"
        "(\<And>sa. sa \<in> cball x e \<Longrightarrow> s (flow0 sa (u sa)) = 0)"
        "continuous_on (cball x e) u"
        "(\<lambda>t. (t, u t)) ` cball x e \<subseteq> Sigma Y existence_ivl0"
        "0 < e"
        "(u has_derivative
             blinfun_apply
              (- blinfun_scaleR_left
                  (inverse (blinfun_apply (Ds (poincare_map ?P x)) (f (poincare_map ?P x)))) o\<^sub>L
               (Ds (poincare_map ?P x) o\<^sub>L flowderiv x (return_time ?P x)) o\<^sub>L
               embed1_blinfun))
             (at x)"
        "(\<And>s. s \<in> cball x e \<Longrightarrow>
          Ds (flow0 s (u s)) o\<^sub>L flowderiv s (u s) o\<^sub>L embed2_blinfun \<in> invertibles_blinfun)"
       and unique: "(\<And>U v sa.
                (\<And>sa. sa \<in> U \<Longrightarrow> s (flow0 sa (v sa)) = 0) \<Longrightarrow>
                u x = v x \<Longrightarrow>
                continuous_on U v \<Longrightarrow> sa \<in> U \<Longrightarrow> x \<in> U \<Longrightarrow> U \<subseteq> cball x e \<Longrightarrow> connected U \<Longrightarrow> open U \<Longrightarrow> u sa = v sa)"
     apply (rule implicit_function_theorem_unique[where f="\<lambda>(x, t). s (flow0 x t)"
           and S="Sigma Y existence_ivl0", OF D xt1 \<open>open (Sigma Y _)\<close> order_refl C Z I1 I2])
      apply blast
     unfolding split_beta' fst_conv snd_conv poincare_map_def[symmetric]
     apply (rule)
     by (assumption+, blast)
   have u_rt: "u y = return_time ?P y" if "y \<in> ball x e \<inter> Y" for y
     apply (rule unique[of "ball x e \<inter> Y" "return_time ?P"])
     subgoal for y
       unfolding poincare_map_def[symmetric]
       using poincare_map_returns[OF Yr cls]
       by auto
     subgoal by (auto simp: u)
     subgoal using cY by (rule continuous_on_subset) auto
     subgoal using that by auto
     subgoal using x \<open>0 < e\<close> by auto
     subgoal by auto
     subgoal
       apply (rule convex_connected)
       apply (rule convex_Int)
        apply simp
       apply fact
       done
     subgoal by (auto intro!: open_Int \<open>open Y\<close>)
     done
 
   have *: "(- blinfun_scaleR_left
                  (inverse (blinfun_apply (Ds (poincare_map ?P x)) (f (poincare_map ?P x)))) o\<^sub>L
               (Ds (poincare_map ?P x) o\<^sub>L flowderiv x (return_time ?P x)) o\<^sub>L
               embed1_blinfun) =
     - blinfun_scaleR_left (inverse (blinfun_apply (Ds (poincare_map ?P x)) (f (poincare_map ?P x)))) o\<^sub>L
               (Ds (poincare_map ?P x) o\<^sub>L Dflow x (return_time ?P x))"
     by (auto intro!: blinfun_eqI simp: flowderiv_def)
   define e' where "e' = min e eY"
   have e'_eq: "ball x e' = ball x e \<inter> Y" by (auto simp: e'_def Y_def)
   have
     "0 < e'"
     "\<And>y. y \<in> ball x e' \<Longrightarrow> returns_to ?P y"
     "\<And>y. y \<in> ball x e' \<Longrightarrow> s (flow0 y (return_time ?P y)) = 0"
     "continuous_on (ball x e') (return_time ?P)"
     "(\<And>y. y \<in> ball x e' \<Longrightarrow> Ds (poincare_map ?P y) o\<^sub>L flowderiv y (return_time ?P y) o\<^sub>L embed2_blinfun \<in> invertibles_blinfun)"
     "(\<And>U v sa.
        (\<And>sa. sa \<in> U \<Longrightarrow> s (flow0 sa (v sa)) = 0) \<Longrightarrow>
        return_time ?P x = v x \<Longrightarrow>
        continuous_on U v \<Longrightarrow> sa \<in> U \<Longrightarrow> x \<in> U \<Longrightarrow> U \<subseteq> ball x e' \<Longrightarrow> connected U \<Longrightarrow> open U \<Longrightarrow> return_time ?P sa = v sa)"
     "(return_time ?P has_derivative blinfun_apply
              (- blinfun_scaleR_left
                  (inverse (blinfun_apply (Ds (poincare_map ?P x)) (f (poincare_map ?P x)))) o\<^sub>L
               (Ds (poincare_map ?P x) o\<^sub>L flowderiv x (return_time ?P x)) o\<^sub>L
               embed1_blinfun))
             (at x)"
     unfolding e'_eq
     subgoal by (auto simp: e'_def \<open>0 < e\<close> \<open>0 < eY\<close>)
     subgoal by (rule Yr) auto
     subgoal for y
       unfolding poincare_map_def[symmetric]
       using poincare_map_returns[OF Yr cls]
       by auto
     subgoal using cY by (rule continuous_on_subset) auto
     subgoal premises prems for y
       unfolding poincare_map_def
       unfolding u_rt[OF prems, symmetric]
       apply (rule u)
       using prems by auto
     subgoal premises prems for U v t
       apply (subst u_rt[symmetric])
       subgoal using prems by force
       apply (rule unique[of U v])
       subgoal by fact
       subgoal by (auto simp: u prems)
       subgoal by fact
       subgoal by fact
       subgoal by fact
       subgoal using prems by auto
       subgoal by fact
       subgoal by fact
       done
     subgoal
     proof -
       have "\<forall>\<^sub>F x' in at x. x' \<in> ball x e'"
         using eventually_at_ball[OF \<open>0 < e'\<close>]
         by eventually_elim simp
       then have "\<forall>\<^sub>F x' in at x. u x' = return_time ?P x'"
         unfolding e'_eq
         by eventually_elim (rule u_rt, auto)
       from u(7) this
       show ?thesis
         by (rule has_derivative_transform_eventually) (auto simp: u)
     qed
     done
   then show ?thesis unfolding * ..
 qed
 
 lemma return_time_has_derivative:
   fixes s::"'a::euclidean_space \<Rightarrow> real"
   assumes rt: "returns_to {x \<in> S. s x = 0} x" (is "returns_to ?P _")
   assumes cS: "closed S"
   assumes Ds: "\<And>x. (s has_derivative blinfun_apply (Ds x)) (at x)"
   assumes DsC: "\<And>x. isCont Ds x"
   assumes Ds_through: "(Ds (poincare_map ?P x)) (f (poincare_map ?P x)) \<noteq> 0"
   assumes eventually_inside: "\<forall>\<^sub>F x in at (poincare_map {x \<in> S. s x = 0} x). s x = 0 \<longrightarrow> x \<in> S"
   assumes outside: "x \<notin> S \<or> s x \<noteq> 0"
   shows "(return_time ?P has_derivative
   - blinfun_scaleR_left (inverse ((Ds (poincare_map ?P x)) (f (poincare_map ?P x)))) o\<^sub>L
       (Ds (poincare_map ?P x) o\<^sub>L Dflow x (return_time ?P x)))
             (at x)"
   using return_time_implicit_functionE[OF assms] by blast
 
 lemma return_time_plane_has_derivative_blinfun:
   assumes rt: "returns_to {x \<in> S. x \<bullet> i = c} x" (is "returns_to ?P _")
   assumes cS: "closed S"
   assumes fnz: "f (poincare_map ?P x) \<bullet> i \<noteq> 0"
   assumes eventually_inside: "\<forall>\<^sub>F x in at (poincare_map ?P x). x \<bullet> i = c \<longrightarrow> x \<in> S"
   assumes outside: "x \<notin> S \<or> x \<bullet> i \<noteq> c"
   shows "(return_time ?P has_derivative
     (- blinfun_scaleR_left (inverse ((blinfun_inner_left i) (f (poincare_map ?P x)))) o\<^sub>L
       (blinfun_inner_left i o\<^sub>L Dflow x (return_time ?P x)))) (at x)"
 proof -
   have rt: "returns_to {x \<in> S. x \<bullet> i - c = 0} x"
     using rt by auto
   have D: "((\<lambda>x. x \<bullet> i - c) has_derivative blinfun_inner_left i) (at x)" for x
     by (auto intro!: derivative_eq_intros)
   have DC: "(\<And>x. isCont (\<lambda>x. blinfun_inner_left i) x)"
     by (auto intro!: continuous_intros)
   have nz: "blinfun_apply (blinfun_inner_left i) (f (poincare_map {x \<in> S. x \<bullet> i - c = 0} x)) \<noteq> 0"
     using fnz by (auto )
   from cS have cS: "closed S"by auto
   have out: "x \<notin> S \<or> x \<bullet> i - c \<noteq> 0" using outside by simp
   from eventually_inside
   have eventually_inside: "\<forall>\<^sub>F x in at (poincare_map {x \<in> S. x \<bullet> i - c = 0} x). x \<bullet> i - c = 0 \<longrightarrow> x \<in> S"
     by auto
   from return_time_has_derivative[OF rt cS D DC nz eventually_inside out]
   show ?thesis
     by auto
 qed
 
 lemma return_time_plane_has_derivative:
   assumes rt: "returns_to {x \<in> S. x \<bullet> i = c} x" (is "returns_to ?P _")
   assumes cS: "closed S"
   assumes fnz: "f (poincare_map ?P x) \<bullet> i \<noteq> 0"
   assumes eventually_inside: "\<forall>\<^sub>F x in at (poincare_map ?P x). x \<bullet> i = c \<longrightarrow> x \<in> S"
   assumes outside: "x \<notin> S \<or> x \<bullet> i \<noteq> c"
   shows "(return_time ?P has_derivative
     (\<lambda>h. - (Dflow x (return_time ?P x)) h \<bullet> i / (f (poincare_map ?P x) \<bullet> i))) (at x)"
   by (rule return_time_plane_has_derivative_blinfun[OF assms, THEN has_derivative_eq_rhs])
     (auto simp: blinfun.bilinear_simps flowderiv_def inverse_eq_divide intro!: ext)
 
 definition "Dpoincare_map i c S x =
   (\<lambda>h. (Dflow x (return_time {x \<in> S. x \<bullet> i = c} x)) h -
       ((Dflow x (return_time {x \<in> S. x \<bullet> i = c} x)) h \<bullet> i /
         (f (poincare_map {x \<in> S. x \<bullet> i = c} x) \<bullet> i)) *\<^sub>R f (poincare_map {x \<in> S. x \<bullet> i = c} x))"
 
 definition "Dpoincare_map' i c S x =
   Dflow x (return_time {x \<in> S. x \<bullet> i - c = 0} x) -
   (blinfun_scaleR_left (f (poincare_map {x \<in> S. x \<bullet> i = c} x)) o\<^sub>L
     (blinfun_scaleR_left (inverse ((f (poincare_map {x \<in> S. x \<bullet> i = c} x) \<bullet> i))) o\<^sub>L
     (blinfun_inner_left i o\<^sub>L Dflow x (return_time {x \<in> S. x \<bullet> i - c = 0} x))))"
 
 theorem poincare_map_plane_has_derivative:
   assumes rt: "returns_to {x \<in> S. x \<bullet> i = c} x" (is "returns_to ?P _")
   assumes cS: "closed S"
   assumes fnz: "f (poincare_map ?P x) \<bullet> i \<noteq> 0"
   assumes eventually_inside: "\<forall>\<^sub>F x in at (poincare_map ?P x). x \<bullet> i = c \<longrightarrow> x \<in> S"
   assumes outside: "x \<notin> S \<or> x \<bullet> i \<noteq> c"
   notes [derivative_intros] = return_time_plane_has_derivative[OF rt cS fnz eventually_inside outside]
   shows "(poincare_map ?P has_derivative Dpoincare_map' i c S x) (at x)"
   unfolding poincare_map_def Dpoincare_map'_def
   using fnz outside
   by (auto intro!: derivative_eq_intros return_time_exivl assms ext closed_levelset_within
       continuous_intros
       simp: flowderiv_eq poincare_map_def blinfun.bilinear_simps inverse_eq_divide algebra_simps)
 
 end
 
 end
diff --git a/thys/Stirling_Formula/Stirling_Formula.thy b/thys/Stirling_Formula/Stirling_Formula.thy
--- a/thys/Stirling_Formula/Stirling_Formula.thy
+++ b/thys/Stirling_Formula/Stirling_Formula.thy
@@ -1,722 +1,722 @@
 (*
   File:    Stirling_Formula.thy
   Author:  Manuel Eberl
 
   A proof of Stirling's formula, i.e. an asymptotic approximation of
   the Gamma function and the factorial.
 *)
 section \<open>Stirling's Formula\<close>
 theory Stirling_Formula
 imports
   "HOL-Analysis.Analysis"
   "Landau_Symbols.Landau_More"
 begin
 
 context
 begin
 
 text \<open>
   First, we define the $S_n^*$ from Jameson's article:
 \<close>
 private definition S' :: "nat \<Rightarrow> real \<Rightarrow> real" where
   "S' n x = 1/(2*x) + (\<Sum>r=1..<n. 1/(of_nat r+x)) + 1 /(2*(n + x))"
 
 text \<open>
   Next, the trapezium (also called $T$ in Jameson's article):
 \<close>
 private definition T :: "real \<Rightarrow> real" where
   "T x = 1/(2*x) + 1/(2*(x+1))"
 
 text \<open>
   Now we define The difference $\Delta(x)$:
 \<close>
 private definition D :: "real \<Rightarrow> real" where
   "D x = T x - ln (x + 1) + ln x"
 
 private lemma S'_telescope_trapezium:
   assumes "n > 0"
   shows   "S' n x = (\<Sum>r<n. T (of_nat r + x))"
 proof (cases n)
   case (Suc m)
   hence m: "Suc m = n" by simp
   have "(\<Sum>r<n. T (of_nat r + x)) = 
           (\<Sum>r<Suc m. 1 / (2 * real r + 2 * x)) + (\<Sum>r<n. 1 / (2 * real (Suc r) + 2 * x))"
     unfolding m by (simp add: T_def sum.distrib algebra_simps)
   also have "(\<Sum>r<Suc m. 1 / (2 * real r + 2 * x)) = 
                1/(2*x) + (\<Sum>r<m. 1 / (2 * real (Suc r) + 2 * x))" (is "_ = ?a + ?S")
     by (subst sum.lessThan_Suc_shift) simp
   also have "(\<Sum>r<n. 1 / (2 * real (Suc r) + 2 * x)) = 
                ?S + 1 / (2*(real m + x + 1))" (is "_ = _ + ?b") by (simp add: Suc)
   also have "?a + ?S + (?S + ?b) = 2*?S + ?a + ?b" by (simp add: add_ac)
   also have "2 * ?S = (\<Sum>r=0..<m. 1 / (real (Suc r) + x))" 
     unfolding sum_distrib_left by (intro sum.cong) (auto simp add: divide_simps)
   also have "(\<Sum>r=0..<m. 1 / (real (Suc r) + x)) = (\<Sum>r=Suc 0..<Suc m. 1 / (real r + x))"
     by (subst sum.atLeast_Suc_lessThan_Suc_shift) simp_all
   also have "\<dots> = (\<Sum>r=1..<n. 1 / (real r + x))" unfolding m by simp
   also have "\<dots> + ?a + ?b = S' n x" by (simp add: S'_def Suc)
   finally show ?thesis ..
 qed (insert assms, simp_all)
 
 private lemma stirling_trapezium:
   assumes x: "(x::real) > 0"
   shows   "D x \<in> {0 .. 1/(12*x^2) - 1/(12 * (x+1)^2)}"
 proof -
   define y where "y = 1 / (2*x + 1)"
   from x have y: "y > 0" "y < 1" by (simp_all add: divide_simps y_def)
 
   from x have "D x = T x - ln ((x + 1) / x)" by (subst ln_div) (simp_all add: D_def)
   also from x have "(x + 1) / x = 1 + 1 / x" by (simp add: field_simps)
   finally have D: "D x = T x - ln (1 + 1/x)" .
 
   from y have "(\<lambda>n. y * y^n) sums (y * (1 / (1 - y)))" 
     by (intro geometric_sums sums_mult) simp_all
   hence "(\<lambda>n. y ^ Suc n) sums (y / (1 - y))" by simp
   also from x have "y / (1 - y) = 1 / (2*x)" by (simp add: y_def divide_simps)
   finally have *: "(\<lambda>n. y ^ Suc n) sums (1 / (2*x))" .
 
   from y have "(\<lambda>n. (-y) * (-y)^n) sums ((-y) * (1 / (1 - (-y))))" 
     by (intro geometric_sums sums_mult) simp_all
   hence "(\<lambda>n. (-y) ^ Suc n) sums (-(y / (1 + y)))" by simp
   also from x have "y / (1 + y) = 1 / (2*(x+1))" by (simp add: y_def divide_simps)
   finally have **: "(\<lambda>n. (-y) ^ Suc n) sums (-(1 / (2*(x+1))))" .
 
   from sums_diff[OF * **] have sum1: "(\<lambda>n. y ^ Suc n - (-y) ^ Suc n) sums T x"
     by (simp add: T_def)
   
   from y have "abs y < 1" "abs (-y) < 1" by simp_all
   from sums_diff[OF this[THEN ln_series']]
     have "(\<lambda>n. y ^ n / real n - (-y) ^ n / real n) sums (ln (1 + y) - ln (1 - y))" by simp
   also from y have "ln (1 + y) - ln (1 - y) = ln ((1 + y) / (1 - y))" by (simp add: ln_div)
   also from x have "(1 + y) / (1 - y) = 1 + 1/x" by (simp add: divide_simps y_def)
   finally have "(\<lambda>n. y^n / real n - (-y)^n / real n) sums ln (1 + 1/x)" .
   hence sum2: "(\<lambda>n. y^Suc n / real (Suc n) - (-y)^Suc n / real (Suc n)) sums ln (1 + 1/x)"
     by (subst sums_Suc_iff) simp
 
-  from sum2 sum1 have "ln (1 + 1/x) \<le> T x"
-  proof (rule sums_le [OF allI, rotated])
+  have "ln (1 + 1/x) \<le> T x"
+  proof (rule sums_le [OF _ sum2 sum1])
     fix n :: nat
     show "y ^ Suc n / real (Suc n) - (-y) ^ Suc n / real (Suc n) \<le> y^Suc n - (-y) ^ Suc n"
     proof (cases "even n")
       case True
       hence eq: "A - (-y) ^ Suc n / B = A + y ^ Suc n / B" "A - (-y) ^ Suc n = A + y ^ Suc n"
         for A B by simp_all
       from y show ?thesis unfolding eq
         by (intro add_mono) (auto simp: divide_simps)
     qed simp_all
   qed
   hence "D x \<ge> 0" by (simp add: D)
 
   define c where "c = (\<lambda>n. if even n then 2 * (1 - 1 / real (Suc n)) else 0)"
   note sums_diff[OF sum1 sum2]
   also have "(\<lambda>n. y ^ Suc n - (-y) ^ Suc n - (y ^ Suc n / real (Suc n) - 
                    (-y) ^ Suc n / real (Suc n))) = (\<lambda>n. c n * y ^ Suc n)"
     by (intro ext) (simp add: c_def algebra_simps)
   finally have sum3: "(\<lambda>n. c n * y ^ Suc n) sums D x" by (simp add: D)
   
   from y have "(\<lambda>n. y^2 * (of_nat (Suc n) * y^n)) sums (y^2 * (1 / (1 - y)^2))"
     by (intro sums_mult geometric_deriv_sums) simp_all
   hence "(\<lambda>n. of_nat (Suc n) * y^(n+2)) sums (y^2 / (1 - y)^2)" 
     by (simp add: algebra_simps power2_eq_square)
   also from x have "y^2 / (1 - y)^2 = 1 / (4*x^2)" by (simp add: y_def divide_simps)
   finally have *: "(\<lambda>n. real (Suc n) * y ^ (Suc (Suc n))) sums (1 / (4 * x\<^sup>2))" by simp
 
   from y have "(\<lambda>n. y^2 * (of_nat (Suc n) * (-y)^n)) sums (y^2 * (1 / (1 - -y)^2))"
     by (intro sums_mult geometric_deriv_sums) simp_all
   hence "(\<lambda>n. of_nat (Suc n) * (-y)^(n+2)) sums (y^2 / (1 + y)^2)"
     by (simp add: algebra_simps power2_eq_square)
   also from x have "y^2 / (1 + y)^2 = 1 / (2^2*(x+1)^2)" 
     unfolding power_mult_distrib [symmetric] by (simp add: y_def divide_simps add_ac)
   finally have **: "(\<lambda>n. real (Suc n) * (- y) ^ (Suc (Suc n))) sums (1 / (4 * (x + 1)\<^sup>2))" by simp
   
   define d where "d = (\<lambda>n. if even n then 2 * real n else 0)"
   note sums_diff[OF * **]
   also have "(\<lambda>n. real (Suc n) * y^(Suc (Suc n)) - real (Suc n) * (-y)^(Suc (Suc n))) = 
                  (\<lambda>n. d (Suc n) * y ^ Suc (Suc n))"
     by (intro ext) (simp_all add: d_def)
   finally have "(\<lambda>n. d n * y ^ Suc n) sums (1 / (4 * x\<^sup>2) - 1 / (4 * (x + 1)\<^sup>2))" 
     by (subst (asm) sums_Suc_iff) (simp add: d_def)
   from sums_mult[OF this, of "1/3"] x
     have sum4: "(\<lambda>n. d n / 3 * y ^ Suc n) sums (1 / (12 * x^2) - 1 / (12 * (x + 1)^2))"
     by (simp add: field_simps)
   
   have "D x \<le> (1 / (12 * x^2) - 1 / (12 * (x + 1)^2))"
   proof (intro sums_le [OF _ sum3 sum4] allI)
     fix n :: nat
     define c' :: "nat \<Rightarrow> real" 
       where "c' = (\<lambda>n. if odd n \<or> n = 0 then 0 else if n = 2 then 4/3 else 2)"
     show "c n * y ^ Suc n \<le> d n / 3 * y ^ Suc n"
     proof (intro mult_right_mono)
       have "c n \<le> c' n" by (simp add: c_def c'_def)
       also consider "n = 0" | "n = 1" | "n = 2" | "n \<ge> 3" by force
       hence "c' n \<le> d n / 3" by cases (simp_all add: c'_def d_def)
       finally show "c n \<le> d n / 3" .
     qed (insert y, simp)
   qed
 
   with \<open>D x \<ge> 0\<close> show ?thesis by simp
 qed  
 
 text \<open>
   The following functions correspond to the $p_n(x)$ from the article.
   The special case $n = 0$ would not, strictly speaking, be necessary, but 
   it allows some theorems to work even without the precondition $n \neq 0$:
 \<close>
 private definition p :: "nat \<Rightarrow> real \<Rightarrow> real" where
   "p n x = (if n = 0 then 1/x else (\<Sum>r<n. D (real r + x)))"
 
 text \<open>
   We can write the Digamma function in terms of @{term S'}:
 \<close>
 private lemma S'_LIMSEQ_Digamma:
   assumes x: "x \<noteq> 0"
   shows   "(\<lambda>n. ln (real n) - S' n x - 1/(2*x)) \<longlonglongrightarrow> Digamma x"
 proof -
   define c where "c = (\<lambda>n. ln (real n) - (\<Sum>r<n. inverse (x + real r)))"
   have "eventually (\<lambda>n. 1 / (2 * (x + real n)) = c n - (ln (real n) - S' n x - 1/(2*x))) at_top"
     using eventually_gt_at_top[of "0::nat"]
   proof eventually_elim
     fix n :: nat
     assume n: "n > 0"
     have "c n - (ln (real n) - S' n x - 1/(2*x)) = 
             -(\<Sum>r<n. inverse (real r + x)) + (1/x + (\<Sum>r=1..<n. inverse (real r + x))) + 1/(2*(real n + x))"
       using x by (simp add: S'_def c_def field_simps)
     also have "1/x + (\<Sum>r=1..<n. inverse (real r + x)) = (\<Sum>r<n. inverse (real r + x))"
       unfolding lessThan_atLeast0 using n 
       by (subst (2) sum.atLeast_Suc_lessThan) (simp_all add: field_simps)
     finally show "1 / (2 * (x + real n)) = c n - (ln (real n) - S' n x - 1/(2*x))" by simp
   qed
   moreover have "(\<lambda>n. 1 / (2 * (x + real n))) \<longlonglongrightarrow> 0"
     by (rule real_tendsto_divide_at_top tendsto_const filterlim_tendsto_pos_mult_at_top
           filterlim_tendsto_add_at_top filterlim_real_sequentially | simp)+
   ultimately have "(\<lambda>n. c n - (ln (real n) - S' n x - 1/(2*x))) \<longlonglongrightarrow> 0"
     by (blast intro: Lim_transform_eventually)
   from tendsto_minus[OF this] have "(\<lambda>n. (ln (real n) - S' n x - 1/(2*x)) - c n) \<longlonglongrightarrow> 0" by simp
   moreover from Digamma_LIMSEQ[OF x] have "c \<longlonglongrightarrow> Digamma x" by (simp add: c_def) 
   ultimately show "(\<lambda>n. ln (real n) - S' n x - 1/(2*x)) \<longlonglongrightarrow> Digamma x"
     by (rule Lim_transform [rotated])
 qed
 
 text \<open>
   Moreover, we can give an expansion of @{term S'} with the @{term p} as variation terms.
 \<close>
 private lemma S'_approx: 
   "S' n x = ln (real n + x) - ln x + p n x"
 proof (cases "n = 0")
   case True
   thus ?thesis by (simp add: p_def S'_def)
 next
   case False
   hence "S' n x = (\<Sum>r<n. T (real r + x))"
     by (subst S'_telescope_trapezium) simp_all
   also have "\<dots> = (\<Sum>r<n. ln (real r + x + 1) - ln (real r + x) + D (real r + x))"
     by (simp add: D_def)
   also have "\<dots> = (\<Sum>r<n. ln (real (Suc r) + x) - ln (real r + x)) + p n x"
     using False by (simp add: sum.distrib add_ac p_def)
   also have "(\<Sum>r<n. ln (real (Suc r) + x) - ln (real r + x)) = ln (real n + x) - ln x"
     by (subst sum_lessThan_telescope) simp_all
   finally show ?thesis .
 qed
 
 text \<open>
   We define the limit of the @{term p} (simply called $p(x)$ in Jameson's article):
 \<close>
 private definition P :: "real \<Rightarrow> real" where
   "P x = (\<Sum>n. D (real n + x))"
 
 private lemma D_summable:
   assumes x: "x > 0"
   shows   "summable (\<lambda>n. D (real n + x))"
 proof -
   have *: "summable (\<lambda>n. 1 / (12 * (x + real n)\<^sup>2) - 1 / (12 * (x + real (Suc n))\<^sup>2))"
     by (rule telescope_summable' real_tendsto_divide_at_top tendsto_const 
              filterlim_tendsto_pos_mult_at_top filterlim_pow_at_top
              filterlim_tendsto_add_at_top filterlim_real_sequentially | simp)+
   show "summable (\<lambda>n. D (real n + x))" 
   proof (rule summable_comparison_test[OF _ *], rule exI[of _ 2], safe)
     fix n :: nat assume "n \<ge> 2"
     show "norm (D (real n + x)) \<le> 1 / (12 * (x + real n)^2) - 1 / (12 * (x + real (Suc n))^2)"
       using stirling_trapezium[of "real n + x"] x by (auto simp: algebra_simps)
   qed
 qed
 
 private lemma p_LIMSEQ:
   assumes x: "x > 0"
   shows   "(\<lambda>n. p n x) \<longlonglongrightarrow> P x"
 proof (rule Lim_transform_eventually)
   from D_summable[OF x] have "(\<lambda>n. D (real n + x)) sums P x" unfolding P_def
     by (simp add: sums_iff)
   then show "(\<lambda>n. \<Sum>r<n. D (real r + x)) \<longlonglongrightarrow> P x" by (simp add: sums_def)
   moreover from eventually_gt_at_top[of 1]
   show "eventually (\<lambda>n. (\<Sum>r<n. D (real r + x)) = p n x) at_top"
     by eventually_elim (auto simp: p_def)
 qed
 
 text \<open>
   This gives us an expansion of the Digamma function:
 \<close>
 lemma Digamma_approx:
   assumes x: "(x :: real) > 0"
   shows   "Digamma x = ln x - 1 / (2 * x) - P x"
 proof -
   have "eventually (\<lambda>n. ln (inverse (1 + x / real n)) + ln x - 1/(2*x) - p n x =
           ln (real n) - S' n x - 1/(2*x)) at_top"
     using eventually_gt_at_top[of "1::nat"]
   proof eventually_elim
     fix n :: nat assume n: "n > 1"
     have "ln (real n) - S' n x = ln ((real n) / (real n + x)) + ln x - p n x"
       using assms n unfolding S'_approx by (subst ln_div) (auto simp: algebra_simps)
     also from n have "real n / (real n + x) = inverse (1 + x / real n)" by (simp add: field_simps)
     finally show "ln (inverse (1 + x / real n)) + ln x - 1/(2*x) - p n x = 
                     ln (real n) - S' n x - 1/(2*x)" by simp
   qed
   moreover have "(\<lambda>n. ln (inverse (1 + x / real n)) + ln x - 1/(2*x) - p n x) 
                    \<longlonglongrightarrow> ln (inverse (1 + 0)) + ln x - 1/(2*x) - P x"
     by (rule tendsto_intros p_LIMSEQ x real_tendsto_divide_at_top 
           filterlim_real_sequentially | simp)+
   hence "(\<lambda>n. ln (inverse (1 + x / real n)) + ln x - 1/(2*x) - p n x) 
              \<longlonglongrightarrow> ln x - 1/(2*x) - P x" by simp
   ultimately have "(\<lambda>n. ln (real n) - S' n x - 1 / (2 * x)) \<longlonglongrightarrow> ln x - 1/(2*x) - P x"
     by (blast intro: Lim_transform_eventually)
   moreover from x have "(\<lambda>n. ln (real n) - S' n x - 1 / (2 * x)) \<longlonglongrightarrow> Digamma x"
     by (intro S'_LIMSEQ_Digamma) simp_all
   ultimately show "Digamma x = ln x - 1 / (2 * x) - P x"
     by (rule LIMSEQ_unique [rotated])
 qed
 
 text \<open>
   Next, we derive some bounds on @{term "P"}:
 \<close>
 private lemma p_ge_0: "x > 0 \<Longrightarrow> p n x \<ge> 0"
   using stirling_trapezium[of "real n + x" for n]
   by (auto simp add: p_def intro!: sum_nonneg)
 
 private lemma P_ge_0: "x > 0 \<Longrightarrow> P x \<ge> 0"
   by (rule tendsto_lowerbound[OF p_LIMSEQ]) 
      (insert p_ge_0[of x], simp_all)
 
 private lemma p_upper_bound:
   assumes "x > 0" "n > 0"
   shows "p n x \<le> 1/(12*x^2)"
 proof -
   from assms have "p n x = (\<Sum>r<n. D (real r + x))"
     by (simp add: p_def)
   also have "\<dots> \<le> (\<Sum>r<n. 1/(12*(real r + x)^2) - 1/(12 * (real (Suc r) + x)^2))"
     using stirling_trapezium[of "real r + x" for r] assms 
     by (intro sum_mono) (simp add: add_ac)
   also have "\<dots> = 1 / (12 * x\<^sup>2) - 1 / (12 * (real n + x)\<^sup>2)"
     by (subst sum_lessThan_telescope') simp
   also have "\<dots> \<le> 1 / (12 * x^2)" by simp
   finally show ?thesis .
 qed
 
 private lemma P_upper_bound:
   assumes "x > 0"
   shows   "P x \<le> 1/(12*x^2)"
 proof (rule tendsto_upperbound)
   show "eventually (\<lambda>n. p n x \<le> 1 / (12 * x^2)) at_top"
     using eventually_gt_at_top[of 0] 
     by eventually_elim (use p_upper_bound[of x] assms in auto)
   show "(\<lambda>n. p n x) \<longlonglongrightarrow> P x"
     by (simp add: assms p_LIMSEQ)
 qed auto
 
 
 text \<open>
   We can now use this approximation of the Digamma function to approximate
   @{term ln_Gamma} (since the former is the derivative of the latter). 
   We therefore define the function $g$ from Jameson's article, which measures 
   the difference between @{term ln_Gamma} and its approximation:
 \<close>
 
 private definition g :: "real \<Rightarrow> real" where
   "g x = ln_Gamma x - (x - 1/2) * ln x + x"
 
 private lemma DERIV_g: "x > 0 \<Longrightarrow> (g has_field_derivative -P x) (at x)"
   unfolding g_def [abs_def] using Digamma_approx[of x]
   by (auto intro!: derivative_eq_intros simp: field_simps)
 
 private lemma isCont_P: 
   assumes "x > 0"
   shows   "isCont P x"
 proof -
   define D' :: "real \<Rightarrow> real"
     where "D' = (\<lambda>x. - 1 / (2 * x^2 * (x+1)^2))"
   have DERIV_D: "(D has_field_derivative D' x) (at x)" if "x > 0" for x
     unfolding D_def [abs_def] D'_def T_def
     by (insert that, (rule derivative_eq_intros refl | simp)+)
        (simp add: power2_eq_square divide_simps,  (simp add: algebra_simps)?)
   note this [THEN DERIV_chain2, derivative_intros]
   
   have "(P has_field_derivative (\<Sum>n. D' (real n + x))) (at x)"
     unfolding P_def [abs_def]
   proof (rule has_field_derivative_series')
     show "convex {x/2<..}" by simp
   next
     fix n :: nat and y :: real assume y: "y \<in> {x/2<..}"
     with assms have "y > 0" by simp
     thus "((\<lambda>a. D (real n + a)) has_real_derivative D' (real n + y)) (at y within {x/2<..})"
       by (auto intro!: derivative_eq_intros)
   next
     from assms D_summable[of x] show "summable (\<lambda>n. D (real n + x))" by simp
   next
     show "uniformly_convergent_on {x/2<..} (\<lambda>n x. \<Sum>i<n. D' (real i + x))"
     proof (rule Weierstrass_m_test')
       fix n :: nat and y :: real
       assume y: "y \<in> {x/2<..}"
       with assms have "y > 0" by auto
       have "norm (D' (real n + y)) = (1 / (2 * (y + real n)^2)) * (1 / (y + real (Suc n))^2)"
         by (simp add: D'_def add_ac)
       also from y assms have "\<dots> \<le> (1 / (2 * (x/2)^2)) * (1 / (real (Suc n))^2)"
         by (intro mult_mono divide_left_mono power_mono) simp_all
       also have "1 / (real (Suc n))^2 = inverse ((real (Suc n))^2)" by (simp add: field_simps)
       finally show "norm (D' (real n + y)) \<le> (1 / (2 * (x/2)^2)) * inverse ((real (Suc n))^2)" .
     next
       show "summable (\<lambda>n. (1 / (2 * (x/2)^2)) * inverse ((real (Suc n))^2))"
         by (subst summable_Suc_iff, intro summable_mult inverse_power_summable) simp_all
     qed
   qed (insert assms, simp_all add: interior_open)
   thus ?thesis by (rule DERIV_isCont)
 qed
 
 private lemma P_continuous_on [THEN continuous_on_subset]: "continuous_on {0<..} P"
   by (intro continuous_at_imp_continuous_on ballI isCont_P) auto
 
 private lemma P_integrable:
   assumes a: "a > 0"
   shows   "P integrable_on {a..}"
 proof -
   define f where "f = (\<lambda>n x. if x \<in> {a..real n} then P x else 0)"
   show "P integrable_on {a..}"
   proof (rule dominated_convergence)
     fix n :: nat
     from a have "P integrable_on {a..real n}"
       by (intro integrable_continuous_real P_continuous_on) auto
     hence "f n integrable_on {a..real n}"
       by (rule integrable_eq) (simp add: f_def)
     thus "f n integrable_on {a..}"
       by (rule integrable_on_superset) (auto simp: f_def)
   next
     fix n :: nat
     show "norm (f n x) \<le> of_real (1/12) * (1 / x^2)" if "x \<in> {a..}" for x
       using a P_ge_0 P_upper_bound by (auto simp: f_def)
   next
     show "(\<lambda>x::real. of_real (1/12) * (1 / x^2)) integrable_on {a..}"
       using has_integral_inverse_power_to_inf[of 2 a] a
       by (intro integrable_on_cmult_left) auto
   next
     show "(\<lambda>n. f n x) \<longlonglongrightarrow> P x" if "x\<in>{a..}" for x
     proof -
       have "eventually (\<lambda>n. real n \<ge> x) at_top"
         using filterlim_real_sequentially by (simp add: filterlim_at_top)
       with that have "eventually (\<lambda>n. f n x = P x) at_top"
         by (auto elim!: eventually_mono simp: f_def)
       thus "(\<lambda>n. f n x) \<longlonglongrightarrow> P x" by (simp add: tendsto_eventually)
     qed
   qed
 qed
 
 private definition c :: real where "c = integral {1..} (\<lambda>x. -P x) + g 1"
 
 text \<open>
   We can now give bounds on @{term g}:
 \<close>
 private lemma g_bounds:
   assumes x: "x \<ge> 1"
   shows   "g x \<in> {c..c + 1/(12*x)}"
 proof -
   from assms have int_nonneg: "integral {x..} P \<ge> 0"
     by (intro Henstock_Kurzweil_Integration.integral_nonneg P_integrable)
        (auto simp: P_ge_0)
   have int_upper_bound: "integral {x..} P \<le> 1/(12*x)"
   proof (rule has_integral_le)
     from x show "(P has_integral integral {x..} P) {x..}"
       by (intro integrable_integral P_integrable) simp_all
     from x has_integral_mult_right[OF has_integral_inverse_power_to_inf[of 2 x], of "1/12"]
       show "((\<lambda>x. 1/(12*x^2)) has_integral (1/(12*x))) {x..}" by (simp add: field_simps)
   qed (insert P_upper_bound x, simp_all)
 
   note DERIV_g [THEN DERIV_chain2, derivative_intros]
   from assms have int1: "((\<lambda>x. -P x) has_integral (g x - g 1)) {1..x}"
     by (intro fundamental_theorem_of_calculus)
        (auto simp: has_field_derivative_iff_has_vector_derivative [symmetric]
              intro!: derivative_eq_intros)
   from x have int2: "((\<lambda>x. -P x) has_integral integral {x..} (\<lambda>x. -P x)) {x..}"
     by (intro integrable_integral integrable_neg P_integrable) simp_all
   from has_integral_Un[OF int1 int2] x
     have "((\<lambda>x. - P x) has_integral g x - g 1 - integral {x..} P) ({1..x} \<union> {x..})"
     by (simp add: max_def)
   also from x have "{1..x} \<union> {x..} = {1..}" by auto
   finally have "((\<lambda>x. -P x) has_integral g x - g 1 - integral {x..} P) {1..}" .
   moreover have "((\<lambda>x. -P x) has_integral integral {1..} (\<lambda>x. -P x)) {1..}"
     by (intro integrable_integral integrable_neg P_integrable) simp_all
   ultimately have "g x - g 1 - integral {x..} P = integral {1..} (\<lambda>x. -P x)"
     by (simp add: has_integral_unique)
   hence "g x = c + integral {x..} P" by (simp add: c_def algebra_simps)
   with int_upper_bound int_nonneg show "g x \<in> {c..c + 1/(12*x)}" by simp
 qed
 
 
 text \<open>
   Finally, we have bounds on @{term ln_Gamma}, @{term Gamma}, and @{term fact}.
 \<close>
 private lemma ln_Gamma_bounds_aux:
   "x \<ge> 1 \<Longrightarrow> ln_Gamma x \<ge> c + (x - 1/2) * ln x - x"
   "x \<ge> 1 \<Longrightarrow> ln_Gamma x \<le> c + (x - 1/2) * ln x - x + 1/(12*x)"
   using g_bounds[of x] by (simp_all add: g_def)
 
 private lemma Gamma_bounds_aux:
   assumes x: "x \<ge> 1"
   shows   "Gamma x \<ge> exp c * x powr (x - 1/2) / exp x"
           "Gamma x \<le> exp c * x powr (x - 1/2) / exp x * exp (1/(12*x))"
 proof -
   have "exp (ln_Gamma x) \<ge> exp (c + (x - 1/2) * ln x - x)"
     by (subst exp_le_cancel_iff, rule ln_Gamma_bounds_aux) (simp add: x)
   with x show "Gamma x \<ge> exp c * x powr (x - 1/2) / exp x"
     by (simp add: Gamma_real_pos_exp exp_add exp_diff powr_def del: exp_le_cancel_iff)
 next
   have "exp (ln_Gamma x) \<le> exp (c + (x - 1/2) * ln x - x + 1/(12*x))"
     by (subst exp_le_cancel_iff, rule ln_Gamma_bounds_aux) (simp add: x)
   with x show "Gamma x \<le> exp c * x powr (x - 1/2) / exp x * exp (1/(12*x))"
     by (simp add: Gamma_real_pos_exp exp_add exp_diff powr_def del: exp_le_cancel_iff)
 qed
 
 private lemma Gamma_asymp_equiv_aux: 
   "Gamma \<sim>[at_top] (\<lambda>x. exp c * x powr (x - 1/2) / exp x)"
 proof (rule asymp_equiv_sandwich)
   include asymp_equiv_notation
   show "eventually (\<lambda>x. exp c * x powr (x - 1/2) / exp x \<le> Gamma x) at_top"
        "eventually (\<lambda>x. exp c * x powr (x - 1/2) / exp x * exp (1/(12*x)) \<ge> Gamma x) at_top"
     using eventually_ge_at_top[of "1::real"]
     by (eventually_elim; use Gamma_bounds_aux in force)+
   have "((\<lambda>x::real. exp (1 / (12 * x))) \<longlongrightarrow> exp 0) at_top"
     by (rule tendsto_intros real_tendsto_divide_at_top filterlim_tendsto_pos_mult_at_top)+
        (simp_all add: filterlim_ident)
   hence "(\<lambda>x. exp (1 / (12 * x))) \<sim> (\<lambda>x. 1 :: real)"
     by (intro asymp_equivI') simp_all
   hence "(\<lambda>x. exp c * x powr (x - 1 / 2) / exp x * 1) \<sim>
           (\<lambda>x. exp c * x powr (x - 1 / 2) / exp x * exp (1 / (12 * x)))"
     by (intro asymp_equiv_mult asymp_equiv_refl) (simp add: asymp_equiv_sym)
   thus "(\<lambda>x. exp c * x powr (x - 1 / 2) / exp x) \<sim>
           (\<lambda>x. exp c * x powr (x - 1 / 2) / exp x * exp (1 / (12 * x)))" by simp
 qed simp_all
 
 private lemma exp_1_powr_real [simp]: "exp (1::real) powr x = exp x"
   by (simp add: powr_def)
 
 private lemma fact_asymp_equiv_aux:
   "fact \<sim>[at_top] (\<lambda>x. exp c * sqrt (real x) * (real x / exp 1) powr real x)"
 proof -
   include asymp_equiv_notation
   have "fact \<sim> (\<lambda>n. Gamma (real (Suc n)))" by (simp add: Gamma_fact)
   also have "eventually (\<lambda>n. Gamma (real (Suc n)) = real n * Gamma (real n)) at_top"
     using eventually_gt_at_top[of "0::nat"]
     by eventually_elim (insert Gamma_plus1[of "real n" for n], 
                         auto simp: add_ac of_nat_in_nonpos_Ints_iff)
   also have "(\<lambda>n. Gamma (real n)) \<sim> (\<lambda>n. exp c * real n powr (real n - 1/2) / exp (real n))"
     by (rule asymp_equiv_compose'[OF Gamma_asymp_equiv_aux] filterlim_real_sequentially)+
   also have "eventually (\<lambda>n. real n * (exp c * real n powr (real n - 1 / 2) / exp (real n)) =
                exp c * sqrt (real n) * (real n / exp 1) powr real n) at_top"
     using eventually_gt_at_top[of "0::nat"]
   proof eventually_elim
     fix n :: nat assume n: "n > 0"
     thus "real n * (exp c * real n powr (real n - 1 / 2) / exp (real n)) =
             exp c * sqrt (real n) * (real n / exp 1) powr real n"
       by (subst powr_diff) (simp_all add: powr_divide powr_half_sqrt field_simps)
   qed
   finally show ?thesis by - (simp_all add: asymp_equiv_mult)
 qed
 
 text \<open>
   We still need to determine the constant term @{term c}, which we do using Wallis' 
   product formula: $$\prod_{n=1}^\infty \frac{4n^2}{4n^2-1} = \frac{\pi}{2}$$
 \<close>
 private lemma powr_mult_2: "(x::real) > 0 \<Longrightarrow> x powr (y * 2) = (x^2) powr y"
   by (subst mult.commute, subst powr_powr [symmetric]) (simp add: powr_numeral)
 
 private lemma exp_mult_2: "exp (y * 2 :: real) = exp y * exp y"
   by (subst exp_add [symmetric]) simp
 
 private lemma exp_c: "exp c = sqrt (2*pi)"
 proof -
   include asymp_equiv_notation
   define p where "p = (\<lambda>n. \<Prod>k=1..n. (4*real k^2) / (4*real k^2 - 1))"
 
   have p_0 [simp]: "p 0 = 1" by (simp add: p_def)
   have p_Suc: "p (Suc n) = p n * (4 * real (Suc n)^2) / (4 * real (Suc n)^2 - 1)"
     for n unfolding p_def by (subst prod.nat_ivl_Suc') simp_all
   have p: "p = (\<lambda>n. 16 ^ n * fact n ^ 4 / (fact (2 * n))\<^sup>2 / (2 * real n + 1))"
   proof
     fix n :: nat
     have "p n = (\<Prod>k=1..n. (2*real k)^2 / (2*real k - 1) / (2 * real k + 1))"
       unfolding p_def by (intro prod.cong refl) (simp add: field_simps power2_eq_square)
     also have "\<dots> = (\<Prod>k=1..n. (2*real k)^2 / (2*real k - 1)) / (\<Prod>k=1..n. (2 * real (Suc k) - 1))"
       by (simp add: prod_dividef prod.distrib add_ac)
     also have "(\<Prod>k=1..n. (2 * real (Suc k) - 1)) = (\<Prod>k=Suc 1..Suc n. (2 * real k - 1))"
       by (subst prod.atLeast_Suc_atMost_Suc_shift) simp_all
     also have "\<dots> = (\<Prod>k=1..n. (2 * real k - 1)) * (2 * real n + 1)"
       by (induction n) (simp_all add: prod.nat_ivl_Suc')
     also have "(\<Prod>k = 1..n. (2 * real k)\<^sup>2 / (2 * real k - 1)) / \<dots> =
                  (\<Prod>k = 1..n. (2 * real k)^2 / (2 * real k - 1)^2) / (2 * real n + 1)"
       unfolding power2_eq_square by (simp add: prod.distrib prod_dividef)
     also have "(\<Prod>k = 1..n. (2 * real k)^2 / (2 * real k - 1)^2) =
                  (\<Prod>k = 1..n. (2 * real k)^4 / ((2*real k)*(2 * real k - 1))^2)"
       by (rule prod.cong) (simp_all add: power2_eq_square eval_nat_numeral)
     also have "\<dots> = 16^n * fact n^4 / (\<Prod>k=1..n. (2*real k) * (2*real k - 1))^2"
       by (simp add: prod.distrib prod_dividef fact_prod
             prod_power_distrib [symmetric] prod_constant)
     also have "(\<Prod>k=1..n. (2*real k) * (2*real k - 1)) = fact (2*n)"
       by (induction n) (simp_all add: algebra_simps prod.nat_ivl_Suc')
     finally show "p n = 16 ^ n * fact n ^ 4 / (fact (2 * n))\<^sup>2 / (2 * real n + 1)" .
   qed
 
   have "p \<sim> (\<lambda>n. 16 ^ n * fact n ^ 4 / (fact (2 * n))\<^sup>2 / (2 * real n + 1))"
     by (simp add: p)
   also have "\<dots> \<sim> (\<lambda>n. 16^n * (exp c * sqrt (real n) * (real n / exp 1) powr real n)^4 /
                        (exp c * sqrt (real (2*n)) * (real (2*n) / exp 1) powr real (2*n))^2 /
                        (2 * real n + 1))" (is "_ \<sim> ?f")
     by (intro asymp_equiv_mult asymp_equiv_divide asymp_equiv_refl mult_nat_left_at_top
               fact_asymp_equiv_aux asymp_equiv_power asymp_equiv_compose'[OF fact_asymp_equiv_aux]) 
        simp_all
   also have "eventually (\<lambda>n. \<dots> n = exp c ^ 2 / (4 + 2/n)) at_top"
     using eventually_gt_at_top[of "0::nat"]
   proof eventually_elim
     fix n :: nat assume n: "n > 0"
     have [simp]: "16^n = 4^n * (4^n :: real)" by (simp add: power_mult_distrib [symmetric])
     from n have "?f n = exp c ^ 2 * (n / (2*(2*n+1)))"
       by (simp add: power_mult_distrib divide_simps powr_mult real_sqrt_power_even)
          (simp add: field_simps power2_eq_square eval_nat_numeral powr_mult_2 
                     exp_mult_2 powr_realpow)
     also from n have "\<dots> = exp c ^ 2 / (4 + 2/n)" by (simp add: field_simps)
     finally show "?f n = \<dots>" .
   qed
   also have "(\<lambda>x. 4 + 2 / real x) \<sim> (\<lambda>x. 4)"
     by (subst asymp_equiv_add_right) auto
   finally have "p \<longlonglongrightarrow> exp c ^ 2 / 4" 
     by (rule asymp_equivD_const) (simp_all add: asymp_equiv_divide)
   moreover have "p \<longlonglongrightarrow> pi / 2" unfolding p_def by (rule wallis)
   ultimately have "exp c ^ 2 / 4 = pi / 2" by (rule LIMSEQ_unique)
   hence "2 * pi = exp c ^ 2" by simp
   also have "sqrt (exp c ^ 2) = exp c" by simp
   finally show "exp c = sqrt (2 * pi)" ..
 qed
 
 private lemma c: "c = ln (2*pi) / 2"
 proof -
   note exp_c [symmetric]
   also have "ln (exp c) = c" by simp
   finally show ?thesis by (simp add: ln_sqrt)
 qed
 
 
 text \<open>
   This gives us the final bounds:
 \<close>
 theorem Gamma_bounds:
   assumes "x \<ge> 1"
   shows   "Gamma x \<ge> sqrt (2*pi/x) * (x / exp 1) powr x" (is ?th1)
           "Gamma x \<le> sqrt (2*pi/x) * (x / exp 1) powr x * exp (1 / (12 * x))" (is ?th2)
 proof -
   from assms have "exp c * x powr (x - 1/2) / exp x = sqrt (2*pi/x) * (x / exp 1) powr x"
     by (subst powr_diff)
        (simp add: exp_c real_sqrt_divide powr_divide powr_half_sqrt field_simps)
   with Gamma_bounds_aux[OF assms] show ?th1 ?th2 by simp_all
 qed
 
 theorem ln_Gamma_bounds:
   assumes "x \<ge> 1"
   shows   "ln_Gamma x \<ge> ln (2*pi/x) / 2 + x * ln x - x" (is ?th1)
           "ln_Gamma x \<le> ln (2*pi/x) / 2 + x * ln x - x + 1/(12*x)" (is ?th2)
 proof -
   from ln_Gamma_bounds_aux[OF assms] assms show ?th1 ?th2
     by (simp_all add: c field_simps ln_div)
   from assms have "exp c * x powr (x - 1/2) / exp x = sqrt (2*pi/x) * (x / exp 1) powr x"
     by (subst powr_diff)
        (simp add: exp_c real_sqrt_divide powr_divide powr_half_sqrt field_simps)
 qed
 
 theorem fact_bounds:
   assumes "n > 0"
   shows   "(fact n :: real) \<ge> sqrt (2*pi*n) * (n / exp 1) ^ n" (is ?th1)
           "(fact n :: real) \<le> sqrt (2*pi*n) * (n / exp 1) ^ n * exp (1 / (12 * n))" (is ?th2)
 proof -
   from assms have n: "real n \<ge> 1" by simp
   from assms Gamma_plus1[of "real n"]
     have "real n * Gamma (real n) = Gamma (real (Suc n))" 
     by (simp add: of_nat_in_nonpos_Ints_iff add_ac)
   also have "Gamma (real (Suc n)) = fact n" by (subst Gamma_fact [symmetric]) simp
   finally have *: "fact n = real n * Gamma (real n)" by simp
   
   have "2*pi/n = 2*pi*n / n^2" by (simp add: power2_eq_square)
   also have "sqrt \<dots> = sqrt (2*pi*n) / n" by (subst real_sqrt_divide) simp_all
   also have "real n * \<dots> = sqrt (2*pi*n)" by simp
   finally have **: "real n * sqrt (2*pi/real n) = sqrt (2*pi*real n)" .
 
   note *
   also note Gamma_bounds(2)[OF n]
   also have "real n * (sqrt (2 * pi / real n) * (real n / exp 1) powr real n * 
                   exp (1 / (12 * real n))) = 
                (real n * sqrt (2*pi/n)) * (n / exp 1) powr n * exp (1 / (12 * n))" 
     by (simp add: algebra_simps)
   also from n have "(real n / exp 1) powr real n = (real n / exp 1) ^ n"
     by (subst powr_realpow) simp_all
   also note **
   finally show ?th2 by - (insert assms, simp_all)
 
   have "sqrt (2*pi*n) * (n / exp 1) powr n = n * (sqrt (2*pi/n) * (n / exp 1) powr n)"
     by (subst ** [symmetric]) (simp add: field_simps)
   also from assms have "\<dots> \<le> real n * Gamma (real n)"
     by (intro mult_left_mono Gamma_bounds(1)) simp_all
   also from n have "(real n / exp 1) powr real n = (real n / exp 1) ^ n"
     by (subst powr_realpow) simp_all
   also note * [symmetric]
   finally show ?th1 .
 qed
 
 theorem ln_fact_bounds:
   assumes "n > 0"
   shows   "ln (fact n :: real) \<ge> ln (2*pi*n)/2 + n * ln n - n" (is ?th1)
           "ln (fact n :: real) \<le> ln (2*pi*n)/2 + n * ln n - n + 1/(12*real n)" (is ?th2)
 proof -
   have "ln (fact n :: real) \<ge> ln (sqrt (2*pi*real n)*(real n/exp 1)^n)"
     using fact_bounds(1)[OF assms] assms by (subst ln_le_cancel_iff) auto
   also from assms have "ln (sqrt (2*pi*real n)*(real n/exp 1)^n) = ln (2*pi*n)/2 + n * ln n - n"
     by (simp add: ln_mult ln_div ln_realpow ln_sqrt field_simps)
   finally show ?th1 .
 next
   have "ln (fact n :: real) \<le> ln (sqrt (2*pi*real n) * (real n/exp 1)^n * exp (1/(12*real n)))"
     using fact_bounds(2)[OF assms] assms by (subst ln_le_cancel_iff) auto
   also from assms have "\<dots> = ln (2*pi*n)/2 + n * ln n - n + 1/(12*real n)" 
     by (simp add: ln_mult ln_div ln_realpow ln_sqrt field_simps)
   finally show ?th2 .
 qed
 
 theorem Gamma_asymp_equiv: 
   "Gamma \<sim>[at_top] (\<lambda>x. sqrt (2*pi/x) * (x / exp 1) powr x :: real)"
 proof -
   note Gamma_asymp_equiv_aux
   also have "eventually (\<lambda>x. exp c * x powr (x - 1/2) / exp x = 
                sqrt (2*pi/x) * (x / exp 1) powr x) at_top"
     using eventually_gt_at_top[of "0::real"]
   proof eventually_elim
     fix x :: real assume x: "x > 0"
     thus "exp c * x powr (x - 1/2) / exp x = sqrt (2*pi/x) * (x / exp 1) powr x"
       by (subst powr_diff) 
          (simp add: exp_c powr_half_sqrt powr_divide field_simps real_sqrt_divide)
   qed
   finally show ?thesis .
 qed
 
 theorem fact_asymp_equiv: 
   "fact \<sim>[at_top] (\<lambda>n. sqrt (2*pi*n) * (n / exp 1) ^ n :: real)"
 proof -
   note fact_asymp_equiv_aux
   also have "eventually (\<lambda>n. exp c * sqrt (real n) = sqrt (2 * pi * real n)) at_top"
     using eventually_gt_at_top[of "0::nat"] by eventually_elim (simp add: exp_c real_sqrt_mult)
   also have "eventually (\<lambda>n. (n / exp 1) powr n = (n / exp 1) ^ n) at_top"
     using eventually_gt_at_top[of "0::nat"] by eventually_elim (simp add: powr_realpow)
   finally show ?thesis .
 qed
 
 end
 
 end