diff --git a/thys/Independence_CH/CH.thy b/thys/Independence_CH/CH.thy
--- a/thys/Independence_CH/CH.thy
+++ b/thys/Independence_CH/CH.thy
@@ -1,442 +1,438 @@
 section\<open>Forcing extension satisfying the Continuum Hypothesis\<close>
 
 theory CH
   imports
     Kappa_Closed_Notions
     Cohen_Posets_Relative
 begin
 
-context M_ctm3_AC
+context M_ctm2_AC
 begin
 
 declare Fn_rel_closed[simp del, rule del, simplified setclass_iff, simp, intro]
 declare Fnle_rel_closed[simp del, rule del, simplified setclass_iff, simp, intro]
 
 abbreviation
   Coll :: "i" where
   "Coll \<equiv> Fn\<^bsup>M\<^esup>(\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>, \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>, \<omega> \<rightarrow>\<^bsup>M\<^esup> 2)"
 
 abbreviation
   Colleq :: "i" where
   "Colleq \<equiv> Fnle\<^bsup>M\<^esup>(\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>, \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>, \<omega> \<rightarrow>\<^bsup>M\<^esup> 2)"
 
 lemma Coll_in_M[intro,simp]: "Coll \<in> M" by simp
 
 lemma Colleq_refl : "refl(Coll,Colleq)"
   unfolding Fnle_rel_def Fnlerel_def refl_def
   using RrelI by simp
 
 subsection\<open>Collapse forcing is sufficiently closed\<close>
 
 \<comment> \<open>Kunen IV.7.14, only for \<^term>\<open>\<aleph>\<^bsub>1\<^esub>\<close>\<close>
 lemma succ_omega_closed_Coll: "succ(\<omega>)-closed\<^bsup>M\<^esup>(Coll,Colleq)"
 proof -
   \<comment> \<open>Case for finite sequences\<close>
   have "n\<in>\<omega> \<Longrightarrow> \<forall>f \<in> n \<^sub><\<rightarrow>\<^bsup>M\<^esup> (Coll,converse(Colleq)).
           \<exists>q\<in>M. q \<in> Coll \<and> (\<forall>\<alpha>\<in>M. \<alpha> \<in> n \<longrightarrow> \<langle>q, f ` \<alpha>\<rangle> \<in> Colleq)" for n
   proof (induct rule:nat_induct)
     case 0
     then
     show ?case
       using zero_lt_Aleph_rel1 zero_in_Fn_rel
       by (auto simp del:setclass_iff) (rule bexI[OF _ zero_in_M], auto)
   next
     case (succ x)
     then
     have "\<forall>f\<in>succ(x) \<^sub><\<rightarrow>\<^bsup>M\<^esup> (Coll,converse(Colleq)). \<forall>\<alpha> \<in> succ(x). \<langle>f`x, f ` \<alpha>\<rangle> \<in> Colleq"
     proof(intro ballI)
       fix f \<alpha>
       assume "f\<in>succ(x) \<^sub><\<rightarrow>\<^bsup>M\<^esup> (Coll,converse(Colleq))" "\<alpha>\<in>succ(x)"
       moreover from \<open>x\<in>\<omega>\<close> this
       have "f\<in>succ(x) \<^sub><\<rightarrow> (Coll,converse(Colleq))"
         using mono_seqspace_rel_char nat_into_M
         by simp
       moreover from calculation succ
       consider "\<alpha>\<in>x" | "\<alpha>=x"
         by auto
       then
       show "\<langle>f`x, f ` \<alpha>\<rangle> \<in> Colleq"
       proof(cases)
         case 1
         then
         have "\<langle>\<alpha>, x\<rangle> \<in> Memrel(succ(x))" "x\<in>succ(x)" "\<alpha>\<in>succ(x)"
           by auto
         with \<open>f\<in>succ(x) \<^sub><\<rightarrow> (Coll,converse(Colleq))\<close>
         show ?thesis
           using mono_mapD(2)[OF _ \<open>\<alpha>\<in>succ(x)\<close> _ \<open>\<langle>\<alpha>, x\<rangle> \<in> Memrel(succ(x))\<close>]
           unfolding mono_seqspace_def
           by auto
       next
         case 2
         with \<open>f\<in>succ(x) \<^sub><\<rightarrow> (Coll,converse(Colleq))\<close>
         show ?thesis
           using Colleq_refl mono_seqspace_is_fun[THEN apply_type]
           unfolding refl_def
           by simp
       qed
     qed
     moreover
     note \<open>x\<in>\<omega>\<close>
     moreover from this
     have "f`x \<in> Coll" if "f: succ(x) \<^sub><\<rightarrow>\<^bsup>M\<^esup> (Coll,converse(Colleq))" for f
       using that mono_seqspace_rel_char[simplified, of "succ(x)" Coll "converse(Colleq)"]
         nat_into_M[simplified] mono_seqspace_is_fun[of "converse(Colleq)"]
       by (intro apply_type[of _ "succ(x)"]) (auto simp del:setclass_iff)
     ultimately
     show ?case
       using transM[of _ Coll]
       by (auto dest:transM simp del:setclass_iff, rule_tac x="f`x" in bexI)
         (auto simp del:setclass_iff, simp)
   qed
   moreover
     \<comment> \<open>Interesting case: Countably infinite sequences.\<close>
   have "\<forall>f\<in>M. f \<in> \<omega> \<^sub><\<rightarrow>\<^bsup>M\<^esup> (Coll,converse(Colleq)) \<longrightarrow>
                   (\<exists>q\<in>M. q \<in> Coll \<and> (\<forall>\<alpha>\<in>M. \<alpha> \<in> \<omega> \<longrightarrow> \<langle>q, f ` \<alpha>\<rangle> \<in> Colleq))"
   proof(intro ballI impI)
     fix f
     let ?rnf="f``\<omega>"
     assume "f\<in>M" "f \<in> \<omega> \<^sub><\<rightarrow>\<^bsup>M\<^esup> (Coll,converse(Colleq))"
     moreover from this
     have "f\<in>\<omega> \<^sub><\<rightarrow> (Coll,converse(Colleq))" "f\<in>\<omega> \<rightarrow> Coll"
       using mono_seqspace_rel_char mono_mapD(2) nat_in_M
       by auto
     moreover from this
     have "countable\<^bsup>M\<^esup>(f`x)" if "x\<in>\<omega>" for x
       using that Fn_rel_is_function countable_iff_lesspoll_rel_Aleph_rel_one
       by auto
     moreover from calculation
     have "?rnf \<in> M" "f\<subseteq>\<omega>\<times>Coll"
       using nat_in_M image_closed Pi_iff
       by simp_all
     moreover from calculation
     have 1:"\<exists>d\<in>?rnf. d \<supseteq> h \<and> d \<supseteq> g" if "h \<in> ?rnf" "g \<in> ?rnf" for h g
     proof -
       from calculation
       have "?rnf={f`x . x\<in>\<omega>}"
         using  image_function[of f \<omega>] Pi_iff domain_of_fun
         by auto
       from \<open>?rnf=_\<close> that
       obtain m n where eq:"h=f`m" "g=f`n" "n\<in>\<omega>" "m\<in>\<omega>"
         by auto
       then
       have "m\<union>n\<in>\<omega>" "m\<le>m\<union>n" "n\<le>m\<union>n"
         using Un_upper1_le Un_upper2_le nat_into_Ord by simp_all
       with calculation eq \<open>?rnf=_\<close>
       have "f`(m\<union>n)\<in>?rnf" "f`(m\<union>n) \<supseteq> h" "f`(m\<union>n) \<supseteq> g"
         using Fnle_relD mono_map_lt_le_is_mono converse_refl[OF Colleq_refl]
         by auto
       then
       show ?thesis
         by auto
     qed
     moreover from calculation
     have "?rnf \<subseteq> (\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup> \<rightharpoonup>\<^bsup>##M\<^esup> (nat \<rightarrow>\<^bsup>M\<^esup> 2))"
       using subset_trans[OF image_subset[OF \<open>f\<subseteq>_\<close>,of \<omega>] Fn_rel_subset_PFun_rel]
       by simp
     moreover
     have "\<Union> ?rnf \<in> (\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup> \<rightharpoonup>\<^bsup>##M\<^esup> (nat \<rightarrow>\<^bsup>M\<^esup> 2))"
       using pfun_Un_filter_closed'[OF \<open>?rnf\<subseteq>_\<close> 1]  \<open>?rnf\<in>M\<close>
       by simp
     moreover from calculation
     have "\<Union>?rnf \<prec>\<^bsup>M\<^esup> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>"
       using countable_fun_imp_countable_image[of f]
         mem_function_space_rel_abs[simplified,OF nat_in_M Coll_in_M \<open>f\<in>M\<close>]
         countableI[OF lepoll_rel_refl]
         countable_iff_lesspoll_rel_Aleph_rel_one[of "\<Union>?rnf"]
       by auto
     moreover from calculation
     have "\<Union>?rnf\<in>Coll"
       unfolding Fn_rel_def
       by simp
     moreover from calculation
     have "\<Union>?rnf \<supseteq> f ` \<alpha> " if "\<alpha>\<in>\<omega>" for \<alpha>
       using that image_function[OF fun_is_function] domain_of_fun
       by auto
     ultimately
     show "\<exists>q\<in>M. q \<in> Coll \<and> (\<forall>\<alpha>\<in>M. \<alpha> \<in> \<omega> \<longrightarrow> \<langle>q, f ` \<alpha>\<rangle> \<in> Colleq)"
       using Fn_rel_is_function Fnle_relI
       by auto
   qed
   ultimately
   show ?thesis
     unfolding kappa_closed_rel_def by (auto elim!:leE dest:ltD)
 qed
 
-end \<comment> \<open>\<^locale>\<open>M_ctm3_AC\<close>\<close>
+end \<comment> \<open>\<^locale>\<open>M_ctm2_AC\<close>\<close>
 
-sublocale M_ZFC3_trans \<subseteq> M_library "##M"
-  by unfold_locales (simp_all add:repl_instances sep_instances del:setclass_iff
-      add: transrec_replacement_def wfrec_replacement_def)
-
-locale collapse_CH = G_generic4_AC_CH "Fn\<^bsup>M\<^esup>(\<aleph>\<^bsub>1\<^esub>\<^bsup>##M\<^esup>, \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>, \<omega> \<rightarrow>\<^bsup>M\<^esup> 2)" "Fnle\<^bsup>M\<^esup>(\<aleph>\<^bsub>1\<^esub>\<^bsup>##M\<^esup>, \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>, \<omega> \<rightarrow>\<^bsup>M\<^esup> 2)" 0
+locale collapse_CH = G_generic3_AC_CH "Fn\<^bsup>M\<^esup>(\<aleph>\<^bsub>1\<^esub>\<^bsup>##M\<^esup>, \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>, \<omega> \<rightarrow>\<^bsup>M\<^esup> 2)" "Fnle\<^bsup>M\<^esup>(\<aleph>\<^bsub>1\<^esub>\<^bsup>##M\<^esup>, \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>, \<omega> \<rightarrow>\<^bsup>M\<^esup> 2)" 0
 
 sublocale collapse_CH \<subseteq> forcing_notion "Coll" "Colleq" 0
   using zero_lt_Aleph_rel1 by unfold_locales
 
 context collapse_CH
 begin
 
 notation Leq (infixl "\<preceq>" 50)
 notation Incompatible (infixl "\<bottom>" 50)
 
 abbreviation
   f_G :: "i" (\<open>f\<^bsub>G\<^esub>\<close>) where
   "f\<^bsub>G\<^esub> \<equiv> \<Union>G"
 
 lemma f_G_in_MG[simp]:
   shows "f\<^bsub>G\<^esub> \<in> M[G]"
   using G_in_MG by simp
 
 abbreviation
   dom_dense :: "i\<Rightarrow>i" where
   "dom_dense(x) \<equiv> { p\<in>Coll . x \<in> domain(p) }"
 
 lemma dom_dense_closed[intro,simp]: "x\<in>M \<Longrightarrow> dom_dense(x) \<in> M"
   using separation_in_domain[of x]
   by simp
 
 lemma domain_f_G: assumes "x \<in> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>"
   shows "x \<in> domain(f\<^bsub>G\<^esub>)"
 proof -
   have "(\<lambda>n\<in>\<omega>. 0) \<in> \<omega> \<rightarrow>\<^bsup>M\<^esup> 2"
     using function_space_rel_nonempty[of 0 2 \<omega>]
     by auto
   with assms
   have "dense(dom_dense(x))" "x\<in>M"
     using dense_dom_dense InfCard_rel_Aleph_rel[of 1] transitivity[OF _
        Aleph_rel_closed[of 1,THEN setclass_iff[THEN iffD1]]]
     unfolding dense_def
      by auto
   with assms
   obtain p where "p\<in>dom_dense(x)" "p\<in>G"
     using M_generic_denseD[of "dom_dense(x)"]
     by auto
   then
   show "x \<in> domain(f\<^bsub>G\<^esub>)" by blast
 qed
 
 lemma Un_filter_is_function:
   assumes "filter(G)"
   shows "function(\<Union>G)"
 proof -
   have "Coll \<subseteq> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup> \<rightharpoonup>\<^bsup>##M\<^esup> (\<omega> \<rightarrow>\<^bsup>M\<^esup> 2)"
     using Fn_rel_subset_PFun_rel
     by simp
   moreover
   have "\<exists> d \<in> Coll. d \<supseteq> f \<and> d \<supseteq> g" if "f\<in>G" "g\<in>G" for f g
     using filter_imp_compat[OF assms \<open>f\<in>G\<close> \<open>g\<in>G\<close>] filterD[OF assms]
     unfolding compat_def compat_in_def
     by auto
   ultimately
   have "\<exists>d \<in> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup> \<rightharpoonup>\<^bsup>##M\<^esup> (\<omega> \<rightarrow>\<^bsup>M\<^esup> 2). d \<supseteq> f \<and> d \<supseteq> g" if "f\<in>G" "g\<in>G" for f g
     using rex_mono[of Coll] that by simp
   moreover
   have "G\<subseteq>Coll"
     using assms
     unfolding filter_def
     by simp
   moreover from this
   have "G \<subseteq> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup> \<rightharpoonup>\<^bsup>##M\<^esup> (\<omega> \<rightarrow>\<^bsup>M\<^esup> 2)"
     using assms unfolding Fn_rel_def
     by auto
   ultimately
   show ?thesis
     using pfun_Un_filter_closed[of G]
     by simp
 qed
 
 lemma f_G_funtype:
   shows "f\<^bsub>G\<^esub> : \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup> \<rightarrow> \<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2"
 proof -
   have "x \<in> B \<Longrightarrow> B \<in> G \<Longrightarrow> x \<in> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup> \<times> (\<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2)" for B x
   proof -
     assume "x\<in>B" "B\<in>G"
     moreover from this
     have "x \<in> M[G]"
       by (auto dest!: ext.transM simp add:G_in_MG)
     moreover from calculation
     have "x \<in> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup> \<times> (\<omega> \<rightarrow> 2)"
       using Fn_rel_subset_Pow[of "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>" "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>" "\<omega> \<rightarrow>\<^bsup>M\<^esup> 2",
           OF _ _ function_space_rel_closed] function_space_rel_char
       by (auto dest!: M_genericD)
     moreover from this
     obtain z w where "x=\<langle>z,w\<rangle>" "z\<in>\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>" "w:\<omega> \<rightarrow> 2" by auto
     moreover from calculation
     have "w \<in> M[G]" by (auto dest:ext.transM)
     ultimately
     show ?thesis using ext.function_space_rel_char by auto
   qed
   moreover
   have "function(f\<^bsub>G\<^esub>)"
     using Un_filter_is_function generic
     by fast
   ultimately
   show ?thesis
     using generic domain_f_G Pi_iff by auto
 qed
 
 abbreviation
   surj_dense :: "i\<Rightarrow>i" where
   "surj_dense(x) \<equiv> { p\<in>Coll . x \<in> range(p) }"
 
 lemma surj_dense_closed[intro,simp]:
   "x \<in> \<omega> \<rightarrow>\<^bsup>M\<^esup> 2 \<Longrightarrow> surj_dense(x) \<in> M"
   using separation_in_range transM[of x] by simp
 
 lemma reals_sub_image_f_G:
   assumes "x \<in> \<omega> \<rightarrow>\<^bsup>M\<^esup> 2"
   shows "\<exists>\<alpha>\<in>\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>. f\<^bsub>G\<^esub> ` \<alpha> = x"
 proof -
   from assms
   have "dense(surj_dense(x))"
     using dense_surj_dense lepoll_rel_refl InfCard_rel_Aleph_rel
     unfolding dense_def
     by auto
   with \<open>x \<in> \<omega> \<rightarrow>\<^bsup>M\<^esup> 2\<close>
   obtain p where "p\<in>surj_dense(x)" "p\<in>G"
     using M_generic_denseD[of "surj_dense(x)"]
     by blast
   then
   show ?thesis
     using succ_omega_closed_Coll f_G_funtype function_apply_equality[of _ x f_G]
       succ_omega_closed_imp_no_new_reals[symmetric]
     by (auto, rule_tac bexI) (auto simp:Pi_def)
 qed
 
 lemma f_G_surj_Aleph_rel1_reals: "f\<^bsub>G\<^esub> \<in> surj\<^bsup>M[G]\<^esup>(\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>, \<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2)"
   using Aleph_rel_sub_closed
 proof (intro ext.mem_surj_abs[THEN iffD2],simp_all)
   show "f\<^bsub>G\<^esub> \<in> surj(\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>, \<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2)"
     using f_G_funtype G_in_MG ext.nat_into_M f_G_in_MG
       reals_sub_image_f_G succ_omega_closed_Coll
       succ_omega_closed_imp_no_new_reals
     unfolding surj_def
     by auto
 qed
 
 lemma continuum_rel_le_Aleph1_extension:
   includes G_generic1_lemmas
   shows "2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup> \<le> \<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup>"
 proof -
   have "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup> \<in> M[G]" "Ord(\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>)"
     using Card_rel_is_Ord by auto
   moreover from this
   have "\<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2 \<lesssim>\<^bsup>M[G]\<^esup> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>"
     using ext.surj_rel_implies_inj_rel[OF f_G_surj_Aleph_rel1_reals]
       f_G_in_MG unfolding lepoll_rel_def by auto
   with \<open>Ord(\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>)\<close>
   have "|\<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2|\<^bsup>M[G]\<^esup> \<le> |\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>|\<^bsup>M[G]\<^esup>"
     using M_subset_MG[OF one_in_G] Aleph_rel_closed[of 1]
     by (rule_tac ext.lepoll_rel_imp_cardinal_rel_le) simp_all
   ultimately
   have "2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup> \<le> |\<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup>|\<^bsup>M[G]\<^esup>"
     using ext.lepoll_rel_imp_cardinal_rel_le[of "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>" "\<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2"]
       ext.Aleph_rel_zero succ_omega_closed_Coll
       succ_omega_closed_imp_Aleph_1_preserved
     unfolding cexp_rel_def by simp
   then
   show "2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup> \<le> \<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup>" by simp
 qed
 
 theorem CH: "\<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup> = 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>"
   using continuum_rel_le_Aleph1_extension ext.Aleph_rel_succ[of 0]
     ext.Aleph_rel_zero ext.csucc_rel_le[of "2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>" \<omega>]
     ext.Card_rel_cexp_rel ext.cantor_cexp_rel[of \<omega>] ext.Card_rel_nat
     le_anti_sym
   by auto
 
 end \<comment> \<open>\<^locale>\<open>collapse_CH\<close>\<close>
 
 subsection\<open>Models of fragments of $\ZFC + \CH$\<close>
 
 theorem ctm_of_CH:
   assumes
     "M \<approx> \<omega>" "Transset(M)"
     "M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_CH}"
     "\<Phi> \<subseteq> formula" "M \<Turnstile> { \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>}"
   shows
     "\<exists>N.
       M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZC \<union> {\<cdot>CH\<cdot>} \<union> { \<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>} \<and>
       (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> (\<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N))"
 proof -
   from \<open>M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_CH}\<close>
-  interpret M_ZFC4 M
-    using M_satT_overhead_imp_M_ZF4 unfolding overhead_CH_def overhead_notCH_def by auto
+  interpret M_ZFC3 M
+    using M_satT_overhead_imp_M_ZF3 unfolding overhead_CH_def overhead_notCH_def by auto
   from \<open>M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_CH}\<close> \<open>Transset(M)\<close>
   interpret M_ZF_ground_CH_trans M
     using M_satT_imp_M_ZF_ground_CH_trans
     unfolding ZC_def by auto
   from \<open>M \<approx> \<omega>\<close>
   obtain enum where "enum \<in> bij(\<omega>,M)"
     using eqpoll_sym unfolding eqpoll_def by blast
   then
-  interpret M_ctm3_AC_CH M enum by unfold_locales
+  interpret M_ctm2_AC_CH M enum by unfold_locales
   interpret forcing_data1 "Coll" "Colleq" 0 M enum
     using zero_in_Fn_rel[of "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>" "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>" "\<omega> \<rightarrow>\<^bsup>M\<^esup> 2"]
       zero_top_Fn_rel[of _ "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>" "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>" "\<omega> \<rightarrow>\<^bsup>M\<^esup> 2"]
       preorder_on_Fnle_rel[of "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>" "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>" "\<omega> \<rightarrow>\<^bsup>M\<^esup> 2"]
       zero_lt_Aleph_rel1
     by unfold_locales simp_all
   obtain G where "M_generic(G)"
     using generic_filter_existence[OF one_in_P]
     by auto
   moreover from this
   interpret collapse_CH M enum G by unfold_locales
   have "\<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup> = 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>"
     using CH .
   then
   have "M[G], [] \<Turnstile> \<cdot>CH\<cdot>"
     using ext.is_ContHyp_iff
     by (simp add:ContHyp_rel_def)
   then
   have "M[G] \<Turnstile> ZC \<union> {\<cdot>CH\<cdot>}"
     using ext.M_satT_ZC by auto
   moreover
   have "Transset(M[G])" using Transset_MG .
   moreover
   have "M \<subseteq> M[G]" using M_subset_MG[OF one_in_G] generic by simp
   moreover
   note \<open>M \<Turnstile> { \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>}\<close> \<open>\<Phi> \<subseteq> formula\<close>
   ultimately
   show ?thesis
     using Ord_MG_iff MG_eqpoll_nat satT_ground_repl_fm_imp_satT_ZF_replacement_fm[of \<Phi>]
     by (rule_tac x="M[G]" in exI,blast)
 qed
 
 corollary ctm_ZFC_imp_ctm_CH:
   assumes
     "M \<approx> \<omega>" "Transset(M)" "M \<Turnstile> ZFC"
   shows
     "\<exists>N.
       M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZFC \<union> {\<cdot>CH\<cdot>} \<and>
       (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> (\<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N))"
 proof -
   from assms
   have "\<exists>N.
       M \<subseteq> N \<and>
         N \<approx> \<omega> \<and>
         Transset(N) \<and>
         N \<Turnstile> ZC \<and> N \<Turnstile> {\<cdot>CH\<cdot>} \<and> N \<Turnstile> {\<cdot>Replacement(x)\<cdot> . x \<in> formula} \<and> (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)"
     using ctm_of_CH[of M formula] satT_ZFC_imp_satT_ZC[of M]
       satT_mono[OF _ ground_repl_fm_sub_ZFC, of M]
       satT_mono[OF _ ZF_replacement_overhead_CH_sub_ZFC, of M]
       satT_mono[OF _ ZF_replacement_fms_sub_ZFC, of M]
     by (simp add: satT_Un_iff)
   then
   obtain N where "N \<Turnstile> ZC" "N \<Turnstile> {\<cdot>CH\<cdot>}" "N \<Turnstile> {\<cdot>Replacement(x)\<cdot> . x \<in> formula}"
     "M \<subseteq> N" "N \<approx> \<omega>" "Transset(N)" "(\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)"
     by auto
   moreover from this
   have "N \<Turnstile> ZFC"
     using satT_ZC_ZF_replacement_imp_satT_ZFC
     by auto
   moreover from this and \<open>N \<Turnstile> {\<cdot>CH\<cdot>}\<close>
   have "N \<Turnstile> ZFC \<union> {\<cdot>CH\<cdot>}"
     using satT_ZC_ZF_replacement_imp_satT_ZFC
     by auto
   ultimately
   show ?thesis
     by auto
 qed
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Cardinal_Preservation.thy b/thys/Independence_CH/Cardinal_Preservation.thy
--- a/thys/Independence_CH/Cardinal_Preservation.thy
+++ b/thys/Independence_CH/Cardinal_Preservation.thy
@@ -1,488 +1,488 @@
 section\<open>Preservation of cardinals in generic extensions\<close>
 
 theory Cardinal_Preservation
   imports
     Forcing_Main
 begin
 
 context forcing_data1
 
 begin
 
 lemma antichain_abs' [absolut]:
   "\<lbrakk> A\<in>M \<rbrakk> \<Longrightarrow> antichain\<^bsup>M\<^esup>(P,leq,A) \<longleftrightarrow> antichain(P,leq,A)"
   unfolding antichain_rel_def antichain_def compat_def
   using transitivity[of _ A]
   by (auto simp add:absolut)
 
 lemma inconsistent_imp_incompatible:
   assumes "p \<tturnstile> \<phi> env" "q \<tturnstile> Neg(\<phi>) env" "p\<in>P" "q\<in>P"
     "arity(\<phi>) \<le> length(env)" "\<phi> \<in> formula" "env \<in> list(M)"
   shows "p \<bottom> q"
 proof
   assume "compat(p,q)"
   then
   obtain d where "d \<preceq> p" "d \<preceq> q" "d \<in> P" by blast
   moreover
   note assms
   moreover from calculation
   have "d \<tturnstile> \<phi> env" "d \<tturnstile> Neg(\<phi>) env"
     using strengthening_lemma by simp_all
   ultimately
   show "False"
     using Forces_Neg[of d env \<phi>] refl_leq
     by (auto dest:transitivity; drule_tac bspec; auto dest:transitivity)
 qed
 
 notation check (\<open>_\<^sup>v\<close> [101] 100)
 
 end \<comment> \<open>\<^locale>\<open>forcing_data1\<close>\<close>
 
 
+locale G_generic2 = G_generic1 + forcing_data2
+locale G_generic2_AC = G_generic1_AC + G_generic2
+
 locale G_generic3 = G_generic2 + forcing_data3
 locale G_generic3_AC = G_generic2_AC + G_generic3
 
-locale G_generic4 = G_generic3 + forcing_data4
-locale G_generic4_AC = G_generic3_AC + G_generic4
+locale G_generic3_AC_CH = G_generic3_AC + M_ZFC2_ground_CH_trans
 
-locale G_generic4_AC_CH = G_generic4_AC + M_ZFC3_ground_CH_trans
-
-sublocale G_generic4_AC \<subseteq> ext:M_ZFC3_trans "M[G]"
-  using ground_replacements4 replacement_assm_MG
+sublocale G_generic3_AC \<subseteq> ext:M_ZFC2_trans "M[G]"
+  using ground_replacements3 replacement_assm_MG
   by unfold_locales simp_all
 
 lemma (in forcing_data1) forces_neq_apply_imp_incompatible:
   assumes
     "p \<tturnstile> \<cdot>0`1 is 2\<cdot> [f,a,b\<^sup>v]"
     "q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f,a,b'\<^sup>v]"
     "b \<noteq> b'"
     \<comment> \<open>More general version: taking general names
        \<^term>\<open>b\<^sup>v\<close> and \<^term>\<open>b'\<^sup>v\<close>, satisfying
        \<^term>\<open>p \<tturnstile> \<cdot>\<not>\<cdot>0 = 1\<cdot>\<cdot> [b\<^sup>v, b'\<^sup>v]\<close> and
        \<^term>\<open>q \<tturnstile> \<cdot>\<not>\<cdot>0 = 1\<cdot>\<cdot> [b\<^sup>v, b'\<^sup>v]\<close>.\<close>
     and
     types:"f\<in>M" "a\<in>M" "b\<in>M" "b'\<in>M" "p\<in>P" "q\<in>P"
   shows
     "p \<bottom> q"
 proof -
   {
     fix G
     assume "M_generic(G)"
     then
     interpret G_generic1 _ _ _ _ _ G by unfold_locales
     include G_generic1_lemmas
     assume "q\<in>G"
     with assms \<open>M_generic(G)\<close>
     have "M[G], map(val(G),[f,a,b'\<^sup>v]) \<Turnstile> \<cdot>0`1 is 2\<cdot>"
       using truth_lemma[of "\<cdot>0`1 is 2\<cdot>" "[f,a,b'\<^sup>v]"]
       by (auto simp add:ord_simp_union arity_fun_apply_fm
           fun_apply_type)
     with \<open>b \<noteq> b'\<close> types
     have "M[G], map(val(G),[f,a,b\<^sup>v]) \<Turnstile> \<cdot>\<not>\<cdot>0`1 is 2\<cdot>\<cdot>"
       using GenExtI by auto
   }
   with types
   have "q \<tturnstile> \<cdot>\<not>\<cdot>0`1 is 2\<cdot>\<cdot> [f,a,b\<^sup>v]"
     using definition_of_forcing[where \<phi>="\<cdot>\<not>\<cdot>0`1 is 2\<cdot>\<cdot>" ]
     by (auto simp add:ord_simp_union arity_fun_apply_fm)
   with \<open>p \<tturnstile> \<cdot>0`1 is 2\<cdot> [f,a,b\<^sup>v]\<close> and types
   show "p \<bottom> q"
     using inconsistent_imp_incompatible
     by (simp add:ord_simp_union arity_fun_apply_fm fun_apply_type)
 qed
 
-context M_ctm3_AC
+context M_ctm2_AC
 begin
 
 \<comment> \<open>Simplifying simp rules (because of the occurrence of
    \<^term>\<open>setclass\<close>)\<close>
 lemmas sharp_simps = Card_rel_Union Card_rel_cardinal_rel Collect_abs
   Cons_abs Cons_in_M_iff Diff_closed Equal_abs Equal_in_M_iff Finite_abs
   Forall_abs Forall_in_M_iff Inl_abs Inl_in_M_iff Inr_abs Inr_in_M_iff
   Int_closed Inter_abs Inter_closed M_nat Member_abs Member_in_M_iff
   Memrel_closed Nand_abs Nand_in_M_iff Nil_abs Nil_in_M Ord_cardinal_rel
   Pow_rel_closed Un_closed Union_abs Union_closed and_abs and_closed
   apply_abs apply_closed bij_rel_closed bijection_abs bool_of_o_abs
   bool_of_o_closed cadd_rel_0 cadd_rel_closed cardinal_rel_0_iff_0
   cardinal_rel_closed cardinal_rel_idem cartprod_abs cartprod_closed
   cmult_rel_0 cmult_rel_1 cmult_rel_closed comp_closed composition_abs
   cons_abs cons_closed converse_abs converse_closed csquare_lam_closed
   csquare_rel_closed depth_closed domain_abs domain_closed eclose_abs
   eclose_closed empty_abs field_abs field_closed finite_funspace_closed
   finite_ordinal_abs formula_N_abs formula_N_closed formula_abs
   formula_case_abs formula_case_closed formula_closed
   formula_functor_abs fst_closed function_abs function_space_rel_closed
   hd_abs image_abs image_closed inj_rel_closed injection_abs inter_abs
   irreflexive_abs is_depth_apply_abs is_eclose_n_abs is_funspace_abs
   iterates_closed length_abs length_closed lepoll_rel_refl
   limit_ordinal_abs linear_rel_abs list_N_abs list_N_closed list_abs
   list_case'_closed list_case_abs list_closed list_functor_abs
   mem_bij_abs mem_eclose_abs mem_inj_abs mem_list_abs membership_abs
   minimum_closed nat_case_abs nat_case_closed nonempty not_abs
   not_closed nth_abs number1_abs number2_abs number3_abs omega_abs
   or_abs or_closed order_isomorphism_abs ordermap_closed
   ordertype_closed ordinal_abs pair_abs pair_in_M_iff powerset_abs
   pred_closed pred_set_abs quasilist_abs quasinat_abs radd_closed
   rall_abs range_abs range_closed relation_abs restrict_closed
   restriction_abs rex_abs rmult_closed rtrancl_abs rtrancl_closed
   rvimage_closed separation_closed setdiff_abs singleton_abs
   singleton_in_M_iff snd_closed strong_replacement_closed subset_abs
   succ_in_M_iff successor_abs successor_ordinal_abs sum_abs sum_closed
   surj_rel_closed surjection_abs tl_abs trancl_abs trancl_closed
   transitive_rel_abs transitive_set_abs typed_function_abs union_abs
   upair_abs upair_in_M_iff vimage_abs vimage_closed well_ord_abs
   mem_formula_abs nth_closed Aleph_rel_closed csucc_rel_closed
   Card_rel_Aleph_rel
 
 declare sharp_simps[simp del, simplified setclass_iff, simp]
 
 lemmas sharp_intros = nat_into_M Aleph_rel_closed Card_rel_Aleph_rel
 
 declare sharp_intros[rule del, simplified setclass_iff, intro]
 
-end \<comment> \<open>\<^locale>\<open>M_ctm3_AC\<close>\<close>
+end \<comment> \<open>\<^locale>\<open>M_ctm2_AC\<close>\<close>
 
-context G_generic4_AC begin
+context G_generic3_AC begin
 
 context
   includes G_generic1_lemmas
 begin
 
 lemmas mg_sharp_simps = ext.Card_rel_Union ext.Card_rel_cardinal_rel
   ext.Collect_abs ext.Cons_abs ext.Cons_in_M_iff ext.Diff_closed
   ext.Equal_abs ext.Equal_in_M_iff ext.Finite_abs ext.Forall_abs
   ext.Forall_in_M_iff ext.Inl_abs ext.Inl_in_M_iff ext.Inr_abs
   ext.Inr_in_M_iff ext.Int_closed ext.Inter_abs ext.Inter_closed
   ext.M_nat ext.Member_abs ext.Member_in_M_iff ext.Memrel_closed
   ext.Nand_abs ext.Nand_in_M_iff ext.Nil_abs ext.Nil_in_M
   ext.Ord_cardinal_rel ext.Pow_rel_closed ext.Un_closed
   ext.Union_abs ext.Union_closed ext.and_abs ext.and_closed
   ext.apply_abs ext.apply_closed ext.bij_rel_closed
   ext.bijection_abs ext.bool_of_o_abs ext.bool_of_o_closed
   ext.cadd_rel_0 ext.cadd_rel_closed ext.cardinal_rel_0_iff_0
   ext.cardinal_rel_closed ext.cardinal_rel_idem ext.cartprod_abs
   ext.cartprod_closed ext.cmult_rel_0 ext.cmult_rel_1
   ext.cmult_rel_closed ext.comp_closed ext.composition_abs
   ext.cons_abs ext.cons_closed ext.converse_abs ext.converse_closed
   ext.csquare_lam_closed ext.csquare_rel_closed ext.depth_closed
   ext.domain_abs ext.domain_closed ext.eclose_abs ext.eclose_closed
   ext.empty_abs ext.field_abs ext.field_closed
   ext.finite_funspace_closed ext.finite_ordinal_abs ext.formula_N_abs
   ext.formula_N_closed ext.formula_abs ext.formula_case_abs
   ext.formula_case_closed ext.formula_closed ext.formula_functor_abs
   ext.fst_closed ext.function_abs ext.function_space_rel_closed
   ext.hd_abs ext.image_abs ext.image_closed ext.inj_rel_closed
   ext.injection_abs ext.inter_abs ext.irreflexive_abs
   ext.is_depth_apply_abs ext.is_eclose_n_abs ext.is_funspace_abs
   ext.iterates_closed ext.length_abs ext.length_closed
   ext.lepoll_rel_refl ext.limit_ordinal_abs ext.linear_rel_abs
   ext.list_N_abs ext.list_N_closed ext.list_abs
   ext.list_case'_closed ext.list_case_abs ext.list_closed
   ext.list_functor_abs ext.mem_bij_abs ext.mem_eclose_abs
   ext.mem_inj_abs ext.mem_list_abs ext.membership_abs
   ext.nat_case_abs ext.nat_case_closed
   ext.nonempty ext.not_abs ext.not_closed ext.nth_abs
   ext.number1_abs ext.number2_abs ext.number3_abs ext.omega_abs
   ext.or_abs ext.or_closed ext.order_isomorphism_abs
   ext.ordermap_closed ext.ordertype_closed ext.ordinal_abs
   ext.pair_abs ext.pair_in_M_iff ext.powerset_abs ext.pred_closed
   ext.pred_set_abs ext.quasilist_abs ext.quasinat_abs
   ext.radd_closed ext.rall_abs ext.range_abs ext.range_closed
   ext.relation_abs ext.restrict_closed ext.restriction_abs
   ext.rex_abs ext.rmult_closed ext.rtrancl_abs ext.rtrancl_closed
   ext.rvimage_closed ext.separation_closed ext.setdiff_abs
   ext.singleton_abs ext.singleton_in_M_iff ext.snd_closed
   ext.strong_replacement_closed ext.subset_abs ext.succ_in_M_iff
   ext.successor_abs ext.successor_ordinal_abs ext.sum_abs
   ext.sum_closed ext.surj_rel_closed ext.surjection_abs ext.tl_abs
   ext.trancl_abs ext.trancl_closed ext.transitive_rel_abs
   ext.transitive_set_abs ext.typed_function_abs ext.union_abs
   ext.upair_abs ext.upair_in_M_iff ext.vimage_abs ext.vimage_closed
   ext.well_ord_abs ext.mem_formula_abs ext.nth_closed ext.Aleph_rel_closed
   ext.csucc_rel_closed ext.Card_rel_Aleph_rel
 
 \<comment> \<open>The following was motivated by the fact that
     @{thm [source] ext.apply_closed} did not simplify appropriately.\<close>
 declare mg_sharp_simps[simp del, simplified setclass_iff, simp]
 
 lemmas mg_sharp_intros = ext.nat_into_M ext.Aleph_rel_closed
   ext.Card_rel_Aleph_rel
 
 declare mg_sharp_intros[rule del, simplified setclass_iff, intro]
 
 \<comment> \<open>Kunen IV.2.31\<close>
 lemma forces_below_filter:
   assumes "M[G], map(val(G),env) \<Turnstile> \<phi>" "p \<in> G"
     "arity(\<phi>) \<le> length(env)" "\<phi> \<in> formula" "env \<in> list(M)"
   shows "\<exists>q\<in>G. q \<preceq> p \<and> q \<tturnstile> \<phi> env"
 proof -
   note assms
   moreover from this
   obtain r where "r \<tturnstile> \<phi> env" "r\<in>G"
     using generic truth_lemma[of \<phi> env]
     by blast
   moreover from this and \<open>p\<in>G\<close>
   obtain q where "q \<preceq> p" "q \<preceq> r" "q \<in> G" by auto
   ultimately
   show ?thesis
     using strengthening_lemma[of r \<phi> _ env] by blast
 qed
 
 subsection\<open>Preservation by ccc forcing notions\<close>
 
 lemma ccc_fun_closed_lemma_aux:
   assumes "f_dot\<in>M" "p\<in>M" "a\<in>M" "b\<in>M"
   shows "{q \<in> P . q \<preceq> p \<and> (M, [q, P, leq, \<one>, f_dot, a\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))} \<in> M"
   using separation_forces[where env="[f_dot, a\<^sup>v, b\<^sup>v]" and \<phi>="\<cdot>0`1 is 2\<cdot>",simplified]
     assms G_subset_M[THEN subsetD] generic
     separation_in lam_replacement_constant lam_replacement_identity
     lam_replacement_product
     separation_conj arity_fun_apply_fm union_abs1
   by simp_all
 
 lemma ccc_fun_closed_lemma_aux2:
   assumes "B\<in>M" "f_dot\<in>M" "p\<in>M" "a\<in>M"
   shows "(##M)(\<lambda>b\<in>B. {q \<in> P . q \<preceq> p \<and> (M, [q, P, leq, \<one>, f_dot, a\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))})"
 proof -
   have "separation(##M, \<lambda>z. M, [snd(z), P, leq, \<one>, f_dot, \<tau>, fst(z)\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))"
     if "\<tau>\<in>M" for \<tau>
   proof -
     let ?f_fm="snd_fm(1,0)"
     let ?g_fm="hcomp_fm(check_fm(6),fst_fm,2,0)"
     note assms
     moreover
     have "arity(forces(\<cdot>0`1 is 2\<cdot> )) \<le> 7"
       using arity_fun_apply_fm union_abs1 arity_forces[of "\<cdot>0`1 is 2\<cdot> "]
       by simp
     moreover
     have "?f_fm \<in> formula" "arity(?f_fm) \<le> 7" "?g_fm \<in> formula" "arity(?g_fm) \<le> 8"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     ultimately
     show ?thesis
       using separation_sat_after_function assms that sats_fst_fm
         snd_abs sats_snd_fm sats_check_fm check_abs fst_abs
       unfolding hcomp_fm_def
       by simp
   qed
   with assms
   show ?thesis
     using lam_replacement_imp_lam_closed separation_conj separation_in
       lam_replacement_product lam_replacement_constant transitivity[of _ B]
       lam_replacement_snd lam_replacement_Collect' ccc_fun_closed_lemma_aux
     by simp
 qed
 
 lemma ccc_fun_closed_lemma:
   assumes "A\<in>M" "B\<in>M" "f_dot\<in>M" "p\<in>M"
   shows "(\<lambda>a\<in>A. {b\<in>B. \<exists>q\<in>P. q \<preceq> p \<and> (q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v])}) \<in> M"
 proof -
   have "separation(##M, \<lambda>z. M, [snd(z), P, leq, \<one>, f_dot, fst(fst(z))\<^sup>v, snd(fst(z))\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))"
   proof -
     let ?f_fm="snd_fm(1,0)"
     let ?g="\<lambda>z . fst(fst(fst(z)))\<^sup>v"
     let ?g_fm="hcomp_fm(check_fm(6),hcomp_fm(fst_fm,fst_fm),2,0)"
     let ?h_fm="hcomp_fm(check_fm(7),hcomp_fm(snd_fm,fst_fm),3,0)"
     note assms
     moreover
     have "arity(forces(\<cdot>0`1 is 2\<cdot> )) \<le> 7"
       using arity_fun_apply_fm union_abs1 arity_forces[of "\<cdot>0`1 is 2\<cdot> "]
       by simp
     moreover
     have "?f_fm \<in> formula" "arity(?f_fm) \<le> 6" "?g_fm \<in> formula" "arity(?g_fm) \<le> 7"
       "?h_fm \<in> formula" "arity(?h_fm) \<le> 8"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     ultimately
     show ?thesis
       using separation_sat_after_function3 assms sats_check_fm check_abs
         fst_abs snd_abs
       unfolding hcomp_fm_def
       by simp
   qed
   moreover
   have 1:"separation(##M, \<lambda>z. M, [snd(z), P, leq, \<one>, f_dot, \<tau>, fst(z)\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))"
     if "\<tau>\<in>M" for \<tau>
   proof -
     let ?f_fm="snd_fm(1,0)"
     let ?g_fm="hcomp_fm(check_fm(6),fst_fm,2,0)"
     note assms
     moreover
     have "arity(forces(\<cdot>0`1 is 2\<cdot> )) \<le> 7"
       using arity_forces[of "\<cdot>0`1 is 2\<cdot> "] arity_fun_apply_fm union_abs1
       by simp
     moreover
     have "?f_fm \<in> formula" "arity(?f_fm) \<le> 7" "?g_fm \<in> formula" "arity(?g_fm) \<le> 8"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     ultimately
     show ?thesis
       using separation_sat_after_function that fst_abs snd_abs sats_check_fm check_abs
       unfolding hcomp_fm_def
       by simp
   qed
   moreover note assms
   ultimately
   show ?thesis
     using lam_replacement_imp_lam_closed lam_replacement_Collect' transitivity[of _ A]
       lam_replacement_constant lam_replacement_identity lam_replacement_snd
       lam_replacement_product separation_conj separation_in separation_bex separation_iff'
     by simp
 qed
 
 \<comment> \<open>Kunen IV.3.5\<close>
 lemma ccc_fun_approximation_lemma:
   notes le_trans[trans]
   assumes "ccc\<^bsup>M\<^esup>(P,leq)" "A\<in>M" "B\<in>M" "f\<in>M[G]" "f : A \<rightarrow> B"
   shows
     "\<exists>F\<in>M. F : A \<rightarrow> Pow\<^bsup>M\<^esup>(B) \<and> (\<forall>a\<in>A. f`a \<in> F`a \<and> |F`a|\<^bsup>M\<^esup> \<le> \<omega>)"
 proof -
   from \<open>f\<in>M[G]\<close>
   obtain f_dot where "f = val(G,f_dot)" "f_dot\<in>M" using GenExtD by force
   with assms
   obtain p where "p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, A\<^sup>v, B\<^sup>v]" "p\<in>G" "p\<in>M"
     using G_subset_M truth_lemma[of "\<cdot>0:1\<rightarrow>2\<cdot>" "[f_dot, A\<^sup>v, B\<^sup>v]"]
     by (auto simp add:ord_simp_union arity_typed_function_fm
         \<comment> \<open>NOTE: type-checking is not performed here by the Simplifier\<close>
         typed_function_type)
   define F where "F\<equiv>\<lambda>a\<in>A. {b\<in>B. \<exists>q\<in>P. q \<preceq> p \<and> (q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v])}"
   from assms \<open>f_dot\<in>_\<close> \<open>p\<in>M\<close>
   have "F \<in> M"
     unfolding F_def using ccc_fun_closed_lemma by simp
   moreover from calculation
   have "f`a \<in> F`a" if "a \<in> A" for a
   proof -
     note \<open>f: A \<rightarrow> B\<close> \<open>a \<in> A\<close>
     moreover from this
     have "f ` a \<in> B" by simp
     moreover
     note \<open>f\<in>M[G]\<close> \<open>A\<in>M\<close>
     moreover from calculation
     have "M[G], [f, a, f`a] \<Turnstile> \<cdot>0`1 is 2\<cdot>"
       by (auto dest:transitivity)
     moreover
     note \<open>B\<in>M\<close> \<open>f = val(G,f_dot)\<close>
     moreover from calculation
     have "a\<in>M" "val(G, f_dot)`a\<in>M"
       by (auto dest:transitivity)
     moreover
     note \<open>f_dot\<in>M\<close> \<open>p\<in>G\<close>
     ultimately
     obtain q where "q \<preceq> p" "q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, (f`a)\<^sup>v]" "q\<in>G"
       using forces_below_filter[of "\<cdot>0`1 is 2\<cdot>" "[f_dot, a\<^sup>v, (f`a)\<^sup>v]" p]
       by (auto simp add: ord_simp_union arity_fun_apply_fm
           fun_apply_type)
     with \<open>f`a \<in> B\<close>
     have "f`a \<in> {b\<in>B . \<exists>q\<in>P. q \<preceq> p \<and> q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v]}"
       by blast
     with \<open>a\<in>A\<close>
     show ?thesis unfolding F_def by simp
   qed
   moreover
   have "|F`a|\<^bsup>M\<^esup> \<le> \<omega> \<and> F`a\<in>M" if "a \<in> A" for a
   proof -
     let ?Q="\<lambda>b. {q\<in>P. q \<preceq> p \<and> (q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v])}"
     from \<open>F \<in> M\<close> \<open>a\<in>A\<close> \<open>A\<in>M\<close>
     have "F`a \<in> M" "a\<in>M"
       using transitivity[OF _ \<open>A\<in>M\<close>] by simp_all
     moreover
     have 2:"\<And>x. x\<in>F`a \<Longrightarrow> x\<in>M"
       using transitivity[OF _ \<open>F`a\<in>M\<close>] by simp
     moreover
     have 3:"\<And>x. x\<in>F`a \<Longrightarrow> (##M)(?Q(x))"
       using ccc_fun_closed_lemma_aux[OF \<open>f_dot\<in>M\<close> \<open>p\<in>M\<close> \<open>a\<in>M\<close> 2] transitivity[of _ "F`a"]
       by simp
     moreover
     have 4:"lam_replacement(##M,\<lambda>b. {q \<in> P . q \<preceq> p \<and> (M, [q, P, leq, \<one>, f_dot, a\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))})"
       using ccc_fun_closed_lemma_aux2[OF _ \<open>f_dot\<in>M\<close> \<open>p\<in>M\<close> \<open>a\<in>M\<close>]
         lam_replacement_iff_lam_closed[THEN iffD2]
         ccc_fun_closed_lemma_aux[OF  \<open>f_dot\<in>M\<close> \<open>p\<in>M\<close> \<open>a\<in>M\<close>]
       by simp
     ultimately
     interpret M_Pi_assumptions_choice "##M" "F`a" ?Q
       using Pi_replacement1[OF _ 3] lam_replacement_Sigfun[OF 4]
         lam_replacement_imp_strong_replacement
         ccc_fun_closed_lemma_aux[OF \<open>f_dot\<in>M\<close> \<open>p\<in>M\<close> \<open>a\<in>M\<close>]
         lam_replacement_hcomp2[OF lam_replacement_constant 4 _ _
           lam_replacement_minimum,unfolded lam_replacement_def]
       by unfold_locales simp_all
     from \<open>F`a \<in> M\<close>
     interpret M_Pi_assumptions2 "##M" "F`a" ?Q "\<lambda>_ . P"
       using lam_replacement_imp_strong_replacement[OF
           lam_replacement_Sigfun[OF lam_replacement_constant]]
         Pi_replacement1 transitivity[of _ "F`a"]
       by unfold_locales simp_all
     from \<open>p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, A\<^sup>v, B\<^sup>v]\<close> \<open>a\<in>A\<close>
     have "\<exists>y. y \<in> ?Q(b)" if "b \<in> F`a" for b
       using that unfolding F_def by auto
     then
     obtain q where "q \<in> Pi\<^bsup>M\<^esup>(F`a,?Q)" "q\<in>M" using AC_Pi_rel by auto
     moreover
     note \<open>F`a \<in> M\<close>
     moreover from calculation
     have "q : F`a \<rightarrow>\<^bsup>M\<^esup> P"
       using Pi_rel_weaken_type def_function_space_rel by auto
     moreover from calculation
     have "q : F`a \<rightarrow> range(q)" "q : F`a \<rightarrow> P" "q : F`a \<rightarrow>\<^bsup>M\<^esup> range(q)"
       using mem_function_space_rel_abs range_of_fun by simp_all
     moreover
     have "q`b \<bottom> q`c" if "b \<in> F`a" "c \<in> F`a" "b \<noteq> c"
       \<comment> \<open>For the next step, if the premise \<^term>\<open>b \<noteq> c\<close> is first,
         the proof breaks down badly\<close>
       for b c
     proof -
       from \<open>b \<in> F`a\<close> \<open>c \<in> F`a\<close> \<open>q \<in> Pi\<^bsup>M\<^esup>(F`a,?Q)\<close> \<open>q\<in>M\<close>
       have "q`b \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v]"
         "q`c \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, c\<^sup>v]"
         using mem_Pi_rel_abs[of q] apply_type[of _ _  ?Q]
         by simp_all
       with \<open>b \<noteq> c\<close> \<open>q : F`a \<rightarrow> P\<close> \<open>a\<in>A\<close> \<open>b\<in>_\<close> \<open>c\<in>_\<close>
         \<open>A\<in>M\<close> \<open>f_dot\<in>M\<close> \<open>F`a\<in>M\<close>
       show ?thesis
         using forces_neq_apply_imp_incompatible
           transitivity[of _ A] transitivity[of _ "F`a"]
         by auto
     qed
     moreover from calculation
     have "antichain(P,leq,range(q))"
       using Pi_range_eq[of _  _ "\<lambda>_ . P"]
       unfolding antichain_def compat_in_def by auto
     moreover from this and \<open>q\<in>M\<close>
     have "antichain\<^bsup>M\<^esup>(P,leq,range(q))"
       by (simp add:absolut del:P_in_M)
     moreover from calculation
     have "q`b \<noteq> q`c" if "b \<noteq> c" "b \<in> F`a" "c \<in> F`a" for b c
       using that Incompatible_imp_not_eq apply_type
         mem_function_space_rel_abs by simp
     ultimately
     have "q \<in> inj\<^bsup>M\<^esup>(F`a,range(q))"
       using def_inj_rel by auto
     with \<open>F`a \<in> M\<close> \<open>q\<in>M\<close>
     have "|F`a|\<^bsup>M\<^esup> \<le> |range(q)|\<^bsup>M\<^esup>"
       using def_lepoll_rel
       by (rule_tac lepoll_rel_imp_cardinal_rel_le) auto
     also from \<open>antichain\<^bsup>M\<^esup>(P,leq,range(q))\<close> \<open>ccc\<^bsup>M\<^esup>(P,leq)\<close> \<open>q\<in>M\<close>
     have "|range(q)|\<^bsup>M\<^esup> \<le> \<omega>"
       using def_ccc_rel by simp
     finally
     show ?thesis using \<open>F`a\<in>M\<close> by auto
   qed
   moreover from this
   have "F`a\<in>M" if "a\<in>A" for a
     using that by simp
   moreover from this \<open>B\<in>M\<close>
   have "F : A \<rightarrow> Pow\<^bsup>M\<^esup>(B)"
     using Pow_rel_char
     unfolding F_def by (rule_tac lam_type) auto
   ultimately
   show ?thesis by auto
 qed
 
 end \<comment> \<open>G\_generic1\_lemmas bundle\<close>
 
-end \<comment> \<open>\<^locale>\<open>G_generic4_AC\<close>\<close>
+end \<comment> \<open>\<^locale>\<open>G_generic3_AC\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Choice_Axiom.thy b/thys/Independence_CH/Choice_Axiom.thy
--- a/thys/Independence_CH/Choice_Axiom.thy
+++ b/thys/Independence_CH/Choice_Axiom.thy
@@ -1,326 +1,322 @@
 section\<open>The Axiom of Choice in $M[G]$\<close>
 
 theory Choice_Axiom
   imports
     Powerset_Axiom
     Extensionality_Axiom
     Foundation_Axiom
     Replacement_Axiom
     Infinity_Axiom
 begin
 
 definition
   upair_name :: "i \<Rightarrow> i \<Rightarrow> i \<Rightarrow> i" where
   "upair_name(\<tau>,\<rho>,on) \<equiv> Upair(\<langle>\<tau>,on\<rangle>,\<langle>\<rho>,on\<rangle>)"
 
 definition
   opair_name :: "i \<Rightarrow> i \<Rightarrow> i \<Rightarrow> i" where
   "opair_name(\<tau>,\<rho>,on) \<equiv> upair_name(upair_name(\<tau>,\<tau>,on),upair_name(\<tau>,\<rho>,on),on)"
 
 definition
   induced_surj :: "i\<Rightarrow>i\<Rightarrow>i\<Rightarrow>i" where
   "induced_surj(f,a,e) \<equiv> f-``(range(f)-a)\<times>{e} \<union> restrict(f,f-``a)"
 
 lemma domain_induced_surj: "domain(induced_surj(f,a,e)) = domain(f)"
   unfolding induced_surj_def using domain_restrict domain_of_prod by auto
 
 lemma range_restrict_vimage:
   assumes "function(f)"
   shows "range(restrict(f,f-``a)) \<subseteq> a"
 proof
   from assms
   have "function(restrict(f,f-``a))"
     using function_restrictI by simp
   fix y
   assume "y \<in> range(restrict(f,f-``a))"
   then
   obtain x where "\<langle>x,y\<rangle> \<in> restrict(f,f-``a)"  "x \<in> f-``a" "x\<in>domain(f)"
     using domain_restrict domainI[of _ _ "restrict(f,f-``a)"] by auto
   moreover
   note \<open>function(restrict(f,f-``a))\<close>
   ultimately
   have "y = restrict(f,f-``a)`x"
     using function_apply_equality by blast
   also from \<open>x \<in> f-``a\<close>
   have "restrict(f,f-``a)`x = f`x"
     by simp
   finally
   have "y = f`x" .
   moreover from assms \<open>x\<in>domain(f)\<close>
   have "\<langle>x,f`x\<rangle> \<in> f"
     using function_apply_Pair by auto
   moreover
   note assms \<open>x \<in> f-``a\<close>
   ultimately
   show "y\<in>a"
     using function_image_vimage[of f a] by auto
 qed
 
 lemma induced_surj_type:
   assumes "function(f)" (* "relation(f)" (* a function can contain non-pairs *) *)
   shows
     "induced_surj(f,a,e): domain(f) \<rightarrow> {e} \<union> a"
     and
     "x \<in> f-``a \<Longrightarrow> induced_surj(f,a,e)`x = f`x"
 proof -
   let ?f1="f-``(range(f)-a) \<times> {e}" and ?f2="restrict(f, f-``a)"
   have "domain(?f2) = domain(f) \<inter> f-``a"
     using domain_restrict by simp
   moreover from assms
   have "domain(?f1) = f-``(range(f))-f-``a"
     using domain_of_prod function_vimage_Diff by simp
   ultimately
   have "domain(?f1) \<inter> domain(?f2) = 0"
     by auto
   moreover
   have "function(?f1)" "relation(?f1)" "range(?f1) \<subseteq> {e}"
     unfolding function_def relation_def range_def by auto
   moreover from this and assms
   have "?f1: domain(?f1) \<rightarrow> range(?f1)"
     using function_imp_Pi by simp
   moreover from assms
   have "?f2: domain(?f2) \<rightarrow> range(?f2)"
     using function_imp_Pi[of "restrict(f, f -`` a)"] function_restrictI by simp
   moreover from assms
   have "range(?f2) \<subseteq> a"
     using range_restrict_vimage by simp
   ultimately
   have "induced_surj(f,a,e): domain(?f1) \<union> domain(?f2) \<rightarrow> {e} \<union> a"
     unfolding induced_surj_def using fun_is_function fun_disjoint_Un fun_weaken_type by simp
   moreover
   have "domain(?f1) \<union> domain(?f2) = domain(f)"
     using domain_restrict domain_of_prod by auto
   ultimately
   show "induced_surj(f,a,e): domain(f) \<rightarrow> {e} \<union> a"
     by simp
   assume "x \<in> f-``a"
   then
   have "?f2`x = f`x"
     using restrict by simp
   moreover from \<open>x \<in> f-``a\<close> \<open>domain(?f1) = _\<close>
   have "x \<notin> domain(?f1)"
     by simp
   ultimately
   show "induced_surj(f,a,e)`x = f`x"
     unfolding induced_surj_def using fun_disjoint_apply2[of x ?f1 ?f2] by simp
 qed
 
 lemma induced_surj_is_surj :
   assumes
     "e\<in>a" "function(f)" "domain(f) = \<alpha>" "\<And>y. y \<in> a \<Longrightarrow> \<exists>x\<in>\<alpha>. f ` x = y"
   shows "induced_surj(f,a,e) \<in> surj(\<alpha>,a)"
   unfolding surj_def
 proof (intro CollectI ballI)
   from assms
   show "induced_surj(f,a,e): \<alpha> \<rightarrow> a"
     using induced_surj_type[of f a e] cons_eq cons_absorb by simp
   fix y
   assume "y \<in> a"
   with assms
   have "\<exists>x\<in>\<alpha>. f ` x = y"
     by simp
   then
   obtain x where "x\<in>\<alpha>" "f ` x = y" by auto
   with \<open>y\<in>a\<close> assms
   have "x\<in>f-``a"
     using vimage_iff function_apply_Pair[of f x] by auto
   with \<open>f ` x = y\<close> assms
   have "induced_surj(f, a, e) ` x = y"
     using induced_surj_type by simp
   with \<open>x\<in>\<alpha>\<close> show
     "\<exists>x\<in>\<alpha>. induced_surj(f, a, e) ` x = y" by auto
 qed
 
 lemma (in M_ZF1_trans) upair_name_closed :
   "\<lbrakk> x\<in>M; y\<in>M ; o\<in>M\<rbrakk> \<Longrightarrow> upair_name(x,y,o)\<in>M"
   unfolding upair_name_def
   using upair_in_M_iff pair_in_M_iff Upair_eq_cons
   by simp
 
-locale G_generic2 = G_generic1 + forcing_data2
-
-context G_generic2
+context G_generic1
 begin
 
 lemma val_upair_name : "val(G,upair_name(\<tau>,\<rho>,\<one>)) = {val(G,\<tau>),val(G,\<rho>)}"
   unfolding upair_name_def
   using val_Upair Upair_eq_cons generic one_in_G
   by simp
 
 lemma val_opair_name : "val(G,opair_name(\<tau>,\<rho>,\<one>)) = \<langle>val(G,\<tau>),val(G,\<rho>)\<rangle>"
   unfolding opair_name_def Pair_def
   using val_upair_name by simp
 
 lemma val_RepFun_one: "val(G,{\<langle>f(x),\<one>\<rangle> . x\<in>a}) = {val(G,f(x)) . x\<in>a}"
 proof -
   let ?A = "{f(x) . x \<in> a}"
   let ?Q = "\<lambda>\<langle>x,p\<rangle> . p = \<one>"
   have "\<one> \<in> P\<inter>G" using generic one_in_G one_in_P by simp
   have "{\<langle>f(x),\<one>\<rangle> . x \<in> a} = {t \<in> ?A \<times> P . ?Q(t)}"
     using one_in_P by force
   then
   have "val(G,{\<langle>f(x),\<one>\<rangle>  . x \<in> a}) = val(G,{t \<in> ?A \<times> P . ?Q(t)})"
     by simp
   also
   have "... = {z . t \<in> ?A , (\<exists>p\<in>P\<inter>G . ?Q(\<langle>t,p\<rangle>)) \<and> z= val(G,t)}"
     using val_of_name_alt by simp
   also from \<open>\<one>\<in>P\<inter>G\<close>
   have "... = {val(G,t) . t \<in> ?A }"
     by force
   also
   have "... = {val(G,f(x)) . x \<in> a}"
     by auto
   finally
   show ?thesis
     by simp
 qed
 
-end\<comment> \<open>\<^locale>\<open>G_generic2\<close>\<close>
+end\<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 subsection\<open>$M[G]$ is a transitive model of ZF\<close>
 
 sublocale G_generic1 \<subseteq> ext:M_Z_trans "M[G]"
   using Transset_MG generic pairing_in_MG Union_MG
     extensionality_in_MG power_in_MG foundation_in_MG
     replacement_assm_MG separation_in_MG infinity_in_MG
     replacement_ax1
   by unfold_locales
 
 lemma (in M_replacement) upair_name_lam_replacement :
   "M(z) \<Longrightarrow> lam_replacement(M,\<lambda>x . upair_name(fst(x),snd(x),z))"
   using lam_replacement_Upair[THEN [5] lam_replacement_hcomp2]
     lam_replacement_product
     lam_replacement_fst lam_replacement_snd lam_replacement_constant
   unfolding upair_name_def
   by simp
 
-lemma (in forcing_data2) repl_opname_check :
+lemma (in forcing_data1) repl_opname_check :
   assumes "A\<in>M" "f\<in>M"
   shows "{opair_name(check(x),f`x,\<one>). x\<in>A}\<in>M"
     using assms lam_replacement_constant check_lam_replacement lam_replacement_identity
       upair_name_lam_replacement[THEN [5] lam_replacement_hcomp2]
       lam_replacement_apply2[THEN [5] lam_replacement_hcomp2]
       lam_replacement_imp_strong_replacement_aux
       transitivity RepFun_closed upair_name_closed apply_closed
     unfolding opair_name_def
     by simp
 
-theorem (in G_generic2) choice_in_MG:
+theorem (in G_generic1) choice_in_MG:
   assumes "choice_ax(##M)"
   shows "choice_ax(##M[G])"
 proof -
   {
     fix a
     assume "a\<in>M[G]"
     then
     obtain \<tau> where "\<tau>\<in>M" "val(G,\<tau>) = a"
       using GenExt_def by auto
     with \<open>\<tau>\<in>M\<close>
     have "domain(\<tau>)\<in>M"
       using domain_closed by simp
     then
     obtain s \<alpha> where "s\<in>surj(\<alpha>,domain(\<tau>))" "Ord(\<alpha>)" "s\<in>M" "\<alpha>\<in>M"
       using assms choice_ax_abs
       by auto
     then
     have "\<alpha>\<in>M[G]"
       using M_subset_MG generic one_in_G subsetD
       by blast
     let ?A="domain(\<tau>)\<times>P"
     let ?g = "{opair_name(check(\<beta>),s`\<beta>,\<one>). \<beta>\<in>\<alpha>}"
     have "?g \<in> M"
       using \<open>s\<in>M\<close> \<open>\<alpha>\<in>M\<close> repl_opname_check
       by simp
     let ?f_dot="{\<langle>opair_name(check(\<beta>),s`\<beta>,\<one>),\<one>\<rangle>. \<beta>\<in>\<alpha>}"
     have "?f_dot = ?g \<times> {\<one>}" by blast
     define f where
       "f \<equiv> val(G,?f_dot)"
     from \<open>?g\<in>M\<close> \<open>?f_dot = ?g\<times>{\<one>}\<close>
     have "?f_dot\<in>M"
       using cartprod_closed singleton_closed
       by simp
     then
     have "f \<in> M[G]"
       unfolding f_def
       by (blast intro:GenExtI)
     have "f = {val(G,opair_name(check(\<beta>),s`\<beta>,\<one>)) . \<beta>\<in>\<alpha>}"
       unfolding f_def
       using val_RepFun_one
       by simp
     also
     have "... = {\<langle>\<beta>,val(G,s`\<beta>)\<rangle> . \<beta>\<in>\<alpha>}"
       using val_opair_name val_check generic one_in_G one_in_P
       by simp
     finally
     have "f = {\<langle>\<beta>,val(G,s`\<beta>)\<rangle> . \<beta>\<in>\<alpha>}" .
     then
     have 1: "domain(f) = \<alpha>" "function(f)"
       unfolding function_def by auto
     have 2: "y \<in> a \<Longrightarrow> \<exists>x\<in>\<alpha>. f ` x = y" for y
     proof -
       fix y
       assume
         "y \<in> a"
       with \<open>val(G,\<tau>) = a\<close>
       obtain \<sigma> where  "\<sigma>\<in>domain(\<tau>)" "val(G,\<sigma>) = y"
         using elem_of_val[of y _ \<tau>]
         by blast
       with \<open>s\<in>surj(\<alpha>,domain(\<tau>))\<close>
       obtain \<beta> where "\<beta>\<in>\<alpha>" "s`\<beta> = \<sigma>"
         unfolding surj_def
         by auto
       with \<open>val(G,\<sigma>) = y\<close>
       have "val(G,s`\<beta>) = y"
         by simp
       with \<open>f = {\<langle>\<beta>,val(G,s`\<beta>)\<rangle> . \<beta>\<in>\<alpha>}\<close> \<open>\<beta>\<in>\<alpha>\<close>
       have "\<langle>\<beta>,y\<rangle>\<in>f"
         by auto
       with \<open>function(f)\<close>
       have "f`\<beta> = y"
         using function_apply_equality by simp
       with \<open>\<beta>\<in>\<alpha>\<close> show
         "\<exists>\<beta>\<in>\<alpha>. f ` \<beta> = y"
         by auto
     qed
     then
     have "\<exists>\<alpha>\<in>(M[G]). \<exists>f'\<in>(M[G]). Ord(\<alpha>) \<and> f' \<in> surj(\<alpha>,a)"
     proof (cases "a=0")
       case True
       then
       show ?thesis
         unfolding surj_def
         using zero_in_MG
         by auto
     next
       case False
       with \<open>a\<in>M[G]\<close>
       obtain e where "e\<in>a" "e\<in>M[G]"
         using transitivity_MG
         by blast
       with 1 and 2
       have "induced_surj(f,a,e) \<in> surj(\<alpha>,a)"
         using induced_surj_is_surj by simp
       moreover from \<open>f\<in>M[G]\<close> \<open>a\<in>M[G]\<close> \<open>e\<in>M[G]\<close>
       have "induced_surj(f,a,e) \<in> M[G]"
         unfolding induced_surj_def
         by (simp flip: setclass_iff)
       moreover
       note \<open>\<alpha>\<in>M[G]\<close> \<open>Ord(\<alpha>)\<close>
       ultimately
       show ?thesis
         by auto
     qed
   }
   then
   show ?thesis
     using ext.choice_ax_abs
     by simp
 qed
 
-locale G_generic2_AC = G_generic1_AC + G_generic2 + M_ctm2_AC
-
-sublocale G_generic2_AC \<subseteq> ext:M_ZC_basic "M[G]"
+sublocale G_generic1_AC \<subseteq> ext:M_ZC_basic "M[G]"
   using choice_ax choice_in_MG
   by unfold_locales
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Definitions_Main.thy b/thys/Independence_CH/Definitions_Main.thy
--- a/thys/Independence_CH/Definitions_Main.thy
+++ b/thys/Independence_CH/Definitions_Main.thy
@@ -1,630 +1,641 @@
 section\<open>Main definitions of the development\label{sec:main-definitions}\<close>
 
 theory Definitions_Main
   imports
     Absolute_Versions
 begin
 
 text\<open>This theory gathers the main definitions of the
 \<^session>\<open>Transitive_Models\<close> session and the present one.
 
 It might be considered as the bare minimum reading requisite to
 trust that our development indeed formalizes the theory of
 forcing. This should be mathematically clear since this is the
 only known method for obtaining proper extensions of ctms while
 preserving the ordinals.
 
 The main theorem of this session and all of its relevant definitions
 appear in Section~\ref{sec:def-main-forcing}. The reader trusting
 all the libraries on which our development is based, might jump
 directly to Section~\ref{sec:relative-arith}, which treats relative
 cardinal arithmetic as implemented in
 \<^session>\<open>Transitive_Models\<close>. But in case one wants to dive deeper, the
 following sections treat some basic concepts of the ZF logic
 (Section~\ref{sec:def-main-ZF}) and in the
 ZF-Constructible library (Section~\ref{sec:def-main-relative})
 on which our definitions are built.
 \<close>
 
 declare [[show_question_marks=false]]
 
 subsection\<open>ZF\label{sec:def-main-ZF}\<close>
 
 text\<open>For the basic logic ZF we restrict ourselves to just a few
 concepts.\<close>
 
 thm bij_def[unfolded inj_def surj_def]
 text\<open>@{thm [display] bij_def[unfolded inj_def surj_def]}\<close>
 (*
 bij(A, B) \<equiv>
   {f \<in> A \<rightarrow> B . \<forall>w\<in>A. \<forall>x\<in>A. f ` w = f ` x \<longrightarrow> w = x} \<inter>
   {f \<in> A \<rightarrow> B . \<forall>y\<in>B. \<exists>x\<in>A. f ` x = y}
 *)
 
 thm eqpoll_def
 text\<open>@{thm [display] eqpoll_def}\<close>
 (*
   A \<approx> B \<equiv> \<exists>f. f \<in> bij(A, B)
 *)
 
 thm Transset_def
 text\<open>@{thm [display] Transset_def}\<close>
 (*
   Transset(i) \<equiv> \<forall>x\<in>i. x \<subseteq> i
 *)
 
 thm Ord_def
 text\<open>@{thm [display] Ord_def}\<close>
 (*
   Ord(i) \<equiv> Transset(i) \<and> (\<forall>x\<in>i. Transset(x))
 *)
 
 thm lt_def le_iff
 text\<open>@{thm [display] lt_def le_iff}\<close>
 (*
   i < j \<equiv> i \<in> j \<and> Ord(j)
   i \<le> j \<longleftrightarrow> i < j \<or> i = j \<and> Ord(j)
 *)
 
 text\<open>With the concepts of empty set and successor in place,\<close>
 lemma empty_def': "\<forall>x. x \<notin> 0" by simp
 lemma succ_def': "succ(i) = i \<union> {i}" by blast
 
 text\<open>we can define the set of natural numbers \<^term>\<open>\<omega>\<close>. In the
 sources, it is  defined as a fixpoint, but here we just write
 its characterization as the first limit ordinal.\<close>
 thm Limit_nat[unfolded Limit_def] nat_le_Limit[unfolded Limit_def]
 text\<open>@{thm [display] Limit_nat[unfolded Limit_def]
  nat_le_Limit[unfolded Limit_def]}\<close>
 (*
   Ord(\<omega>) \<and> 0 < \<omega> \<and> (\<forall>y. y < \<omega> \<longrightarrow> succ(y) < \<omega>)
   Ord(i) \<and> 0 < i \<and> (\<forall>y. y < i \<longrightarrow> succ(y) < i) \<Longrightarrow> \<omega> \<le> i
 *)
 
 text\<open>Then, addition and predecessor on \<^term>\<open>\<omega>\<close> are inductively
 characterized as follows:\<close>
 thm add_0_right add_succ_right pred_0 pred_succ_eq
 text\<open>@{thm [display] add_succ_right add_0_right pred_0 pred_succ_eq}\<close>
 (*
   m \<in> \<omega> \<Longrightarrow> m +\<^sub>\<omega> 0 = m
   m +\<^sub>\<omega> succ(n) = succ(m +\<^sub>\<omega> n)
 
   pred(0) = 0
   pred(succ(y)) = y
 *)
 
 text\<open>Lists on a set \<^term>\<open>A\<close> can be characterized by being
 recursively generated from the empty list \<^term>\<open>[]\<close> and the
 operation \<^term>\<open>Cons\<close> that adds a new element to the left end;
 the induction theorem for them shows that the characterization is
 “complete”.\<close>
 
 thm Nil Cons list.induct
 text\<open>@{thm [display] Nil Cons list.induct }\<close>
 (*
   [] \<in> list(A)
   a \<in> A \<Longrightarrow> l \<in> list(A) \<Longrightarrow> Cons(a, l) \<in> list(A)
   x \<in> list(A) \<Longrightarrow>
   P([]) \<Longrightarrow> (\<And>a l. a \<in> A \<Longrightarrow> l \<in> list(A) \<Longrightarrow> P(l) \<Longrightarrow> P(Cons(a, l))) \<Longrightarrow> P(x)
 *)
 
 text\<open>Length, concatenation, and \<^term>\<open>n\<close>th element of lists are
 recursively characterized as follows.\<close>
 thm length.simps app.simps nth_0 nth_Cons
 text\<open>@{thm [display] length.simps app.simps nth_0 nth_Cons}\<close>
 (*
   length([]) = 0
   length(Cons(a, l)) = succ(length(l))
 
   [] @ ys = ys
   Cons(a, l) @ ys = Cons(a, l @ ys)
 
   nth(0, Cons(a, l)) = a
   n \<in> \<omega> \<Longrightarrow> nth(succ(n), Cons(a, l)) = nth(n, l)
 *)
 text\<open>We have the usual Haskell-like notation for iterated applications
 of \<^term>\<open>Cons\<close>:\<close>
 lemma Cons_app: "[a,b,c] = Cons(a,Cons(b,Cons(c,[])))" ..
 
 text\<open>Relative quantifiers restrict the range of the bound variable to a
 class \<^term>\<open>M\<close> of type \<^typ>\<open>i\<Rightarrow>o\<close>; that is, a truth-valued function with
 set arguments.\<close>
 lemma "\<forall>x[M]. P(x) \<equiv> \<forall>x. M(x) \<longrightarrow> P(x)"
       "\<exists>x[M]. P(x) \<equiv> \<exists>x. M(x) \<and> P(x)"
   unfolding rall_def rex_def .
 
 text\<open>Finally, a set can be viewed (“cast”) as a class using the
 following function of type \<^typ>\<open>i\<Rightarrow>(i\<Rightarrow>o)\<close>.\<close>
 thm setclass_iff
 text\<open>@{thm [display] setclass_iff}\<close>
 (*
   (##A)(x) \<longleftrightarrow> x \<in> A
 *)
 
 subsection\<open>Relative concepts\label{sec:def-main-relative}\<close>
 text\<open>A list of relative concepts (mostly from the ZF-Constructible
     library) follows next.\<close>
 
 thm big_union_def
 text\<open>@{thm [display] big_union_def}\<close>
 (*
   big_union(M, A, z) \<equiv> \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>y[M]. y \<in> A \<and> x \<in> y)
 *)
 
 thm upair_def
 text\<open>@{thm [display] upair_def}\<close>
 (*
   upair(M, a, b, z) \<equiv> a \<in> z \<and> b \<in> z \<and> (\<forall>x[M]. x \<in> z \<longrightarrow> x = a \<or> x = b)
 *)
 
 thm pair_def
 text\<open>@{thm [display] pair_def}\<close>
 (*
   pair(M, a, b, z) \<equiv> \<exists>x[M]. upair(M, a, a, x) \<and>
                         (\<exists>y[M]. upair(M, a, b, y) \<and> upair(M, x, y, z))
 *)
 
 thm successor_def[unfolded is_cons_def union_def]
 text\<open>@{thm [display] successor_def[unfolded is_cons_def union_def]}\<close>
 (*
   successor(M, a, z) \<equiv> \<exists>x[M]. upair(M, a, a, x) \<and> (\<forall>xa[M]. xa \<in> z \<longleftrightarrow> xa \<in> x \<or> xa \<in> a)
 *)
 
 thm empty_def
 text\<open>@{thm [display] empty_def}\<close>
 (*
   empty(M, z) \<equiv> \<forall>x[M]. x \<notin> z
 *)
 
 thm transitive_set_def[unfolded subset_def]
 text\<open>@{thm [display] transitive_set_def[unfolded subset_def]}\<close>
 (*
   transitive_set(M, a) \<equiv> \<forall>x[M]. x \<in> a \<longrightarrow> (\<forall>xa[M]. xa \<in> x \<longrightarrow> xa \<in> a)
 *)
 
 
 thm ordinal_def
 text\<open>@{thm [display] ordinal_def}\<close>
 (*
   ordinal(M, a) \<equiv> transitive_set(M, a) \<and> (\<forall>x[M]. x \<in> a \<longrightarrow>
                                               transitive_set(M, x))
 *)
 
 thm image_def
 text\<open>@{thm [display] image_def}\<close>
 (*
   image(M, r, A, z) \<equiv> \<forall>y[M]. y \<in> z \<longleftrightarrow>
                 (\<exists>w[M]. w \<in> r \<and> (\<exists>x[M]. x \<in> A \<and> pair(M, x, y, w)))
 *)
 
 thm fun_apply_def
 text\<open>@{thm [display] fun_apply_def}\<close>
 (*
   fun_apply(M, f, x, y) \<equiv> \<exists>xs[M]. \<exists>fxs[M]. upair(M, x, x, xs) \<and>
                        image(M, f, xs, fxs) \<and> big_union(M, fxs, y)
 *)
 
 thm is_function_def
 text\<open>@{thm [display] is_function_def}\<close>
 (*
   is_function(M, r) \<equiv> \<forall>x[M]. \<forall>y[M]. \<forall>y'[M]. \<forall>p[M]. \<forall>p'[M].
        pair(M, x, y, p) \<longrightarrow> pair(M, x, y', p') \<longrightarrow> p \<in> r \<longrightarrow> p' \<in> r \<longrightarrow> y = y'
 *)
 
 thm is_relation_def
 text\<open>@{thm [display] is_relation_def}\<close>
 (*
   is_relation(M, r) \<equiv> \<forall>z[M]. z \<in> r \<longrightarrow> (\<exists>x[M]. \<exists>y[M]. pair(M, x, y, z))
 *)
 
 thm is_domain_def
 text\<open>@{thm [display] is_domain_def}\<close>
 (*
   is_domain(M, r, z) \<equiv> \<forall>x[M]. x \<in> z \<longleftrightarrow>
                         (\<exists>w[M]. w \<in> r \<and> (\<exists>y[M]. pair(M, x, y, w)))
 *)
 
 thm typed_function_def
 text\<open>@{thm [display] typed_function_def}\<close>
 (*
   typed_function(M, A, B, r) \<equiv> is_function(M, r) \<and> is_relation(M, r) \<and>
                                 is_domain(M, r, A) \<and>
             (\<forall>u[M]. u \<in> r \<longrightarrow> (\<forall>x[M]. \<forall>y[M]. pair(M, x, y, u) \<longrightarrow> y \<in> B))
 *)
 
 thm is_function_space_def[unfolded is_funspace_def]
   function_space_rel_def surjection_def
 text\<open>@{thm [display] is_function_space_def[unfolded is_funspace_def]
   function_space_rel_def surjection_def}\<close>
 (*
   is_function_space(M, A, B, fs) \<equiv>
   M(fs) \<and> (\<forall>f[M]. f \<in> fs \<longleftrightarrow> typed_function(M, A, B, f))
 
   A \<rightarrow>\<^bsup>M\<^esup> B \<equiv> THE d. is_function_space(M, A, B, d)
 
   surjection(M, A, B, f) \<equiv>
   typed_function(M, A, B, f) \<and>
   (\<forall>y[M]. y \<in> B \<longrightarrow> (\<exists>x[M]. x \<in> A \<and> is_apply(M, f, x, y)))
 *)
 
 
 text\<open>Relative version of the $\ZFC$ axioms\<close>
 thm extensionality_def
 text\<open>@{thm [display] extensionality_def}\<close>
 (*
   extensionality(M) \<equiv> \<forall>x[M]. \<forall>y[M]. (\<forall>z[M]. z \<in> x \<longleftrightarrow> z \<in> y) \<longrightarrow> x = y
 *)
 
 thm foundation_ax_def
 text\<open>@{thm [display] foundation_ax_def}\<close>
 (*
   foundation_ax(M) \<equiv> \<forall>x[M]. (\<exists>y[M]. y \<in> x) \<longrightarrow> (\<exists>y[M]. y \<in> x \<and> \<not> (\<exists>z[M]. z \<in> x \<and> z \<in> y))
 *)
 
 thm upair_ax_def
 text\<open>@{thm [display] upair_ax_def}\<close>
 (*
   upair_ax(M) \<equiv> \<forall>x[M]. \<forall>y[M]. \<exists>z[M]. upair(M, x, y, z)
 *)
 
 thm Union_ax_def
 text\<open>@{thm [display] Union_ax_def}\<close>
 (*
   Union_ax(M) \<equiv> \<forall>x[M]. \<exists>z[M]. \<forall>xa[M]. xa \<in> z \<longleftrightarrow> (\<exists>y[M]. y \<in> x \<and> xa \<in> y)
 *)
 
 thm power_ax_def[unfolded powerset_def subset_def]
 text\<open>@{thm [display] power_ax_def[unfolded powerset_def subset_def]}\<close>
 (*
   power_ax(M) \<equiv> \<forall>x[M]. \<exists>z[M]. \<forall>xa[M]. xa \<in> z \<longleftrightarrow> (\<forall>xb[M]. xb \<in> xa \<longrightarrow> xb \<in> x)
 *)
 
 thm infinity_ax_def
 text\<open>@{thm [display] infinity_ax_def}\<close>
 (*
   infinity_ax(M) \<equiv> \<exists>I[M]. (\<exists>z[M]. empty(M, z) \<and> z \<in> I) \<and> (\<forall>y[M]. y \<in> I \<longrightarrow>
                         (\<exists>sy[M]. successor(M, y, sy) \<and> sy \<in> I))
 *)
 
 thm choice_ax_def
 text\<open>@{thm [display] choice_ax_def}\<close>
 (*
   choice_ax(M) \<equiv> \<forall>x[M]. \<exists>a[M]. \<exists>f[M]. ordinal(M, a) \<and> surjection(M, a, x, f)
 *)
 
 thm separation_def
 text\<open>@{thm [display] separation_def}\<close>
 (*
   separation(M, P) \<equiv> \<forall>z[M]. \<exists>y[M]. \<forall>x[M]. x \<in> y \<longleftrightarrow> x \<in> z \<and> P(x)
 *)
 
 thm univalent_def
 text\<open>@{thm [display] univalent_def}\<close>
 (*
   univalent(M, A, P) \<equiv> \<forall>x[M]. x \<in> A \<longrightarrow>
                           (\<forall>y[M]. \<forall>z[M]. P(x, y) \<and> P(x, z) \<longrightarrow> y = z)
 *)
 
 thm strong_replacement_def
 text\<open>@{thm [display] strong_replacement_def}\<close>
 (*
   strong_replacement(M, P) \<equiv> \<forall>A[M]. univalent(M, A, P) \<longrightarrow>
        (\<exists>Y[M]. \<forall>b[M]. b \<in> Y \<longleftrightarrow> (\<exists>x[M]. x \<in> A \<and> P(x, b)))
 *)
 
 text\<open>Internalized formulas\<close>
 
 text\<open>“Codes” for formulas (as sets) are constructed from natural
 numbers using \<^term>\<open>Member\<close>, \<^term>\<open>Equal\<close>, \<^term>\<open>Nand\<close>,
 and \<^term>\<open>Forall\<close>.\<close>
 
 thm Member Equal Nand Forall formula.induct
 text\<open>@{thm [display] Member Equal Nand Forall formula.induct}\<close>
 (*
   x \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> \<cdot>x \<in> y\<cdot> \<in> formula
   x \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> \<cdot>x = y\<cdot> \<in> formula
   p \<in> formula \<Longrightarrow> q \<in> formula \<Longrightarrow> \<cdot>\<not>(p \<and> q)\<cdot> \<in> formula
   p \<in> formula \<Longrightarrow> (\<forall>p) \<in> formula
 
   x \<in> formula \<Longrightarrow>
   (\<And>x y. x \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> P(\<cdot>x \<in> y\<cdot>)) \<Longrightarrow>
   (\<And>x y. x \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> P(\<cdot>x = y\<cdot>)) \<Longrightarrow>
   (\<And>p q. p \<in> formula \<Longrightarrow> P(p) \<Longrightarrow> q \<in> formula \<Longrightarrow> P(q) \<Longrightarrow> P(\<cdot>\<not>(p \<and> q)\<cdot>)) \<Longrightarrow>
   (\<And>p. p \<in> formula \<Longrightarrow> P(p) \<Longrightarrow> P((\<forall>p))) \<Longrightarrow> P(x)
 *)
 
 text\<open>Definitions for the other connectives and the internal existential
 quantifier are also provided. For instance, negation:\<close>
 thm Neg_def
 text\<open>@{thm [display] Neg_def}\<close>
 (*
   \<cdot>\<not>p\<cdot> \<equiv> \<cdot>\<not>(p \<and> p)\<cdot>
 *)
 
 thm arity.simps
 text\<open>@{thm [display] arity.simps}\<close>
 (*
   arity(\<cdot>x \<in> y\<cdot>) = succ(x) \<union> succ(y)
   arity(\<cdot>x = y\<cdot>) = succ(x) \<union> succ(y)
   arity(\<cdot>\<not>(p \<and> q)\<cdot>) = arity(p) \<union> arity(q)
   arity((\<forall>p)) = pred(arity(p))
 *)
 
 text\<open>We have the satisfaction relation between $\in$-models and
     first order formulas (given a “environment” list representing
     the assignment of free variables),\<close>
 thm mem_iff_sats equal_iff_sats sats_Nand_iff sats_Forall_iff
 text\<open>@{thm [display] mem_iff_sats equal_iff_sats sats_Nand_iff sats_Forall_iff}\<close>
 (*
   nth(i, env) = x \<Longrightarrow> nth(j, env) = y \<Longrightarrow> env \<in> list(A) \<Longrightarrow> x \<in> y \<longleftrightarrow> A, env \<Turnstile> \<cdot>i \<in> j\<cdot>
   nth(i, env) = x \<Longrightarrow> nth(j, env) = y \<Longrightarrow> env \<in> list(A) \<Longrightarrow> x = y \<longleftrightarrow> A, env \<Turnstile> \<cdot>i = j\<cdot>
   env \<in> list(A) \<Longrightarrow> (A, env \<Turnstile> \<cdot>\<not>(p \<and> q)\<cdot>) \<longleftrightarrow> \<not> ((A, env \<Turnstile> p) \<and> (A, env \<Turnstile> q))
   env \<in> list(A) \<Longrightarrow> (A, env \<Turnstile> (\<cdot>\<forall>p\<cdot>)) \<longleftrightarrow> (\<forall>x\<in>A. A, Cons(x, env) \<Turnstile> p)*)
 
 text\<open>as well as the satisfaction of an arbitrary set of sentences.\<close>
 thm satT_def
 text\<open>@{thm [display] satT_def}\<close>
 (*
   A \<Turnstile> \<Phi>  \<equiv>  \<forall>\<phi>\<in>\<Phi>. A, [] \<Turnstile> \<phi>
 *)
 
 text\<open>The internalized (viz. as elements of the set \<^term>\<open>formula\<close>)
     version of the axioms follow next.\<close>
 
 thm ZF_union_iff_sats ZF_power_iff_sats ZF_pairing_iff_sats
   ZF_foundation_iff_sats ZF_extensionality_iff_sats
   ZF_infinity_iff_sats sats_ZF_separation_fm_iff
   sats_ZF_replacement_fm_iff ZF_choice_iff_sats
 text\<open>@{thm [display] ZF_union_iff_sats ZF_power_iff_sats
   ZF_pairing_iff_sats
   ZF_foundation_iff_sats ZF_extensionality_iff_sats
   ZF_infinity_iff_sats sats_ZF_separation_fm_iff
   sats_ZF_replacement_fm_iff ZF_choice_iff_sats}\<close>
 (*
   Union_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Union Ax\<cdot>
   power_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Powerset Ax\<cdot>
   upair_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Pairing\<cdot>
   foundation_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Foundation\<cdot>
   extensionality(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Extensionality\<cdot>
   infinity_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Infinity\<cdot>
 
   \<phi> \<in> formula \<Longrightarrow>
   (M, [] \<Turnstile> \<cdot>Separation(\<phi>)\<cdot>) \<longleftrightarrow>
   (\<forall>env\<in>list(M).
       arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env) \<longrightarrow> separation(##M, \<lambda>x. M, [x] @ env \<Turnstile> \<phi>))
 
   \<phi> \<in> formula \<Longrightarrow>
-  (M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>) \<longleftrightarrow>
-  (\<forall>env\<in>list(M).
-      arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(env) \<longrightarrow>
-      strong_replacement(##M, \<lambda>x y. M, [x, y] @ env \<Turnstile> \<phi>))
+  (M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>) \<longleftrightarrow> (\<forall>env. replacement_assm(M, env, \<phi>))
 
   choice_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>AC\<cdot>
 *)
 
+text\<open>Above, we use the following:\<close>
+
+thm replacement_assm_def
+text\<open>@{thm [display] replacement_assm_def}\<close>
+(*
+replacement_assm(M, env, \<phi>) \<equiv>
+\<phi> \<in> formula \<longrightarrow>
+env \<in> list(M) \<longrightarrow>
+arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(env) \<longrightarrow>
+strong_replacement(##M, \<lambda>x y. M, [x, y] @ env \<Turnstile> \<phi>
+*)
+
+text\<open>Finally, the axiom sets are defined as follows.\<close>
+
 thm ZF_fin_def ZF_schemes_def Zermelo_fms_def ZC_def ZF_def ZFC_def
 text\<open>@{thm [display] ZF_fin_def ZF_schemes_def Zermelo_fms_def ZC_def ZF_def
   ZFC_def}\<close>
 (*
   ZF_fin \<equiv> {\<cdot>Extensionality\<cdot>, \<cdot>Foundation\<cdot>, \<cdot>Pairing\<cdot>, \<cdot>Union Ax\<cdot>, \<cdot>Infinity\<cdot>, \<cdot>Powerset Ax\<cdot>}
   ZF_schemes \<equiv> {\<cdot>Separation(p)\<cdot> . p \<in> formula} \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> formula}
   \<cdot>Z\<cdot> \<equiv> ZF_fin \<union> {\<cdot>Separation(p)\<cdot> . p \<in> formula}
   ZC \<equiv> \<cdot>Z\<cdot> \<union> {\<cdot>AC\<cdot>}
   ZF \<equiv> ZF_schemes \<union> ZF_fin
   ZFC \<equiv> ZF \<union> {\<cdot>AC\<cdot>}
 *)
 
 subsection\<open>Relativization of infinitary arithmetic\label{sec:relative-arith}\<close>
 
 text\<open>In order to state the defining property of the relative
     equipotence relation, we work under the assumptions of the
     locale \<^term>\<open>M_cardinals\<close>. They comprise a finite set
     of instances of Separation and Replacement to prove
     closure properties of the transitive class \<^term>\<open>M\<close>.\<close>
 
 lemma (in M_cardinals) eqpoll_def':
   assumes "M(A)" "M(B)" shows "A \<approx>\<^bsup>M\<^esup> B \<longleftrightarrow> (\<exists>f[M]. f \<in> bij(A,B))"
   using assms unfolding eqpoll_rel_def by auto
 
 text\<open>Below, $\mu$ denotes the minimum operator on the ordinals.\<close>
 lemma cardinalities_defs:
   fixes M::"i\<Rightarrow>o"
   shows
     "|A|\<^bsup>M\<^esup> \<equiv> \<mu> i. M(i) \<and> i \<approx>\<^bsup>M\<^esup> A"
     "Card\<^bsup>M\<^esup>(\<alpha>) \<equiv> \<alpha> = |\<alpha>|\<^bsup>M\<^esup>"
     "\<kappa>\<^bsup>\<up>\<nu>,M\<^esup> \<equiv> |\<nu> \<rightarrow>\<^bsup>M\<^esup> \<kappa>|\<^bsup>M\<^esup>"
     "(\<kappa>\<^sup>+)\<^bsup>M\<^esup> \<equiv> \<mu> x. M(x) \<and> Card\<^bsup>M\<^esup>(x) \<and> \<kappa> < x"
   unfolding cardinal_rel_def cexp_rel_def
     csucc_rel_def Card_rel_def .
 
 context M_aleph
 begin
 
 text\<open>Analogous to the previous Lemma @{thm [source] eqpoll_def'}, we are now under
     the assumptions of the locale \<^term>\<open>M_aleph\<close>. The axiom instances
     included are sufficient to state and prove the defining
     properties of the relativized \<^term>\<open>Aleph\<close> function
     (in particular, the required ability to perform transfinite recursions).\<close>
 
 thm Aleph_rel_zero Aleph_rel_succ Aleph_rel_limit
 text\<open>@{thm [display] Aleph_rel_zero Aleph_rel_succ Aleph_rel_limit}\<close>
 (*
   \<aleph>\<^bsub>0\<^esub>\<^bsup>M\<^esup> = \<omega>
   Ord(\<alpha>) \<Longrightarrow> M(\<alpha>) \<Longrightarrow> \<aleph>\<^bsub>succ(\<alpha>)\<^esub>\<^bsup>M\<^esup> = (\<aleph>\<^bsub>\<alpha>\<^esub>\<^bsup>M\<^esup>\<^sup>+)\<^bsup>M\<^esup>
   Limit(\<alpha>) \<Longrightarrow> M(\<alpha>) \<Longrightarrow> \<aleph>\<^bsub>\<alpha>\<^esub>\<^bsup>M\<^esup> = (\<Union>j\<in>\<alpha>. \<aleph>\<^bsub>j\<^esub>\<^bsup>M\<^esup>)
 *)
 
 end \<comment> \<open>\<^locale>\<open>M_aleph\<close>\<close>
 
 lemma ContHyp_rel_def':
   fixes N::"i\<Rightarrow>o"
   shows
     "CH\<^bsup>N\<^esup> \<equiv> \<aleph>\<^bsub>1\<^esub>\<^bsup>N\<^esup> = 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>N\<^esup>,N\<^esup>"
   unfolding ContHyp_rel_def .
 
 text\<open>Under appropriate hypotheses (this time, from the locale \<^term>\<open>M_ZF_library\<close>),
    \<^term>\<open>CH\<^bsup>M\<^esup>\<close> is equivalent to its fully relational version \<^term>\<open>is_ContHyp\<close>.
     As a sanity check, we see that if the transitive class is indeed \<^term>\<open>\<V>\<close>,
     we recover the original $\CH$.\<close>
 
 thm M_ZF_library.is_ContHyp_iff is_ContHyp_iff_CH[unfolded ContHyp_def]
 text\<open>@{thm [display] M_ZF_library.is_ContHyp_iff
     is_ContHyp_iff_CH[unfolded ContHyp_def]}\<close>
 (*
   M_ZF_library(M) \<Longrightarrow> is_ContHyp(M) \<longleftrightarrow> CH\<^bsup>M\<^esup>
   is_ContHyp(\<V>) \<longleftrightarrow> \<aleph>\<^bsub>1\<^esub> = 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^esup>
 *)
 
 text\<open>In turn, the fully relational version evaluated on a nonempty
     transitive \<^term>\<open>A\<close> is equivalent to the satisfaction of the
     first-order formula \<^term>\<open>\<cdot>CH\<cdot>\<close>.\<close>
 thm is_ContHyp_iff_sats
 text\<open>@{thm [display] is_ContHyp_iff_sats}\<close>
 (*
   env \<in> list(A) \<Longrightarrow> 0 \<in> A \<Longrightarrow> is_ContHyp(##A) \<longleftrightarrow> A, env \<Turnstile> \<cdot>CH\<cdot>
 *)
 
 
 subsection\<open>Forcing \label{sec:def-main-forcing}\<close>
 
 text\<open>Our first milestone was to obtain a proper extension using forcing.
 Its original proof didn't required the previous developments involving
 the relativization of material on cardinal arithmetic. Now it is
 derived from a stronger result, namely @{thm [source] extensions_of_ctms}
 below.\<close>
 
 thm extensions_of_ctms_ZF
 text\<open>@{thm [display] extensions_of_ctms_ZF}\<close>
 (*
   M \<approx> \<omega> \<Longrightarrow>
   Transset(M) \<Longrightarrow>
   M \<Turnstile> ZF \<Longrightarrow>
   \<exists>N. M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZF \<and> M \<noteq> N \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N) \<and> ((M, [] \<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N \<Turnstile> ZFC)
 *)
 
 text\<open>We can finally state our main results, namely, the existence of models
 for $\ZFC + \CH$ and $\ZFC + \neg\CH$ under the assumption of a ctm of $\ZFC$.\<close>
 
 thm ctm_ZFC_imp_ctm_not_CH
 text\<open>@{thm [display] ctm_ZFC_imp_ctm_not_CH}\<close>
 (*
   M \<approx> \<omega> \<Longrightarrow>
   Transset(M) \<Longrightarrow>
   M \<Turnstile> ZFC \<Longrightarrow>
   \<exists>N. M \<subseteq> N \<and>
     N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZFC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>} \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)
 *)
 
 thm ctm_ZFC_imp_ctm_CH
 text\<open>@{thm [display] ctm_ZFC_imp_ctm_CH}\<close>
 (*
   M \<approx> \<omega> \<Longrightarrow>
   Transset(M) \<Longrightarrow>
   M \<Turnstile> ZFC \<Longrightarrow>
   \<exists>N. M \<subseteq> N \<and>
       N \<approx> \<omega> \<and>
       Transset(N) \<and> N \<Turnstile> ZFC \<union> {\<cdot>CH\<cdot>} \<and> (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)
 *)
 
 text\<open>These results can be strengthened by enumerating six finite sets of
 replacement instances which are sufficient to develop forcing and for
 the construction of the aforementioned models: \<^term>\<open>instances1_fms\<close>
-through \<^term>\<open>instances4_fms\<close>, \<^term>\<open>instances_ground_fms\<close>, and
+through \<^term>\<open>instances3_fms\<close>, \<^term>\<open>instances_ground_fms\<close>, and
 \<^term>\<open>instances_ground_notCH_fms\<close>,
-which are then collected into the $33$-element set \<^term>\<open>overhead_notCH\<close>.
+which are then collected into the $31$-element set \<^term>\<open>overhead_notCH\<close>.
 For example, we have:\<close>
 
 thm instances1_fms_def
 text\<open>@{thm [display] instances1_fms_def}\<close>
 (*
 instances1_fms \<equiv>
 { list_repl1_intf_fm, list_repl2_intf_fm, formula_repl1_intf_fm,
  formula_repl2_intf_fm, eclose_repl1_intf_fm, eclose_repl2_intf_fm,
  wfrec_rank_fm, trans_repl_HVFrom_fm, tl_repl_intf_fm }
 *)
 
 thm overhead_def overhead_notCH_def
 text\<open>@{thm [display] overhead_def overhead_notCH_def overhead_CH_def}\<close>
 (*
-  overhead \<equiv> instances1_fms \<union> instances2_fms \<union> instances_ground_fms
+  overhead \<equiv> instances1_fms \<union> instances_ground_fms
 
   overhead_notCH \<equiv> overhead \<union>
-    instances3_fms \<union> instances4_fms \<union> instances_ground_notCH_fms
+    instances2_fms \<union> instances3_fms \<union> instances_ground_notCH_fms
 *)
 
 text\<open>One further instance is needed to force $\CH$, with a total count
 of $32$ instances:\<close>
 thm overhead_CH_def
 text\<open>@{thm [display] overhead_CH_def}\<close>
 (*
   overhead_CH \<equiv> overhead_notCH \<union> {replacement_dcwit_repl_body_fm}
 *)
 
 thm extensions_of_ctms
 text\<open>@{thm [display] extensions_of_ctms}\<close>
 (*
 M \<approx> \<omega> \<Longrightarrow>
 Transset(M) \<Longrightarrow>
 M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead} \<Longrightarrow>
 \<Phi> \<subseteq> formula \<Longrightarrow>
 M \<Turnstile> {\<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>} \<Longrightarrow>
 \<exists>N. M \<subseteq> N \<and>
     N \<approx> \<omega> \<and>
     Transset(N) \<and>
     M \<noteq> N \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N) \<and>
     ((M, [] \<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N, [] \<Turnstile> \<cdot>AC\<cdot>) \<and> N \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>}
 *)
 
 thm ctm_of_not_CH
 text\<open>@{thm [display] ctm_of_not_CH}\<close>
 (*
 M \<approx> \<omega> \<Longrightarrow>
 Transset(M) \<Longrightarrow>
 M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH} \<Longrightarrow>
 \<Phi> \<subseteq> formula \<Longrightarrow>
 M \<Turnstile> {\<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>} \<Longrightarrow>
 \<exists>N. M \<subseteq> N \<and>
     N \<approx> \<omega> \<and>
     Transset(N) \<and>
     N \<Turnstile> ZC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>} \<union> {\<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>} \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)
 *)
 
 thm ctm_of_CH
 text\<open>@{thm [display] ctm_of_CH}\<close>
 (*
 M \<approx> \<omega> \<Longrightarrow>
 Transset(M) \<Longrightarrow>
 M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_CH} \<Longrightarrow>
 \<Phi> \<subseteq> formula \<Longrightarrow>
 M \<Turnstile> {\<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>} \<Longrightarrow>
 \<exists>N. M \<subseteq> N \<and>
     N \<approx> \<omega> \<and>
     Transset(N) \<and>
     N \<Turnstile> ZC \<union> {\<cdot>CH\<cdot>} \<union> {\<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>} \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)
 *)
 
 text\<open>In the above three statements, the function \<^term>\<open>ground_repl_fm\<close>
 takes an element \<^term>\<open>\<phi>\<close> of \<^term>\<open>formula\<close> and returns the
 replacement instance in the ground model that produces the
 \<^term>\<open>\<phi>\<close>-replacement instance in the generic extension. The next
 result is stated in the context \<^locale>\<open>G_generic1\<close>, which assumes
 the existence of a generic filter.\<close>
 
 context G_generic1
 begin
 
 thm sats_ground_repl_fm_imp_sats_ZF_replacement_fm
 text\<open>@{thm [display] sats_ground_repl_fm_imp_sats_ZF_replacement_fm}\<close>
 (*
   \<phi> \<in> formula \<Longrightarrow>
   M, [] \<Turnstile> \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> \<Longrightarrow> M[G], [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>
 *)
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Demonstrations.thy b/thys/Independence_CH/Demonstrations.thy
--- a/thys/Independence_CH/Demonstrations.thy
+++ b/thys/Independence_CH/Demonstrations.thy
@@ -1,168 +1,179 @@
 section\<open>Some demonstrations\<close>
 
 theory Demonstrations
   imports
     Definitions_Main
 begin
 
 text\<open>The following theory is only intended to explore some details of the
 formalization and to show the appearance of relevant internalized formulas.
 It is \<^bold>\<open>not\<close> intended as the entry point of the session. For that purpose,
 consult \<^theory>\<open>Independence_CH.Definitions_Main\<close>\<close>
 
+
+text\<open>The snippet (by M. Pagano) commented out below outputs a directed
+graph picturing the locale structure.\<close>
+\<comment> \<open>
+ML\<open>Locale.pretty_locale_deps @{theory} |>
+map (fn n => let val nom = #name n
+    in  map (writeln o (fn p => "\"" ^ p ^ "\" -> \"" ^ nom ^ "\";")) (#parents n)
+end)
+\<close>
+\<close>
+
 locale Demo = M_trivial + M_AC +
   fixes t\<^sub>1 t\<^sub>2
   assumes
     ts_in_nat[simp]: "t\<^sub>1\<in>\<omega>" "t\<^sub>2\<in>\<omega>"
     and
     power_infty: "power_ax(M)" "M(\<omega>)"
 begin
 
 text\<open>The next fake lemma is intended to explore the instances of the axiom
 schemes that are needed to build our forcing models. They are categorized as
 plain replacements (using \<^term>\<open>strong_replacement\<close>), “lambda-replacements”
 using a higher order function, replacements  to perform
 transfinite and general well-founded recursion (using \<^term>\<open>transrec_replacement\<close> and
 \<^term>\<open>wfrec_replacement\<close> respectively) and for the construction of fixpoints
 (using \<^term>\<open>iterates_replacement\<close>). Lastly, separations instances.\<close>
 
 lemma
   assumes
     sorried_replacements:
     "\<And>P. strong_replacement(M,P)"
     "\<And>F. lam_replacement(M,F)"
     "\<And>Q S. iterates_replacement(M,Q,S)"
     "\<And>Q S. wfrec_replacement(M,Q,S)"
     "\<And>Q S. transrec_replacement(M,Q,S)"
     and
     sorried_separations: "\<And>Q. separation(M,Q)"
   shows
     "M_master(M)"
   apply unfold_locales
                       apply
     (simp_all add:
       sorried_replacements(1-2)
       sorried_separations
       power_infty)
   oops
 
 \<comment> \<open>NOTE: Only for pretty-printing purposes, overrides previous
   fundamental notations\<close>
 no_notation mem (infixl \<open>\<in>\<close> 50)
 no_notation conj  (infixr \<open>\<and>\<close> 35)
 no_notation disj (infixr \<open>\<or>\<close> 30)
 no_notation iff (infixr \<open>\<longleftrightarrow>\<close> 25)
 no_notation imp (infixr \<open>\<longrightarrow>\<close> 25)
 no_notation not (\<open>\<not> _\<close> [40] 40)
 no_notation All (\<open>'(\<forall>_')\<close>)
 no_notation Ex (\<open>'(\<exists>_')\<close>)
 
 no_notation Member (\<open>\<cdot>_ \<in>/ _\<cdot>\<close>)
 no_notation Equal (\<open>\<cdot>_ =/ _\<cdot>\<close>)
 no_notation Nand (\<open>\<cdot>\<not>'(_ \<and>/ _')\<cdot>\<close>)
 no_notation And (\<open>\<cdot>_ \<and>/ _\<cdot>\<close>)
 no_notation Or (\<open>\<cdot>_ \<or>/ _\<cdot>\<close>)
 no_notation Iff (\<open>\<cdot>_ \<leftrightarrow>/ _\<cdot>\<close>)
 no_notation Implies (\<open>\<cdot>_ \<rightarrow>/ _\<cdot>\<close>)
 no_notation Neg (\<open>\<cdot>\<not>_\<cdot>\<close>)
 no_notation Forall (\<open>'(\<cdot>\<forall>(/_)\<cdot>')\<close>)
 no_notation Exists (\<open>'(\<cdot>\<exists>(/_)\<cdot>')\<close>)
 
 notation Member (infixl \<open>\<in>\<close> 50)
 notation Equal (infixl \<open>\<equiv>\<close> 50)
 notation Nand (\<open>\<not>'(_ \<and>/ _')\<close>)
 notation And  (infixr \<open>\<and>\<close> 35)
 notation Or (infixr \<open>\<or>\<close> 30)
 notation Iff (infixr \<open>\<longleftrightarrow>\<close> 25)
 notation Implies (infixr \<open>\<longrightarrow>\<close> 25)
 notation Neg (\<open>\<not> _\<close> [40] 40)
 notation Forall (\<open>'(\<forall>_')\<close>)
 notation Exists (\<open>'(\<exists>_')\<close>)
 
 lemma "forces(t\<^sub>1\<in>t\<^sub>2) = (0 \<in> 1 \<and> forces_mem_fm(1, 2, 0, t\<^sub>1+\<^sub>\<omega>4, t\<^sub>2+\<^sub>\<omega>4))"
   unfolding forces_def by simp
 
 (*
 \<comment> \<open>Prefix abbreviated notation\<close>
 notation Member (\<open>M\<close>)
 notation Equal (\<open>Eq\<close>)
 notation Nand (\<open>Na\<close>)
 notation And  (\<open>A\<close>)
 notation Or (\<open>O\<close>)
 notation Iff (\<open>If\<close>)
 notation Implies (\<open>Im\<close>)
 notation Neg (\<open>Ne\<close>)
 notation Forall (\<open>Fo\<close>)
 notation Exists (\<open>Ex\<close>)
 *)
 
 (* forces_mem_fm(1, 2, 0, t\<^sub>1+\<^sub>\<omega>4, t\<^sub>1+\<^sub>\<omega>4)
    = forces_mem_fm(1, 2, 0, succ(succ(succ(succ(t\<^sub>1)))), succ(succ(succ(succ(t\<^sub>2)))))
    = \<dots> *)
 
 definition forces_0_mem_1 where "forces_0_mem_1\<equiv>forces_mem_fm(1,2,0,t\<^sub>1+\<^sub>\<omega>4,t\<^sub>2+\<^sub>\<omega>4)"
 thm forces_0_mem_1_def[
     unfolded frc_at_fm_def ftype_fm_def
     name1_fm_def name2_fm_def snd_snd_fm_def hcomp_fm_def
     ecloseN_fm_def eclose_n1_fm_def eclose_n2_fm_def
     is_eclose_fm_def mem_eclose_fm_def eclose_n_fm_def
     is_If_fm_def least_fm_def Replace_fm_def Collect_fm_def
     fm_definitions,simplified]
   (* NOTE: in view of the above, @{thm [source] fm_definitions} might be incomplete *)
 
 named_theorems incr_bv_new_simps
 
 schematic_goal incr_bv_Neg(* [incr_bv_new_simps] *):
   "mem(n,\<omega>) \<Longrightarrow> mem(\<phi>,formula) \<Longrightarrow> incr_bv(Neg(\<phi>))`n = ?x"
   unfolding Neg_def by simp
 
 schematic_goal incr_bv_Exists [incr_bv_new_simps]:
   "mem(n,\<omega>) \<Longrightarrow> mem(\<phi>,formula) \<Longrightarrow> incr_bv(Exists(\<phi>))`n = ?x"
   unfolding Exists_def by (simp add: incr_bv_Neg)
 (*
 schematic_goal incr_bv_And [incr_bv_new_simps]:
   "mem(n,\<omega>) \<Longrightarrow> mem(\<phi>,formula) \<Longrightarrow>mem(\<psi>,formula)\<Longrightarrow> incr_bv(And(\<phi>,\<psi>))`n = ?x"
   unfolding And_def by (simp add: incr_bv_Neg)
 
 schematic_goal incr_bv_Or [incr_bv_new_simps]:
   "mem(n,\<omega>) \<Longrightarrow> mem(\<phi>,formula) \<Longrightarrow>mem(\<psi>,formula)\<Longrightarrow> incr_bv(Or(\<phi>,\<psi>))`n = ?x"
   unfolding Or_def by (simp add: incr_bv_Neg)
 
 schematic_goal incr_bv_Implies [incr_bv_new_simps]:
   "mem(n,\<omega>) \<Longrightarrow> mem(\<phi>,formula) \<Longrightarrow>mem(\<psi>,formula)\<Longrightarrow> incr_bv(Implies(\<phi>,\<psi>))`n = ?x"
   unfolding Implies_def by (simp add: incr_bv_Neg)
 *)
 
 \<comment> \<open>The two renamings involved in the definition of \<^term>\<open>forces\<close> depend on
 the recursive function \<^term>\<open>incr_bv\<close>. Here we have an apparently
 exponential bottleneck, since all the propositional connectives (even \<^term>\<open>Neg\<close>)
 duplicate the appearances of \<^term>\<open>incr_bv\<close>.
 
 Not even the double negation of an atomic formula can be managed by the
 system (in version 2021-1).\<close>
 (* 
 
 schematic_goal "forces(\<not>\<not>0\<in>1) = ?x"
   unfolding forces_def Neg_def
    by (simp add:ren_forces_nand_def ren_forces_forall_def 
       frc_at_fm_def ftype_fm_def
       name1_fm_def name2_fm_def snd_snd_fm_def hcomp_fm_def
       ecloseN_fm_def eclose_n1_fm_def eclose_n2_fm_def
       is_eclose_fm_def mem_eclose_fm_def eclose_n_fm_def
       is_If_fm_def least_fm_def Collect_fm_def
       fm_definitions incr_bv_Neg incr_bv_Exists)
 (* exception Size raised (line 183 of "./basis/LibrarySupport.sml") *)
 
 *)
 
 (*
 declare is_ContHyp_fm_def[fm_definitions del]
 
 thm is_ContHyp_fm_def[unfolded is_eclose_fm_def mem_eclose_fm_def eclose_n_fm_def
    is_If_fm_def least_fm_def Replace_fm_def Collect_fm_def
    fm_definitions, simplified] *)
 
 end \<comment> \<open>\<^locale>\<open>Demo\<close>\<close>
 
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Forcing_Data.thy b/thys/Independence_CH/Forcing_Data.thy
--- a/thys/Independence_CH/Forcing_Data.thy
+++ b/thys/Independence_CH/Forcing_Data.thy
@@ -1,163 +1,161 @@
 section\<open>Transitive set models of ZF\<close>
 text\<open>This theory defines locales for countable transitive models of $\ZF$,
 and on top of that, one that includes a forcing notion. Weakened versions
 of both locales are included, that only assume finitely many replacement
 instances.\<close>
 
 theory Forcing_Data
   imports
     Forcing_Notions
     Cohen_Posets_Relative
     ZF_Trans_Interpretations
 begin
 
 no_notation Aleph (\<open>\<aleph>_\<close> [90] 90)
 
 subsection\<open>A forcing locale and generic filters\<close>
 
 text\<open>Ideally, countability should be separated from the assumption of this locale.
 The fact is that our present proofs of the “definition of forces” (and many
 consequences) and of the lemma for “forcing a value” of function
 unnecessarily depend on the countability of the ground model. \<close>
 
 locale forcing_data1 = forcing_notion + M_ctm1 + M_ZF_ground_trans +
   assumes P_in_M:           "P \<in> M"
     and leq_in_M:         "leq \<in> M"
 
-locale forcing_data2 = forcing_data1 + M_ctm2
+locale forcing_data2 = forcing_data1 + M_ctm2_AC
 
 locale forcing_data3 = forcing_data2 + M_ctm3_AC
 
-locale forcing_data4 = forcing_data3 + M_ctm4_AC
-
 context forcing_data1
 begin
 
 lemma P_sub_M : "P \<subseteq> M"
   using transitivity P_in_M by auto
 
 definition
   M_generic :: "i\<Rightarrow>o" where
   "M_generic(G) \<equiv> filter(G) \<and> (\<forall>D\<in>M. D\<subseteq>P \<and> dense(D)\<longrightarrow>D\<inter>G\<noteq>0)"
 
 declare iff_trans [trans]
 
 lemma M_generic_imp_filter[dest]: "M_generic(G) \<Longrightarrow> filter(G)"
   unfolding M_generic_def by blast
 
 lemma generic_filter_existence:
   "p\<in>P \<Longrightarrow> \<exists>G. p\<in>G \<and> M_generic(G)"
 proof -
   assume "p\<in>P"
   let ?D="\<lambda>n\<in>nat. (if (enum`n\<subseteq>P \<and> dense(enum`n))  then enum`n else P)"
   have "\<forall>n\<in>nat. ?D`n \<in> Pow(P)"
     by auto
   then
   have "?D:nat\<rightarrow>Pow(P)"
     using lam_type by auto
   have "\<forall>n\<in>nat. dense(?D`n)"
   proof(intro ballI)
     fix n
     assume "n\<in>nat"
     then
     have "dense(?D`n) \<longleftrightarrow> dense(if enum`n \<subseteq> P \<and> dense(enum`n) then enum`n else P)"
       by simp
     also
     have "... \<longleftrightarrow>  (\<not>(enum`n \<subseteq> P \<and> dense(enum`n)) \<longrightarrow> dense(P)) "
       using split_if by simp
     finally
     show "dense(?D`n)"
       using P_dense \<open>n\<in>nat\<close> by auto
   qed
   with \<open>?D\<in>_\<close>
   interpret cg: countable_generic P leq \<one> ?D
     by (unfold_locales, auto)
   from \<open>p\<in>P\<close>
   obtain G where 1: "p\<in>G \<and> filter(G) \<and> (\<forall>n\<in>nat.(?D`n)\<inter>G\<noteq>0)"
     using cg.countable_rasiowa_sikorski[where M="\<lambda>_. M"]  P_sub_M
       M_countable[THEN bij_is_fun] M_countable[THEN bij_is_surj, THEN surj_range]
     unfolding cg.D_generic_def by blast
   then
   have "(\<forall>D\<in>M. D\<subseteq>P \<and> dense(D)\<longrightarrow>D\<inter>G\<noteq>0)"
   proof (intro ballI impI)
     fix D
     assume "D\<in>M" and 2: "D \<subseteq> P \<and> dense(D) "
     moreover
     have "\<forall>y\<in>M. \<exists>x\<in>nat. enum`x= y"
       using M_countable and  bij_is_surj unfolding surj_def by (simp)
     moreover from calculation
     obtain n where Eq10: "n\<in>nat \<and> enum`n = D"
       by auto
     moreover from calculation if_P
     have "?D`n = D"
       by simp
     moreover
     note 1
     ultimately
     show "D\<inter>G\<noteq>0"
       by auto
   qed
   with 1
   show ?thesis
     unfolding M_generic_def by auto
 qed
 
 lemma one_in_M: "\<one> \<in> M"
   using one_in_P P_in_M transitivity
   by simp
 
 declare P_in_M [simp,intro]
 declare one_in_M [simp,intro]
 declare leq_in_M [simp,intro]
 declare one_in_P [intro]
 
 end \<comment> \<open>\<^locale>\<open>forcing_data1\<close>\<close>
 
 locale G_generic1 = forcing_data1 +
   fixes G :: "i"
   assumes generic : "M_generic(G)"
 begin
 
 lemma G_nonempty: "G\<noteq>0"
   using generic subset_refl[of P] P_dense
   unfolding M_generic_def
   by auto
 
 lemma M_genericD [dest]: "x\<in>G \<Longrightarrow> x\<in>P"
   using generic
   by (blast dest:filterD)
 
 lemma M_generic_leqD [dest]: "p\<in>G \<Longrightarrow> q\<in>P \<Longrightarrow> p\<preceq>q \<Longrightarrow> q\<in>G"
   using generic
   by (blast dest:filter_leqD)
 
 lemma M_generic_compatD [dest]: "p\<in>G \<Longrightarrow> r\<in>G \<Longrightarrow> \<exists>q\<in>G. q\<preceq>p \<and> q\<preceq>r"
   using generic
   by (blast dest:low_bound_filter)
 
 lemma M_generic_denseD [dest]: "dense(D) \<Longrightarrow> D\<subseteq>P \<Longrightarrow> D\<in>M \<Longrightarrow> \<exists>q\<in>G. q\<in>D"
   using generic
   unfolding M_generic_def by blast
 
 lemma G_subset_P: "G\<subseteq>P"
   using generic by auto
 
 lemma one_in_G : "\<one> \<in> G"
 proof -
   have "increasing(G)"
     using generic
     unfolding M_generic_def filter_def by simp
   then
   show ?thesis
     using G_nonempty one_max
     unfolding increasing_def by blast
 qed
 
 lemma G_subset_M: "G \<subseteq> M"
   using generic transitivity[OF _ P_in_M] by auto
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 locale G_generic1_AC = G_generic1 + M_ctm1_AC
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Forcing_Main.thy b/thys/Independence_CH/Forcing_Main.thy
--- a/thys/Independence_CH/Forcing_Main.thy
+++ b/thys/Independence_CH/Forcing_Main.thy
@@ -1,170 +1,170 @@
 section\<open>The main theorem\<close>
 
 theory Forcing_Main
   imports
     Ordinals_In_MG
     Choice_Axiom
     Succession_Poset
 
 begin
 
 subsection\<open>The generic extension is countable\<close>
 
 lemma (in forcing_data1) surj_nat_MG : "\<exists>f. f \<in> surj(\<omega>,M[G])"
 proof -
   let ?f="\<lambda>n\<in>\<omega>. val(G,enum`n)"
   have "x \<in> \<omega> \<Longrightarrow> val(G, enum ` x)\<in> M[G]" for x
     using GenExtI bij_is_fun[OF M_countable]
     by simp
   then
   have "?f: \<omega> \<rightarrow> M[G]"
     using lam_type[of \<omega> "\<lambda>n. val(G,enum`n)" "\<lambda>_.M[G]"] by simp
   moreover
   have "\<exists>n\<in>\<omega>. ?f`n = x" if "x\<in>M[G]" for x
     using that GenExt_iff[of _ G] bij_is_surj[OF M_countable]
     unfolding surj_def by auto
   ultimately
   show ?thesis
     unfolding surj_def by blast
 qed
 
 lemma (in G_generic1) MG_eqpoll_nat: "M[G] \<approx> \<omega>"
 proof -
   obtain f where "f \<in> surj(\<omega>,M[G])"
     using surj_nat_MG by blast
   then
   have "M[G] \<lesssim> \<omega>"
     using well_ord_surj_imp_lepoll well_ord_Memrel[of \<omega>] by simp
   moreover
   have "\<omega> \<lesssim> M[G]"
     using ext.nat_into_M subset_imp_lepoll by (auto del:lepollI)
   ultimately
   show ?thesis
     using eqpollI by simp
 qed
 
 subsection\<open>Extensions of ctms of fragments of $\ZFC$\<close>
 
 context G_generic1
 begin
 
 lemma sats_ground_repl_fm_imp_sats_ZF_replacement_fm:
   assumes
     "\<phi>\<in>formula" "M, [] \<Turnstile> \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot>"
   shows
     "M[G], [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>"
   using assms sats_ZF_replacement_fm_iff
   by (auto simp:replacement_assm_def ground_replacement_assm_def
       intro:strong_replacement_in_MG[simplified])
 
 lemma satT_ground_repl_fm_imp_satT_ZF_replacement_fm:
   assumes
     "\<Phi> \<subseteq> formula" "M \<Turnstile> { \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>}"
   shows
     "M[G] \<Turnstile> { \<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>}"
   using assms sats_ground_repl_fm_imp_sats_ZF_replacement_fm
   by auto
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 theorem extensions_of_ctms:
   assumes
     "M \<approx> \<omega>" "Transset(M)"
     "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead}"
     "\<Phi> \<subseteq> formula" "M \<Turnstile> { \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>}"
   shows
     "\<exists>N.
       M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> M\<noteq>N \<and>
       (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> (\<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)) \<and>
       ((M, []\<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N, [] \<Turnstile> \<cdot>AC\<cdot>) \<and> N \<Turnstile> \<cdot>Z\<cdot> \<union> { \<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>}"
 proof -
   from \<open>M \<Turnstile> \<cdot>Z\<cdot> \<union> _\<close> \<open>Transset(M)\<close>
   interpret M_ZF_ground_trans M
     using M_satT_imp_M_ZF_ground_trans
     by simp
   from \<open>M \<approx> \<omega>\<close>
   obtain enum where "enum \<in> bij(\<omega>,M)"
     using eqpoll_sym unfolding eqpoll_def by blast
   then
-  interpret M_ctm2 M enum by unfold_locales
+  interpret M_ctm1 M enum by unfold_locales
   interpret forcing_data1 "2\<^bsup><\<omega>\<^esup>" seqle 0 M enum
     using nat_into_M seqspace_closed seqle_in_M
     by unfold_locales simp
   obtain G where "M_generic(G)" "M \<noteq> M[G]"
     using cohen_extension_is_proper
     by blast
   text\<open>Recall that \<^term>\<open>M[G]\<close> denotes the generic extension
   of \<^term>\<open>M\<close> using the poset of sequences \<^term>\<open>2\<^bsup><\<omega>\<^esup>\<close>.\<close>
   then
-  interpret G_generic2 "2\<^bsup><\<omega>\<^esup>" seqle 0 _ enum G by unfold_locales
+  interpret G_generic1 "2\<^bsup><\<omega>\<^esup>" seqle 0 _ enum G by unfold_locales
   interpret MG: M_Z_basic "M[G]"
     using generic pairing_in_MG
       Union_MG  extensionality_in_MG power_in_MG
       foundation_in_MG replacement_assm_MG
       separation_in_MG infinity_in_MG replacement_ax1
     by unfold_locales simp
   have "M, []\<Turnstile> \<cdot>AC\<cdot> \<Longrightarrow> M[G], [] \<Turnstile> \<cdot>AC\<cdot>"
   proof -
     assume "M, [] \<Turnstile> \<cdot>AC\<cdot>"
     then
     have "choice_ax(##M)"
       unfolding ZF_choice_fm_def using ZF_choice_auto by simp
     then
     have "choice_ax(##M[G])" using choice_in_MG by simp
     then
     show "M[G], [] \<Turnstile> \<cdot>AC\<cdot>"
       using ZF_choice_auto sats_ZFC_iff_sats_ZF_AC
       unfolding ZF_choice_fm_def by simp
   qed
   moreover
   note \<open>M \<noteq> M[G]\<close> \<open>M \<Turnstile> { \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>}\<close> \<open>\<Phi> \<subseteq> formula\<close>
   moreover
   have "Transset(M[G])" using Transset_MG .
   moreover
   have "M \<subseteq> M[G]" using M_subset_MG[OF one_in_G] generic by simp
   ultimately
   show ?thesis
     using Ord_MG_iff MG_eqpoll_nat ext.M_satT_Zermelo_fms
       satT_ground_repl_fm_imp_satT_ZF_replacement_fm[of \<Phi>]
     by (rule_tac x="M[G]" in exI, auto)
 qed
 
-lemma ZF_replacement_instances12_sub_ZF: "{\<cdot>Replacement(p)\<cdot> . p \<in> overhead} \<subseteq> ZF"
-  using instances1_fms_type instances2_fms_type instances_ground_fms_type
+lemma ZF_replacement_overhead_sub_ZF: "{\<cdot>Replacement(p)\<cdot> . p \<in> overhead} \<subseteq> ZF"
+  using instances1_fms_type instances_ground_fms_type
   unfolding overhead_def ZF_def ZF_schemes_def by auto
 
 theorem extensions_of_ctms_ZF:
   assumes
     "M \<approx> \<omega>" "Transset(M)" "M \<Turnstile> ZF"
   shows
     "\<exists>N.
       M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZF \<and> M\<noteq>N \<and>
       (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> (\<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)) \<and>
       ((M, []\<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N \<Turnstile> ZFC)"
 proof -
   from assms
   have "\<exists>N.
       M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> M\<noteq>N \<and>
       (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> (\<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)) \<and>
       ((M, []\<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N, [] \<Turnstile> \<cdot>AC\<cdot>) \<and> N \<Turnstile> \<cdot>Z\<cdot> \<union> { \<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> formula}"
     using extensions_of_ctms[of M formula] satT_ZF_imp_satT_Z[of M]
       satT_mono[OF _ ground_repl_fm_sub_ZF, of M]
-      satT_mono[OF _ ZF_replacement_instances12_sub_ZF, of M]
+      satT_mono[OF _ ZF_replacement_overhead_sub_ZF, of M]
     by (auto simp: satT_Un_iff)
   then
   obtain N where "N \<Turnstile> \<cdot>Z\<cdot> \<union> { \<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> formula}" "M \<subseteq> N" "N \<approx> \<omega>" "Transset(N)"
     "M \<noteq> N" "(\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)"
     "(M, []\<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N, [] \<Turnstile> \<cdot>AC\<cdot>"
     by blast
   moreover from \<open>N \<Turnstile> \<cdot>Z\<cdot> \<union> { \<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> formula}\<close>
   have "N \<Turnstile> ZF"
     using satT_Z_ZF_replacement_imp_satT_ZF by auto
   moreover from this and \<open>(M, []\<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N, [] \<Turnstile> \<cdot>AC\<cdot>\<close>
   have "(M, []\<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N \<Turnstile> ZFC"
     using sats_ZFC_iff_sats_ZF_AC by simp
   ultimately
   show ?thesis
     by auto
 qed
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Infinity_Axiom.thy b/thys/Independence_CH/Infinity_Axiom.thy
--- a/thys/Independence_CH/Infinity_Axiom.thy
+++ b/thys/Independence_CH/Infinity_Axiom.thy
@@ -1,30 +1,28 @@
 section\<open>The Axiom of Infinity in $M[G]$\<close>
 theory Infinity_Axiom
   imports Union_Axiom Pairing_Axiom
 begin
-sublocale G_generic1 \<subseteq> forcing_data1
-  by unfold_locales
 
 context G_generic1 begin
 
 interpretation mg_triv: M_trivial"##M[G]"
   using transitivity_MG zero_in_MG[of G] generic Union_MG pairing_in_MG
   by unfold_locales auto
 
 lemma infinity_in_MG : "infinity_ax(##M[G])"
 proof -
   have "\<omega> \<in> M[G]"
     using M_subset_MG one_in_G nat_in_M by auto
   moreover from this
   have "succ(y) \<in> \<omega> \<inter> M[G]" if "y \<in> \<omega>" for y
     using that transitivity_MG by blast
   ultimately
   show ?thesis
     using transitivity_MG[of 0 \<omega>]
     unfolding infinity_ax_def
     by auto
 qed
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Internal_ZFC_Axioms.thy b/thys/Independence_CH/Internal_ZFC_Axioms.thy
--- a/thys/Independence_CH/Internal_ZFC_Axioms.thy
+++ b/thys/Independence_CH/Internal_ZFC_Axioms.thy
@@ -1,520 +1,519 @@
 section\<open>The ZFC axioms, internalized\<close>
 theory Internal_ZFC_Axioms
   imports
     Fm_Definitions
 
 begin
 
 schematic_goal ZF_union_auto:
     "Union_ax(##A) \<longleftrightarrow> (A, [] \<Turnstile> ?zfunion)"
   unfolding Union_ax_def
   by ((rule sep_rules | simp)+)
 
 synthesize "ZF_union" from_schematic ZF_union_auto
 notation ZF_union_fm (\<open>\<cdot>Union Ax\<cdot>\<close>)
 
 schematic_goal ZF_power_auto:
     "power_ax(##A) \<longleftrightarrow> (A, [] \<Turnstile> ?zfpow)"
   unfolding power_ax_def powerset_def subset_def
   by ((rule sep_rules | simp)+)
 
 synthesize "ZF_power" from_schematic ZF_power_auto
 notation ZF_power_fm (\<open>\<cdot>Powerset Ax\<cdot>\<close>)
 
 schematic_goal ZF_pairing_auto:
     "upair_ax(##A) \<longleftrightarrow> (A, [] \<Turnstile> ?zfpair)"
   unfolding upair_ax_def
   by ((rule sep_rules | simp)+)
 
 synthesize "ZF_pairing" from_schematic ZF_pairing_auto
 notation ZF_pairing_fm (\<open>\<cdot>Pairing\<cdot>\<close>)
 
 schematic_goal ZF_foundation_auto:
     "foundation_ax(##A) \<longleftrightarrow> (A, [] \<Turnstile> ?zffound)"
   unfolding foundation_ax_def
   by ((rule sep_rules | simp)+)
 
 synthesize "ZF_foundation" from_schematic ZF_foundation_auto
 notation ZF_foundation_fm (\<open>\<cdot>Foundation\<cdot>\<close>)
 
 schematic_goal ZF_extensionality_auto:
     "extensionality(##A) \<longleftrightarrow> (A, [] \<Turnstile> ?zfext)"
   unfolding extensionality_def
   by ((rule sep_rules | simp)+)
 
 synthesize "ZF_extensionality" from_schematic ZF_extensionality_auto
 notation ZF_extensionality_fm (\<open>\<cdot>Extensionality\<cdot>\<close>)
 
 schematic_goal ZF_infinity_auto:
     "infinity_ax(##A) \<longleftrightarrow> (A, [] \<Turnstile> (?\<phi>(i,j,h)))"
   unfolding infinity_ax_def
   by ((rule sep_rules | simp)+)
 
 synthesize "ZF_infinity" from_schematic ZF_infinity_auto
 notation ZF_infinity_fm (\<open>\<cdot>Infinity\<cdot>\<close>)
 
 schematic_goal ZF_choice_auto:
     "choice_ax(##A) \<longleftrightarrow> (A, [] \<Turnstile> (?\<phi>(i,j,h)))"
   unfolding choice_ax_def
   by ((rule sep_rules | simp)+)
 
 synthesize "ZF_choice" from_schematic ZF_choice_auto
 notation ZF_choice_fm (\<open>\<cdot>AC\<cdot>\<close>)
 
 lemmas ZFC_fm_defs = ZF_extensionality_fm_def ZF_foundation_fm_def ZF_pairing_fm_def
               ZF_union_fm_def ZF_infinity_fm_def ZF_power_fm_def ZF_choice_fm_def
 
 lemmas ZFC_fm_sats = ZF_extensionality_auto ZF_foundation_auto ZF_pairing_auto
               ZF_union_auto ZF_infinity_auto ZF_power_auto ZF_choice_auto
 
 definition
   ZF_fin :: "i" where
   "ZF_fin \<equiv> {\<cdot>Extensionality\<cdot>, \<cdot>Foundation\<cdot>, \<cdot>Pairing\<cdot>,
               \<cdot>Union Ax\<cdot>, \<cdot>Infinity\<cdot>, \<cdot>Powerset Ax\<cdot>}"
 
 subsection\<open>The Axiom of Separation, internalized\<close>
 lemma iterates_Forall_type [TC]:
       "\<lbrakk> n \<in> nat; p \<in> formula \<rbrakk> \<Longrightarrow> Forall^n(p) \<in> formula"
   by (induct set:nat, auto)
 
 lemma last_init_eq :
   assumes "l \<in> list(A)" "length(l) = succ(n)"
   shows "\<exists> a\<in>A. \<exists>l'\<in>list(A). l = l'@[a]"
 proof-
   from \<open>l\<in>_\<close> \<open>length(_) = _\<close>
   have "rev(l) \<in> list(A)" "length(rev(l)) = succ(n)"
     by simp_all
   then
   obtain a l' where "a\<in>A" "l'\<in>list(A)" "rev(l) = Cons(a,l')"
     by (cases;simp)
   then
   have "l = rev(l') @ [a]" "rev(l') \<in> list(A)"
     using rev_rev_ident[OF \<open>l\<in>_\<close>] by auto
   with \<open>a\<in>_\<close>
   show ?thesis by blast
 qed
 
 lemma take_drop_eq :
   assumes "l\<in>list(M)"
   shows "\<And> n . n < succ(length(l)) \<Longrightarrow> l = take(n,l) @ drop(n,l)"
   using \<open>l\<in>list(M)\<close>
 proof induct
   case Nil
   then show ?case by auto
 next
   case (Cons a l)
   then show ?case
   proof -
     {
       fix i
       assume "i<succ(succ(length(l)))"
       with \<open>l\<in>list(M)\<close>
       consider (lt) "i = 0" | (eq) "\<exists>k\<in>nat. i = succ(k) \<and> k < succ(length(l))"
         using \<open>l\<in>list(M)\<close>  le_natI nat_imp_quasinat
         by (cases rule:nat_cases[of i];auto)
       then
       have "take(i,Cons(a,l)) @ drop(i,Cons(a,l)) = Cons(a,l)"
         using Cons
         by (cases;auto)
     }
     then show ?thesis using Cons by auto
   qed
 qed
 
 lemma list_split :
 assumes "n \<le> succ(length(rest))" "rest \<in> list(M)"
 shows  "\<exists>re\<in>list(M). \<exists>st\<in>list(M). rest = re @ st \<and> length(re) = pred(n)"
 proof -
   from assms
   have "pred(n) \<le> length(rest)"
     using pred_mono[OF _ \<open>n\<le>_\<close>] pred_succ_eq by auto
   with \<open>rest\<in>_\<close>
   have "pred(n)\<in>nat" "rest = take(pred(n),rest) @ drop(pred(n),rest)" (is "_ = ?re @ ?st")
     using take_drop_eq[OF \<open>rest\<in>_\<close>] le_natI by auto
   then
   have "length(?re) = pred(n)" "?re\<in>list(M)" "?st\<in>list(M)"
     using length_take[rule_format,OF _ \<open>pred(n)\<in>_\<close>] \<open>pred(n) \<le> _\<close> \<open>rest\<in>_\<close>
     unfolding min_def
     by auto
   then
   show ?thesis
     using rev_bexI[of _ _ "\<lambda> re. \<exists>st\<in>list(M). rest = re @ st \<and> length(re) = pred(n)"]
       \<open>length(?re) = _\<close> \<open>rest = _\<close>
     by auto
 qed
 
 lemma sats_nForall:
   assumes
     "\<phi> \<in> formula"
   shows
     "n\<in>nat \<Longrightarrow> ms \<in> list(M) \<Longrightarrow>
        (M, ms \<Turnstile> (Forall^n(\<phi>))) \<longleftrightarrow>
        (\<forall>rest \<in> list(M). length(rest) = n \<longrightarrow> M, rest @ ms \<Turnstile> \<phi>)"
 proof (induct n arbitrary:ms set:nat)
   case 0
   with assms
   show ?case by simp
 next
   case (succ n)
   have "(\<forall>rest\<in>list(M). length(rest) = succ(n) \<longrightarrow> P(rest,n)) \<longleftrightarrow>
         (\<forall>t\<in>M. \<forall>res\<in>list(M). length(res) = n \<longrightarrow> P(res @ [t],n))"
     if "n\<in>nat" for n P
     using that last_init_eq by force
   from this[of _ "\<lambda>rest _. (M, rest @ ms \<Turnstile> \<phi>)"] \<open>n\<in>nat\<close>
   have "(\<forall>rest\<in>list(M). length(rest) = succ(n) \<longrightarrow> M, rest @ ms \<Turnstile> \<phi>) \<longleftrightarrow>
         (\<forall>t\<in>M. \<forall>res\<in>list(M). length(res) = n \<longrightarrow>  M, (res @ [t]) @ ms \<Turnstile> \<phi>)"
     by simp
     with assms succ(1,3) succ(2)[of "Cons(_,ms)"]
   show ?case
     using arity_sats_iff[of \<phi> _ M "Cons(_, ms @ _)"] app_assoc
     by (simp)
 qed
 
 definition
   sep_body_fm :: "i \<Rightarrow> i" where
   "sep_body_fm(p) \<equiv> (\<cdot>\<forall>(\<cdot>\<exists>(\<cdot>\<forall>\<cdot>\<cdot>0 \<in> 1\<cdot> \<leftrightarrow> \<cdot>\<cdot>0 \<in> 2\<cdot> \<and> incr_bv1^2 (p) \<cdot>\<cdot>\<cdot>)\<cdot>)\<cdot>)"
 
 lemma sep_body_fm_type [TC]: "p \<in> formula \<Longrightarrow> sep_body_fm(p) \<in> formula"
   by (simp add: sep_body_fm_def)
 
 lemma sats_sep_body_fm:
   assumes
     "\<phi> \<in> formula" "ms\<in>list(M)" "rest\<in>list(M)"
   shows
     "(M, rest @ ms \<Turnstile> sep_body_fm(\<phi>)) \<longleftrightarrow>
      separation(##M,\<lambda>x. M, [x] @ rest @ ms \<Turnstile> \<phi>)"
   using assms formula_add_params1[of _ 2 _ _ "[_,_]" ]
   unfolding sep_body_fm_def separation_def by simp
 
 definition
   ZF_separation_fm :: "i \<Rightarrow> i" (\<open>\<cdot>Separation'(_')\<cdot>\<close>) where
   "ZF_separation_fm(p) \<equiv> Forall^(pred(arity(p)))(sep_body_fm(p))"
 
 lemma ZF_separation_fm_type [TC]: "p \<in> formula \<Longrightarrow> ZF_separation_fm(p) \<in> formula"
   by (simp add: ZF_separation_fm_def)
 
 lemma sats_ZF_separation_fm_iff:
   assumes
     "\<phi>\<in>formula"
   shows
   "(M, [] \<Turnstile> \<cdot>Separation(\<phi>)\<cdot>)
    \<longleftrightarrow>
    (\<forall>env\<in>list(M). arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env) \<longrightarrow>
       separation(##M,\<lambda>x. M, [x] @ env \<Turnstile> \<phi>))"
 proof (intro iffI ballI impI)
   let ?n="pred(arity(\<phi>))"
   fix env
   assume "M, [] \<Turnstile> ZF_separation_fm(\<phi>)"
   assume "arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env)" "env\<in>list(M)"
   moreover from this
   have "arity(\<phi>) \<le> succ(length(env))" by simp
   then
   obtain some rest where "some\<in>list(M)" "rest\<in>list(M)"
     "env = some @ rest" "length(some) = pred(arity(\<phi>))"
     using list_split[OF \<open>arity(\<phi>) \<le> succ(_)\<close> \<open>env\<in>_\<close>] by force
   moreover from \<open>\<phi>\<in>_\<close>
   have "arity(\<phi>) \<le> succ(pred(arity(\<phi>)))"
    using succpred_leI by simp
   moreover
   note assms
   moreover
   assume "M, [] \<Turnstile> ZF_separation_fm(\<phi>)"
   moreover from calculation
   have "M, some \<Turnstile> sep_body_fm(\<phi>)"
     using sats_nForall[of "sep_body_fm(\<phi>)" ?n]
     unfolding ZF_separation_fm_def by simp
   ultimately
   show "separation(##M, \<lambda>x. M, [x] @ env \<Turnstile> \<phi>)"
     unfolding ZF_separation_fm_def
     using sats_sep_body_fm[of \<phi> "[]" M some]
       arity_sats_iff[of \<phi> rest M "[_] @ some"]
       separation_cong[of "##M" "\<lambda>x. M, Cons(x, some @ rest) \<Turnstile> \<phi>" _ ]
     by simp
 next \<comment> \<open>almost equal to the previous implication\<close>
   let ?n="pred(arity(\<phi>))"
   assume asm:"\<forall>env\<in>list(M). arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env) \<longrightarrow>
     separation(##M, \<lambda>x. M, [x] @ env \<Turnstile> \<phi>)"
   {
     fix some
     assume "some\<in>list(M)" "length(some) = pred(arity(\<phi>))"
     moreover
     note \<open>\<phi>\<in>_\<close>
     moreover from calculation
     have "arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(some)"
       using le_trans[OF succpred_leI] succpred_leI by simp
     moreover from calculation and asm
     have "separation(##M, \<lambda>x. M, [x] @ some \<Turnstile> \<phi>)" by blast
     ultimately
     have "M, some \<Turnstile> sep_body_fm(\<phi>)"
     using sats_sep_body_fm[of \<phi> "[]" M some]
       arity_sats_iff[of \<phi> _ M "[_,_] @ some"]
       strong_replacement_cong[of "##M" "\<lambda>x y. M, Cons(x, Cons(y, some @ _)) \<Turnstile> \<phi>" _ ]
     by simp
   }
   with \<open>\<phi>\<in>_\<close>
   show "M, [] \<Turnstile> ZF_separation_fm(\<phi>)"
     using sats_nForall[of "sep_body_fm(\<phi>)" ?n]
     unfolding ZF_separation_fm_def
     by simp
 qed
 
 subsection\<open>The Axiom of Replacement, internalized\<close>
 schematic_goal sats_univalent_fm_auto:
   assumes
     (*    Q_iff_sats:"\<And>a b z env aa bb. nth(a,Cons(z,env)) = aa \<Longrightarrow> nth(b,Cons(z,env)) = bb \<Longrightarrow> z\<in>A
           \<Longrightarrow> aa \<in> A \<Longrightarrow> bb \<in> A \<Longrightarrow> env\<in> list(A) \<Longrightarrow>
                  Q(aa,bb) \<longleftrightarrow> (A, Cons(z,env) \<Turnstile> (Q_fm(a,b)))" \<comment> \<open>using only \<one> formula\<close> *)
     Q_iff_sats:"\<And>x y z. x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> z\<in>A \<Longrightarrow>
                  Q(x,z) \<longleftrightarrow> (A,Cons(z,Cons(y,Cons(x,env))) \<Turnstile> Q1_fm)"
        "\<And>x y z. x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> z\<in>A \<Longrightarrow>
                  Q(x,y) \<longleftrightarrow> (A,Cons(z,Cons(y,Cons(x,env))) \<Turnstile> Q2_fm)"
     and
     asms: "nth(i,env) = B" "i \<in> nat" "env \<in> list(A)"
   shows
     "univalent(##A,B,Q) \<longleftrightarrow> A,env \<Turnstile> ?ufm(i)"
   unfolding univalent_def
   by (insert asms; (rule sep_rules Q_iff_sats | simp)+)
 
 synthesize_notc "univalent" from_schematic sats_univalent_fm_auto
 
 lemma univalent_fm_type [TC]: "q1\<in> formula \<Longrightarrow> q2\<in>formula \<Longrightarrow> i\<in>nat \<Longrightarrow>
   univalent_fm(q2,q1,i) \<in>formula"
   by (simp add:univalent_fm_def)
 
 lemma sats_univalent_fm :
   assumes
     Q_iff_sats:"\<And>x y z. x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> z\<in>A \<Longrightarrow>
                  Q(x,z) \<longleftrightarrow> (A,Cons(z,Cons(y,Cons(x,env))) \<Turnstile> Q1_fm)"
        "\<And>x y z. x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> z\<in>A \<Longrightarrow>
                  Q(x,y) \<longleftrightarrow> (A,Cons(z,Cons(y,Cons(x,env))) \<Turnstile> Q2_fm)"
     and
     asms: "nth(i,env) = B" "i \<in> nat" "env \<in> list(A)"
   shows
     "(A,env \<Turnstile> univalent_fm(Q1_fm,Q2_fm,i)) \<longleftrightarrow> univalent(##A,B,Q)"
   unfolding univalent_fm_def using asms sats_univalent_fm_auto[OF Q_iff_sats] by simp
 
 definition
   swap_vars :: "i\<Rightarrow>i" where
   "swap_vars(\<phi>) \<equiv>
       Exists(Exists(And(Equal(0,3),And(Equal(1,2),iterates(\<lambda>p. incr_bv(p)`2 , 2, \<phi>)))))"
 
 lemma swap_vars_type[TC] :
   "\<phi>\<in>formula \<Longrightarrow> swap_vars(\<phi>) \<in>formula"
   unfolding swap_vars_def by simp
 
 lemma sats_swap_vars :
   "[x,y] @ env \<in> list(M) \<Longrightarrow> \<phi>\<in>formula \<Longrightarrow>
     (M, [x,y] @ env \<Turnstile> swap_vars(\<phi>)) \<longleftrightarrow> M,[y,x] @ env \<Turnstile> \<phi>"
   unfolding swap_vars_def
   using sats_incr_bv_iff [of _ _ M _ "[y,x]"] by simp
 
 definition
   univalent_Q1 :: "i \<Rightarrow> i" where
   "univalent_Q1(\<phi>) \<equiv> incr_bv1(swap_vars(\<phi>))"
 
 definition
   univalent_Q2 :: "i \<Rightarrow> i" where
   "univalent_Q2(\<phi>) \<equiv> incr_bv(swap_vars(\<phi>))`0"
 
 lemma univalent_Qs_type [TC]:
   assumes "\<phi>\<in>formula"
   shows "univalent_Q1(\<phi>) \<in> formula" "univalent_Q2(\<phi>) \<in> formula"
   unfolding univalent_Q1_def univalent_Q2_def using assms by simp_all
 
 lemma sats_univalent_fm_assm:
   assumes
     "x \<in> A" "y \<in> A" "z\<in>A" "env\<in> list(A)" "\<phi> \<in> formula"
   shows
     "(A, ([x,z] @ env) \<Turnstile> \<phi>) \<longleftrightarrow> (A, Cons(z,Cons(y,Cons(x,env))) \<Turnstile> (univalent_Q1(\<phi>)))"
     "(A, ([x,y] @ env) \<Turnstile> \<phi>) \<longleftrightarrow> (A, Cons(z,Cons(y,Cons(x,env))) \<Turnstile> (univalent_Q2(\<phi>)))"
   unfolding univalent_Q1_def univalent_Q2_def
   using
     sats_incr_bv_iff[of _ _ A _ "[]"] \<comment> \<open>simplifies iterates of \<^term>\<open>\<lambda>x. incr_bv(x)`0\<close>\<close>
     sats_incr_bv1_iff[of _ "Cons(x,env)" A z y]
     sats_swap_vars  assms
    by simp_all
 
 definition
   rep_body_fm :: "i \<Rightarrow> i" where
   "rep_body_fm(p) \<equiv> Forall(Implies(
         univalent_fm(univalent_Q1(incr_bv(p)`2),univalent_Q2(incr_bv(p)`2),0),
         Exists(Forall(
           Iff(Member(0,1),Exists(And(Member(0,3),incr_bv(incr_bv(p)`2)`2)))))))"
 
 lemma rep_body_fm_type [TC]: "p \<in> formula \<Longrightarrow> rep_body_fm(p) \<in> formula"
   by (simp add: rep_body_fm_def)
 
 lemmas ZF_replacement_simps = formula_add_params1[of \<phi> 2 _ M "[_,_]" ]
   sats_incr_bv_iff[of _ _ M _ "[]"] \<comment> \<open>simplifies iterates of \<^term>\<open>\<lambda>x. incr_bv(x)`0\<close>\<close>
   sats_incr_bv_iff[of _ _ M _ "[_,_]"]\<comment> \<open>simplifies \<^term>\<open>\<lambda>x. incr_bv(x)`2\<close>\<close>
   sats_incr_bv1_iff[of _ _ M] sats_swap_vars for \<phi> M
 
 lemma sats_rep_body_fm:
   assumes
     "\<phi> \<in> formula" "ms\<in>list(M)" "rest\<in>list(M)"
   shows
     "(M, rest @ ms \<Turnstile> rep_body_fm(\<phi>)) \<longleftrightarrow>
      strong_replacement(##M,\<lambda>x y. M, [x,y] @ rest @ ms \<Turnstile> \<phi>)"
   using assms ZF_replacement_simps
   unfolding rep_body_fm_def strong_replacement_def univalent_def
   unfolding univalent_fm_def univalent_Q1_def univalent_Q2_def
   by simp
 
 definition
   ZF_replacement_fm :: "i \<Rightarrow> i" (\<open>\<cdot>Replacement'(_')\<cdot>\<close>) where
   "ZF_replacement_fm(p) \<equiv> Forall^(pred(pred(arity(p))))(rep_body_fm(p))"
 
 lemma ZF_replacement_fm_type [TC]: "p \<in> formula \<Longrightarrow> ZF_replacement_fm(p) \<in> formula"
   by (simp add: ZF_replacement_fm_def)
 
 lemma sats_ZF_replacement_fm_iff:
   assumes
     "\<phi>\<in>formula"
   shows
-  "(M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>)
-   \<longleftrightarrow>
-   (\<forall>env\<in>list(M). arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(env) \<longrightarrow>
-      strong_replacement(##M,\<lambda>x y. M,[x,y] @ env \<Turnstile> \<phi>))"
-proof (intro iffI ballI impI)
+  "(M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>) \<longleftrightarrow> (\<forall>env. replacement_assm(M,env,\<phi>))"
+  unfolding replacement_assm_def
+proof (intro iffI allI impI)
   let ?n="pred(pred(arity(\<phi>)))"
   fix env
   assume "M, [] \<Turnstile> ZF_replacement_fm(\<phi>)" "arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(env)" "env\<in>list(M)"
   moreover from this
   have "arity(\<phi>) \<le> succ(succ(length(env)))" by (simp)
   moreover from calculation
   have "pred(arity(\<phi>)) \<le> succ(length(env))"
     using pred_mono[OF _ \<open>arity(\<phi>)\<le>succ(_)\<close>] pred_succ_eq by simp
   moreover from calculation
   obtain some rest where "some\<in>list(M)" "rest\<in>list(M)"
     "env = some @ rest" "length(some) = pred(pred(arity(\<phi>)))"
     using list_split[OF \<open>pred(_) \<le> _\<close> \<open>env\<in>_\<close>] by auto
   moreover
   note \<open>\<phi>\<in>_\<close>
   moreover from this
   have "arity(\<phi>) \<le> succ(succ(pred(pred(arity(\<phi>)))))"
     using le_trans[OF succpred_leI] succpred_leI by simp
   moreover from calculation
   have "M, some \<Turnstile> rep_body_fm(\<phi>)"
     using sats_nForall[of "rep_body_fm(\<phi>)" ?n]
     unfolding ZF_replacement_fm_def
     by simp
   ultimately
   show "strong_replacement(##M, \<lambda>x y. M, [x, y] @ env \<Turnstile> \<phi>)"
     using sats_rep_body_fm[of \<phi> "[]" M some]
       arity_sats_iff[of \<phi> rest M "[_,_] @ some"]
       strong_replacement_cong[of "##M" "\<lambda>x y. M, Cons(x, Cons(y, some @ rest)) \<Turnstile> \<phi>" _ ]
     by simp
 next \<comment> \<open>almost equal to the previous implication\<close>
   let ?n="pred(pred(arity(\<phi>)))"
-  assume asm:"\<forall>env\<in>list(M). arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(env) \<longrightarrow>
+  assume asm:"\<forall>env. \<phi> \<in> formula \<longrightarrow>
+          env \<in> list(M) \<longrightarrow> arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(env) \<longrightarrow>
     strong_replacement(##M, \<lambda>x y. M, [x, y] @ env \<Turnstile> \<phi>)"
   {
     fix some
     assume "some\<in>list(M)" "length(some) = pred(pred(arity(\<phi>)))"
     moreover
     note \<open>\<phi>\<in>_\<close>
     moreover from calculation
     have "arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(some)"
       using le_trans[OF succpred_leI] succpred_leI by simp
     moreover from calculation and asm
     have "strong_replacement(##M, \<lambda>x y. M, [x, y] @ some \<Turnstile> \<phi>)" by blast
     ultimately
     have "M, some \<Turnstile> rep_body_fm(\<phi>)"
     using sats_rep_body_fm[of \<phi> "[]" M some]
       arity_sats_iff[of \<phi> _ M "[_,_] @ some"]
       strong_replacement_cong[of "##M" "\<lambda>x y. M, Cons(x, Cons(y, some @ _)) \<Turnstile> \<phi>" _ ]
     by simp
   }
   with \<open>\<phi>\<in>_\<close>
   show "M, [] \<Turnstile> ZF_replacement_fm(\<phi>)"
     using sats_nForall[of "rep_body_fm(\<phi>)" ?n]
     unfolding ZF_replacement_fm_def
     by simp
 qed
 
 definition
   ZF_schemes :: "i" where
   "ZF_schemes \<equiv> {\<cdot>Separation(p)\<cdot> . p \<in> formula } \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> formula }"
 
 lemma Un_subset_formula [TC]: "A\<subseteq>formula \<and> B\<subseteq>formula \<Longrightarrow> A\<union>B \<subseteq> formula"
   by auto
 
 lemma ZF_schemes_subset_formula [TC]: "ZF_schemes \<subseteq> formula"
   unfolding ZF_schemes_def by auto
 
 lemma ZF_fin_subset_formula [TC]: "ZF_fin \<subseteq> formula"
   unfolding ZF_fin_def by simp
 
 definition
   ZF :: "i" where
   "ZF \<equiv> ZF_schemes \<union> ZF_fin"
 
 lemma ZF_subset_formula [TC]: "ZF \<subseteq> formula"
   unfolding ZF_def by auto
 
 definition
   ZFC :: "i" where
   "ZFC \<equiv> ZF \<union> {\<cdot>AC\<cdot>}"
 
 definition
   ZF_minus_P :: "i" where
   "ZF_minus_P \<equiv> ZF - { \<cdot>Powerset Ax\<cdot> }"
 
 definition
   Zermelo_fms :: "i" (\<open>\<cdot>Z\<cdot>\<close>) where
   "Zermelo_fms \<equiv> ZF_fin \<union> {\<cdot>Separation(p)\<cdot> . p \<in> formula }"
 
 definition
   ZC :: "i" where
   "ZC \<equiv> Zermelo_fms \<union> {\<cdot>AC\<cdot>}"
 
 lemma ZFC_subset_formula: "ZFC \<subseteq> formula"
   by (simp add:ZFC_def Un_subset_formula)
 
 text\<open>Satisfaction of a set of sentences\<close>
 definition
   satT :: "[i,i] \<Rightarrow> o"  ("_ \<Turnstile> _" [36,36] 60) where
   "A \<Turnstile> \<Phi>  \<equiv>  \<forall>\<phi>\<in>\<Phi>. (A,[] \<Turnstile> \<phi>)"
 
 lemma satTI [intro!]:
   assumes "\<And>\<phi>. \<phi>\<in>\<Phi> \<Longrightarrow> A,[] \<Turnstile> \<phi>"
   shows "A \<Turnstile> \<Phi>"
   using assms unfolding satT_def by simp
 
 lemma satTD [dest] :"A \<Turnstile> \<Phi> \<Longrightarrow> \<phi>\<in>\<Phi> \<Longrightarrow> A,[] \<Turnstile> \<phi>"
   unfolding satT_def by simp
 
 lemma satT_mono: "A \<Turnstile> \<Phi> \<Longrightarrow> \<Psi> \<subseteq> \<Phi> \<Longrightarrow> A \<Turnstile> \<Psi>"
   by blast
 
 lemma satT_Un_iff: "M \<Turnstile> \<Phi> \<union> \<Psi> \<longleftrightarrow> M \<Turnstile> \<Phi> \<and> M \<Turnstile> \<Psi>" by auto
 
 lemma sats_ZFC_iff_sats_ZF_AC:
   "(N \<Turnstile> ZFC) \<longleftrightarrow> (N \<Turnstile> ZF) \<and> (N, [] \<Turnstile> \<cdot>AC\<cdot>)"
     unfolding ZFC_def ZF_def by auto
 
 lemma satT_ZF_imp_satT_Z: "M \<Turnstile> ZF \<Longrightarrow> M \<Turnstile> \<cdot>Z\<cdot>"
   unfolding ZF_def ZF_schemes_def Zermelo_fms_def ZF_fin_def by auto
 
 lemma satT_ZFC_imp_satT_ZC: "M \<Turnstile> ZFC \<Longrightarrow> M \<Turnstile> ZC"
   unfolding ZFC_def ZF_def ZF_schemes_def ZC_def Zermelo_fms_def by auto
 
 lemma satT_Z_ZF_replacement_imp_satT_ZF: "N \<Turnstile> \<cdot>Z\<cdot> \<Longrightarrow> N \<Turnstile> {\<cdot>Replacement(x)\<cdot> . x \<in> formula} \<Longrightarrow> N \<Turnstile> ZF"
   unfolding ZF_def ZF_schemes_def Zermelo_fms_def ZF_fin_def by auto
 
 lemma satT_ZC_ZF_replacement_imp_satT_ZFC: "N \<Turnstile> ZC \<Longrightarrow> N \<Turnstile> {\<cdot>Replacement(x)\<cdot> . x \<in> formula} \<Longrightarrow> N \<Turnstile> ZFC"
   unfolding ZFC_def ZF_def ZF_schemes_def ZC_def Zermelo_fms_def  by auto
 
 lemma ground_repl_fm_sub_ZF: "{\<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> formula} \<subseteq> ZF"
    unfolding ZF_def ZF_schemes_def by auto
 
 lemma ZF_replacement_fms_sub_ZFC: "{\<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> formula} \<subseteq> ZFC"
    unfolding ZFC_def ZF_def ZF_schemes_def by auto
 
 lemma ground_repl_fm_sub_ZFC: "{\<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> formula} \<subseteq> ZFC"
    unfolding ZFC_def ZF_def ZF_schemes_def by auto
 
 lemma ZF_replacement_ground_repl_fm_type: "{\<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> formula} \<subseteq> formula"
   by auto
 
 end
diff --git a/thys/Independence_CH/Kappa_Closed_Notions.thy b/thys/Independence_CH/Kappa_Closed_Notions.thy
--- a/thys/Independence_CH/Kappa_Closed_Notions.thy
+++ b/thys/Independence_CH/Kappa_Closed_Notions.thy
@@ -1,723 +1,723 @@
 section\<open>Preservation results for $\kappa$-closed forcing notions\<close>
 
 theory Kappa_Closed_Notions
   imports
     Not_CH
 begin
 
 definition
   lerel :: "i\<Rightarrow>i" where
   "lerel(\<alpha>) \<equiv> Memrel(\<alpha>) \<union> id(\<alpha>)"
 
 lemma lerelI[intro!]: "x\<le>y \<Longrightarrow> y\<in>\<alpha> \<Longrightarrow> Ord(\<alpha>) \<Longrightarrow> \<langle>x,y\<rangle> \<in> lerel(\<alpha>)"
   using Ord_trans[of x y \<alpha>] ltD unfolding lerel_def by auto
 
 lemma lerelD[dest]: "\<langle>x,y\<rangle> \<in> lerel(\<alpha>) \<Longrightarrow> Ord(\<alpha>) \<Longrightarrow> x\<le>y"
   using ltI[THEN leI] Ord_in_Ord unfolding lerel_def by auto
 
 definition
   mono_seqspace :: "[i,i,i] \<Rightarrow> i" (\<open>_ \<^sub><\<rightarrow> '(_,_')\<close> [61] 60) where
   "\<alpha> \<^sub><\<rightarrow> (P,leq) \<equiv> mono_map(\<alpha>,Memrel(\<alpha>),P,leq)"
 
 relativize functional "mono_seqspace" "mono_seqspace_rel"
 relationalize "mono_seqspace_rel" "is_mono_seqspace"
 synthesize "is_mono_seqspace" from_definition assuming "nonempty"
 
 context M_ZF_library
 begin
 
 rel_closed for "mono_seqspace"
   unfolding mono_seqspace_rel_def mono_map_rel_def
   using separation_closed separation_ball separation_imp separation_in
     lam_replacement_fst lam_replacement_snd lam_replacement_hcomp lam_replacement_constant
     lam_replacement_product
     lam_replacement_apply2[THEN[5] lam_replacement_hcomp2]
   by simp_all
 
 end \<comment> \<open>\<^locale>\<open>M_ZF_library\<close>\<close>
 
 abbreviation
   mono_seqspace_r (\<open>_ \<^sub><\<rightarrow>\<^bsup>_\<^esup> '(_,_')\<close> [61] 60) where
   "\<alpha> \<^sub><\<rightarrow>\<^bsup>M\<^esup> (P,leq) \<equiv> mono_seqspace_rel(M,\<alpha>,P,leq)"
 
 abbreviation
   mono_seqspace_r_set (\<open>_ \<^sub><\<rightarrow>\<^bsup>_\<^esup> '(_,_')\<close> [61] 60) where
   "\<alpha> \<^sub><\<rightarrow>\<^bsup>M\<^esup> (P,leq) \<equiv> mono_seqspace_rel(##M,\<alpha>,P,leq)"
 
 lemma mono_seqspaceI[intro!]:
   includes mono_map_rules
   assumes "f: A\<rightarrow>P" "\<And>x y. x\<in>A \<Longrightarrow> y\<in>A \<Longrightarrow> x<y \<Longrightarrow> \<langle>f`x, f`y\<rangle> \<in> leq" "Ord(A)"
   shows  "f: A \<^sub><\<rightarrow> (P,leq)"
   using ltI[OF _ Ord_in_Ord[of A], THEN [3] assms(2)] assms(1,3)
   unfolding mono_seqspace_def by auto
 
 lemma (in M_ZF_library) mono_seqspace_rel_char:
   assumes "M(A)" "M(P)" "M(leq)"
   shows "A \<^sub><\<rightarrow>\<^bsup>M\<^esup> (P,leq) = {f\<in>A \<^sub><\<rightarrow> (P,leq). M(f)}"
   using assms mono_map_rel_char
   unfolding mono_seqspace_def mono_seqspace_rel_def by simp
 
 lemma (in M_ZF_library) mono_seqspace_relI[intro!]:
   assumes "f: A\<rightarrow>\<^bsup>M\<^esup> P" "\<And>x y. x\<in>A \<Longrightarrow> y\<in>A \<Longrightarrow> x<y \<Longrightarrow> \<langle>f`x, f`y\<rangle> \<in> leq"
     "Ord(A)" "M(A)" "M(P)" "M(leq)"
   shows  "f: A \<^sub><\<rightarrow>\<^bsup>M\<^esup> (P,leq)"
   using mono_seqspace_rel_char function_space_rel_char assms by auto
 
 lemma mono_seqspace_is_fun[dest]:
   includes mono_map_rules
   shows "j: A \<^sub><\<rightarrow> (P,leq) \<Longrightarrow> j: A\<rightarrow> P"
   unfolding mono_seqspace_def by auto
 
 lemma mono_map_lt_le_is_mono[dest]:
   includes mono_map_rules
   assumes "j: A \<^sub><\<rightarrow> (P,leq)" "a\<in>A" "c\<in>A" "a\<le>c" "Ord(A)" "refl(P,leq)"
   shows "\<langle>j`a,j`c\<rangle> \<in> leq"
   using assms mono_map_increasing unfolding mono_seqspace_def refl_def
   by (cases "a=c") (auto dest:ltD)
 
 lemma (in M_ZF_library) mem_mono_seqspace_abs[absolut]:
   assumes "M(f)" "M(A)" "M(P)" "M(leq)"
   shows  "f:A \<^sub><\<rightarrow>\<^bsup>M\<^esup> (P,leq) \<longleftrightarrow>  f: A \<^sub><\<rightarrow> (P,leq)"
   using assms mono_map_rel_char unfolding mono_seqspace_def mono_seqspace_rel_def
   by (simp)
 
 definition
   mono_map_lt_le :: "[i,i] \<Rightarrow> i" (infixr \<open>\<^sub><\<rightarrow>\<^sub>\<le>\<close> 60) where
   "\<alpha> \<^sub><\<rightarrow>\<^sub>\<le> \<beta> \<equiv> \<alpha> \<^sub><\<rightarrow> (\<beta>,lerel(\<beta>))"
 
 lemma mono_map_lt_leI[intro!]:
   includes mono_map_rules
   assumes "f: A\<rightarrow>B" "\<And>x y. x\<in>A \<Longrightarrow> y\<in>A \<Longrightarrow> x<y \<Longrightarrow> f`x \<le> f`y" "Ord(A)" "Ord(B)"
   shows  "f: A \<^sub><\<rightarrow>\<^sub>\<le> B"
   using assms
   unfolding mono_map_lt_le_def by auto
 
 \<comment> \<open>Kunen IV.7.13, with “$\kappa$” in place of “$\lambda$”\<close>
 definition
   kappa_closed :: "[i,i,i] \<Rightarrow> o" (\<open>_-closed'(_,_')\<close>) where
   "\<kappa>-closed(P,leq) \<equiv> \<forall>\<delta>. \<delta><\<kappa> \<longrightarrow> (\<forall>f\<in>\<delta> \<^sub><\<rightarrow> (P,converse(leq)). \<exists>q\<in>P. \<forall>\<alpha>\<in>\<delta>. \<langle>q,f`\<alpha>\<rangle>\<in>leq)"
 
 relativize functional "kappa_closed" "kappa_closed_rel"
 relationalize "kappa_closed_rel" "is_kappa_closed"
 synthesize "is_kappa_closed" from_definition assuming "nonempty"
 
 abbreviation
   kappa_closed_r (\<open>_-closed\<^bsup>_\<^esup>'(_,_')\<close> [61] 60) where
   "\<kappa>-closed\<^bsup>M\<^esup>(P,leq) \<equiv> kappa_closed_rel(M,\<kappa>,P,leq)"
 
 abbreviation
   kappa_closed_r_set (\<open>_-closed\<^bsup>_\<^esup>'(_,_')\<close> [61] 60) where
   "\<kappa>-closed\<^bsup>M\<^esup>(P,leq) \<equiv> kappa_closed_rel(##M,\<kappa>,P,leq)"
 
-lemma (in forcing_data4) forcing_a_value:
+lemma (in forcing_data3) forcing_a_value:
   assumes "p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, A\<^sup>v, B\<^sup>v]" "a \<in> A"
     "q \<preceq> p" "q \<in> P" "p\<in>P" "f_dot \<in> M" "A\<in>M" "B\<in>M"
   shows "\<exists>d\<in>P. \<exists>b\<in>B. d \<preceq> q \<and> d \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v]"
     (* \<comment> \<open>Old neater version, but harder to use
     (without the assumptions on \<^term>\<open>q\<close>):\<close>
     "dense_below({q \<in> P. \<exists>b\<in>B. q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v]}, p)" *)
 proof -
   from assms
   have "q \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, A\<^sup>v, B\<^sup>v]"
     using strengthening_lemma[of p "\<cdot>0:1\<rightarrow>2\<cdot>" q "[f_dot, A\<^sup>v, B\<^sup>v]"]
       typed_function_type arity_typed_function_fm
     by (auto simp: union_abs2 union_abs1)
   from \<open>a\<in>A\<close> \<open>A\<in>M\<close>
   have "a\<in>M" by (auto dest:transitivity)
   from \<open>q\<in>P\<close>
   text\<open>Here we're using countability (via the existence of generic filters)
     of \<^term>\<open>M\<close> as a shortcut, to avoid a further density argument.\<close>
   obtain G where "M_generic(G)" "q\<in>G"
     using generic_filter_existence by blast
   then
-  interpret G_generic4_AC _ _ _ _ _ G by unfold_locales
+  interpret G_generic3_AC _ _ _ _ _ G by unfold_locales
   include G_generic1_lemmas
   note \<open>q\<in>G\<close>
   moreover
   note \<open>q \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, A\<^sup>v, B\<^sup>v]\<close> \<open>M_generic(G)\<close>
   moreover
   note \<open>q\<in>P\<close> \<open>f_dot\<in>M\<close> \<open>B\<in>M\<close> \<open>A\<in>M\<close>
   moreover from this
   have "map(val( G), [f_dot, A\<^sup>v, B\<^sup>v]) \<in> list(M[G])" by simp
   moreover from calculation
   have "val(G,f_dot) : A \<rightarrow>\<^bsup>M[G]\<^esup> B"
     using truth_lemma[of "\<cdot>0:1\<rightarrow>2\<cdot>" "[f_dot, A\<^sup>v, B\<^sup>v]", THEN iffD1]
       typed_function_type arity_typed_function_fm val_check[OF one_in_G one_in_P]
     by (auto simp: union_abs2 union_abs1 ext.mem_function_space_rel_abs)
   moreover
   note \<open>a \<in> M\<close>
   moreover from calculation and \<open>a\<in>A\<close>
   have "val(G,f_dot) ` a \<in> B" (is "?b \<in> B")
     by (simp add: ext.mem_function_space_rel_abs)
   moreover from calculation
   have "?b \<in> M" by (auto dest:transitivity)
   moreover from calculation
   have "M[G], map(val(G), [f_dot, a\<^sup>v, ?b\<^sup>v]) \<Turnstile> \<cdot>0`1 is 2\<cdot>"
     by simp
   ultimately
   obtain r where "r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, ?b\<^sup>v]" "r\<in>G" "r\<in>P"
     using truth_lemma[of "\<cdot>0`1 is 2\<cdot>" "[f_dot, a\<^sup>v, ?b\<^sup>v]", THEN iffD2]
       fun_apply_type arity_fun_apply_fm val_check[OF one_in_G one_in_P]
       G_subset_P
     by (auto simp: union_abs2 union_abs1 ext.mem_function_space_rel_abs)
   moreover from this and \<open>q\<in>G\<close>
   obtain d where "d\<preceq>q" "d\<preceq>r" "d\<in>P" by force
   moreover
   note \<open>f_dot\<in>M\<close> \<open>a\<in>M\<close> \<open>?b\<in>B\<close> \<open>B\<in>M\<close>
   moreover from calculation
   have "d \<preceq> q \<and> d \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, ?b\<^sup>v]"
     using fun_apply_type arity_fun_apply_fm
       strengthening_lemma[of r "\<cdot>0`1 is 2\<cdot>" d "[f_dot, a\<^sup>v, ?b\<^sup>v]"]
     by (auto dest:transitivity simp add: union_abs2 union_abs1)
   ultimately
   show ?thesis by auto
 qed
 
 locale M_master_CH = M_master + M_library_DC
 
-sublocale M_ZFC3_ground_CH_trans \<subseteq> M_master_CH "##M"
+sublocale M_ZFC2_ground_CH_trans \<subseteq> M_master_CH "##M"
   using replacement_dcwit_repl_body
   by unfold_locales (simp_all add:sep_instances del:setclass_iff
       add: transrec_replacement_def wfrec_replacement_def dcwit_repl_body_def)
 
-context G_generic4_AC_CH begin
+context G_generic3_AC_CH begin
 
 context
   includes G_generic1_lemmas
 begin
 
 lemma separation_check_snd_aux:
   assumes "f_dot\<in>M" "\<tau>\<in>M" "\<chi>\<in>formula" "arity(\<chi>) \<le> 7"
   shows "separation(##M, \<lambda>r. M, [fst(r), P, leq, \<one>, f_dot, \<tau>, snd(r)\<^sup>v] \<Turnstile> \<chi>)"
 proof -
   let ?f_fm="fst_fm(1,0)"
   let ?g_fm="hcomp_fm(check_fm(6),snd_fm,2,0)"
   note assms
   moreover
   have "?f_fm \<in> formula" "arity(?f_fm) \<le> 7" "?g_fm \<in> formula" "arity(?g_fm) \<le> 8"
     using ord_simp_union
     unfolding hcomp_fm_def
     by (simp_all add:arity)
   ultimately
   show ?thesis
     using separation_sat_after_function
     using fst_abs snd_abs sats_snd_fm sats_check_fm check_abs
     unfolding hcomp_fm_def
     by simp
 qed
 
 lemma separation_check_fst_snd_aux :
   assumes "f_dot\<in>M" "r\<in>M" "\<chi>\<in>formula" "arity(\<chi>) \<le> 7"
   shows "separation(##M, \<lambda>p. M, [r, P, leq, \<one>, f_dot, fst(p)\<^sup>v, snd(p)\<^sup>v] \<Turnstile> \<chi>)"
 proof -
   let ?\<rho>="\<lambda>z. [r, P, leq, \<one>, f_dot, fst(z)\<^sup>v, snd(z)\<^sup>v]"
   let ?\<rho>'="\<lambda>z. [fst(z)\<^sup>v, P, leq, \<one>, f_dot, r, snd(z)\<^sup>v]"
   let ?\<phi>=" (\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>\<cdot>\<cdot>0 = 11\<cdot> \<and> \<cdot>\<cdot>1 = 7\<cdot> \<and> \<cdot>\<cdot>2 = 8\<cdot> \<and> \<cdot>\<cdot>3 = 9\<cdot> \<and> \<cdot>\<cdot>4 = 10\<cdot> \<and> \<cdot>\<cdot>5 = 6\<cdot> \<and>
     (\<lambda>p. incr_bv(p)`6)^6 (\<chi>) \<cdot>\<cdot>\<cdot>\<cdot>\<cdot>\<cdot>\<cdot>)\<cdot>)\<cdot>)\<cdot>)\<cdot>)\<cdot>)"
   let ?f_fm="hcomp_fm(check_fm(5),fst_fm,1,0)"
   let ?g_fm="hcomp_fm(check_fm(6),snd_fm,2,0)"
   note assms
   moreover
   have "?f_fm \<in> formula" "arity(?f_fm) \<le> 7" "?g_fm \<in> formula" "arity(?g_fm) \<le> 8"
     using ord_simp_union
     unfolding hcomp_fm_def
     by (simp_all add:arity)
   moreover from assms
   have fm:"?\<phi>\<in>formula" by simp
   moreover from \<open>\<chi> \<in> formula\<close> \<open>arity(\<chi>) \<le> 7\<close>
   have "arity(\<chi>) = 0 \<or> arity(\<chi>) = 1 \<or> arity(\<chi>) = 2 \<or> arity(\<chi>) = 3
     \<or> arity(\<chi>) = 4 \<or> arity(\<chi>) = 5 \<or> arity(\<chi>) = 6 \<or> arity(\<chi>) = 7"
     unfolding lt_def by auto
   with calculation and \<open>\<chi> \<in> formula\<close>
   have ar:"arity(?\<phi>) \<le> 7"
     using arity_incr_bv_lemma by safe (simp_all add: arity ord_simp_union)
   moreover from calculation
   have sep:"separation(##M,\<lambda>z. M,?\<rho>'(z)\<Turnstile>?\<phi>)"
     using separation_sat_after_function sats_check_fm check_abs
       fst_abs snd_abs
     unfolding hcomp_fm_def
     by simp
   moreover from assms
   have "?\<rho>(z) \<in> list(M)" if "(##M)(z)" for z
     using that by simp
   moreover from calculation and \<open>r \<in> M\<close> \<open>\<chi> \<in> formula\<close>
   have "(M,?\<rho>(z) \<Turnstile> \<chi>) \<longleftrightarrow> (M,?\<rho>'(z)\<Turnstile>?\<phi>)" if "(##M)(z)" for z
     using that sats_incr_bv_iff[of _ _ M _ "[_,_,_,_,_,_]"]
     by simp
   ultimately
   show ?thesis
     using separation_cong[THEN iffD1,OF _ sep]
     by simp
 qed
 
 lemma separation_leq_and_forces_apply_aux:
   assumes "f_dot\<in>M" "B\<in>M"
   shows "\<forall>n\<in>M. separation(##M, \<lambda>x. snd(x) \<preceq> fst(x) \<and>
           (\<exists>b\<in>B. M, [snd(x), P, leq, \<one>, f_dot, (\<Union>(n))\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> )))"
 proof -
   have pred_nat_closed: "pred(n)\<in>M" if "n\<in>M" for n
     using nat_case_closed that
     unfolding pred_def
     by auto
   have "separation(##M, \<lambda>z. M, [snd(fst(z)), P, leq, \<one>, f_dot, \<tau>, snd(z)\<^sup>v] \<Turnstile> \<chi>)"
     if "\<chi>\<in>formula" "arity(\<chi>) \<le> 7" "\<tau>\<in>M" for \<chi> \<tau>
   proof -
     let ?f_fm="hcomp_fm(snd_fm,fst_fm,1,0)"
     let ?g_fm="hcomp_fm(check_fm(6),snd_fm,2,0)"
     note assms
     moreover
     have "?f_fm \<in> formula" "arity(?f_fm) \<le> 7" "?g_fm \<in> formula" "arity(?g_fm) \<le> 8"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     ultimately
     show ?thesis
       using separation_sat_after_function sats_check_fm check_abs fst_abs snd_abs that
       unfolding hcomp_fm_def
       by simp
   qed
   with assms
   show ?thesis
     using separation_in lam_replacement_constant lam_replacement_snd lam_replacement_fst
       lam_replacement_product pred_nat_closed
       arity_forces[of " \<cdot>0`1 is 2\<cdot>"] arity_fun_apply_fm[of 0 1 2] ord_simp_union
     by(clarify,rule_tac separation_conj,simp_all,rule_tac separation_bex,simp_all)
 qed
 
 lemma separation_leq_and_forces_apply_aux':
   assumes "f_dot\<in>M" "p\<in>M" "B\<in>M"
   shows "separation
      (##M, \<lambda>p .  snd(snd(p)) \<preceq> fst(snd(p)) \<and>
     (\<exists>b\<in>B. M, [snd(snd(p)), P, leq, \<one>, f_dot, (\<Union>fst(p))\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> )))"
 proof -
   have "separation(##M, \<lambda>z. M, [snd(snd(fst(z))), P, leq, \<one>, f_dot, (\<Union>fst(fst(z)))\<^sup>v, snd(z)\<^sup>v] \<Turnstile> \<chi>)"
     if "\<chi>\<in>formula" "arity(\<chi>) \<le> 7" for \<chi>
   proof -
     let ?f_fm="hcomp_fm(snd_fm,hcomp_fm(snd_fm,fst_fm),1,0)"
     let ?g="\<lambda>z . (\<Union>(fst(fst(z))))\<^sup>v"
     let ?g_fm="hcomp_fm(check_fm(6),hcomp_fm(big_union_fm,hcomp_fm(fst_fm,fst_fm)),2,0)"
     let ?h_fm="hcomp_fm(check_fm(7),snd_fm,3,0)"
     note assms
     moreover
     have f_fm_facts:"?f_fm \<in> formula" "arity(?f_fm) \<le> 6"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     moreover from assms
     have "?g_fm \<in> formula" "arity(?g_fm) \<le> 7" "?h_fm \<in> formula" "arity(?h_fm) \<le> 8"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     ultimately
     show ?thesis
       using separation_sat_after_function3[OF _ _ _ f_fm_facts] check_abs
         sats_check_fm that fst_abs snd_abs sats_fst_fm sats_snd_fm
       unfolding hcomp_fm_def
       by simp
   qed
   with assms
   show ?thesis
     using
       separation_conj separation_bex
       lam_replacement_constant lam_replacement_hcomp
       lam_replacement_fst lam_replacement_snd
       arity_forces[of " \<cdot>0`1 is 2\<cdot>"] arity_fun_apply_fm[of 0 1 2] ord_simp_union
       separation_in[OF _ lam_replacement_product]
     by simp
 qed
 
 lemma separation_closed_leq_and_forces_eq_check_aux :
   assumes "A\<in>M" "r\<in>G" "\<tau> \<in> M"
   shows "(##M)({q\<in>P. \<exists>h\<in>A. q \<preceq> r \<and> q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]})"
 proof -
   have "separation(##M, \<lambda>z. M, [fst(z), P, leq, \<one>, \<tau>, snd(z)\<^sup>v] \<Turnstile> \<chi>)" if
     "\<chi>\<in>formula" "arity(\<chi>) \<le> 6" for \<chi>
   proof -
     let ?f_fm="fst_fm(1,0)"
     let ?g_fm="hcomp_fm(check_fm(6),snd_fm,2,0)"
     note assms
     moreover
     have "?f_fm \<in> formula" "arity(?f_fm) \<le> 6" "?g_fm \<in> formula" "arity(?g_fm) \<le> 7"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     ultimately
     show ?thesis
       using separation_sat_after_function_1 sats_fst_fm that
         fst_abs snd_abs sats_snd_fm sats_check_fm check_abs
       unfolding hcomp_fm_def
       by simp
   qed
   with assms
   show ?thesis
     using separation_conj separation_in G_subset_M[THEN subsetD]
       lam_replacement_constant lam_replacement_fst lam_replacement_product
       arity_forces[of "\<cdot>0 = 1\<cdot>",simplified] ord_simp_union
     by(rule_tac separation_closed[OF separation_bex],simp_all)
 qed
 
 lemma separation_closed_forces_apply_aux:
   assumes "B\<in>M" "f_dot\<in>M" "r\<in>M"
   shows "(##M)({\<langle>n,b\<rangle> \<in> \<omega> \<times> B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]})"
   using nat_in_M assms transitivity[OF _ \<open>B\<in>M\<close>] nat_into_M separation_check_fst_snd_aux
     arity_forces[of " \<cdot>0`1 is 2\<cdot>"] arity_fun_apply_fm[of 0 1 2] ord_simp_union
   unfolding split_def
   by simp_all
 
 \<comment> \<open>Kunen IV.6.9 (3)$\Rightarrow$(2), with general domain.\<close>
 lemma kunen_IV_6_9_function_space_rel_eq:
   assumes "\<And>p \<tau>. p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [\<tau>, A\<^sup>v, B\<^sup>v] \<Longrightarrow> p\<in>P \<Longrightarrow> \<tau> \<in> M \<Longrightarrow>
     \<exists>q\<in>P. \<exists>h\<in>A \<rightarrow>\<^bsup>M\<^esup> B. q \<preceq> p \<and>  q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]" "A\<in>M" "B\<in>M"
   shows
     "A \<rightarrow>\<^bsup>M\<^esup> B = A \<rightarrow>\<^bsup>M[G]\<^esup> B"
 proof (intro equalityI; clarsimp simp add:
     assms function_space_rel_char ext.function_space_rel_char)
   fix f
   assume "f \<in> A \<rightarrow> B" "f \<in> M[G]"
   moreover from this
   obtain \<tau> where "val(G,\<tau>) = f" "\<tau> \<in> M"
     using GenExtD by force
   moreover from calculation and \<open>A\<in>M\<close> \<open>B\<in>M\<close>
   obtain r where "r \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [\<tau>, A\<^sup>v, B\<^sup>v]" "r\<in>G"
     using truth_lemma[of "\<cdot>0:1\<rightarrow>2\<cdot>" "[\<tau>, A\<^sup>v, B\<^sup>v]"]
       typed_function_type arity_typed_function_fm val_check[OF one_in_G one_in_P]
     by (auto simp: union_abs2 union_abs1)
   moreover from \<open>A\<in>M\<close> \<open>B\<in>M\<close> \<open>r\<in>G\<close> \<open>\<tau> \<in> M\<close>
   have "{q\<in>P. \<exists>h\<in>A \<rightarrow>\<^bsup>M\<^esup> B. q \<preceq> r \<and> q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]} \<in> M" (is "?D \<in> M")
     using separation_closed_leq_and_forces_eq_check_aux by auto
   moreover from calculation and assms(2-)
   have "dense_below(?D, r)"
     using strengthening_lemma[of r "\<cdot>0:1\<rightarrow>2\<cdot>" _ "[\<tau>, A\<^sup>v, B\<^sup>v]", THEN assms(1)[of _ \<tau>]]
       leq_transD generic_dests(1)[of r]
     by (auto simp: union_abs2 union_abs1 typed_function_type arity_typed_function_fm) blast
   moreover from calculation
   obtain q h where "h\<in>A \<rightarrow>\<^bsup>M\<^esup> B" "q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]" "q \<preceq> r" "q\<in>P" "q\<in>G"
     using generic_inter_dense_below[of ?D r] by blast
   note \<open>q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]\<close> \<open>\<tau>\<in>M\<close> \<open>h\<in>A \<rightarrow>\<^bsup>M\<^esup> B\<close> \<open>A\<in>M\<close> \<open>B\<in>M\<close> \<open>q\<in>G\<close>
   moreover from this
   have "map(val(G), [\<tau>, h\<^sup>v]) \<in> list(M[G])" "h\<in>M"
     by (auto dest:transitivity)
   ultimately
   have "h = f"
     using truth_lemma[of "\<cdot>0=1\<cdot>" "[\<tau>, h\<^sup>v]"] val_check[OF one_in_G one_in_P]
     by (auto simp: ord_simp_union)
   with \<open>h\<in>M\<close>
   show "f \<in> M" by simp
 qed
 
 subsection\<open>$(\omega+1)$-Closed notions preserve countable sequences\<close>
 
 \<comment> \<open>Kunen IV.7.15, only for countable sequences\<close>
 lemma succ_omega_closed_imp_no_new_nat_sequences:
   assumes "succ(\<omega>)-closed\<^bsup>M\<^esup>(P,leq)" "f : \<omega> \<rightarrow> B" "f\<in>M[G]" "B\<in>M"
   shows "f\<in>M"
 proof -
   (* Nice jEdit folding level to read this: 7 *)
   text\<open>The next long block proves that the assumptions of Lemma
   @{thm [source] kunen_IV_6_9_function_space_rel_eq} are satisfied.\<close>
   {
     fix p f_dot
     assume "p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, \<omega>\<^sup>v, B\<^sup>v]" "p\<in>P" "f_dot\<in>M"
     let ?subp="{q\<in>P. q \<preceq> p}"
     from \<open>p\<in>P\<close>
     have "?subp \<in> M"
       using first_section_closed[of P p "converse(leq)"]
       by (auto dest:transitivity)
     define S where "S \<equiv> \<lambda>n\<in>nat.
     {\<langle>q,r\<rangle> \<in> ?subp\<times>?subp. r \<preceq> q \<and> (\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, (\<Union>(n))\<^sup>v, b\<^sup>v])}"
       (is "S \<equiv> \<lambda>n\<in>nat. ?Y(n)")
     define S' where "S' \<equiv> \<lambda>n\<in>nat.
     {\<langle>q,r\<rangle> \<in> ?subp\<times>?subp. r \<preceq> q \<and> (\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, (pred(n))\<^sup>v, b\<^sup>v])}"
       \<comment> \<open>Towards proving \<^term>\<open>S\<in>M\<close>.\<close>
     moreover
     have "S = S'"
       unfolding S_def S'_def using pred_nat_eq lam_cong by auto
     moreover from \<open>B\<in>M\<close> \<open>?subp\<in>M\<close> \<open>f_dot\<in>M\<close>
     have "{r \<in> ?subp. \<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, (\<Union>(n))\<^sup>v, b\<^sup>v]} \<in> M" (is "?X(n) \<in> M")
       if "n\<in>\<omega>" for n
       using that separation_check_snd_aux nat_into_M ord_simp_union
         arity_forces[of " \<cdot>0`1 is 2\<cdot>"] arity_fun_apply_fm
       by(rule_tac separation_closed[OF separation_bex,simplified], simp_all)
     moreover
     have "?Y(n) = (?subp \<times> ?X(n)) \<inter> converse(leq)" for n
       by (intro equalityI) auto
     moreover
     note \<open>?subp \<in> M\<close> \<open>B\<in>M\<close> \<open>p\<in>P\<close> \<open>f_dot\<in>M\<close>
     moreover from calculation
     have "n \<in> \<omega> \<Longrightarrow> ?Y(n) \<in> M" for n
       using nat_into_M by simp
     moreover from calculation
     have "S \<in> M"
       using  separation_leq_and_forces_apply_aux separation_leq_and_forces_apply_aux'
         transitivity[OF \<open>p\<in>P\<close>]
       unfolding S_def split_def
       by(rule_tac lam_replacement_Collect'[THEN lam_replacement_imp_lam_closed,simplified], simp_all)
     ultimately
     have "S' \<in> M"
       by simp
     from \<open>p\<in>P\<close> \<open>f_dot\<in>M\<close> \<open>p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, \<omega>\<^sup>v, B\<^sup>v]\<close> \<open>B\<in>M\<close>
     have exr:"\<exists>r\<in>P. r \<preceq> q \<and> (\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, pred(n)\<^sup>v, b\<^sup>v])"
       if "q \<preceq> p" "q\<in>P" "n\<in>\<omega>" for q n
       using that forcing_a_value by (auto dest:transitivity)
     have "\<forall>q\<in>?subp. \<forall>n\<in>\<omega>. \<exists>r\<in>?subp. \<langle>q,r\<rangle> \<in> S'`n"
     proof -
       {
         fix q n
         assume "q \<in> ?subp" "n\<in>\<omega>"
         moreover from this
         have "q \<preceq> p" "q \<in> P" "pred(n) = \<Union>n"
           using pred_nat_eq by simp_all
         moreover from calculation and exr
         obtain r where MM:"r \<preceq> q" "\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, pred(n)\<^sup>v, b\<^sup>v]" "r\<in>P"
           by blast
         moreover from calculation \<open>q \<preceq> p\<close> \<open>p \<in> P\<close>
         have "r \<preceq> p"
           using leq_transD[of r q p] by auto
         ultimately
         have "\<exists>r\<in>?subp. r \<preceq> q \<and> (\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, (pred(n))\<^sup>v, b\<^sup>v])"
           by auto
       }
       then
       show ?thesis
         unfolding S'_def by simp
     qed
     with \<open>p\<in>P\<close> \<open>?subp \<in> M\<close> \<open>S' \<in> M\<close>
     obtain g where "g \<in> \<omega> \<rightarrow>\<^bsup>M\<^esup> ?subp" "g`0 = p" "\<forall>n \<in> nat. \<langle>g`n,g`succ(n)\<rangle>\<in>S'`succ(n)"
       using sequence_DC[simplified] refl_leq[of p] by blast
     moreover from this and \<open>?subp \<in> M\<close>
     have "g : \<omega> \<rightarrow> P" "g \<in> M"
       using fun_weaken_type[of g \<omega> ?subp P] function_space_rel_char by auto
     ultimately
     have "g : \<omega> \<^sub><\<rightarrow>\<^bsup>M\<^esup> (P,converse(leq))"
       using decr_succ_decr[of g] leq_preord
       unfolding S'_def by (auto simp:absolut intro:leI)
     moreover from \<open>succ(\<omega>)-closed\<^bsup>M\<^esup>(P,leq)\<close> and this
     have "\<exists>q\<in>M. q \<in> P \<and> (\<forall>\<alpha>\<in>M. \<alpha> \<in> \<omega> \<longrightarrow> q \<preceq> g ` \<alpha>)"
       using transitivity[simplified, of g] mono_seqspace_rel_closed[of \<omega> _ "converse(leq)"]
       unfolding kappa_closed_rel_def
       by auto
     ultimately
     obtain r where "r\<in>P" "r\<in>M" "\<forall>n\<in>\<omega>. r \<preceq> g`n"
       using nat_into_M by auto
     with \<open>g`0 = p\<close>
     have "r \<preceq> p"
       by blast
     let ?h="{\<langle>n,b\<rangle> \<in> \<omega> \<times> B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]}"
     have "function(?h)"
     proof (rule_tac functionI, rule_tac ccontr, auto simp del: app_Cons)
       fix n b b'
       assume "n \<in> \<omega>" "b \<noteq> b'" "b \<in> B" "b' \<in> B"
       moreover
       assume "r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]" "r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b'\<^sup>v]"
       moreover
       note \<open>r \<in> P\<close>
       moreover from this
       have "\<not> r \<bottom> r"
         by (auto intro!:refl_leq)
       moreover
       note \<open>f_dot\<in>M\<close> \<open>B\<in>M\<close>
       ultimately
       show False
         using forces_neq_apply_imp_incompatible[of r f_dot "n\<^sup>v" b r b']
           transitivity[of _ B] by (auto dest:transitivity)
     qed
     moreover
     have "range(?h) \<subseteq> B"
       by auto
     moreover
     have "domain(?h) = \<omega>"
     proof -
       {
         fix n
         assume "n \<in> \<omega>"
         moreover from this
         have 1:"(\<Union>(n)) = pred(n)"
           using pred_nat_eq by simp
         moreover from calculation and \<open>\<forall>n \<in> nat. \<langle>g`n,g`succ(n)\<rangle>\<in>S'`succ(n)\<close>
         obtain b where "g`(succ(n)) \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]" "b\<in>B"
           unfolding S'_def by auto
         moreover from \<open>B\<in>M\<close> and calculation
         have "b \<in> M" "n \<in> M"
           by (auto dest:transitivity)
         moreover
         note \<open>g : \<omega> \<rightarrow> P\<close> \<open>\<forall>n\<in>\<omega>. r \<preceq> g`n\<close> \<open>r\<in>P\<close> \<open>f_dot\<in>M\<close>
         moreover from calculation
         have "r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]"
           using fun_apply_type arity_fun_apply_fm
             strengthening_lemma[of "g`succ(n)" "\<cdot>0`1 is 2\<cdot>" r "[f_dot, n\<^sup>v, b\<^sup>v]"]
           by (simp add: union_abs2 union_abs1)
         ultimately
         have "\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]"
           by auto
       }
       then
       show ?thesis
         by force
     qed
     moreover
     have "relation(?h)"
       unfolding relation_def by simp
     moreover from \<open>f_dot\<in>M\<close> \<open>r\<in>M\<close> \<open>B\<in>M\<close>
     have "?h \<in> M"
       using separation_closed_forces_apply_aux by simp
     moreover
     note \<open>B \<in> M\<close>
     ultimately
     have "?h: \<omega> \<rightarrow>\<^bsup>M\<^esup> B"
       using function_imp_Pi[THEN fun_weaken_type[of ?h _ "range(?h)" B]]
         function_space_rel_char by simp
     moreover
     note \<open>p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, \<omega>\<^sup>v, B\<^sup>v]\<close> \<open>r \<preceq> p\<close> \<open>r\<in>P\<close> \<open>p\<in>P\<close> \<open>f_dot\<in>M\<close> \<open>B\<in>M\<close>
     moreover from this
     have "r \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, \<omega>\<^sup>v, B\<^sup>v]"
       using strengthening_lemma[of p "\<cdot>0:1\<rightarrow>2\<cdot>" r "[f_dot, \<omega>\<^sup>v, B\<^sup>v]"]
         typed_function_type arity_typed_function_fm
       by (auto simp: union_abs2 union_abs1)
     moreover
     note \<open>?h\<in>M\<close>
     moreover from calculation
     have "r \<tturnstile> \<cdot>0 = 1\<cdot> [f_dot, ?h\<^sup>v]"
     proof (intro definition_of_forcing[THEN iffD2] allI impI,
         simp_all add:union_abs2 union_abs1 del:app_Cons)
       fix H
       let ?f="val(H,f_dot)"
       assume "M_generic(H) \<and> r \<in> H"
       moreover from this
       interpret g:G_generic1 _ _ _ _ _ H
         by unfold_locales simp
       note \<open>r\<in>P\<close> \<open>f_dot\<in>M\<close> \<open>B\<in>M\<close>
       moreover from calculation
       have "map(val(H), [f_dot, \<omega>\<^sup>v, B\<^sup>v]) \<in> list(M[H])" "r\<in>H"
         by simp_all
       moreover from calculation and \<open>r\<in>H\<close> and \<open>r \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, \<omega>\<^sup>v, B\<^sup>v]\<close>
       have "?f : \<omega> \<rightarrow> B"
         using g.truth_lemma[of "\<cdot>0:1\<rightarrow>2\<cdot>" "[f_dot, \<omega>\<^sup>v, B\<^sup>v]",THEN iffD1] g.one_in_G one_in_P
           typed_function_type arity_typed_function_fm val_check
         by (auto simp: union_abs2 union_abs1)
       moreover
       have "?h`n = ?f`n" if "n \<in> \<omega>" for n
       proof -
         note \<open>n \<in> \<omega>\<close> \<open>domain(?h) = \<omega>\<close>
         moreover from this
         have "n\<in>domain(?h)"
           by simp
         moreover from this
         obtain b where "r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]" "b\<in>B"
           by force
         moreover
         note \<open>function(?h)\<close>
         moreover from calculation
         have "b = ?h`n"
           using function_apply_equality by simp
         moreover
         note \<open>B \<in> M\<close>
         moreover from calculation
         have "?h`n \<in> M"
           by (auto dest:transitivity)
         moreover
         note \<open>f_dot \<in> M\<close> \<open>r \<in> P\<close> \<open>M_generic(H) \<and> r \<in> H\<close> \<open>map(val(H), [f_dot, \<omega>\<^sup>v, B\<^sup>v]) \<in> list(M[H])\<close>
         moreover from calculation
         have "[?f, n, ?h`n] \<in> list(M[H])"
           using M_subset_MG nat_into_M[of n] g.one_in_G by (auto dest:transitivity)
         ultimately
         show ?thesis
           using definition_of_forcing[of r "\<cdot>0`1 is 2\<cdot>" "[f_dot, n\<^sup>v, b\<^sup>v]",
               THEN iffD1, rule_format, of H]\<comment> \<open>without this line is slower\<close>
             val_check g.one_in_G one_in_P nat_into_M
           by (auto dest:transitivity simp add:fun_apply_type
               arity_fun_apply_fm union_abs2 union_abs1)
       qed
       with calculation and \<open>B\<in>M\<close> \<open>?h: \<omega> \<rightarrow>\<^bsup>M\<^esup> B\<close>
       have "?h = ?f"
         using function_space_rel_char
         by (rule_tac fun_extension[of ?h \<omega> "\<lambda>_.B" ?f]) auto
       ultimately
       show "?f = val(H, ?h\<^sup>v)"
         using val_check g.one_in_G one_in_P generic by simp
     qed
     ultimately
     have "\<exists>r\<in>P. \<exists>h\<in>\<omega> \<rightarrow>\<^bsup>M\<^esup> B. r \<preceq> p \<and> r \<tturnstile> \<cdot>0 = 1\<cdot> [f_dot, h\<^sup>v]"
       by blast
   }
   moreover
   note \<open>B \<in> M\<close> assms
   moreover from calculation
   have "f : \<omega> \<rightarrow>\<^bsup>M\<^esup> B"
     using kunen_IV_6_9_function_space_rel_eq function_space_rel_char
       ext.mem_function_space_rel_abs by auto
   ultimately
   show ?thesis
     by (auto dest:transitivity)
 qed
 
 declare mono_seqspace_rel_closed[rule del]
   \<comment> \<open>Mysteriously breaks the end of the next proof\<close>
 
 lemma succ_omega_closed_imp_no_new_reals:
   assumes "succ(\<omega>)-closed\<^bsup>M\<^esup>(P,leq)"
   shows "\<omega> \<rightarrow>\<^bsup>M\<^esup> 2 = \<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2"
 proof -
   from assms
   have "\<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2 \<subseteq> \<omega> \<rightarrow>\<^bsup>M\<^esup> 2"
     using succ_omega_closed_imp_no_new_nat_sequences function_space_rel_char
       ext.function_space_rel_char Aleph_rel_succ Aleph_rel_zero
     by auto
   then
   show ?thesis
     using function_space_rel_transfer by (intro equalityI) auto
 qed
 
 lemma succ_omega_closed_imp_Aleph_1_preserved:
   assumes "succ(\<omega>)-closed\<^bsup>M\<^esup>(P,leq)"
   shows "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup> = \<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup>"
 proof -
   have "\<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup> \<le> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>"
   proof (rule ccontr)
     assume "\<not> \<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup> \<le> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>"
     then
     have "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup> < \<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup>"
       \<comment> \<open>Ridiculously complicated proof\<close>
       using Card_rel_is_Ord ext.Card_rel_is_Ord
         not_le_iff_lt[THEN iffD1] by auto
     then
     have "|\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>|\<^bsup>M[G]\<^esup> \<le> \<omega>"
       using ext.Card_rel_lt_csucc_rel_iff ext.Aleph_rel_zero
         ext.Aleph_rel_succ ext.Card_rel_nat
       by (auto intro!:ext.lt_csucc_rel_iff[THEN iffD1]
           intro:Card_rel_Aleph_rel[THEN Card_rel_is_Ord, of 1])
     then
     obtain f where "f \<in> inj(\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>,\<omega>)" "f \<in> M[G]"
       using ext.countable_rel_iff_cardinal_rel_le_nat[of "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>", THEN iffD2]
       unfolding countable_rel_def lepoll_rel_def
       by auto
     then
     obtain g where "g \<in> surj\<^bsup>M[G]\<^esup>(\<omega>, \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>)"
       using ext.inj_rel_imp_surj_rel[of f _ \<omega>, OF _ zero_lt_Aleph_rel1[THEN ltD]]
       by auto
     moreover from this
     have "g : \<omega> \<rightarrow> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>" "g \<in> M[G]"
       using ext.surj_rel_char surj_is_fun by simp_all
     moreover
     note \<open>succ(\<omega>)-closed\<^bsup>M\<^esup>(P,leq)\<close>
     ultimately
     have "g \<in> surj\<^bsup>M\<^esup>(\<omega>, \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>)" "g \<in> M"
       using succ_omega_closed_imp_no_new_nat_sequences
         mem_surj_abs ext.mem_surj_abs by simp_all
     then
     show False
       using surj_rel_implies_cardinal_rel_le[of g \<omega> "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>"]
         Card_rel_nat[THEN Card_rel_cardinal_rel_eq] Card_rel_is_Ord
         not_le_iff_lt[THEN iffD2, OF _ _ nat_lt_Aleph_rel1]
       by simp
   qed
   then
   show ?thesis
     using Aleph_rel_le_Aleph_rel
     by (rule_tac le_anti_sym) simp
 qed
 
 end \<comment> \<open>bundle G\_generic1\_lemmas\<close>
 
-end \<comment> \<open>\<^locale>\<open>G_generic4_AC\<close>\<close>
+end \<comment> \<open>\<^locale>\<open>G_generic3_AC\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Not_CH.thy b/thys/Independence_CH/Not_CH.thy
--- a/thys/Independence_CH/Not_CH.thy
+++ b/thys/Independence_CH/Not_CH.thy
@@ -1,593 +1,593 @@
 section\<open>Model of the negation of the Continuum Hypothesis\<close>
 
 theory Not_CH
   imports
     Cardinal_Preservation
 begin
 
 text\<open>We are taking advantage that the poset of finite functions is absolute,
 and thus we work with the unrelativized \<^term>\<open>Fn\<close>. But it would have been more
 appropriate to do the following using the relative \<^term>\<open>Fn_rel\<close>. As it turns
 out, the present theory was developed prior to having \<^term>\<open>Fn\<close> relativized!
 
 We also note that \<^term>\<open>Fn(\<omega>,\<kappa>\<times>\<omega>,2)\<close> is separative, i.e. each \<^term>\<open>X \<in> Fn(\<omega>,\<kappa>\<times>\<omega>,2)\<close>
 has two incompatible extensions; therefore we may recover part of our previous theorem
 @{thm [source] extensions_of_ctms_ZF}. But that result also included the possibility
 of not having $\AC$ in the ground model, which would not be sensible in a context
 where the cardinality of the continuum is under discussion. It is also the case that
 @{thm [source] extensions_of_ctms_ZF} was historically our first formalized result
 (with a different proof) that showed the forcing machinery had all of its elements
 in place.\<close>
 
 abbreviation
   Add_subs :: "i \<Rightarrow> i" where
   "Add_subs(\<kappa>) \<equiv> Fn(\<omega>,\<kappa>\<times>\<omega>,2)"
 
 abbreviation
   Add_le :: "i \<Rightarrow> i" where
   "Add_le(\<kappa>) \<equiv> Fnle(\<omega>,\<kappa> \<times> \<omega>,2)"
 
 lemma (in M_aleph) Aleph_rel2_closed[intro,simp]: "M(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>)"
   using nat_into_Ord by simp
 
 locale M_master = M_cohen + M_library +
   assumes
     UN_lepoll_assumptions:
     "M(A) \<Longrightarrow> M(b) \<Longrightarrow> M(f) \<Longrightarrow> M(A') \<Longrightarrow> separation(M, \<lambda>y. \<exists>x\<in>A'. y = \<langle>x, \<mu> i. x\<in>if_range_F_else_F((`)(A), b, f, i)\<rangle>)"
 
 subsection\<open>Non-absolute concepts between extensions\<close>
 
 sublocale M_master \<subseteq> M_Pi_replacement
   by unfold_locales
 
 locale M_master_sub = M_master + N:M_aleph N for N +
   assumes
     M_imp_N: "M(x) \<Longrightarrow> N(x)" and
     Ord_iff: "Ord(x) \<Longrightarrow> M(x) \<longleftrightarrow> N(x)"
 
 sublocale M_master_sub \<subseteq> M_N_Perm
   using M_imp_N by unfold_locales
 
 context M_master_sub
 begin
 
 lemma cardinal_rel_le_cardinal_rel: "M(X) \<Longrightarrow> |X|\<^bsup>N\<^esup> \<le> |X|\<^bsup>M\<^esup>"
   using M_imp_N N.lepoll_rel_cardinal_rel_le[OF lepoll_rel_transfer Card_rel_is_Ord]
     cardinal_rel_eqpoll_rel[THEN eqpoll_rel_sym, THEN eqpoll_rel_imp_lepoll_rel]
   by simp
 
 lemma Aleph_rel_sub_closed: "Ord(\<alpha>) \<Longrightarrow> M(\<alpha>) \<Longrightarrow> N(\<aleph>\<^bsub>\<alpha>\<^esub>\<^bsup>M\<^esup>)"
   using Ord_iff[THEN iffD1, OF Card_rel_Aleph_rel[THEN Card_rel_is_Ord]]
   by simp
 
 lemma Card_rel_imp_Card_rel: "Card\<^bsup>N\<^esup>(\<kappa>) \<Longrightarrow> M(\<kappa>) \<Longrightarrow> Card\<^bsup>M\<^esup>(\<kappa>)"
   using N.Card_rel_is_Ord[of \<kappa>] M_imp_N Ord_cardinal_rel_le[of \<kappa>]
     cardinal_rel_le_cardinal_rel[of \<kappa>] le_anti_sym
   unfolding Card_rel_def by auto
 
 lemma csucc_rel_le_csucc_rel:
   assumes "Ord(\<kappa>)" "M(\<kappa>)"
   shows "(\<kappa>\<^sup>+)\<^bsup>M\<^esup> \<le> (\<kappa>\<^sup>+)\<^bsup>N\<^esup>"
 proof -
   note assms
   moreover from this
   have "N(L) \<and> Card\<^bsup>N\<^esup>(L) \<and> \<kappa> < L \<Longrightarrow> M(L) \<and> Card\<^bsup>M\<^esup>(L) \<and> \<kappa> < L"
     (is "?P(L) \<Longrightarrow> ?Q(L)") for L
     using M_imp_N Ord_iff[THEN iffD2, of L] N.Card_rel_is_Ord lt_Ord
       Card_rel_imp_Card_rel by auto
   moreover from assms
   have "N((\<kappa>\<^sup>+)\<^bsup>N\<^esup>)" "Card\<^bsup>N\<^esup>((\<kappa>\<^sup>+)\<^bsup>N\<^esup>)" "\<kappa> < (\<kappa>\<^sup>+)\<^bsup>N\<^esup>"
     using N.lt_csucc_rel[of \<kappa>] N.Card_rel_csucc_rel[of \<kappa>] M_imp_N by simp_all
   ultimately
   show ?thesis
     using M_imp_N Least_antitone[of _ ?P ?Q] unfolding csucc_rel_def by blast
 qed
 
 lemma Aleph_rel_le_Aleph_rel: "Ord(\<alpha>) \<Longrightarrow> M(\<alpha>) \<Longrightarrow> \<aleph>\<^bsub>\<alpha>\<^esub>\<^bsup>M\<^esup> \<le> \<aleph>\<^bsub>\<alpha>\<^esub>\<^bsup>N\<^esup>"
 proof (induct rule:trans_induct3)
   case 0
   then
   show ?case
     using Aleph_rel_zero N.Aleph_rel_zero by simp
 next
   case (succ x)
   then
   have "\<aleph>\<^bsub>x\<^esub>\<^bsup>M\<^esup> \<le> \<aleph>\<^bsub>x\<^esub>\<^bsup>N\<^esup>" "Ord(x)" "M(x)" by simp_all
   moreover from this
   have "(\<aleph>\<^bsub>x\<^esub>\<^bsup>M\<^esup>\<^sup>+)\<^bsup>M\<^esup> \<le> (\<aleph>\<^bsub>x\<^esub>\<^bsup>N\<^esup>\<^sup>+)\<^bsup>M\<^esup>"
     using M_imp_N Ord_iff[THEN iffD2, OF N.Card_rel_is_Ord]
     by (intro csucc_rel_le_mono) simp_all
   moreover from calculation
   have "(\<aleph>\<^bsub>x\<^esub>\<^bsup>N\<^esup>\<^sup>+)\<^bsup>M\<^esup> \<le> (\<aleph>\<^bsub>x\<^esub>\<^bsup>N\<^esup>\<^sup>+)\<^bsup>N\<^esup>"
     using M_imp_N N.Card_rel_is_Ord Ord_iff[THEN iffD2, OF N.Card_rel_is_Ord]
     by (intro csucc_rel_le_csucc_rel) auto
   ultimately
   show ?case
     using M_imp_N Aleph_rel_succ N.Aleph_rel_succ csucc_rel_le_csucc_rel
       le_trans by auto
 next
   case (limit x)
   then
   show ?case
     using M_imp_N Aleph_rel_limit N.Aleph_rel_limit
     by simp (blast dest: transM intro!:le_implies_UN_le_UN)
 qed
 
 end \<comment> \<open>\<^locale>\<open>M_master_sub\<close>\<close>
 
-lemmas (in M_ZF3_trans) sep_instances =
+lemmas (in M_ZF2_trans) sep_instances =
   separation_ifrangeF_body separation_ifrangeF_body2 separation_ifrangeF_body3
   separation_ifrangeF_body4 separation_ifrangeF_body5 separation_ifrangeF_body6
   separation_ifrangeF_body7 separation_cardinal_rel_lesspoll_rel
   separation_is_dcwit_body separation_cdltgamma separation_cdeqgamma
 
-lemmas (in M_ZF3_trans) repl_instances = lam_replacement_inj_rel
+lemmas (in M_ZF2_trans) repl_instances = lam_replacement_inj_rel
 
-sublocale M_ZFC3_ground_notCH_trans \<subseteq> M_master "##M"
+sublocale M_ZFC2_ground_notCH_trans \<subseteq> M_master "##M"
   using replacement_trans_apply_image
   by unfold_locales (simp_all add:repl_instances sep_instances del:setclass_iff
       add: transrec_replacement_def wfrec_replacement_def)
 
-sublocale M_ZFC3_trans \<subseteq> M_Pi_replacement "##M"
+sublocale M_ZFC2_trans \<subseteq> M_Pi_replacement "##M"
   by unfold_locales
 
 subsection\<open>Cohen forcing is ccc\<close>
 
-context M_ctm3_AC
+context M_ctm2_AC
 begin
 
 lemma ccc_Add_subs_Aleph_2: "ccc\<^bsup>M\<^esup>(Add_subs(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>),Add_le(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>))"
 proof -
   interpret M_add_reals "##M" "\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<times> \<omega>"
     by unfold_locales blast
   show ?thesis
     using ccc_rel_Fn_nat by fast
 qed
 
-end \<comment> \<open>\<^locale>\<open>M_ctm3_AC\<close>\<close>
+end \<comment> \<open>\<^locale>\<open>M_ctm2_AC\<close>\<close>
 
-sublocale G_generic4_AC \<subseteq> M_master_sub "##M" "##(M[G])"
+sublocale G_generic3_AC \<subseteq> M_master_sub "##M" "##(M[G])"
   using M_subset_MG[OF one_in_G] generic Ord_MG_iff
   by unfold_locales auto
 
 lemma (in M_trans) mem_F_bound4:
   fixes F A
   defines "F \<equiv> (`)"
   shows "x\<in>F(A,c) \<Longrightarrow> c \<in> (range(f) \<union> domain(A))"
   using apply_0 unfolding F_def
   by (cases "M(c)", auto simp:F_def)
 
 lemma (in M_trans) mem_F_bound5:
   fixes F A
   defines "F \<equiv> \<lambda>_ x. A`x "
   shows "x\<in>F(A,c) \<Longrightarrow> c \<in> (range(f) \<union> domain(A))"
   using apply_0 unfolding F_def
   by (cases "M(c)", auto simp:F_def drSR_Y_def dC_F_def)
 
-sublocale M_ctm3_AC \<subseteq> M_replacement_lepoll "##M" "(`)"
+sublocale M_ctm2_AC \<subseteq> M_replacement_lepoll "##M" "(`)"
   using UN_lepoll_assumptions lam_replacement_apply lam_replacement_inj_rel
     mem_F_bound4 apply_0 lam_replacement_minimum
   unfolding lepoll_assumptions_defs
 proof (unfold_locales,
     rule_tac [3] lam_Least_assumption_general[where U=domain, OF _ mem_F_bound4], simp_all)
   fix A i x
   assume "A \<in> M" "x \<in> M" "x \<in> A ` i"
   then
   show "i \<in> M"
     using apply_0[of i A] transM[of _ "domain(A)", simplified]
     by force
 qed
 
-context G_generic4_AC begin
+context G_generic3_AC begin
 
 context
   includes G_generic1_lemmas
 begin
 
 lemma G_in_MG: "G \<in> M[G]"
   using G_in_Gen_Ext
   by blast
 
 lemma ccc_preserves_Aleph_succ:
   assumes "ccc\<^bsup>M\<^esup>(P,leq)" "Ord(z)" "z \<in> M"
   shows "Card\<^bsup>M[G]\<^esup>(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)"
 proof (rule ccontr)
   assume "\<not> Card\<^bsup>M[G]\<^esup>(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)"
   moreover
   note \<open>z \<in> M\<close> \<open>Ord(z)\<close>
   moreover from this
   have "Ord(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)"
     using Card_rel_is_Ord by fastforce
   ultimately
   obtain \<alpha> f where "\<alpha> < \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>" "f \<in> surj\<^bsup>M[G]\<^esup>(\<alpha>, \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)"
     using ext.lt_surj_rel_empty_imp_Card_rel M_subset_MG[OF one_in_G]
     by force
   moreover from this and \<open>z\<in>M\<close> \<open>Ord(z)\<close>
   have "\<alpha> \<in> M" "f \<in> M[G]"
     using ext.trans_surj_rel_closed
     by (auto dest:transM ext.transM dest!:ltD)
   moreover
   note \<open>ccc\<^bsup>M\<^esup>(P,leq)\<close> \<open>z\<in>M\<close>
   ultimately
   obtain F where "F:\<alpha>\<rightarrow>Pow\<^bsup>M\<^esup>(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)" "\<forall>\<beta>\<in>\<alpha>. f`\<beta> \<in> F`\<beta>" "\<forall>\<beta>\<in>\<alpha>. |F`\<beta>|\<^bsup>M\<^esup> \<le> \<omega>"
     "F \<in> M"
     using ccc_fun_approximation_lemma[of \<alpha> "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>" f]
       ext.mem_surj_abs[of f \<alpha> "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>"] \<open>Ord(z)\<close>
       surj_is_fun[of f \<alpha> "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>"] by auto
   then
   have "\<beta> \<in> \<alpha> \<Longrightarrow> |F`\<beta>|\<^bsup>M\<^esup> \<le> \<aleph>\<^bsub>0\<^esub>\<^bsup>M\<^esup>" for \<beta>
     using Aleph_rel_zero by simp
   have "w \<in> F ` x \<Longrightarrow> x \<in> M" for w x
   proof -
     fix w x
     assume "w \<in> F`x"
     then
     have "x \<in> domain(F)"
       using apply_0 by auto
     with \<open>F:\<alpha>\<rightarrow>Pow\<^bsup>M\<^esup>(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)\<close> \<open>\<alpha> \<in> M\<close>
     show "x \<in> M" using domain_of_fun
       by (auto dest:transM)
   qed
   with \<open>\<alpha> \<in> M\<close> \<open>F:\<alpha>\<rightarrow>Pow\<^bsup>M\<^esup>(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)\<close> \<open>F\<in>M\<close>
   interpret M_cardinal_UN_lepoll "##M" "\<lambda>\<beta>. F`\<beta>" \<alpha>
     using UN_lepoll_assumptions lepoll_assumptions
       lam_replacement_apply lam_replacement_inj_rel lam_replacement_minimum
   proof (unfold_locales, auto dest:transM simp del:if_range_F_else_F_def)
     fix f b
     assume "b\<in>M" "f\<in>M"
     with \<open>F\<in>M\<close>
     show "lam_replacement(##M, \<lambda>x. \<mu> i. x \<in> if_range_F_else_F((`)(F), b, f, i))"
       using UN_lepoll_assumptions mem_F_bound5
       by (rule_tac lam_Least_assumption_general[where U="domain", OF _ mem_F_bound5])
         simp_all
   qed
   from \<open>\<alpha> < \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>\<close> \<open>\<alpha> \<in> M\<close> \<open>Ord(z)\<close> \<open>z\<in>M\<close>
   have "\<alpha> \<lesssim>\<^bsup>M\<^esup> \<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"
     using
       cardinal_rel_lt_csucc_rel_iff[of "\<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>" \<alpha>]
       le_Card_rel_iff[of "\<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>" \<alpha>]
       Aleph_rel_succ[of z] Card_rel_lt_iff[of \<alpha> "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>"]
       lt_Ord[of \<alpha> "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>"]
       Card_rel_csucc_rel[of "\<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"]
       Card_rel_Aleph_rel[THEN Card_rel_is_Ord]
     by simp
   with \<open>\<alpha> < \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>\<close> \<open>\<forall>\<beta>\<in>\<alpha>. |F`\<beta>|\<^bsup>M\<^esup> \<le> \<omega>\<close> \<open>\<alpha> \<in> M\<close> assms
   have "|\<Union>\<beta>\<in>\<alpha>. F`\<beta>|\<^bsup>M\<^esup> \<le> \<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"
     using InfCard_rel_Aleph_rel[of z] Aleph_rel_zero
       subset_imp_lepoll_rel[THEN lepoll_rel_imp_cardinal_rel_le,
         of "\<Union>\<beta>\<in>\<alpha>. F`\<beta>" "\<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"] Aleph_rel_succ
       Aleph_rel_increasing[THEN leI, THEN [2] le_trans, of _ 0 z]
       Ord_0_lt_iff[THEN iffD1, of z]
     by (cases "0<z"; rule_tac lepoll_rel_imp_cardinal_rel_UN_le) (auto, force)
   moreover
   note \<open>z\<in>M\<close> \<open>Ord(z)\<close>
   moreover from \<open>\<forall>\<beta>\<in>\<alpha>. f`\<beta> \<in> F`\<beta>\<close> \<open>f \<in> surj\<^bsup>M[G]\<^esup>(\<alpha>, \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)\<close>
     \<open>\<alpha> \<in> M\<close> \<open>f \<in> M[G]\<close> and this
   have "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup> \<subseteq> (\<Union>\<beta>\<in>\<alpha>. F`\<beta>)"
     using ext.mem_surj_abs by (force simp add:surj_def)
   moreover from \<open>F \<in> M\<close> \<open>\<alpha> \<in> M\<close>
   have "(\<Union>x\<in>\<alpha>. F ` x) \<in> M"
     using j.B_replacement
     by (intro Union_closed[simplified] RepFun_closed[simplified])
       (auto dest:transM)
   ultimately
   have "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup> \<le> \<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"
     using subset_imp_le_cardinal_rel[of "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>" "\<Union>\<beta>\<in>\<alpha>. F`\<beta>"]
       le_trans by auto
   with assms
   show "False"
     using Aleph_rel_increasing not_le_iff_lt[of "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>" "\<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"]
       Card_rel_Aleph_rel[THEN Card_rel_is_Ord]
     by auto
 qed
 
 end \<comment> \<open>bundle G\_generic1\_lemmas\<close>
 
-end \<comment> \<open>\<^locale>\<open>G_generic4_AC\<close>\<close>
+end \<comment> \<open>\<^locale>\<open>G_generic3_AC\<close>\<close>
 
 context M_ctm1
 begin
 
 abbreviation
   Add :: "i" where
   "Add \<equiv> Fn(\<omega>, \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<times> \<omega>, 2)"
 
 end \<comment> \<open>\<^locale>\<open>M_ctm1\<close>\<close>
 
-locale add_generic4 = G_generic4_AC "Fn(\<omega>, \<aleph>\<^bsub>2\<^esub>\<^bsup>##M\<^esup> \<times> \<omega>, 2)" "Fnle(\<omega>, \<aleph>\<^bsub>2\<^esub>\<^bsup>##M\<^esup> \<times> \<omega>, 2)" 0
+locale add_generic3 = G_generic3_AC "Fn(\<omega>, \<aleph>\<^bsub>2\<^esub>\<^bsup>##M\<^esup> \<times> \<omega>, 2)" "Fnle(\<omega>, \<aleph>\<^bsub>2\<^esub>\<^bsup>##M\<^esup> \<times> \<omega>, 2)" 0
 
-sublocale add_generic4 \<subseteq> cohen_data \<omega> "\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<times> \<omega>" 2 by unfold_locales auto
+sublocale add_generic3 \<subseteq> cohen_data \<omega> "\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<times> \<omega>" 2 by unfold_locales auto
 
-context add_generic4
+context add_generic3
 begin
 
 notation Leq (infixl "\<preceq>" 50)
 notation Incompatible (infixl "\<bottom>" 50)
 
 lemma Add_subs_preserves_Aleph_succ: "Ord(z) \<Longrightarrow> z\<in>M \<Longrightarrow> Card\<^bsup>M[G]\<^esup>(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)"
   using ccc_preserves_Aleph_succ ccc_Add_subs_Aleph_2
   by auto
 
 lemma Aleph_rel_nats_MG_eq_Aleph_rel_nats_M:
   includes G_generic1_lemmas
   assumes "z \<in> \<omega>"
   shows "\<aleph>\<^bsub>z\<^esub>\<^bsup>M[G]\<^esup> = \<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"
   using assms
 proof (induct)
   case 0
   show ?case
     by(rule trans[OF ext.Aleph_rel_zero Aleph_rel_zero[symmetric]])
 next
   case (succ z)
   then
   have "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup> \<le> \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M[G]\<^esup>"
     using Aleph_rel_le_Aleph_rel nat_into_M by simp
   moreover from \<open>z \<in> \<omega>\<close>
   have "\<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup> \<in> M[G]" "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup> \<in> M[G]"
     using nat_into_M by simp_all
   moreover from this and \<open>\<aleph>\<^bsub>z\<^esub>\<^bsup>M[G]\<^esup> = \<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>\<close> \<open>z \<in> \<omega>\<close>
   have "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M[G]\<^esup> \<le> \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>"
     using ext.Aleph_rel_succ nat_into_M
       Add_subs_preserves_Aleph_succ[THEN ext.csucc_rel_le, of z]
       Aleph_rel_increasing[of z "succ(z)"]
     by simp
   ultimately
   show ?case using le_anti_sym by blast
 qed
 
 abbreviation
   f_G :: "i" (\<open>f\<^bsub>G\<^esub>\<close>) where
   "f\<^bsub>G\<^esub> \<equiv> \<Union>G"
 
 abbreviation
   dom_dense :: "i \<Rightarrow> i" where
   "dom_dense(x) \<equiv> {p \<in> Add . x \<in> domain(p) }"
 
-declare (in M_ctm3_AC) Fn_nat_closed[simplified setclass_iff, simp, intro]
-declare (in M_ctm3_AC) Fnle_nat_closed[simp del, rule del,
+declare (in M_ctm2_AC) Fn_nat_closed[simplified setclass_iff, simp, intro]
+declare (in M_ctm2_AC) Fnle_nat_closed[simp del, rule del,
     simplified setclass_iff, simp, intro]
-declare (in M_ctm3_AC) cexp_rel_closed[simplified setclass_iff, simp, intro]
-declare (in G_generic4_AC) ext.cexp_rel_closed[simplified setclass_iff, simp, intro]
+declare (in M_ctm2_AC) cexp_rel_closed[simplified setclass_iff, simp, intro]
+declare (in G_generic3_AC) ext.cexp_rel_closed[simplified setclass_iff, simp, intro]
 
 lemma dom_dense_closed[intro,simp]: "x \<in> \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<times> \<omega> \<Longrightarrow> dom_dense(x) \<in> M"
   using separation_in_domain[of x] nat_into_M
   by (rule_tac separation_closed[simplified], blast dest:transM) simp
 
 lemma domain_f_G: assumes "x \<in> \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>" "y \<in> \<omega>"
   shows "\<langle>x, y\<rangle> \<in> domain(f\<^bsub>G\<^esub>)"
 proof -
   from assms
   have "Add = Fn\<^bsup>M\<^esup>(\<omega>,\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>\<times>\<omega>,2)"
     using Fn_nat_abs by auto
   moreover from this
   have "Fnle(\<omega>,\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>\<times>\<omega>,2) = Fnle\<^bsup>M\<^esup>(\<omega>,\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>\<times>\<omega>,2)"
     unfolding Fnle_rel_def Fnle_def by auto
   moreover from calculation assms
   have "dense(dom_dense(\<langle>x, y\<rangle>))"
     using dense_dom_dense[of "\<langle>x,y\<rangle>" "\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>\<times>\<omega>" \<omega>  2] InfCard_rel_nat
     unfolding dense_def by auto
   with assms
   obtain p where "p\<in>dom_dense(\<langle>x, y\<rangle>)" "p\<in>G"
     using M_generic_denseD[of "dom_dense(\<langle>x, y\<rangle>)"]
     by auto
   then
   show "\<langle>x, y\<rangle> \<in> domain(f\<^bsub>G\<^esub>)" by blast
 qed
 
 lemma f_G_funtype:
   includes G_generic1_lemmas
   shows "f\<^bsub>G\<^esub> : \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<times> \<omega> \<rightarrow> 2"
   using generic domain_f_G Pi_iff Un_filter_is_function generic
     subset_trans[OF filter_subset_notion Fn_nat_subset_Pow]
   by force
 
 lemma inj_dense_closed[intro,simp]:
   "w \<in> \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<Longrightarrow> x \<in> \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<Longrightarrow> inj_dense(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>,2,w,x) \<in> M"
   using transM[OF _ Aleph_rel2_closed] separation_conj separation_bex
     lam_replacement_product
     separation_in lam_replacement_fst lam_replacement_snd lam_replacement_constant
     lam_replacement_hcomp[OF lam_replacement_snd lam_replacement_restrict']
     separation_bex separation_conj
   by simp
 
 lemma Aleph_rel2_new_reals:
   assumes "w \<in> \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>" "x \<in> \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>" "w \<noteq> x"
   shows "(\<lambda>n\<in>\<omega>. f\<^bsub>G\<^esub> ` \<langle>w, n\<rangle>) \<noteq> (\<lambda>n\<in>\<omega>. f\<^bsub>G\<^esub> ` \<langle>x, n\<rangle>)"
 proof -
   have "0\<in>2" by auto
   with assms
   have "dense(inj_dense(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>,2,w,x))"
     unfolding dense_def using dense_inj_dense by auto
   with assms
   obtain p where "p\<in>inj_dense(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>,2,w,x)" "p\<in>G"
     using M_generic_denseD[of "inj_dense(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>,2,w,x)"]
     by blast
   then
   obtain n where "n \<in> \<omega>" "\<langle>\<langle>w, n\<rangle>, 1\<rangle> \<in> p" "\<langle>\<langle>x, n\<rangle>, 0\<rangle> \<in> p"
     by blast
   moreover from this and \<open>p\<in>G\<close>
   have "\<langle>\<langle>w, n\<rangle>, 1\<rangle> \<in> f\<^bsub>G\<^esub>" "\<langle>\<langle>x, n\<rangle>, 0\<rangle> \<in> f\<^bsub>G\<^esub>" by auto
   moreover from calculation
   have "f\<^bsub>G\<^esub> ` \<langle>w, n\<rangle> = 1" "f\<^bsub>G\<^esub> ` \<langle>x, n\<rangle> = 0"
     using f_G_funtype apply_equality
     by auto
   ultimately
   have "(\<lambda>n\<in>\<omega>. f\<^bsub>G\<^esub> ` \<langle>w, n\<rangle>) ` n \<noteq> (\<lambda>n\<in>\<omega>. f\<^bsub>G\<^esub> ` \<langle>x, n\<rangle>) ` n"
     by simp
   then
   show ?thesis by fastforce
 qed
 
 definition
   h_G :: "i" (\<open>h\<^bsub>G\<^esub>\<close>) where
   "h\<^bsub>G\<^esub> \<equiv> \<lambda>\<alpha>\<in>\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>. \<lambda>n\<in>\<omega>. f\<^bsub>G\<^esub>`\<langle>\<alpha>,n\<rangle>"
 
 lemma h_G_in_MG[simp]:
   includes G_generic1_lemmas
   shows "h\<^bsub>G\<^esub> \<in> M[G]"
   using ext.curry_closed[unfolded curry_def] G_in_MG
   unfolding h_G_def
   by simp
 
 lemma h_G_inj_Aleph_rel2_reals: "h\<^bsub>G\<^esub> \<in> inj\<^bsup>M[G]\<^esup>(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>, \<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2)"
   using Aleph_rel_sub_closed f_G_funtype G_in_MG Aleph_rel_sub_closed
     ext.curry_rel_exp[unfolded curry_def] ext.curry_closed[unfolded curry_def]
     ext.mem_function_space_rel_abs
   by (intro ext.mem_inj_abs[THEN iffD2],simp_all)
       (auto simp: inj_def h_G_def dest:Aleph_rel2_new_reals)
 
 lemma Aleph2_extension_le_continuum_rel:
   includes G_generic1_lemmas
   shows "\<aleph>\<^bsub>2\<^esub>\<^bsup>M[G]\<^esup> \<le> 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>"
 proof -
   have "\<aleph>\<^bsub>2\<^esub>\<^bsup>M[G]\<^esup> \<lesssim>\<^bsup>M[G]\<^esup> \<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2"
     using ext.def_lepoll_rel[of "\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>" "\<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2"]
       h_G_inj_Aleph_rel2_reals Aleph_rel_nats_MG_eq_Aleph_rel_nats_M
     by auto
   moreover from calculation
   have "\<aleph>\<^bsub>2\<^esub>\<^bsup>M[G]\<^esup> \<lesssim>\<^bsup>M[G]\<^esup> |\<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2|\<^bsup>M[G]\<^esup>"
     using ext.lepoll_rel_imp_lepoll_rel_cardinal_rel by simp
   ultimately
   have "|\<aleph>\<^bsub>2\<^esub>\<^bsup>M[G]\<^esup>|\<^bsup>M[G]\<^esup> \<le> 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>"
     using ext.lepoll_rel_imp_cardinal_rel_le[of "\<aleph>\<^bsub>2\<^esub>\<^bsup>M[G]\<^esup>" "\<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2",
         OF _ _ ext.function_space_rel_closed]
       ext.Aleph_rel_zero
     unfolding cexp_rel_def by simp
   then
   show "\<aleph>\<^bsub>2\<^esub>\<^bsup>M[G]\<^esup> \<le> 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>"
     using ext.Card_rel_Aleph_rel[of 2, THEN ext.Card_rel_cardinal_rel_eq]
     by simp
 qed
 
 lemma Aleph_rel_lt_continuum_rel: "\<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup> < 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>"
   using Aleph2_extension_le_continuum_rel
     ext.Aleph_rel_increasing[of 1 2] le_trans by auto
 
 corollary not_CH: "\<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup> \<noteq> 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>"
   using Aleph_rel_lt_continuum_rel by auto
 
-end \<comment> \<open>\<^locale>\<open>add_generic4\<close>\<close>
+end \<comment> \<open>\<^locale>\<open>add_generic3\<close>\<close>
 
 subsection\<open>Models of fragments of $\ZFC + \neg \CH$\<close>
 
 definition
   ContHyp :: "o" where
   "ContHyp \<equiv> \<aleph>\<^bsub>1\<^esub> = 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^esup>"
 
 relativize functional "ContHyp" "ContHyp_rel"
 notation ContHyp_rel (\<open>CH\<^bsup>_\<^esup>\<close>)
 relationalize "ContHyp_rel" "is_ContHyp"
 
 context M_ZF_library
 begin
 
 is_iff_rel for "ContHyp"
   using is_cexp_iff is_Aleph_iff[of 0] is_Aleph_iff[of 1]
   unfolding is_ContHyp_def ContHyp_rel_def
   by (auto simp del:setclass_iff) (rule rexI[of _ _ M, OF _ nonempty], auto)
 
 end \<comment> \<open>\<^locale>\<open>M_ZF_library\<close>\<close>
 
 synthesize "is_ContHyp" from_definition assuming "nonempty"
 arity_theorem for "is_ContHyp_fm"
 
 notation is_ContHyp_fm (\<open>\<cdot>CH\<cdot>\<close>)
 
 theorem ctm_of_not_CH:
   assumes
     "M \<approx> \<omega>" "Transset(M)" "M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}"
     "\<Phi> \<subseteq> formula" "M \<Turnstile> { \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>}"
   shows
     "\<exists>N.
       M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>} \<union> { \<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>} \<and>
       (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> (\<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N))"
 proof -
   from \<open>M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}\<close>
-  interpret M_ZFC4 M
-    using M_satT_overhead_imp_M_ZF4 unfolding overhead_notCH_def by force
+  interpret M_ZFC3 M
+    using M_satT_overhead_imp_M_ZF3 unfolding overhead_notCH_def by force
   from \<open>M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}\<close> \<open>Transset(M)\<close>
   interpret M_ZF_ground_notCH_trans M
     using M_satT_imp_M_ZF_ground_notCH_trans
     unfolding ZC_def by auto
   from \<open>M \<approx> \<omega>\<close>
   obtain enum where "enum \<in> bij(\<omega>,M)"
     using eqpoll_sym unfolding eqpoll_def by blast
   then
-  interpret M_ctm4_AC M enum by unfold_locales
+  interpret M_ctm3_AC M enum by unfold_locales
   interpret cohen_data \<omega> "\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<times> \<omega>" 2 by unfold_locales auto
   have "Add \<in> M" "Add_le(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>) \<in> M"
     using nat_into_M Aleph_rel_closed M_nat cartprod_closed Fn_nat_closed Fnle_nat_closed
     by simp_all
   then
   interpret forcing_data1 "Add" "Add_le(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>)" 0 M enum
     by unfold_locales simp_all
   obtain G where "M_generic(G)"
     using generic_filter_existence[OF one_in_P]
     by auto
   moreover from this
-  interpret add_generic4 M enum G by unfold_locales
+  interpret add_generic3 M enum G by unfold_locales
   have "\<not> (\<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup> = 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>)"
     using not_CH .
   then
   have "M[G], [] \<Turnstile> \<cdot>\<not>\<cdot>CH\<cdot>\<cdot>"
     using ext.is_ContHyp_iff
     by (simp add:ContHyp_rel_def)
   then
   have "M[G] \<Turnstile> ZC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>}"
     using ext.M_satT_ZC by auto
   moreover
   have "Transset(M[G])" using Transset_MG .
   moreover
   have "M \<subseteq> M[G]" using M_subset_MG[OF one_in_G] generic by simp
   moreover
   note \<open>M \<Turnstile> { \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>}\<close> \<open>\<Phi> \<subseteq> formula\<close>
   ultimately
   show ?thesis
     using Ord_MG_iff MG_eqpoll_nat satT_ground_repl_fm_imp_satT_ZF_replacement_fm[of \<Phi>]
     by (rule_tac x="M[G]" in exI, blast)
 qed
 
 lemma ZF_replacement_overhead_sub_ZFC: "{\<cdot>Replacement(p)\<cdot> . p \<in> overhead} \<subseteq> ZFC"
   using overhead_type unfolding ZFC_def ZF_def ZF_schemes_def by auto
 
 lemma ZF_replacement_overhead_notCH_sub_ZFC: "{\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH} \<subseteq> ZFC"
   using overhead_notCH_type unfolding ZFC_def ZF_def ZF_schemes_def by auto
 
 lemma ZF_replacement_overhead_CH_sub_ZFC: "{\<cdot>Replacement(p)\<cdot> . p \<in> overhead_CH} \<subseteq> ZFC"
   using overhead_CH_type unfolding ZFC_def ZF_def ZF_schemes_def by auto
 
 corollary ctm_ZFC_imp_ctm_not_CH:
   assumes
     "M \<approx> \<omega>" "Transset(M)" "M \<Turnstile> ZFC"
   shows
     "\<exists>N.
       M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZFC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>} \<and>
       (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> (\<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N))"
 proof-
   from assms
   have "\<exists>N.
       M \<subseteq> N \<and>
         N \<approx> \<omega> \<and>
         Transset(N) \<and>
         N \<Turnstile> ZC \<and> N \<Turnstile> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>} \<and> N \<Turnstile> {\<cdot>Replacement(x)\<cdot> . x \<in> formula} \<and> (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)"
     using ctm_of_not_CH[of M formula] satT_ZFC_imp_satT_ZC[of M]
       satT_mono[OF _ ground_repl_fm_sub_ZFC, of M]
       satT_mono[OF _ ZF_replacement_overhead_notCH_sub_ZFC, of M]
       satT_mono[OF _ ZF_replacement_fms_sub_ZFC, of M]
     by (simp add: satT_Un_iff)
   then
   obtain N where "N \<Turnstile> ZC" "N \<Turnstile> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>}" "N \<Turnstile> {\<cdot>Replacement(x)\<cdot> . x \<in> formula}"
     "M \<subseteq> N" "N \<approx> \<omega>" "Transset(N)" "(\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)"
     by auto
   moreover from this
   have "N \<Turnstile> ZFC"
     using satT_ZC_ZF_replacement_imp_satT_ZFC
     by auto
   moreover from this and \<open>N \<Turnstile> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>}\<close>
   have "N \<Turnstile> ZFC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>}"
     by auto
   ultimately
   show ?thesis by auto
 qed
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Proper_Extension.thy b/thys/Independence_CH/Proper_Extension.thy
--- a/thys/Independence_CH/Proper_Extension.thy
+++ b/thys/Independence_CH/Proper_Extension.thy
@@ -1,83 +1,84 @@
 section\<open>Separative notions and proper extensions\<close>
 theory Proper_Extension
   imports
     Names
 
 begin
 
 text\<open>The key ingredient to obtain a proper extension is to have
 a \<^emph>\<open>separative preorder\<close>:\<close>
 
 locale separative_notion = forcing_notion +
   assumes separative: "p\<in>P \<Longrightarrow> \<exists>q\<in>P. \<exists>r\<in>P. q \<preceq> p \<and> r \<preceq> p \<and> q \<bottom> r"
 begin
 
 text\<open>For separative preorders, the complement of every filter is
 dense. Hence an $M$-generic filter cannot belong to the ground model.\<close>
 
 lemma filter_complement_dense:
   assumes "filter(G)"
   shows "dense(P - G)"
 proof
   fix p
   assume "p\<in>P"
   show "\<exists>d\<in>P - G. d \<preceq> p"
   proof (cases "p\<in>G")
     case True
     note \<open>p\<in>P\<close> assms
     moreover
     obtain q r where "q \<preceq> p" "r \<preceq> p" "q \<bottom> r" "q\<in>P" "r\<in>P"
       using separative[OF \<open>p\<in>P\<close>]
       by force
     with \<open>filter(G)\<close>
     obtain s where "s \<preceq> p" "s \<notin> G" "s \<in> P"
       using filter_imp_compat[of G q r]
       by auto
     then
     show ?thesis
       by blast
   next
     case False
     with \<open>p\<in>P\<close>
     show ?thesis
       using refl_leq unfolding Diff_def by auto
   qed
 qed
 
 end \<comment> \<open>\<^locale>\<open>separative_notion\<close>\<close>
-locale ctm_separative = forcing_data2 + separative_notion
+
+locale ctm_separative = forcing_data1 + separative_notion
 begin
 
 context
   fixes G
   assumes generic: "M_generic(G)"
 begin
 
 interpretation G_generic1 P leq \<one> M enum G
   by unfold_locales (simp add:generic)
 
 lemma generic_not_in_M:
   shows "G \<notin> M"
 proof
   assume "G\<in>M"
   then
   have "P - G \<in> M"
     using Diff_closed by simp
   moreover
   have "\<not>(\<exists>q\<in>G. q \<in> P - G)" "(P - G) \<subseteq> P"
     unfolding Diff_def by auto
   moreover
   note generic
   ultimately
   show "False"
     using filter_complement_dense[of G] M_generic_denseD[of "P-G"]
     by auto
 qed
 
 theorem proper_extension: "M \<noteq> M[G]"
   using generic G_in_Gen_Ext one_in_G generic_not_in_M
   by force
 end
 end \<comment> \<open>\<^locale>\<open>ctm_separative\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Replacement_Instances.thy b/thys/Independence_CH/Replacement_Instances.thy
--- a/thys/Independence_CH/Replacement_Instances.thy
+++ b/thys/Independence_CH/Replacement_Instances.thy
@@ -1,1367 +1,1301 @@
 section\<open>More Instances of Replacement\<close>
 
 theory Replacement_Instances
   imports
     Separation_Instances
     Transitive_Models.Pointed_DC_Relative
 begin
 
 lemma composition_fm_type[TC]: "a0 \<in> \<omega> \<Longrightarrow> a1 \<in> \<omega> \<Longrightarrow> a2 \<in> \<omega> \<Longrightarrow>
    composition_fm(a0,a1,a2) \<in> formula"
   unfolding composition_fm_def by simp
 
 arity_theorem for "composition_fm"
 
 definition is_omega_funspace :: "[i\<Rightarrow>o,i,i,i]\<Rightarrow>o" where
   "is_omega_funspace(N,B,n,z) \<equiv>  \<exists>o[N]. omega(N,o) \<and> n\<in>o \<and> is_funspace(N, n, B, z)"
 
 synthesize "omega_funspace" from_definition "is_omega_funspace" assuming "nonempty"
 arity_theorem for "omega_funspace_fm"
 
 definition HAleph_wfrec_repl_body where
   "HAleph_wfrec_repl_body(N,mesa,x,z) \<equiv> \<exists>y[N].
                    pair(N, x, y, z) \<and>
                    (\<exists>g[N].
                        (\<forall>u[N].
                            u \<in> g \<longleftrightarrow>
                            (\<exists>a[N].
                                \<exists>y[N].
                                   \<exists>ax[N].
                                      \<exists>sx[N].
                                         \<exists>r_sx[N].
                                            \<exists>f_r_sx[N].
                                               pair(N, a, y, u) \<and>
                                               pair(N, a, x, ax) \<and>
                                               upair(N, a, a, sx) \<and>
                                               pre_image(N, mesa, sx, r_sx) \<and>
       restriction(N, g, r_sx, f_r_sx) \<and> ax \<in> mesa \<and> is_HAleph(N, a, f_r_sx, y))) \<and>
                        is_HAleph(N, x, g, y))"
 
 (* MOVE THIS to an appropriate place *)
 arity_theorem for "ordinal_fm"
 arity_theorem for "is_Limit_fm"
 arity_theorem for "empty_fm"
 arity_theorem for "fun_apply_fm"
 
 synthesize "HAleph_wfrec_repl_body" from_definition assuming "nonempty"
 arity_theorem for "HAleph_wfrec_repl_body_fm"
 
 definition dcwit_repl_body where
   "dcwit_repl_body(N,mesa,A,a,s,R) \<equiv> \<lambda>x z. \<exists>y[N]. pair(N, x, y, z) \<and>
                                 is_wfrec
                                  (N, \<lambda>n f. is_nat_case
                                              (N, a,
                                               \<lambda>m bmfm.
                                                  \<exists>fm[N].
                                                     \<exists>cp[N].
                                                        is_apply(N, f, m, fm) \<and>
                                                        is_Collect(N, A, \<lambda>x. \<exists>fmx[N]. (N(x) \<and> fmx \<in> R) \<and> pair(N, fm, x, fmx), cp) \<and>
                                                        is_apply(N, s, cp, bmfm),
                                               n),
                                   mesa, x, y)"
 
 manual_schematic for "dcwit_repl_body" assuming "nonempty"
   unfolding dcwit_repl_body_def
   by (rule iff_sats is_nat_case_iff_sats is_eclose_iff_sats sep_rules | simp)+
 
 synthesize "dcwit_repl_body" from_schematic
 
 definition dcwit_aux_fm where
   "dcwit_aux_fm(A,s,R) \<equiv> (\<cdot>\<exists>\<cdot>\<cdot>4`2 is 0\<cdot> \<and>
                (\<cdot>\<exists>\<cdot>Collect_fm
                    (succ(succ(succ(succ(succ(succ(succ(succ(succ(succ(A)))))))))),
                     (\<cdot>\<exists>\<cdot>\<cdot>0 \<in>
                        succ(succ(succ(succ(succ(succ(succ(succ(succ(succ(succ(succ(R)))))))))))) \<cdot> \<and>
                        pair_fm(3, 1, 0) \<cdot>\<cdot>),
                     0) \<and>
                   \<cdot> succ(succ(succ(succ(succ(succ(succ(succ(succ(succ(s))))))))))`0 is 2\<cdot>\<cdot>\<cdot>)\<cdot>\<cdot>)"
 
 arity_theorem for "dcwit_aux_fm"
 
 lemma dcwit_aux_fm_type[TC]: "A \<in> \<omega> \<Longrightarrow> s \<in> \<omega> \<Longrightarrow> R \<in> \<omega> \<Longrightarrow> dcwit_aux_fm(A,s,R) \<in> formula"
   by (simp_all add: dcwit_aux_fm_def)
 
 definition is_nat_case_dcwit_aux_fm where
   "is_nat_case_dcwit_aux_fm(A,a,s,R) \<equiv> is_nat_case_fm
            (succ(succ(succ(succ(succ(succ(a)))))),dcwit_aux_fm(A,s,R),
             2, 0)"
 
 lemma is_nat_case_dcwit_aux_fm_type[TC]: "A \<in> \<omega> \<Longrightarrow> a \<in> \<omega> \<Longrightarrow> s \<in> \<omega> \<Longrightarrow> R \<in> \<omega> \<Longrightarrow> is_nat_case_dcwit_aux_fm(A,a,s,R) \<in> formula"
   by (simp_all add: is_nat_case_dcwit_aux_fm_def)
 
 manual_arity for "is_nat_case_dcwit_aux_fm"
   unfolding is_nat_case_dcwit_aux_fm_def
   by (rule arity_dcwit_aux_fm[THEN [6] arity_is_nat_case_fm]) simp_all
 
 manual_arity for "dcwit_repl_body_fm"
   using arity_is_nat_case_dcwit_aux_fm[THEN [6] arity_is_wfrec_fm]
   unfolding dcwit_repl_body_fm_def  is_nat_case_dcwit_aux_fm_def dcwit_aux_fm_def
   by (auto simp add: arity(1-33))
 
 lemma arity_dcwit_repl_body: "arity(dcwit_repl_body_fm(6,5,4,3,2,0,1)) = 7"
   by (simp_all add: FOL_arities arity_dcwit_repl_body_fm ord_simp_union)
 
 definition fst2_snd2
   where "fst2_snd2(x) \<equiv> \<langle>fst(fst(x)), snd(snd(x))\<rangle>"
 
 relativize functional "fst2_snd2" "fst2_snd2_rel"
 relationalize "fst2_snd2_rel" "is_fst2_snd2"
 
 lemma (in M_trivial) fst2_snd2_abs:
   assumes "M(x)" "M(res)"
   shows "is_fst2_snd2(M, x, res) \<longleftrightarrow> res = fst2_snd2(x)"
   unfolding is_fst2_snd2_def fst2_snd2_def
   using fst_rel_abs snd_rel_abs fst_abs snd_abs assms
   by simp
 
 synthesize "is_fst2_snd2" from_definition assuming "nonempty"
 arity_theorem for "is_fst2_snd2_fm"
 
 definition sndfst_fst2_snd2
   where "sndfst_fst2_snd2(x) \<equiv> \<langle>snd(fst(x)), fst(fst(x)), snd(snd(x))\<rangle>"
 
 relativize functional "sndfst_fst2_snd2" "sndfst_fst2_snd2_rel"
 relationalize "sndfst_fst2_snd2_rel" "is_sndfst_fst2_snd2"
 synthesize "is_sndfst_fst2_snd2" from_definition assuming "nonempty"
 arity_theorem for "is_sndfst_fst2_snd2_fm"
 
 definition order_eq_map where
   "order_eq_map(M,A,r,a,z) \<equiv> \<exists>x[M]. \<exists>g[M]. \<exists>mx[M]. \<exists>par[M].
              ordinal(M,x) & pair(M,a,x,z) & membership(M,x,mx) &
              pred_set(M,A,a,r,par) & order_isomorphism(M,par,r,x,mx,g)"
 
 synthesize "order_eq_map" from_definition assuming "nonempty"
 arity_theorem for "is_ord_iso_fm"
 arity_theorem for "order_eq_map_fm"
 
 (* Banach *)
 synthesize "is_banach_functor" from_definition assuming "nonempty"
 arity_theorem for "is_banach_functor_fm"
 
 definition banach_body_iterates where
   "banach_body_iterates(M,X,Y,f,g,W,n,x,z) \<equiv>
 \<exists>y[M].
                    pair(M, x, y, z) \<and>
                    (\<exists>fa[M].
                        (\<forall>z[M].
                            z \<in> fa \<longleftrightarrow>
                            (\<exists>xa[M].
                                \<exists>y[M].
                                   \<exists>xaa[M].
                                      \<exists>sx[M].
                                         \<exists>r_sx[M].
                                            \<exists>f_r_sx[M]. \<exists>sn[M]. \<exists>msn[M]. successor(M,n,sn) \<and>
                                               membership(M,sn,msn) \<and>
                                               pair(M, xa, y, z) \<and>
                                               pair(M, xa, x, xaa) \<and>
                                               upair(M, xa, xa, sx) \<and>
                                               pre_image(M, msn, sx, r_sx) \<and>
                                               restriction(M, fa, r_sx, f_r_sx) \<and>
                                               xaa \<in> msn \<and>
                                               (empty(M, xa) \<longrightarrow> y = W) \<and>
                                               (\<forall>m[M].
                                                   successor(M, m, xa) \<longrightarrow>
                                                   (\<exists>gm[M].
                                                       is_apply(M, f_r_sx, m, gm) \<and> is_banach_functor(M, X, Y, f, g, gm, y))) \<and>
                                               (is_quasinat(M, xa) \<or> empty(M, y)))) \<and>
                        (empty(M, x) \<longrightarrow> y = W) \<and>
                        (\<forall>m[M].
                            successor(M, m, x) \<longrightarrow>
                            (\<exists>gm[M]. is_apply(M, fa, m, gm) \<and> is_banach_functor(M, X, Y, f, g, gm, y))) \<and>
                        (is_quasinat(M, x) \<or> empty(M, y)))"
 
 synthesize "is_quasinat" from_definition assuming "nonempty"
 arity_theorem for "is_quasinat_fm"
 
 synthesize "banach_body_iterates" from_definition assuming "nonempty"
 arity_theorem for "banach_body_iterates_fm"
 
 definition banach_is_iterates_body where
   "banach_is_iterates_body(M,X,Y,f,g,W,n,y) \<equiv> \<exists>om[M]. omega(M,om) \<and> n \<in> om \<and>
              (\<exists>sn[M].
                  \<exists>msn[M].
                     successor(M, n, sn) \<and>
                     membership(M, sn, msn) \<and>
                     (\<exists>fa[M].
                         (\<forall>z[M].
                             z \<in> fa \<longleftrightarrow>
                             (\<exists>x[M].
                                 \<exists>y[M].
                                    \<exists>xa[M].
                                       \<exists>sx[M].
                                          \<exists>r_sx[M].
                                             \<exists>f_r_sx[M].
                                                pair(M, x, y, z) \<and>
                                                pair(M, x, n, xa) \<and>
                                                upair(M, x, x, sx) \<and>
                                                pre_image(M, msn, sx, r_sx) \<and>
                                                restriction(M, fa, r_sx, f_r_sx) \<and>
                                                xa \<in> msn \<and>
                                                (empty(M, x) \<longrightarrow> y = W) \<and>
                                                (\<forall>m[M].
                                                    successor(M, m, x) \<longrightarrow>
                                                    (\<exists>gm[M].
                                                        fun_apply(M, f_r_sx, m, gm) \<and> is_banach_functor(M, X, Y, f, g, gm, y))) \<and>
                                                (is_quasinat(M, x) \<or> empty(M, y)))) \<and>
                         (empty(M, n) \<longrightarrow> y = W) \<and>
                         (\<forall>m[M].
                             successor(M, m, n) \<longrightarrow>
                             (\<exists>gm[M]. fun_apply(M, fa, m, gm) \<and> is_banach_functor(M, X, Y, f, g, gm, y))) \<and>
                         (is_quasinat(M, n) \<or> empty(M, y))))"
 
 synthesize "banach_is_iterates_body" from_definition assuming "nonempty"
 arity_theorem for "banach_is_iterates_body_fm"
 
 (* (##M)(f) \<Longrightarrow> strong_replacement(##M, \<lambda>x y. y = \<langle>x, transrec(x, \<lambda>a g. f ` (g `` a))\<rangle>) *)
 
 definition trans_apply_image where
   "trans_apply_image(f) \<equiv> \<lambda>a g. f ` (g `` a)"
 
 relativize functional "trans_apply_image" "trans_apply_image_rel"
 relationalize "trans_apply_image" "is_trans_apply_image"
 
 (* MOVE THIS to an appropriate place *)
 schematic_goal arity_is_recfun_fm[arity]:
   "p \<in> formula \<Longrightarrow> a \<in> \<omega> \<Longrightarrow> z \<in> \<omega> \<Longrightarrow> r \<in> \<omega> \<Longrightarrow> arity(is_recfun_fm(p, a, z ,r)) = ?ar"
   unfolding is_recfun_fm_def
   by (simp add:arity) (* clean simpset from arities, use correct attrib *)
     (* Don't know why it doesn't use the theorem at \<^file>\<open>Arities\<close> *)
 schematic_goal arity_is_wfrec_fm[arity]:
   "p \<in> formula \<Longrightarrow> a \<in> \<omega> \<Longrightarrow> z \<in> \<omega> \<Longrightarrow> r \<in> \<omega> \<Longrightarrow> arity(is_wfrec_fm(p, a, z ,r)) = ?ar"
   unfolding is_wfrec_fm_def
   by (simp add:arity)
 schematic_goal arity_is_transrec_fm[arity]:
   "p \<in> formula \<Longrightarrow> a \<in> \<omega> \<Longrightarrow> z \<in> \<omega> \<Longrightarrow> arity(is_transrec_fm(p, a, z)) = ?ar"
   unfolding is_transrec_fm_def
   by (simp add:arity)
 
 synthesize "is_trans_apply_image" from_definition assuming "nonempty"
 arity_theorem for "is_trans_apply_image_fm"
 
 
 definition transrec_apply_image_body where
   "transrec_apply_image_body(M,f,mesa,x,z) \<equiv>  \<exists>y[M]. pair(M, x, y, z) \<and>
                                 (\<exists>fa[M].
                                     (\<forall>z[M].
                                         z \<in> fa \<longleftrightarrow>
                                         (\<exists>xa[M].
                                             \<exists>y[M].
                                                \<exists>xaa[M].
                                                   \<exists>sx[M].
                                                      \<exists>r_sx[M].
                                                         \<exists>f_r_sx[M].
                                                            pair(M, xa, y, z) \<and>
                                                            pair(M, xa, x, xaa) \<and>
                                                            upair(M, xa, xa, sx) \<and>
                                                            pre_image(M, mesa, sx, r_sx) \<and>
                                                            restriction(M, fa, r_sx, f_r_sx) \<and>
                                                            xaa \<in> mesa \<and> is_trans_apply_image(M, f, xa, f_r_sx, y))) \<and>
                                     is_trans_apply_image(M, f, x, fa, y))"
 
 synthesize "transrec_apply_image_body" from_definition assuming "nonempty"
 arity_theorem for "transrec_apply_image_body_fm"
 
  definition is_trans_apply_image_body where
   "is_trans_apply_image_body(M,f,\<beta>,a,w) \<equiv> \<exists>z[M]. pair(M,a,z,w) \<and> a\<in>\<beta> \<and> (\<exists>sa[M].
                  \<exists>esa[M].
                     \<exists>mesa[M].
                       upair(M, a, a, sa) \<and>
                        is_eclose(M, sa, esa) \<and>
                       membership(M, esa, mesa) \<and>
                       (\<exists>fa[M].
                           (\<forall>z[M].
                               z \<in> fa \<longleftrightarrow>
                               (\<exists>x[M].
                                   \<exists>y[M].
                                      \<exists>xa[M].
                                         \<exists>sx[M].
                                            \<exists>r_sx[M].
                                               \<exists>f_r_sx[M].
                                                  pair(M, x, y, z) \<and>
                                                  pair(M, x, a, xa) \<and>
                                                  upair(M, x, x, sx) \<and>
                                                  pre_image(M, mesa, sx, r_sx) \<and>
                                                  restriction(M, fa, r_sx, f_r_sx) \<and>
                                                  xa \<in> mesa \<and> is_trans_apply_image(M, f, x, f_r_sx, y))) \<and>
                           is_trans_apply_image(M, f, a, fa, z)))"
 
 
 synthesize "is_trans_apply_image_body" from_definition assuming "nonempty"
 arity_theorem for "is_trans_apply_image_body_fm"
 
 definition replacement_is_omega_funspace_fm where "replacement_is_omega_funspace_fm \<equiv>  omega_funspace_fm(2,0,1)"
 definition replacement_HAleph_wfrec_repl_body_fm where "replacement_HAleph_wfrec_repl_body_fm \<equiv>  HAleph_wfrec_repl_body_fm(2,0,1)"
 definition replacement_is_fst2_snd2_fm where "replacement_is_fst2_snd2_fm \<equiv>  is_fst2_snd2_fm(0,1)"
 definition replacement_is_sndfst_fst2_snd2_fm where "replacement_is_sndfst_fst2_snd2_fm \<equiv>  is_sndfst_fst2_snd2_fm(0,1)"
 definition replacement_is_order_eq_map_fm where "replacement_is_order_eq_map_fm \<equiv>  order_eq_map_fm(2,3,0,1)"
 definition replacement_transrec_apply_image_body_fm where "replacement_transrec_apply_image_body_fm \<equiv>  transrec_apply_image_body_fm(3,2,0,1)"
 definition banach_replacement_iterates_fm where "banach_replacement_iterates_fm \<equiv> banach_is_iterates_body_fm(6,5,4,3,2,0,1)"
 definition replacement_is_trans_apply_image_fm where "replacement_is_trans_apply_image_fm \<equiv> is_trans_apply_image_body_fm(3,2,0,1)"
 (* definition banach_iterates_fm where "banach_iterates_fm \<equiv> banach_body_iterates_fm(7,6,5,4,3,2,0,1)" *)
 definition replacement_dcwit_repl_body_fm where "replacement_dcwit_repl_body_fm \<equiv> dcwit_repl_body_fm(6,5,4,3,2,0,1)"
 
-locale M_ZF2 = M_ZF1 +
-  assumes
-    replacement_ax2:
-    "replacement_assm(M,env,replacement_HAleph_wfrec_repl_body_fm)"
-    "replacement_assm(M,env,replacement_is_order_eq_map_fm)"
-
-definition instances2_fms where "instances2_fms \<equiv>
-  { replacement_HAleph_wfrec_repl_body_fm,
-    replacement_is_order_eq_map_fm }"
-
-text\<open>This set has 12 internalized formulas.\<close>
-
-lemmas replacement_instances2_defs =
-  replacement_HAleph_wfrec_repl_body_fm_def
-  replacement_is_order_eq_map_fm_def
-  (* banach_iterates_fm_def *)
-
-declare (in M_ZF2) replacement_instances2_defs [simp]
-
-lemma instances2_fms_type[TC]: "instances2_fms \<subseteq> formula"
-  unfolding replacement_instances2_defs instances2_fms_def
-  by (simp del:Lambda_in_M_fm_def)
-
-locale M_ZF2_trans = M_ZF1_trans + M_ZF2
-
 text\<open>The following instances are needed only on the ground model. The
 first one corresponds to the recursive definition of forces for atomic
 formulas; the next two corresponds to \<^term>\<open>PHcheck\<close>; the following
 is used to get a generic filter using some form of choice.\<close>
 
-locale M_ZF_ground = M_ZF2 +
+locale M_ZF_ground = M_ZF1 +
   assumes
     ZF_ground_replacements:
     "replacement_assm(M,env,wfrec_Hfrc_at_fm)"
     "replacement_assm(M,env,wfrec_Hcheck_fm)"
     "replacement_assm(M,env,Lambda_in_M_fm(check_fm(2,0,1),1))"
 
-locale M_ZF_ground_trans = M_ZF2_trans + M_ZF_ground
+locale M_ZF_ground_trans = M_ZF1_trans + M_ZF_ground
 
 definition instances_ground_fms where "instances_ground_fms \<equiv>
   { wfrec_Hfrc_at_fm,
     wfrec_Hcheck_fm,
     Lambda_in_M_fm(check_fm(2,0,1),1) }"
 
 lemmas replacement_instances_ground_defs =
   wfrec_Hfrc_at_fm_def wfrec_Hcheck_fm_def
 
 declare (in M_ZF_ground) replacement_instances_ground_defs [simp]
 
 lemma instances_ground_fms_type[TC]: "instances_ground_fms \<subseteq> formula"
   using Lambda_in_M_fm_type
   unfolding instances_ground_fms_def replacement_instances_ground_defs
   by simp
 
 locale M_ZF_ground_notCH = M_ZF_ground +
   assumes
     ZF_ground_notCH_replacements:
     "replacement_assm(M,env,replacement_transrec_apply_image_body_fm)"
     "replacement_assm(M,env,replacement_is_trans_apply_image_fm)"
 
 definition instances_ground_notCH_fms where "instances_ground_notCH_fms \<equiv>
   { replacement_transrec_apply_image_body_fm,
     replacement_is_trans_apply_image_fm }"
 
 lemma instances_ground_notCH_fms_type[TC]: "instances_ground_notCH_fms \<subseteq> formula"
   unfolding instances_ground_notCH_fms_def replacement_transrec_apply_image_body_fm_def
     replacement_is_trans_apply_image_fm_def
   by simp
 
 declare (in M_ZF_ground_notCH) replacement_transrec_apply_image_body_fm_def[simp]
   replacement_is_trans_apply_image_fm_def[simp]
 
 locale M_ZF_ground_notCH_trans = M_ZF_ground_trans + M_ZF_ground_notCH
 
 locale M_ZF_ground_CH = M_ZF_ground_notCH +
   assumes
     dcwit_replacement: "replacement_assm(M,env,replacement_dcwit_repl_body_fm)"
 
 declare (in M_ZF_ground_CH) replacement_dcwit_repl_body_fm_def [simp]
 
 locale M_ZF_ground_CH_trans = M_ZF_ground_notCH_trans + M_ZF_ground_CH
 
-locale M_ZFC2 = M_ZFC1 + M_ZF2
-
-locale M_ZFC2_trans = M_ZFC1_trans + M_ZF2_trans + M_ZFC2
-
-locale M_ctm1 = M_ZF1_trans +
+locale M_ctm1 = M_ZF1_trans + M_ZF_ground_trans +
   fixes enum
   assumes M_countable:      "enum\<in>bij(nat,M)"
 
 locale M_ctm1_AC = M_ctm1 + M_ZFC1_trans
 
-locale M_ctm2 = M_ctm1 + M_ZF_ground_trans
-
-locale M_ctm2_AC = M_ctm2 + M_ZFC2_trans
-
-context M_ZF2_trans
+context M_ZF_ground_CH_trans
 begin
 
-lemma replacement_HAleph_wfrec_repl_body:
-  "B\<in>M \<Longrightarrow> strong_replacement(##M, HAleph_wfrec_repl_body(##M,B))"
-  using strong_replacement_rel_in_ctm[where \<phi>="HAleph_wfrec_repl_body_fm(2,0,1)" and env="[B]"]
-    zero_in_M arity_HAleph_wfrec_repl_body_fm replacement_ax2(1) ord_simp_union
-  by simp
-
-lemma HAleph_wfrec_repl:
-  "(##M)(sa) \<Longrightarrow>
-        (##M)(esa) \<Longrightarrow>
-        (##M)(mesa) \<Longrightarrow>
-        strong_replacement
-         (##M,
-          \<lambda>x z. \<exists>y[##M].
-                   pair(##M, x, y, z) \<and>
-                   (\<exists>f[##M].
-                       (\<forall>z[##M].
-                           z \<in> f \<longleftrightarrow>
-                           (\<exists>xa[##M].
-                               \<exists>y[##M].
-                                  \<exists>xaa[##M].
-                                     \<exists>sx[##M].
-                                        \<exists>r_sx[##M].
-                                           \<exists>f_r_sx[##M].
-                                              pair(##M, xa, y, z) \<and>
-                                              pair(##M, xa, x, xaa) \<and>
-                                              upair(##M, xa, xa, sx) \<and>
-                                              pre_image(##M, mesa, sx, r_sx) \<and> restriction(##M, f, r_sx, f_r_sx) \<and> xaa \<in> mesa \<and> is_HAleph(##M, xa, f_r_sx, y))) \<and>
-                       is_HAleph(##M, x, f, y)))"
-  using replacement_HAleph_wfrec_repl_body unfolding HAleph_wfrec_repl_body_def by simp
-
-
-lemma (in M_ZF_ground_CH_trans) replacement_dcwit_repl_body:
+lemma replacement_dcwit_repl_body:
   "(##M)(mesa) \<Longrightarrow> (##M)(A) \<Longrightarrow> (##M)(a) \<Longrightarrow> (##M)(s) \<Longrightarrow> (##M)(R) \<Longrightarrow>
    strong_replacement(##M, dcwit_repl_body(##M,mesa,A,a,s,R))"
   using strong_replacement_rel_in_ctm[where \<phi>="dcwit_repl_body_fm(6,5,4,3,2,0,1)"
       and env="[R,s,a,A,mesa]" and f="dcwit_repl_body(##M,mesa,A,a,s,R)"]
     zero_in_M arity_dcwit_repl_body dcwit_replacement
   unfolding replacement_dcwit_repl_body_fm_def
   by simp
 
-lemma (in M_ZF_ground_CH_trans) dcwit_repl:
+lemma dcwit_repl:
   "(##M)(sa) \<Longrightarrow>
         (##M)(esa) \<Longrightarrow>
         (##M)(mesa) \<Longrightarrow> (##M)(A) \<Longrightarrow> (##M)(a) \<Longrightarrow> (##M)(s) \<Longrightarrow> (##M)(R) \<Longrightarrow>
         strong_replacement
               ((##M), \<lambda>x z. \<exists>y[(##M)]. pair((##M), x, y, z) \<and>
                                 is_wfrec
                                  ((##M), \<lambda>n f. is_nat_case
                                              ((##M), a,
                                               \<lambda>m bmfm.
                                                  \<exists>fm[(##M)].
                                                     \<exists>cp[(##M)].
                                                        is_apply((##M), f, m, fm) \<and>
                                                        is_Collect((##M), A, \<lambda>x. \<exists>fmx[(##M)]. ((##M)(x) \<and> fmx \<in> R) \<and> pair((##M), fm, x, fmx), cp) \<and>
                                                        is_apply((##M), s, cp, bmfm),
                                               n),
                                   mesa, x, y))"
   using replacement_dcwit_repl_body unfolding dcwit_repl_body_def by simp
 
+end \<comment> \<open>\<^locale>\<open>M_ZF_ground_CH_trans\<close>\<close>
+
+context M_ZF1_trans
+begin
+
 lemmas M_replacement_ZF_instances = lam_replacement_fst lam_replacement_snd
   lam_replacement_Union lam_replacement_Image
   lam_replacement_middle_del lam_replacement_prodRepl
 
 lemmas M_separation_ZF_instances = separation_fstsnd_in_sndsnd separation_sndfst_eq_fstsnd
 
-lemma (in M_ZF1_trans) separation_is_dcwit_body:
+lemma separation_is_dcwit_body:
   assumes "(##M)(A)" "(##M)(a)" "(##M)(g)" "(##M)(R)"
   shows "separation(##M,is_dcwit_body(##M, A, a, g, R))"
   using assms separation_in_ctm[where env="[A,a,g,R]" and \<phi>="is_dcwit_body_fm(1,2,3,4,0)",
       OF _ _ _ is_dcwit_body_iff_sats[symmetric],
       of "\<lambda>_.A" "\<lambda>_.a" "\<lambda>_.g" "\<lambda>_.R" "\<lambda>x. x"]
     nonempty arity_is_dcwit_body_fm is_dcwit_body_fm_type
   by (simp add:ord_simp_union)
 
-end
+end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
-sublocale M_ZF2_trans \<subseteq> M_replacement "##M"
+sublocale M_ZF1_trans \<subseteq> M_replacement "##M"
   using M_replacement_ZF_instances M_separation_ZF_instances
   by unfold_locales simp
 
-context M_ZF2_trans
+context M_ZF1_trans
 begin
 
 lemma separation_Pow_rel: "A\<in>M \<Longrightarrow>
     separation(##M, \<lambda>y. \<exists>x \<in> M . x\<in>A \<and> y = \<langle>x, Pow\<^bsup>##M\<^esup>(x)\<rangle>)"
   using separation_assm_sats[of "is_Pow_fm(0,1)"] arity_is_Pow_fm ord_simp_union
     Pow_rel_closed nonempty Pow_rel_iff
   by simp
 
 lemma strong_replacement_Powapply_rel:
   "f\<in>M \<Longrightarrow> strong_replacement(##M, \<lambda>x y. y = Powapply\<^bsup>##M\<^esup>(f,x))"
   using Powapply_rel_replacement separation_Pow_rel transM
   by simp
 
-end
+end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
-sublocale M_ZF2_trans \<subseteq> M_Vfrom "##M"
+sublocale M_ZF1_trans \<subseteq> M_Vfrom "##M"
   using power_ax strong_replacement_Powapply_rel phrank_repl trans_repl_HVFrom wfrec_rank
   by unfold_locales auto
 
-sublocale M_ZF2_trans \<subseteq> M_Perm "##M"
+sublocale M_ZF1_trans \<subseteq> M_Perm "##M"
   using separation_PiP_rel separation_injP_rel separation_surjP_rel
     lam_replacement_imp_strong_replacement[OF
       lam_replacement_Sigfun[OF lam_replacement_constant]]
     Pi_replacement1 unfolding Sigfun_def
   by unfold_locales simp_all
 
-sublocale M_ZF2_trans \<subseteq> M_pre_seqspace "##M"
+sublocale M_ZF1_trans \<subseteq> M_pre_seqspace "##M"
   by unfold_locales
 
-context M_ZF2_trans
+context M_ZF1_trans
 begin
 
 lemma separation_inj_rel: "A\<in>M \<Longrightarrow>
      separation(##M, \<lambda>y. \<exists>x\<in>M. x \<in> A \<and> y = \<langle>x, inj_rel(##M,fst(x), snd(x))\<rangle>)"
   using arity_is_inj_fm ord_simp_union
     nonempty inj_rel_closed[simplified] inj_rel_iff[simplified]
   by (rule_tac separation_assm_bin_sats[of "is_inj_fm(0,1,2)"])
     (simp_all add:setclass_def)
 
 lemma lam_replacement_inj_rel: "lam_replacement(##M, \<lambda>x . inj_rel(##M,fst(x),snd(x)))"
   using lam_replacement_inj_rel' separation_inj_rel
   by simp
 
-lemma replacement_is_order_eq_map:
-  "A\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> strong_replacement(##M, order_eq_map(##M,A,r))"
-  using strong_replacement_rel_in_ctm[where \<phi>="order_eq_map_fm(2,3,0,1)" and env="[A,r]"  and f="order_eq_map(##M,A,r)"]
-    order_eq_map_iff_sats[where env="[_,_,A,r]"] zero_in_M fst_snd_closed pair_in_M_iff
-    arity_order_eq_map_fm ord_simp_union replacement_ax2(2)
-  by simp
-
 (*
 
 These lemmas were required for the original proof of Schröder-Bernstein.
 
 lemma banach_iterates:
   assumes "X\<in>M" "Y\<in>M" "f\<in>M" "g\<in>M" "W\<in>M"
   shows "iterates_replacement(##M, is_banach_functor(##M,X,Y,f,g), W)"
 proof -
   have "strong_replacement(##M, \<lambda> x z . banach_body_iterates(##M,X,Y,f,g,W,n,x,z))" if "n\<in>\<omega>" for n
     using assms that arity_banach_body_iterates_fm ord_simp_union nat_into_M
       strong_replacement_rel_in_ctm[where \<phi>="banach_body_iterates_fm(7,6,5,4,3,2,0,1)"
         and env="[n,W,g,f,Y,X]"] replacement_ax2(3)
     by simp
   then
   show ?thesis
     using assms nat_into_M Memrel_closed
     unfolding iterates_replacement_def wfrec_replacement_def is_wfrec_def M_is_recfun_def
       is_nat_case_def iterates_MH_def banach_body_iterates_def
     by simp
 qed
 
 lemma separation_banach_functor_iterates:
   assumes "X\<in>M" "Y\<in>M" "f\<in>M" "g\<in>M" "A\<in>M"
   shows "separation(##M, \<lambda>b. \<exists>x\<in>A. x \<in> \<omega> \<and> b = banach_functor(X, Y, f, g)^x (0))"
 proof -
   have " (\<exists>xa\<in>M. xa \<in> A \<and> xa \<in> \<omega> \<and> banach_is_iterates_body(##M, X, Y, f, g, 0, xa, x)) \<longleftrightarrow>
          (\<exists>n\<in>A. n \<in> \<omega> \<and> banach_is_iterates_body(##M, X, Y, f, g, 0, n, x))" if "x\<in>M" for x
     using assms nat_into_M nat_in_M transM[of _ A] transM[of _ \<omega>] that
     by auto
   then
   have "separation(##M, \<lambda> z . \<exists>n\<in>A . n\<in>\<omega> \<and> banach_is_iterates_body(##M,X,Y,f,g,0,n,z))"
     using assms nat_into_M nat_in_M
       arity_banach_is_iterates_body_fm[of 6 5 4 3 2 0 1] ord_simp_union
       separation_in_ctm[where \<phi>="(\<cdot>\<exists> \<cdot>\<cdot>0\<in>7\<cdot> \<and> \<cdot>\<cdot>0\<in>8\<cdot> \<and> banach_is_iterates_body_fm(6,5,4,3,2,0,1) \<cdot>\<cdot>\<cdot>)"
         and env="[0,g,f,Y,X,A,\<omega>]"]
     by (simp add:arity_Exists arity_And)
   moreover from assms
   have "(\<exists>x\<in>A. x \<in> \<omega> \<and> is_iterates(##M,is_banach_functor(##M,X, Y, f, g),0,x,z)) \<longleftrightarrow>
           (\<exists>n\<in>A . n\<in>\<omega> \<and> banach_is_iterates_body(##M,X,Y,f,g,0,n,z))" if "z\<in>M" for z
     using nat_in_M nat_into_M transM[of _ A] transM[of _ \<omega>]
     unfolding is_iterates_def wfrec_replacement_def is_wfrec_def M_is_recfun_def
       is_nat_case_def iterates_MH_def banach_body_iterates_def banach_is_iterates_body_def
     by simp
   moreover from assms
   have "(\<exists>x\<in>A. x \<in> \<omega> \<and> is_iterates(##M,is_banach_functor(##M,X, Y, f, g),0,x,z)) \<longleftrightarrow>
           (\<exists>x\<in>A. x \<in> \<omega> \<and> z = banach_functor(X, Y, f, g)^x (0))" if "z\<in>M" for z
     using transM[of _ A] nat_in_M nat_into_M that
       iterates_abs[OF banach_iterates banach_functor_abs] banach_functor_closed
     by auto
   ultimately
   show ?thesis
     by(rule_tac separation_cong[THEN iffD2],auto)
 qed
 
 lemma banach_replacement:
   assumes "X\<in>M" "Y\<in>M" "f\<in>M" "g\<in>M"
   shows "strong_replacement(##M, \<lambda>n y. n\<in>nat \<and> y = banach_functor(X, Y, f, g)^n (0))"
   using assms banach_repl_iter' separation_banach_functor_iterates
   by simp
 
 *)
 
+end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
+
 lemma (in M_basic) rel2_trans_apply:
   "M(f) \<Longrightarrow> relation2(M,is_trans_apply_image(M,f),trans_apply_image(f))"
   unfolding is_trans_apply_image_def trans_apply_image_def relation2_def
   by auto
 
 lemma (in M_basic) apply_image_closed:
   shows "M(f) \<Longrightarrow> \<forall>x[M]. \<forall>g[M]. M(trans_apply_image(f, x, g))"
   unfolding trans_apply_image_def by simp
 
-end \<comment> \<open>\<^locale>\<open>M_ZF2_trans\<close>\<close>
-
 context M_ZF_ground_notCH_trans
 begin
 
 lemma replacement_transrec_apply_image_body :
   "(##M)(f) \<Longrightarrow> (##M)(mesa) \<Longrightarrow> strong_replacement(##M,transrec_apply_image_body(##M,f,mesa))"
   using strong_replacement_rel_in_ctm[where \<phi>="transrec_apply_image_body_fm(3,2,0,1)" and env="[mesa,f]"]
     zero_in_M arity_transrec_apply_image_body_fm ord_simp_union
     ZF_ground_notCH_replacements(1)
   by simp
 
 lemma transrec_replacement_apply_image:
   assumes "(##M)(f)" "(##M)(\<alpha>)"
   shows "transrec_replacement(##M, is_trans_apply_image(##M, f), \<alpha>)"
   using replacement_transrec_apply_image_body[unfolded transrec_apply_image_body_def] assms
     Memrel_closed singleton_closed eclose_closed
   unfolding transrec_replacement_def wfrec_replacement_def is_wfrec_def M_is_recfun_def
   by simp
 
 lemma rec_trans_apply_image_abs:
   assumes "(##M)(f)" "(##M)(x)" "(##M)(y)" "Ord(x)"
   shows "is_transrec(##M,is_trans_apply_image(##M, f),x,y) \<longleftrightarrow> y = transrec(x,trans_apply_image(f))"
   using transrec_abs[OF transrec_replacement_apply_image rel2_trans_apply] assms apply_image_closed
   by simp
 
 lemma replacement_is_trans_apply_image:
   "(##M)(f) \<Longrightarrow> (##M)(\<beta>) \<Longrightarrow> strong_replacement(##M, \<lambda> x z .
     \<exists>y[##M]. pair(##M,x,y,z) \<and> x\<in>\<beta> \<and> (is_transrec(##M,is_trans_apply_image(##M, f),x,y)))"
   unfolding is_transrec_def is_wfrec_def M_is_recfun_def
   apply(rule_tac strong_replacement_cong[
         where P="\<lambda> x z. M,[x,z,\<beta>,f] \<Turnstile> is_trans_apply_image_body_fm(3,2,0,1)",THEN iffD1])
    apply(rule_tac is_trans_apply_image_body_iff_sats[symmetric,unfolded is_trans_apply_image_body_def,where env="[_,_,\<beta>,f]"])
             apply(simp_all add:zero_in_M)
   apply(rule_tac ZF_ground_notCH_replacements(2)[unfolded replacement_assm_def, rule_format, where env="[\<beta>,f]",simplified])
     apply(simp_all add: arity_is_trans_apply_image_body_fm is_trans_apply_image_body_fm_type ord_simp_union)
   done
 
 lemma trans_apply_abs:
   "(##M)(f) \<Longrightarrow> (##M)(\<beta>) \<Longrightarrow> Ord(\<beta>) \<Longrightarrow> (##M)(x) \<Longrightarrow> (##M)(z) \<Longrightarrow>
     (x\<in>\<beta> \<and> z = \<langle>x, transrec(x, \<lambda>a g. f ` (g `` a)) \<rangle>) \<longleftrightarrow>
     (\<exists>y[##M]. pair(##M,x,y,z) \<and> x\<in>\<beta> \<and> (is_transrec(##M,is_trans_apply_image(##M, f),x,y)))"
   using rec_trans_apply_image_abs Ord_in_Ord
     transrec_closed[OF transrec_replacement_apply_image rel2_trans_apply,of f,simplified]
     apply_image_closed
   unfolding trans_apply_image_def
   by auto
 
 lemma replacement_trans_apply_image:
   "(##M)(f) \<Longrightarrow> (##M)(\<beta>) \<Longrightarrow> Ord(\<beta>) \<Longrightarrow>
   strong_replacement(##M, \<lambda>x y. x\<in>\<beta> \<and> y = \<langle>x, transrec(x, \<lambda>a g. f ` (g `` a))\<rangle>)"
   using strong_replacement_cong[THEN iffD1,OF _ replacement_is_trans_apply_image,simplified]
     trans_apply_abs Ord_in_Ord
   by simp
 
 end \<comment> \<open>\<^locale>\<open>M_ZF_ground_notCH_trans\<close>\<close>
 
 definition ifrFb_body where
   "ifrFb_body(M,b,f,x,i) \<equiv> x \<in>
   (if b = 0 then if i \<in> range(f) then
   if M(converse(f) ` i) then converse(f) ` i else 0 else 0 else if M(i) then i else 0)"
 
 relativize functional "ifrFb_body" "ifrFb_body_rel"
 relationalize "ifrFb_body_rel" "is_ifrFb_body"
 
 synthesize "is_ifrFb_body" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body_fm"
 
 definition ifrangeF_body :: "[i\<Rightarrow>o,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body(M,A,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body(M,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body" "ifrangeF_body_rel"
 relationalize "ifrangeF_body_rel" "is_ifrangeF_body"
 
 synthesize "is_ifrangeF_body" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body:
   "(##M)(A) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body(##M,A,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body_fm(1,2,3,0)" and env="[A,r,s]"]
     zero_in_M arity_is_ifrangeF_body_fm ord_simp_union is_ifrangeF_body_fm_type
   by simp
 
 lemma (in M_basic) is_ifrFb_body_closed: "M(r) \<Longrightarrow> M(s) \<Longrightarrow> is_ifrFb_body(M, r, s, x, i) \<Longrightarrow> M(i)"
   unfolding ifrangeF_body_def is_ifrangeF_body_def is_ifrFb_body_def If_abs
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_ZF1_trans) ifrangeF_body_abs:
   assumes "(##M)(A)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body(##M,A,r,s,x) \<longleftrightarrow> ifrangeF_body(##M,A,r,s,x)"
 proof -
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body(##M, r, s, z, i))= (\<mu> i. is_ifrFb_body(##M, r, s, z, i))" for z
       using is_ifrFb_body_closed[of r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body(##M,r,s,z,i)"]) auto
     moreover
     have "(\<mu> i. is_ifrFb_body(##M, r, s, z, i))= (\<mu> i. ifrFb_body(##M, r, s, z, i))" for z
     proof (rule_tac Least_cong[of "\<lambda>i. is_ifrFb_body(##M,r,s,z,i)" "\<lambda>i. ifrFb_body(##M,r,s,z,i)"])
       fix y
       from assms \<open>a\<in>M\<close>
       show "is_ifrFb_body(##M, r, s, z, y) \<longleftrightarrow> ifrFb_body(##M, r, s, z, y)"
         using If_abs apply_0
         unfolding ifrFb_body_def is_ifrFb_body_def
         by (cases "y\<in>M"; cases "y\<in>range(s)"; cases "converse(s)`y \<in> M";
             auto dest:transM split del: split_if del:iffI)
           (auto simp flip:setclass_iff; (force simp only:setclass_iff))+
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body(##M, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body(##M, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body(##M,r,s,z,i)" a]
       by simp
     ultimately
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body(##M, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body(##M, r, s, z,i))" for z
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body_def is_ifrangeF_body_def
     by (auto dest:transM)
 qed
 
 lemma (in M_ZF1_trans) separation_ifrangeF_body:
   "(##M)(A) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow> separation
         (##M, \<lambda>y.  \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>x. if (##M)(x) then x else 0, b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body ifrangeF_body_abs
     separation_cong[where P="is_ifrangeF_body(##M,A,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body_def if_range_F_def if_range_F_else_F_def ifrFb_body_def
   by simp
 
 (* (##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
     separation(##M,
       \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>a. if (##M)(a) then G`a else 0, b, f, i)\<rangle>) *)
 
 definition ifrFb_body2 where
   "ifrFb_body2(M,G,b,f,x,i) \<equiv> x \<in>
   (if b = 0 then if i \<in> range(f) then
   if M(converse(f) ` i) then G`(converse(f) ` i) else 0 else 0 else if M(i) then G`i else 0)"
 
 relativize functional "ifrFb_body2" "ifrFb_body2_rel"
 relationalize "ifrFb_body2_rel" "is_ifrFb_body2"
 
 synthesize "is_ifrFb_body2" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body2_fm"
 
 definition ifrangeF_body2 :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body2(M,A,G,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body2(M,G,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body2" "ifrangeF_body2_rel"
 relationalize "ifrangeF_body2_rel" "is_ifrangeF_body2"
 
 synthesize "is_ifrangeF_body2" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body2_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body2:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body2(##M,A,G,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body2_fm(1,2,3,4,0)" and env="[A,G,r,s]"]
     zero_in_M arity_is_ifrangeF_body2_fm ord_simp_union is_ifrangeF_body2_fm_type
   by simp
 
 lemma (in M_basic) is_ifrFb_body2_closed: "M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow> is_ifrFb_body2(M, G, r, s, x, i) \<Longrightarrow> M(i)"
   unfolding ifrangeF_body2_def is_ifrangeF_body2_def is_ifrFb_body2_def If_abs
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_ZF1_trans) ifrangeF_body2_abs:
   assumes "(##M)(A)" "(##M)(G)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body2(##M,A,G,r,s,x) \<longleftrightarrow> ifrangeF_body2(##M,A,G,r,s,x)"
 proof -
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body2(##M, G, r, s, z, i))= (\<mu> i. is_ifrFb_body2(##M, G, r, s, z, i))" for z
       using is_ifrFb_body2_closed[of G r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body2(##M,G,r,s,z,i)"]) auto
     moreover
     have "(\<mu> i. is_ifrFb_body2(##M, G, r, s, z, i))= (\<mu> i. ifrFb_body2(##M, G, r, s, z, i))" for z
     proof (rule_tac Least_cong[of "\<lambda>i. is_ifrFb_body2(##M,G,r,s,z,i)" "\<lambda>i. ifrFb_body2(##M,G,r,s,z,i)"])
       fix y
       from assms \<open>a\<in>M\<close>
       show "is_ifrFb_body2(##M, G, r, s, z, y) \<longleftrightarrow> ifrFb_body2(##M, G, r, s, z, y)"
         using If_abs apply_0
         unfolding ifrFb_body2_def is_ifrFb_body2_def
         by (cases "y\<in>M"; cases "y\<in>range(s)"; cases "converse(s)`y \<in> M";
             auto dest:transM split del: split_if del:iffI)
           (auto simp flip:setclass_iff; (force simp only:setclass_iff))+
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body2(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body2(##M, G, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body2(##M,G,r,s,z,i)" a]
       by simp
     ultimately
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body2(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body2(##M, G, r, s, z,i))" for z
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body2_def is_ifrangeF_body2_def
     by (auto dest:transM)
 qed
 
 lemma (in M_ZF1_trans) separation_ifrangeF_body2:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
        separation
         (##M,
          \<lambda>y. \<exists>x\<in>A.
                 y =
                 \<langle>x, \<mu> i. x \<in>
                          if_range_F_else_F(\<lambda>a. if (##M)(a) then G ` a else 0, b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body2 ifrangeF_body2_abs
     separation_cong[where P="is_ifrangeF_body2(##M,A,G,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body2_def if_range_F_def if_range_F_else_F_def ifrFb_body2_def
   by simp
 
 (* (##M)(A) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow> (##M)(F) \<Longrightarrow>
   separation(##M,
     \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>a. if (##M)(a) then F -`` {a} else 0, b, f, i)\<rangle>) *)
 
 definition ifrFb_body3 where
   "ifrFb_body3(M,G,b,f,x,i) \<equiv> x \<in>
   (if b = 0 then if i \<in> range(f) then
   if M(converse(f) ` i) then G-``{converse(f) ` i} else 0 else 0 else if M(i) then G-``{i} else 0)"
 
 relativize functional "ifrFb_body3" "ifrFb_body3_rel"
 relationalize "ifrFb_body3_rel" "is_ifrFb_body3"
 
 synthesize "is_ifrFb_body3" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body3_fm"
 
 definition ifrangeF_body3 :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body3(M,A,G,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body3(M,G,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body3" "ifrangeF_body3_rel"
 relationalize "ifrangeF_body3_rel" "is_ifrangeF_body3"
 
 synthesize "is_ifrangeF_body3" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body3_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body3:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body3(##M,A,G,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body3_fm(1,2,3,4,0)" and env="[A,G,r,s]"]
     zero_in_M arity_is_ifrangeF_body3_fm ord_simp_union is_ifrangeF_body3_fm_type
   by simp
 
 lemma (in M_basic) is_ifrFb_body3_closed: "M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow> is_ifrFb_body3(M, G, r, s, x, i) \<Longrightarrow> M(i)"
   unfolding ifrangeF_body3_def is_ifrangeF_body3_def is_ifrFb_body3_def If_abs
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_ZF1_trans) ifrangeF_body3_abs:
   assumes "(##M)(A)" "(##M)(G)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body3(##M,A,G,r,s,x) \<longleftrightarrow> ifrangeF_body3(##M,A,G,r,s,x)"
 proof -
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body3(##M, G, r, s, z, i))= (\<mu> i. is_ifrFb_body3(##M, G, r, s, z, i))" for z
       using is_ifrFb_body3_closed[of G r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body3(##M,G,r,s,z,i)"]) auto
     moreover
     have "(\<mu> i. is_ifrFb_body3(##M, G, r, s, z, i))= (\<mu> i. ifrFb_body3(##M, G, r, s, z, i))" for z
     proof (rule_tac Least_cong[of "\<lambda>i. is_ifrFb_body3(##M,G,r,s,z,i)" "\<lambda>i. ifrFb_body3(##M,G,r,s,z,i)"])
       fix y
       from assms \<open>a\<in>M\<close>
       show "is_ifrFb_body3(##M, G, r, s, z, y) \<longleftrightarrow> ifrFb_body3(##M, G, r, s, z, y)"
         using If_abs apply_0
         unfolding ifrFb_body3_def is_ifrFb_body3_def
         by (cases "y\<in>M"; cases "y\<in>range(s)"; cases "converse(s)`y \<in> M";
             auto dest:transM split del: split_if del:iffI)
           (auto simp flip:setclass_iff; (force simp only:setclass_iff))+
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body3(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body3(##M, G, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body3(##M,G,r,s,z,i)" a]
       by simp
     ultimately
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body3(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body3(##M, G, r, s, z,i))" for z
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body3_def is_ifrangeF_body3_def
     by (auto dest:transM)
 qed
 
 lemma (in M_ZF1_trans) separation_ifrangeF_body3:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
        separation
         (##M,
          \<lambda>y. \<exists>x\<in>A.
                 y =
                 \<langle>x, \<mu> i. x \<in>
                          if_range_F_else_F(\<lambda>a. if (##M)(a) then G-``{a} else 0, b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body3 ifrangeF_body3_abs
     separation_cong[where P="is_ifrangeF_body3(##M,A,G,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body3_def if_range_F_def if_range_F_else_F_def ifrFb_body3_def
   by simp
 
 (* (##M)(A) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow> (##M)(A') \<Longrightarrow>
     separation(##M, \<lambda>y. \<exists>x\<in>A'. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F((`)(A), b, f, i)\<rangle>) *)
 
 definition ifrFb_body4 where
   "ifrFb_body4(G,b,f,x,i) \<equiv> x \<in>
   (if b = 0 then if i \<in> range(f) then G`(converse(f) ` i) else 0 else G`i)"
 
 relativize functional "ifrFb_body4" "ifrFb_body4_rel"
 relationalize "ifrFb_body4_rel" "is_ifrFb_body4"
 
 synthesize "is_ifrFb_body4" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body4_fm"
 
 definition ifrangeF_body4 :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body4(M,A,G,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body4(G,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body4" "ifrangeF_body4_rel"
 relationalize "ifrangeF_body4_rel" "is_ifrangeF_body4"
 
 synthesize "is_ifrangeF_body4" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body4_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body4:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body4(##M,A,G,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body4_fm(1,2,3,4,0)" and env="[A,G,r,s]"]
     zero_in_M arity_is_ifrangeF_body4_fm ord_simp_union is_ifrangeF_body4_fm_type
   by simp
 
 lemma (in M_basic) is_ifrFb_body4_closed: "M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow> is_ifrFb_body4(M, G, r, s, x, i) \<Longrightarrow> M(i)"
   using If_abs
   unfolding ifrangeF_body4_def is_ifrangeF_body4_def is_ifrFb_body4_def fun_apply_def
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_ZF1_trans) ifrangeF_body4_abs:
   assumes "(##M)(A)" "(##M)(G)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body4(##M,A,G,r,s,x) \<longleftrightarrow> ifrangeF_body4(##M,A,G,r,s,x)"
 proof -
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body4(##M, G, r, s, z, i))= (\<mu> i. is_ifrFb_body4(##M, G, r, s, z, i))" for z
       using is_ifrFb_body4_closed[of G r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body4(##M,G,r,s,z,i)"]) auto
     moreover
     have "(\<mu> i. is_ifrFb_body4(##M, G, r, s, z, i))= (\<mu> i. ifrFb_body4(G, r, s, z, i))" if "z\<in>M" for z
     proof (rule_tac Least_cong[of "\<lambda>i. is_ifrFb_body4(##M,G,r,s,z,i)" "\<lambda>i. ifrFb_body4(G,r,s,z,i)"])
       fix y
       from assms \<open>a\<in>M\<close> \<open>z\<in>M\<close>
       show "is_ifrFb_body4(##M, G, r, s, z, y) \<longleftrightarrow> ifrFb_body4(G, r, s, z, y)"
         using If_abs apply_0
         unfolding ifrFb_body4_def is_ifrFb_body4_def
         apply (cases "y\<in>M"; cases "y\<in>range(s)"; cases "r=0"; cases "y\<in>domain(G)";
             auto dest:transM split del: split_if del:iffI)
         by (auto simp flip:setclass_iff; (force simp only: fun_apply_def setclass_iff))
           (auto simp flip:setclass_iff simp: fun_apply_def )
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body4(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body4(##M, G, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body4(##M,G,r,s,z,i)" a]
       by simp
     ultimately
     have "z\<in>M \<Longrightarrow> least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body4(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body4(G, r, s, z,i))" for z
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body4_def is_ifrangeF_body4_def
     by (auto dest:transM)
 qed
 
 lemma (in M_ZF1_trans) separation_ifrangeF_body4:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
        separation(##M, \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F((`)(G), b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body4 ifrangeF_body4_abs
     separation_cong[where P="is_ifrangeF_body4(##M,A,G,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body4_def if_range_F_def if_range_F_else_F_def ifrFb_body4_def
   by simp
 
 (* (##M)(G) \<Longrightarrow> (##M)(A) \<Longrightarrow>
     separation(##M,
       \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>x. {xa \<in> G . x \<in> xa}, b, f, i)\<rangle>) *)
 
 definition ifrFb_body5 where
   "ifrFb_body5(G,b,f,x,i) \<equiv> x \<in>
   (if b = 0 then if i \<in> range(f) then {xa \<in> G . converse(f) ` i \<in> xa} else 0 else {xa \<in> G . i \<in> xa})"
 
 relativize functional "ifrFb_body5" "ifrFb_body5_rel"
 relationalize "ifrFb_body5_rel" "is_ifrFb_body5"
 
 synthesize "is_ifrFb_body5" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body5_fm"
 
 definition ifrangeF_body5 :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body5(M,A,G,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body5(G,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body5" "ifrangeF_body5_rel"
 relationalize "ifrangeF_body5_rel" "is_ifrangeF_body5"
 
 synthesize "is_ifrangeF_body5" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body5_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body5:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body5(##M,A,G,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body5_fm(1,2,3,4,0)" and env="[A,G,r,s]"]
     zero_in_M arity_is_ifrangeF_body5_fm ord_simp_union is_ifrangeF_body5_fm_type
   by simp
 
 lemma (in M_basic) is_ifrFb_body5_closed: "M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow> is_ifrFb_body5(M, G, r, s, x, i) \<Longrightarrow> M(i)"
   using If_abs
   unfolding ifrangeF_body5_def is_ifrangeF_body5_def is_ifrFb_body5_def fun_apply_def
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_ZF1_trans) ifrangeF_body5_abs:
   assumes "(##M)(A)" "(##M)(G)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body5(##M,A,G,r,s,x) \<longleftrightarrow> ifrangeF_body5(##M,A,G,r,s,x)"
 proof -
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body5(##M, G, r, s, z, i))= (\<mu> i. is_ifrFb_body5(##M, G, r, s, z, i))" for z
       using is_ifrFb_body5_closed[of G r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body5(##M,G,r,s,z,i)"]) auto
     moreover
     have "(\<mu> i. is_ifrFb_body5(##M, G, r, s, z, i))= (\<mu> i. ifrFb_body5(G, r, s, z, i))" if "z\<in>M" for z
     proof (rule_tac Least_cong[of "\<lambda>i. is_ifrFb_body5(##M,G,r,s,z,i)" "\<lambda>i. ifrFb_body5(G,r,s,z,i)"])
       fix y
       from assms \<open>a\<in>M\<close> \<open>z\<in>M\<close>
       show "is_ifrFb_body5(##M, G, r, s, z, y) \<longleftrightarrow> ifrFb_body5(G, r, s, z, y)"
         using If_abs apply_0 separation_in_constant separation_in_rev
         unfolding ifrFb_body5_def is_ifrFb_body5_def
         apply (cases "y\<in>M"; cases "y\<in>range(s)"; cases "r=0"; cases "y\<in>domain(G)";
             auto dest:transM split del: split_if del:iffI)
               apply (auto simp flip:setclass_iff; (force simp only: fun_apply_def setclass_iff))
              apply (auto simp flip:setclass_iff simp: fun_apply_def)
         apply (auto dest:transM)
         done
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body5(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body5(##M, G, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body5(##M,G,r,s,z,i)" a]
       by simp
     ultimately
     have "z\<in>M \<Longrightarrow> least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body5(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body5(G, r, s, z,i))" for z
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body5_def is_ifrangeF_body5_def
     by (auto dest:transM)
 qed
 
 lemma (in M_ZF1_trans) separation_ifrangeF_body5:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
        separation(##M, \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>x. {xa \<in> G . x \<in> xa}, b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body5 ifrangeF_body5_abs
     separation_cong[where P="is_ifrangeF_body5(##M,A,G,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body5_def if_range_F_def if_range_F_else_F_def ifrFb_body5_def
   by simp
 
 (* (##M)(A) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
     separation(##M,
       \<lambda>y. \<exists>x\<in>A'. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>a. {p \<in> A . domain(p) = a}, b, f, i)\<rangle>) *)
 
 definition ifrFb_body6 where
   "ifrFb_body6(G,b,f,x,i) \<equiv> x \<in>
   (if b = 0 then if i \<in> range(f) then {p\<in>G . domain(p) = converse(f) ` i} else 0 else {p\<in>G . domain(p) = i})"
 
 relativize functional "ifrFb_body6" "ifrFb_body6_rel"
 relationalize "ifrFb_body6_rel" "is_ifrFb_body6"
 
 synthesize "is_ifrFb_body6" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body6_fm"
 
 definition ifrangeF_body6 :: "[i\<Rightarrow>o,i,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body6(M,A,G,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body6(G,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body6" "ifrangeF_body6_rel"
 relationalize "ifrangeF_body6_rel" "is_ifrangeF_body6"
 
 synthesize "is_ifrangeF_body6" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body6_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body6:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body6(##M,A,G,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body6_fm(1,2,3,4,0)" and env="[A,G,r,s]"]
     zero_in_M arity_is_ifrangeF_body6_fm ord_simp_union is_ifrangeF_body6_fm_type
   by simp
 
 lemma (in M_basic) ifrFb_body6_closed: "M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow> ifrFb_body6(G, r, s, x, i) \<longleftrightarrow>  M(i) \<and> ifrFb_body6(G, r, s, x, i)"
   using If_abs
   unfolding ifrangeF_body6_def is_ifrangeF_body6_def ifrFb_body6_def fun_apply_def
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_basic) is_ifrFb_body6_closed: "M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow> is_ifrFb_body6(M, G, r, s, x, i) \<Longrightarrow> M(i)"
   using If_abs
   unfolding ifrangeF_body6_def is_ifrangeF_body6_def is_ifrFb_body6_def fun_apply_def
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
-lemma (in M_ZF2_trans) ifrangeF_body6_abs:
+lemma (in M_ZF1_trans) ifrangeF_body6_abs:
   assumes "(##M)(A)" "(##M)(G)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body6(##M,A,G,r,s,x) \<longleftrightarrow> ifrangeF_body6(##M,A,G,r,s,x)"
 proof -
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body6(##M, G, r, s, z, i))= (\<mu> i. is_ifrFb_body6(##M, G, r, s, z, i))" for z
       using is_ifrFb_body6_closed[of G r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body6(##M,G,r,s,z,i)"]) auto
     moreover
     have "(\<mu> i. i\<in>M \<and> is_ifrFb_body6(##M, G, r, s, z, i))= (\<mu> i. i\<in>M \<and>  ifrFb_body6(G, r, s, z, i))" if "z\<in>M" for z
     proof (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body6(##M,G,r,s,z,i)" "\<lambda>i. i\<in>M \<and> ifrFb_body6(G,r,s,z,i)"])
       fix y
       from assms \<open>a\<in>M\<close> \<open>z\<in>M\<close>
       show "y\<in>M \<and> is_ifrFb_body6(##M, G, r, s, z, y) \<longleftrightarrow> y\<in>M \<and> ifrFb_body6(G, r, s, z, y)"
         using If_abs apply_0 separation_in_constant transitivity[of _ G]
           separation_closed converse_closed apply_closed range_closed zero_in_M
           separation_cong[OF eq_commute,THEN iffD1,OF domain_eq_separation]
         unfolding ifrFb_body6_def is_ifrFb_body6_def
         by auto
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body6(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body6(##M, G, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body6(##M,G,r,s,z,i)" a]
       by simp
     ultimately
     have "z\<in>M \<Longrightarrow> least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body6(##M, G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body6(G, r, s, z,i))" for z
       using Least_cong[OF ifrFb_body6_closed[of G r s]] assms
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body6_def is_ifrangeF_body6_def
     by (auto dest:transM)
 qed
 
-lemma (in M_ZF2_trans) separation_ifrangeF_body6:
+lemma (in M_ZF1_trans) separation_ifrangeF_body6:
   "(##M)(A) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
        separation(##M,
       \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(\<lambda>a. {p \<in> G . domain(p) = a}, b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body6 ifrangeF_body6_abs
     separation_cong[where P="is_ifrangeF_body6(##M,A,G,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body6_def if_range_F_def if_range_F_else_F_def ifrFb_body6_def
   by simp
 
 
 
 (* (##M)(A) \<Longrightarrow> (##M)(f) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(D) \<Longrightarrow> (##M)(r') \<Longrightarrow> (##M)(A') \<Longrightarrow>
     separation(##M,
       \<lambda>y. \<exists>x\<in>A'. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(drSR_Y(r', D, A), b, f, i)\<rangle>) *)
 
 definition ifrFb_body7 where
   "ifrFb_body7(B,D,A,b,f,x,i) \<equiv> x \<in>
     (if b = 0 then if i \<in> range(f) then
         {d \<in> D . \<exists>r\<in>A. restrict(r, B) = converse(f) ` i \<and> d = domain(r)} else 0
        else {d \<in> D . \<exists>r\<in>A. restrict(r, B) = i \<and> d = domain(r)})"
 
 relativize functional "ifrFb_body7" "ifrFb_body7_rel"
 relationalize "ifrFb_body7_rel" "is_ifrFb_body7"
 
 synthesize "is_ifrFb_body7" from_definition assuming "nonempty"
 arity_theorem for "is_ifrFb_body7_fm"
 
 definition ifrangeF_body7 :: "[i\<Rightarrow>o,i,i,i,i,i,i,i] \<Rightarrow> o" where
   "ifrangeF_body7(M,A,B,D,G,b,f) \<equiv> \<lambda>y. \<exists>x\<in>A. y = \<langle>x,\<mu> i. ifrFb_body7(B,D,G,b,f,x,i)\<rangle>"
 
 relativize functional "ifrangeF_body7" "ifrangeF_body7_rel"
 relationalize "ifrangeF_body7_rel" "is_ifrangeF_body7"
 
 synthesize "is_ifrangeF_body7" from_definition assuming "nonempty"
 arity_theorem for "is_ifrangeF_body7_fm"
 
 lemma (in M_Z_trans) separation_is_ifrangeF_body7:
   "(##M)(A) \<Longrightarrow> (##M)(B) \<Longrightarrow> (##M)(D) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(r) \<Longrightarrow> (##M)(s) \<Longrightarrow> separation(##M, is_ifrangeF_body7(##M,A,B,D,G,r,s))"
   using separation_in_ctm[where \<phi>="is_ifrangeF_body7_fm(1,2,3,4,5,6,0)" and env="[A,B,D,G,r,s]"]
     zero_in_M arity_is_ifrangeF_body7_fm ord_simp_union is_ifrangeF_body7_fm_type
   by simp
 
 lemma (in M_basic) ifrFb_body7_closed: "M(B) \<Longrightarrow> M(D) \<Longrightarrow> M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow>
   ifrFb_body7(B,D,G, r, s, x, i) \<longleftrightarrow>  M(i) \<and> ifrFb_body7(B,D,G, r, s, x, i)"
   using If_abs
   unfolding ifrangeF_body7_def is_ifrangeF_body7_def ifrFb_body7_def fun_apply_def
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
 lemma (in M_basic) is_ifrFb_body7_closed: "M(B) \<Longrightarrow> M(D) \<Longrightarrow> M(G) \<Longrightarrow> M(r) \<Longrightarrow> M(s) \<Longrightarrow>
   is_ifrFb_body7(M, B,D,G, r, s, x, i) \<Longrightarrow> M(i)"
   using If_abs
   unfolding ifrangeF_body7_def is_ifrangeF_body7_def is_ifrFb_body7_def fun_apply_def
   by (cases "i\<in>range(s)"; cases "r=0"; auto dest:transM)
 
-lemma (in M_ZF2_trans) ifrangeF_body7_abs:
+lemma (in M_ZF1_trans) ifrangeF_body7_abs:
   assumes "(##M)(A)"  "(##M)(B)" "(##M)(D)" "(##M)(G)" "(##M)(r)" "(##M)(s)" "(##M)(x)"
   shows "is_ifrangeF_body7(##M,A,B,D,G,r,s,x) \<longleftrightarrow> ifrangeF_body7(##M,A,B,D,G,r,s,x)"
 proof -
   from assms
   have sep_dr: "y\<in>M \<Longrightarrow> separation(##M, \<lambda>d . \<exists>r\<in>M . r\<in>G \<and> y = restrict(r, B) \<and> d = domain(r))" for y
     by(rule_tac separation_cong[where P'="\<lambda>d . \<exists>r\<in> M . r\<in>G \<and> y = restrict(r, B) \<and> d = domain(r)",THEN iffD1,OF _
           separation_restrict_eq_dom_eq[rule_format,of G B y]],auto simp:transitivity[of _ G])
   from assms
   have sep_dr'': "y\<in>M \<Longrightarrow> separation(##M, \<lambda>d . \<exists>r\<in>M. r \<in> G \<and> d = domain(r) \<and> converse(s) ` y = restrict(r, B))" for y
     by(rule_tac separation_cong[THEN iffD1,OF _ separation_restrict_eq_dom_eq[rule_format,of G B "converse(s) ` y "]],
         auto simp:transitivity[of _ G] apply_closed[simplified] converse_closed[simplified])
   {
     fix a
     assume "a\<in>M"
     with assms
     have "(\<mu> i. i\<in> M \<and> is_ifrFb_body7(##M, B,D,G, r, s, z, i))= (\<mu> i. is_ifrFb_body7(##M,B,D, G, r, s, z, i))" for z
       using is_ifrFb_body7_closed[of B D G r s z]
       by (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body7(##M,B,D,G,r,s,z,i)"]) auto
     moreover from this
     have "(\<mu> i. i\<in>M \<and> is_ifrFb_body7(##M, B,D,G, r, s, z, i))= (\<mu> i. i\<in>M \<and>  ifrFb_body7(B,D,G, r, s, z, i))" if "z\<in>M" for z
     proof (rule_tac Least_cong[of "\<lambda>i. i\<in>M \<and> is_ifrFb_body7(##M,B,D,G,r,s,z,i)" "\<lambda>i. i\<in>M \<and> ifrFb_body7(B,D,G,r,s,z,i)"])
       from assms \<open>a\<in>M\<close> \<open>z\<in>M\<close>
       have "is_ifrFb_body7(##M, B,D,G, r, s, z, y) \<longleftrightarrow> ifrFb_body7(B,D,G, r, s, z, y)" if "y\<in>M" for y
         using If_abs apply_0
           separation_closed converse_closed apply_closed range_closed zero_in_M
           transitivity[of _ D] transitivity[of _ G] that sep_dr sep_dr''
         unfolding ifrFb_body7_def is_ifrFb_body7_def
         by auto
       then
       show " y \<in> M \<and> is_ifrFb_body7(##M, B, D, G, r, s, z, y) \<longleftrightarrow> y \<in> M \<and> ifrFb_body7(B, D, G, r, s, z, y)" for y
         using conj_cong
         by simp
     qed
     moreover from \<open>a\<in>M\<close>
     have "least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body7(##M, B,D,G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i.  i\<in> M \<and> is_ifrFb_body7(##M,B,D,G, r, s, z,i))" for z
       using If_abs least_abs'[of "\<lambda>i. (##M)(i) \<and> is_ifrFb_body7(##M,B,D,G,r,s,z,i)" a]
       by simp
     ultimately
     have "z\<in>M \<Longrightarrow> least(##M, \<lambda>i. i \<in> M \<and> is_ifrFb_body7(##M,B,D,G, r, s, z, i), a)
       \<longleftrightarrow> a = (\<mu> i. ifrFb_body7(B,D,G, r, s, z,i))" for z
       using Least_cong[OF ifrFb_body7_closed[of B D G r s]] assms
       by simp
   }
   with assms
   show ?thesis
     using  pair_in_M_iff apply_closed zero_in_M transitivity[of _ A]
     unfolding ifrangeF_body7_def is_ifrangeF_body7_def
     by (auto dest:transM)
 qed
 
-lemma (in M_ZF2_trans) separation_ifrangeF_body7:
+lemma (in M_ZF1_trans) separation_ifrangeF_body7:
   "(##M)(A) \<Longrightarrow> (##M)(B) \<Longrightarrow> (##M)(D) \<Longrightarrow> (##M)(G) \<Longrightarrow> (##M)(b) \<Longrightarrow> (##M)(f) \<Longrightarrow>
     separation(##M,
       \<lambda>y. \<exists>x\<in>A. y = \<langle>x, \<mu> i. x \<in> if_range_F_else_F(drSR_Y(B, D, G), b, f, i)\<rangle>)"
   using separation_is_ifrangeF_body7 ifrangeF_body7_abs drSR_Y_equality
     separation_cong[where P="is_ifrangeF_body7(##M,A,B,D,G,b,f)" and M="##M",THEN iffD1]
   unfolding ifrangeF_body7_def if_range_F_def if_range_F_else_F_def ifrFb_body7_def
   by simp
 
 definition omfunspace :: "[i,i] \<Rightarrow> o" where
   "omfunspace(B) \<equiv> \<lambda>z. \<exists>x. \<exists>n\<in>\<omega>. z\<in>x \<and> x = n\<rightarrow>B"
 relativize functional "omfunspace" "omfunspace_rel"
 relationalize "omfunspace_rel" "is_omfunspace"
 synthesize "is_omfunspace" from_definition assuming "nonempty"
 arity_theorem for "is_omfunspace_fm"
 
 context M_pre_seqspace
 begin
 
 is_iff_rel for "omfunspace"
   using is_function_space_iff
   unfolding omfunspace_rel_def is_omfunspace_def
   by (simp add:absolut)
 
 end \<comment> \<open>\<^locale>\<open>M_pre_seqspace\<close>\<close>
 
-context M_ZF2_trans
+context M_ZF1_trans
 begin
 
 lemma separation_omfunspace:
   assumes "(##M)(B)"
   shows "separation(##M, \<lambda>z. \<exists>x[##M]. \<exists>n[##M]. n \<in> \<omega> \<and> z \<in> x \<and> x = n \<rightarrow>\<^bsup>M\<^esup> B)"
   using assms separation_in_ctm[where env="[B]" and \<phi>="is_omfunspace_fm(1,0)"
       and Q="is_omfunspace(##M,B)"]
     nonempty is_omfunspace_iff[of B, THEN separation_cong, of "##M"]
     arity_is_omfunspace_fm is_omfunspace_fm_type
   unfolding omfunspace_rel_def
   by (auto simp add:ord_simp_union)
 
-end \<comment> \<open>\<^locale>\<open>M_ZF2_trans\<close>\<close>
+end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
-sublocale M_ZF2_trans \<subseteq> M_seqspace "##M"
+sublocale M_ZF1_trans \<subseteq> M_seqspace "##M"
   using separation_omfunspace by unfold_locales
 
 definition cdltgamma :: "[i,i] \<Rightarrow> o" where
   "cdltgamma(\<gamma>) \<equiv> \<lambda>Z . |Z| < \<gamma>"
 relativize functional "cdltgamma" "cdltgamma_rel"
 relationalize "cdltgamma_rel" "is_cdltgamma"
 synthesize "is_cdltgamma" from_definition assuming "nonempty"
 arity_theorem for "is_cdltgamma_fm"
 
 definition cdeqgamma :: "[i] \<Rightarrow> o" where
   "cdeqgamma \<equiv> \<lambda>Z . |fst(Z)| = snd(Z)"
 relativize functional "cdeqgamma" "cdeqgamma_rel"
 relationalize "cdeqgamma_rel" "is_cdeqgamma"
 synthesize "is_cdeqgamma" from_definition assuming "nonempty"
 arity_theorem for "is_cdeqgamma_fm"
 
 context M_Perm
 begin
 
 is_iff_rel for "cdltgamma"
   using is_cardinal_iff
   unfolding cdltgamma_rel_def is_cdltgamma_def
   by (simp add:absolut)
 
 is_iff_rel for "cdeqgamma"
   using is_cardinal_iff fst_rel_abs snd_rel_abs
   unfolding cdeqgamma_rel_def is_cdeqgamma_def
   by (auto simp add:absolut)
 
 lemma is_cdeqgamma_iff_split: "M(Z) \<Longrightarrow> cdeqgamma_rel(M, Z) \<longleftrightarrow> (\<lambda>\<langle>x,y\<rangle>. |x|\<^bsup>M\<^esup> = y)(Z)"
   using  fst_rel_abs snd_rel_abs
   unfolding cdeqgamma_rel_def split_def
   by simp
 
 end
 
-context M_ZF2_trans
+context M_ZF1_trans
 begin
 
 lemma separation_cdltgamma:
   assumes "(##M)(\<gamma>)"
   shows "separation(##M, \<lambda>Z . cardinal_rel(##M,Z) < \<gamma>)"
   using assms separation_in_ctm[where env="[\<gamma>]" and \<phi>="is_cdltgamma_fm(1,0)"
       and Q="cdltgamma_rel(##M,\<gamma>)"]
     nonempty is_cdltgamma_iff[of \<gamma>] arity_is_cdltgamma_fm is_cdltgamma_fm_type
   unfolding cdltgamma_rel_def
   by (auto simp add:ord_simp_union)
 
 lemma separation_cdeqgamma:
   shows "separation(##M, \<lambda>Z. (\<lambda>\<langle>x,y\<rangle> . cardinal_rel(##M,x) = y)(Z))"
   using separation_in_ctm[where env="[]" and \<phi>="is_cdeqgamma_fm(0)"
       and Q="cdeqgamma_rel(##M)"] is_cdeqgamma_iff_split
     nonempty is_cdeqgamma_iff arity_is_cdeqgamma_fm is_cdeqgamma_fm_type
     separation_cong[OF is_cdeqgamma_iff_split, of "##M"]
   unfolding cdeqgamma_rel_def
   by (simp add:ord_simp_union)
 
-end \<comment> \<open>\<^locale>\<open>M_ZF2_trans\<close>\<close>
+end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Succession_Poset.thy b/thys/Independence_CH/Succession_Poset.thy
--- a/thys/Independence_CH/Succession_Poset.thy
+++ b/thys/Independence_CH/Succession_Poset.thy
@@ -1,230 +1,230 @@
 section\<open>A poset of successions\<close>
 
 theory Succession_Poset
   imports
     ZF_Trans_Interpretations
     Proper_Extension
 begin
 
 text\<open>In this theory we define a separative poset. Its underlying set is the
 set of finite binary sequences (that is, with codomain $2={0,1}$);
 of course, one can see that set as
 the set \<^term>\<open>\<omega>-||>2\<close> or equivalently as the set of partial functions
 \<^term>\<open>Fn(\<omega>,\<omega>,2)\<close>, i.e. the set of partial functions bounded by \<^term>\<open>\<omega>\<close>.
 
 The order relation of the poset is that of being less defined as functions
 (cf. \<^term>\<open>Fnlerel(A\<^bsup><\<omega>\<^esup>)\<close>), so it could be surprising that we have not used
 \<^term>\<open>Fn(\<omega>,\<omega>,2)\<close> for the set. The only reason why we keep this alternative
 definition is because we can prove \<^term>\<open>A\<^bsup><\<omega>\<^esup> \<in> M\<close> (and therefore
 \<^term>\<open>Fnlerel(A\<^bsup><\<omega>\<^esup>) \<in> M\<close>) using only one instance of separation.\<close>
 
 definition seq_upd :: "i \<Rightarrow> i \<Rightarrow> i" where
   "seq_upd(f,a) \<equiv> \<lambda> j \<in> succ(domain(f)) . if j < domain(f) then f`j else a"
 
 lemma seq_upd_succ_type :
   assumes "n\<in>nat" "f\<in>n\<rightarrow>A" "a\<in>A"
   shows "seq_upd(f,a)\<in> succ(n) \<rightarrow> A"
 proof -
   from assms
   have equ: "domain(f) = n"
     using domain_of_fun by simp
   {
     fix j
     assume "j\<in>succ(domain(f))"
     with equ \<open>n\<in>_\<close>
     have "j\<le>n"
       using ltI by auto
     with \<open>n\<in>_\<close>
     consider (lt) "j<n" | (eq) "j=n"
       using leD by auto
     then
     have "(if j < n then f`j else a) \<in> A"
     proof cases
       case lt
       with \<open>f\<in>_\<close>
       show ?thesis
         using apply_type ltD[OF lt] by simp
     next
       case eq
       with \<open>a\<in>_\<close>
       show ?thesis
         by auto
     qed
   }
   with equ
   show ?thesis
     unfolding seq_upd_def
     using lam_type[of "succ(domain(f))"]
     by auto
 qed
 
 lemma seq_upd_type :
   assumes "f\<in>A\<^bsup><\<omega>\<^esup>" "a\<in>A"
   shows "seq_upd(f,a) \<in> A\<^bsup><\<omega>\<^esup>"
 proof -
   from \<open>f\<in>_\<close>
   obtain y where "y\<in>nat" "f\<in>y\<rightarrow>A"
     unfolding seqspace_def by blast
   with \<open>a\<in>A\<close>
   have "seq_upd(f,a)\<in>succ(y)\<rightarrow>A"
     using seq_upd_succ_type by simp
   with \<open>y\<in>_\<close>
   show ?thesis
     unfolding seqspace_def by auto
 qed
 
 lemma seq_upd_apply_domain [simp]:
   assumes "f:n\<rightarrow>A" "n\<in>nat"
   shows "seq_upd(f,a)`n = a"
   unfolding seq_upd_def using assms domain_of_fun by auto
 
 lemma zero_in_seqspace :
   shows "0 \<in> A\<^bsup><\<omega>\<^esup>"
   unfolding seqspace_def
   by force
 
 definition
   seqlerel :: "i \<Rightarrow> i" where
   "seqlerel(A) \<equiv> Fnlerel(A\<^bsup><\<omega>\<^esup>)"
 
 definition
   seqle :: "i" where
   "seqle \<equiv> seqlerel(2)"
 
 lemma seqleI[intro!]:
   "\<langle>f,g\<rangle> \<in> 2\<^bsup><\<omega>\<^esup>\<times>2\<^bsup><\<omega>\<^esup> \<Longrightarrow> g \<subseteq> f  \<Longrightarrow> \<langle>f,g\<rangle> \<in> seqle"
   unfolding seqle_def seqlerel_def seqspace_def Rrel_def Fnlerel_def
   by blast
 
 lemma seqleD[dest!]:
   "z \<in> seqle \<Longrightarrow> \<exists>x y. \<langle>x,y\<rangle> \<in> 2\<^bsup><\<omega>\<^esup>\<times>2\<^bsup><\<omega>\<^esup> \<and> y \<subseteq> x \<and> z = \<langle>x,y\<rangle>"
   unfolding Rrel_def seqle_def seqlerel_def Fnlerel_def
   by blast
 
 lemma upd_leI :
   assumes "f\<in>2\<^bsup><\<omega>\<^esup>" "a\<in>2"
   shows "\<langle>seq_upd(f,a),f\<rangle>\<in>seqle"  (is "\<langle>?f,_\<rangle>\<in>_")
 proof
   show " \<langle>?f, f\<rangle> \<in> 2\<^bsup><\<omega>\<^esup> \<times> 2\<^bsup><\<omega>\<^esup>"
     using assms seq_upd_type by auto
 next
   show  "f \<subseteq> seq_upd(f,a)"
   proof
     fix x
     assume "x \<in> f"
     moreover from \<open>f \<in> 2\<^bsup><\<omega>\<^esup>\<close>
     obtain n where "n\<in>nat" "f : n \<rightarrow> 2"
       by blast
     moreover from calculation
     obtain y where "y\<in>n" "x=\<langle>y,f`y\<rangle>"
       using Pi_memberD[of f n "\<lambda>_ . 2"]
       by blast
     moreover from \<open>f:n\<rightarrow>2\<close>
     have "domain(f) = n"
       using domain_of_fun by simp
     ultimately
     show "x \<in> seq_upd(f,a)"
       unfolding seq_upd_def lam_def
       by (auto intro:ltI)
   qed
 qed
 
 lemma preorder_on_seqle: "preorder_on(2\<^bsup><\<omega>\<^esup>,seqle)"
   unfolding preorder_on_def refl_def trans_on_def by blast
 
 lemma zero_seqle_max: "x\<in>2\<^bsup><\<omega>\<^esup> \<Longrightarrow> \<langle>x,0\<rangle> \<in> seqle"
   using zero_in_seqspace
   by auto
 
 interpretation sp:forcing_notion "2\<^bsup><\<omega>\<^esup>" "seqle" "0"
   using preorder_on_seqle zero_seqle_max zero_in_seqspace
   by unfold_locales simp_all
 
 notation sp.Leq (infixl "\<preceq>s" 50)
 notation sp.Incompatible (infixl "\<bottom>s" 50)
 
 lemma seqspace_separative:
   assumes "f\<in>2\<^bsup><\<omega>\<^esup>"
   shows "seq_upd(f,0) \<bottom>s seq_upd(f,1)" (is "?f \<bottom>s ?g")
 proof
   assume "sp.compat(?f, ?g)"
   then
   obtain h where "h \<in> 2\<^bsup><\<omega>\<^esup>" "?f \<subseteq> h" "?g \<subseteq> h"
     by blast
   moreover from \<open>f\<in>_\<close>
   obtain y where "y\<in>nat" "f:y\<rightarrow>2"
     by blast
   moreover from this
   have "?f: succ(y) \<rightarrow> 2" "?g: succ(y) \<rightarrow> 2"
     using seq_upd_succ_type by blast+
   moreover from this
   have "\<langle>y,?f`y\<rangle> \<in> ?f" "\<langle>y,?g`y\<rangle> \<in> ?g"
     using apply_Pair by auto
   ultimately
   have "\<langle>y,0\<rangle> \<in> h" "\<langle>y,1\<rangle> \<in> h"
     by auto
   moreover from \<open>h \<in> 2\<^bsup><\<omega>\<^esup>\<close>
   obtain n where "n\<in>nat" "h:n\<rightarrow>2"
     by blast
   ultimately
   show "False"
     using fun_is_function[of h n "\<lambda>_. 2"]
     unfolding seqspace_def function_def by auto
 qed
 
 definition seqleR_fm :: "i \<Rightarrow> i" where
   "seqleR_fm(fg) \<equiv> Exists(Exists(And(pair_fm(0,1,fg+\<^sub>\<omega>2),subset_fm(1,0))))"
 
 lemma type_seqleR_fm : "fg \<in> nat \<Longrightarrow> seqleR_fm(fg) \<in> formula"
   unfolding seqleR_fm_def
   by simp
 
 arity_theorem for "seqleR_fm"
 
 lemma (in M_ctm1) seqleR_fm_sats :
   assumes "fg\<in>nat" "env\<in>list(M)"
   shows "(M, env \<Turnstile> seqleR_fm(fg)) \<longleftrightarrow> (\<exists>f[##M]. \<exists>g[##M]. pair(##M,f,g,nth(fg,env)) \<and> f \<supseteq> g)"
   unfolding seqleR_fm_def
   using assms trans_M sats_subset_fm pair_iff_sats
   by auto
 
-context M_ctm2
+context M_ctm1
 begin
 
 lemma seqle_in_M: "seqle \<in> M"
   using arity_seqleR_fm seqleR_fm_sats type_seqleR_fm
     cartprod_closed seqspace_closed nat_into_M nat_in_M pair_in_M_iff
   unfolding seqle_def seqlerel_def Rrel_def Fnlerel_def
   by (rule_tac Collect_in_M[of "seqleR_fm(0)" "[]"],auto)
 
 subsection\<open>Cohen extension is proper\<close>
 
 interpretation ctm_separative "2\<^bsup><\<omega>\<^esup>" seqle 0
 proof (unfold_locales)
   fix f
   let ?q="seq_upd(f,0)" and ?r="seq_upd(f,1)"
   assume "f \<in> 2\<^bsup><\<omega>\<^esup>"
   then
   have "?q \<preceq>s f \<and> ?r \<preceq>s f \<and> ?q \<bottom>s ?r"
     using upd_leI seqspace_separative by auto
   moreover from calculation
   have "?q \<in> 2\<^bsup><\<omega>\<^esup>"  "?r \<in> 2\<^bsup><\<omega>\<^esup>"
     using seq_upd_type[of f 2] by auto
   ultimately
   show "\<exists>q\<in>2\<^bsup><\<omega>\<^esup>. \<exists>r\<in>2\<^bsup><\<omega>\<^esup>. q \<preceq>s f \<and> r \<preceq>s f \<and> q \<bottom>s r"
     by (rule_tac bexI)+ \<comment> \<open>why the heck auto-tools don't solve this?\<close>
 next
   show "2\<^bsup><\<omega>\<^esup> \<in> M"
     using nat_into_M seqspace_closed by simp
 next
   show "seqle \<in> M"
     using seqle_in_M .
 qed
 
 lemma cohen_extension_is_proper: "\<exists>G. M_generic(G) \<and> M \<noteq> M[G]"
   using proper_extension generic_filter_existence zero_in_seqspace
   by force
 
-end \<comment> \<open>\<^locale>\<open>M_ctm2\<close>\<close>
+end \<comment> \<open>\<^locale>\<open>M_ctm1\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/ZF_Trans_Interpretations.thy b/thys/Independence_CH/ZF_Trans_Interpretations.thy
--- a/thys/Independence_CH/ZF_Trans_Interpretations.thy
+++ b/thys/Independence_CH/ZF_Trans_Interpretations.thy
@@ -1,647 +1,687 @@
 section\<open>Further instances of axiom-schemes\<close>
 
 theory ZF_Trans_Interpretations
   imports
     Internal_ZFC_Axioms
     Replacement_Instances
 
 begin
 
-locale M_ZF3 = M_ZF2 +
+locale M_ZF2 = M_ZF1 +
   assumes
-    replacement_ax3:
+    replacement_ax2:
     "replacement_assm(M,env,replacement_is_order_body_fm)"
     "replacement_assm(M,env,wfrec_replacement_order_pred_fm)"
-
-definition instances3_fms where "instances3_fms \<equiv>
-  { replacement_is_order_body_fm,
-    wfrec_replacement_order_pred_fm }"
-
-lemmas replacement_instances3_defs =
-  replacement_is_order_body_fm_def wfrec_replacement_order_pred_fm_def
-  replacement_is_aleph_fm_def
-
-declare (in M_ZF3) replacement_instances3_defs [simp]
-
-locale M_ZF3_trans = M_ZF2_trans + M_ZF3
-
-locale M_ZFC3 = M_ZFC2 + M_ZF3
-
-locale M_ZFC3_trans = M_ZFC2_trans + M_ZF3_trans
+    "replacement_assm(M,env,replacement_HAleph_wfrec_repl_body_fm)"
+    "replacement_assm(M,env,replacement_is_order_eq_map_fm)"
 
-locale M_ZF3_ground_notCH = M_ZF3 + M_ZF_ground_notCH
-
-locale M_ZF3_ground_notCH_trans = M_ZF3_trans + M_ZF3_ground_notCH + M_ZF_ground_notCH_trans
-
-locale M_ZFC3_ground_notCH = M_ZFC3 + M_ZF3_ground_notCH
-
-locale M_ZFC3_ground_notCH_trans = M_ZFC3_trans + M_ZFC3_ground_notCH + M_ZF3_ground_notCH_trans
+definition instances2_fms where "instances2_fms \<equiv>
+  { replacement_is_order_body_fm,
+    wfrec_replacement_order_pred_fm,
+    replacement_HAleph_wfrec_repl_body_fm,
+    replacement_is_order_eq_map_fm }"
 
-locale M_ZFC3_ground_CH_trans = M_ZFC3_ground_notCH_trans + M_ZF_ground_CH_trans
-
-locale M_ctm3 = M_ctm2 + M_ZF3_ground_notCH_trans
+lemmas replacement_instances2_defs =
+  replacement_is_order_body_fm_def wfrec_replacement_order_pred_fm_def
+  replacement_HAleph_wfrec_repl_body_fm_def replacement_is_order_eq_map_fm_def
 
-locale M_ctm3_AC = M_ctm3 + M_ctm1_AC + M_ZFC3_ground_notCH_trans
+declare (in M_ZF2) replacement_instances2_defs [simp]
 
-locale M_ctm3_AC_CH = M_ctm3_AC + M_ZFC3_ground_CH_trans
+locale M_ZF2_trans = M_ZF1_trans + M_ZF2
 
-lemmas (in M_ZF2_trans) separation_instances =
+locale M_ZFC2 = M_ZFC1 + M_ZF2
+
+locale M_ZFC2_trans = M_ZFC1_trans + M_ZF2_trans + M_ZFC2
+
+locale M_ZF2_ground_notCH = M_ZF2 + M_ZF_ground_notCH
+
+locale M_ZF2_ground_notCH_trans = M_ZF2_trans + M_ZF2_ground_notCH + M_ZF_ground_notCH_trans
+
+locale M_ZFC2_ground_notCH = M_ZFC2 + M_ZF2_ground_notCH
+
+locale M_ZFC2_ground_notCH_trans = M_ZFC2_trans + M_ZFC2_ground_notCH + M_ZF2_ground_notCH_trans
+
+locale M_ZFC2_ground_CH_trans = M_ZFC2_ground_notCH_trans + M_ZF_ground_CH_trans
+
+locale M_ctm2 = M_ctm1 + M_ZF2_ground_notCH_trans
+
+locale M_ctm2_AC = M_ctm2 + M_ctm1_AC + M_ZFC2_ground_notCH_trans
+
+locale M_ctm2_AC_CH = M_ctm2_AC + M_ZFC2_ground_CH_trans
+
+lemmas (in M_ZF1_trans) separation_instances =
   separation_well_ord_iso
   separation_obase_equals separation_is_obase
   separation_PiP_rel separation_surjP_rel
   separation_radd_body separation_rmult_body
 
+context M_ZF2_trans
+begin
+
+lemma replacement_HAleph_wfrec_repl_body:
+  "B\<in>M \<Longrightarrow> strong_replacement(##M, HAleph_wfrec_repl_body(##M,B))"
+  using strong_replacement_rel_in_ctm[where \<phi>="HAleph_wfrec_repl_body_fm(2,0,1)" and env="[B]"]
+    zero_in_M arity_HAleph_wfrec_repl_body_fm replacement_ax2(3) ord_simp_union
+  by simp
+
+lemma HAleph_wfrec_repl:
+  "(##M)(sa) \<Longrightarrow>
+        (##M)(esa) \<Longrightarrow>
+        (##M)(mesa) \<Longrightarrow>
+        strong_replacement
+         (##M,
+          \<lambda>x z. \<exists>y[##M].
+                   pair(##M, x, y, z) \<and>
+                   (\<exists>f[##M].
+                       (\<forall>z[##M].
+                           z \<in> f \<longleftrightarrow>
+                           (\<exists>xa[##M].
+                               \<exists>y[##M].
+                                  \<exists>xaa[##M].
+                                     \<exists>sx[##M].
+                                        \<exists>r_sx[##M].
+                                           \<exists>f_r_sx[##M].
+                                              pair(##M, xa, y, z) \<and>
+                                              pair(##M, xa, x, xaa) \<and>
+                                              upair(##M, xa, xa, sx) \<and>
+                                              pre_image(##M, mesa, sx, r_sx) \<and> restriction(##M, f, r_sx, f_r_sx) \<and> xaa \<in> mesa \<and> is_HAleph(##M, xa, f_r_sx, y))) \<and>
+                       is_HAleph(##M, x, f, y)))"
+  using replacement_HAleph_wfrec_repl_body unfolding HAleph_wfrec_repl_body_def by simp
+
+lemma replacement_is_order_eq_map:
+  "A\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> strong_replacement(##M, order_eq_map(##M,A,r))"
+  using strong_replacement_rel_in_ctm[where \<phi>="order_eq_map_fm(2,3,0,1)" and env="[A,r]"  and f="order_eq_map(##M,A,r)"]
+    order_eq_map_iff_sats[where env="[_,_,A,r]"] zero_in_M fst_snd_closed pair_in_M_iff
+    arity_order_eq_map_fm ord_simp_union replacement_ax2(4)
+  by simp
+
+end \<comment> \<open>\<^locale>\<open>M_ZF2_trans\<close>\<close>
+
 definition omap_wfrec_body where
   "omap_wfrec_body(A,r) \<equiv> (\<cdot>\<exists>\<cdot>image_fm(2, 0, 1) \<and> pred_set_fm(A #+ 9, 3, r #+ 9, 0) \<cdot>\<cdot>)"
 
 lemma type_omap_wfrec_body_fm :"A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow> omap_wfrec_body(A,r)\<in>formula"
   unfolding omap_wfrec_body_def by simp
 
 lemma arity_aux : "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow> arity(omap_wfrec_body(A,r)) = (9+\<^sub>\<omega>A) \<union> (9+\<^sub>\<omega>r)"
   unfolding omap_wfrec_body_def
   using arity_image_fm arity_pred_set_fm pred_Un_distrib union_abs2[of 3] union_abs1
   by (simp add:FOL_arities, auto simp add:Un_assoc[symmetric] union_abs1)
 
 lemma arity_omap_wfrec: "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow>
   arity(is_wfrec_fm(omap_wfrec_body(A,r),succ(succ(succ(r))), 1, 0)) =
   (4+\<^sub>\<omega>A) \<union> (4+\<^sub>\<omega>r)"
   using Arities.arity_is_wfrec_fm[OF _ _ _ _ _ arity_aux,of A r "3+\<^sub>\<omega>r" 1 0] pred_Un_distrib
     union_abs1 union_abs2 type_omap_wfrec_body_fm
   by auto
 
 lemma arity_isordermap: "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow>d\<in>nat\<Longrightarrow>
    arity(is_ordermap_fm(A,r,d)) = succ(d) \<union> (succ(A) \<union> succ(r))"
   unfolding is_ordermap_fm_def
   using arity_lambda_fm[where i="(4+\<^sub>\<omega>A) \<union> (4+\<^sub>\<omega>r)",OF _ _ _ _ arity_omap_wfrec,
       unfolded omap_wfrec_body_def] pred_Un_distrib union_abs1
   by auto
 
 lemma arity_is_ordertype: "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow>d\<in>nat\<Longrightarrow>
    arity(is_ordertype_fm(A,r,d)) = succ(d) \<union> (succ(A) \<union> succ(r))"
   unfolding is_ordertype_fm_def
   using arity_isordermap arity_image_fm pred_Un_distrib FOL_arities
   by auto
 
 lemma arity_is_order_body: "arity(is_order_body_fm(1,0)) = 2"
    using arity_is_order_body_fm arity_is_ordertype ord_simp_union
    by (simp add:FOL_arities)
 
 
-lemma (in M_ZF3_trans) replacement_is_order_body:
+lemma (in M_ZF2_trans) replacement_is_order_body:
   "strong_replacement(##M, \<lambda>x z . \<exists>y[##M]. is_order_body(##M,x,y) \<and> z = \<langle>x,y\<rangle>)"
   apply(rule_tac strong_replacement_cong[
         where P="\<lambda> x f. M,[x,f] \<Turnstile> (\<cdot>\<exists> \<cdot>is_order_body_fm(1,0) \<and> pair_fm(1,0,2) \<cdot>\<cdot>)",THEN iffD1])
    apply(simp add: is_order_body_iff_sats[where env="[_,_]",symmetric])
    apply(simp_all add:zero_in_M )
-  apply(rule_tac replacement_ax3(1)[unfolded replacement_assm_def, rule_format, where env="[]",simplified])
+  apply(rule_tac replacement_ax2(1)[unfolded replacement_assm_def, rule_format, where env="[]",simplified])
     apply(simp_all add:arity_is_order_body arity pred_Un_distrib ord_simp_union)
   done
 
 definition H_order_pred where
   "H_order_pred(A,r) \<equiv>  \<lambda>x f . f `` Order.pred(A, x, r)"
 
 relationalize "H_order_pred" "is_H_order_pred"
 
 lemma (in M_basic) H_order_pred_abs :
   "M(A) \<Longrightarrow> M(r) \<Longrightarrow> M(x) \<Longrightarrow> M(f) \<Longrightarrow> M(z) \<Longrightarrow>
     is_H_order_pred(M,A,r,x,f,z) \<longleftrightarrow> z = H_order_pred(A,r,x,f)"
   unfolding is_H_order_pred_def H_order_pred_def
   by simp
 
 synthesize "is_H_order_pred" from_definition assuming "nonempty"
 
-lemma (in M_ZF3_trans) wfrec_replacement_order_pred:
+lemma (in M_ZF2_trans) wfrec_replacement_order_pred:
   "A\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> wfrec_replacement(##M, \<lambda>x g z. is_H_order_pred(##M,A,r,x,g,z) , r)"
   unfolding wfrec_replacement_def is_wfrec_def M_is_recfun_def is_H_order_pred_def
   apply(rule_tac strong_replacement_cong[
         where P="\<lambda> x f. M,[x,f,r,A] \<Turnstile> order_pred_wfrec_body_fm(3,2,1,0)",THEN iffD1])
    apply(subst order_pred_wfrec_body_def[symmetric])
    apply(rule_tac order_pred_wfrec_body_iff_sats[where env="[_,_,r,A]",symmetric])
            apply(simp_all add:zero_in_M)
-  apply(rule_tac replacement_ax3(2)[unfolded replacement_assm_def, rule_format, where env="[r,A]",simplified])
+  apply(rule_tac replacement_ax2(2)[unfolded replacement_assm_def, rule_format, where env="[r,A]",simplified])
     apply(simp_all add: arity_order_pred_wfrec_body_fm ord_simp_union)
   done
 
-lemma (in M_ZF3_trans) wfrec_replacement_order_pred':
+lemma (in M_ZF2_trans) wfrec_replacement_order_pred':
   "A\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> wfrec_replacement(##M, \<lambda>x g z. z = H_order_pred(A,r,x,g) , r)"
   using wfrec_replacement_cong[OF H_order_pred_abs[of A r,rule_format] refl,THEN iffD1,
       OF _ _ _ _ _ wfrec_replacement_order_pred[of A r]]
   by simp
 
-sublocale M_ZF3_trans \<subseteq> M_pre_cardinal_arith "##M"
+sublocale M_ZF2_trans \<subseteq> M_pre_cardinal_arith "##M"
   using separation_instances wfrec_replacement_order_pred'[unfolded H_order_pred_def]
     replacement_is_order_eq_map[unfolded order_eq_map_def]
   by unfold_locales simp_all
 
 
 definition is_well_ord_fst_snd where
   "is_well_ord_fst_snd(A,x) \<equiv> (\<exists>a[A]. \<exists>b[A]. is_well_ord(A,a,b) \<and> is_snd(A, x, b) \<and> is_fst(A, x, a))"
 
 synthesize "is_well_ord_fst_snd" from_definition assuming "nonempty"
 arity_theorem for "is_well_ord_fst_snd_fm"
 
-lemma (in M_ZF3_trans) separation_well_ord: "separation(##M, \<lambda>x. is_well_ord(##M,fst(x), snd(x)))"
+lemma (in M_ZF2_trans) separation_well_ord: "separation(##M, \<lambda>x. is_well_ord(##M,fst(x), snd(x)))"
   using arity_is_well_ord_fst_snd_fm is_well_ord_iff_sats[symmetric] nonempty
     fst_closed snd_closed fst_abs snd_abs
     separation_in_ctm[where env="[]" and \<phi>="is_well_ord_fst_snd_fm(0)"]
   by(simp_all add: is_well_ord_fst_snd_def)
 
 
-sublocale M_ZF3_trans \<subseteq> M_pre_aleph "##M"
+sublocale M_ZF2_trans \<subseteq> M_pre_aleph "##M"
   using HAleph_wfrec_repl replacement_is_order_body
     separation_well_ord separation_Pow_rel
   by unfold_locales (simp_all add: transrec_replacement_def
       wfrec_replacement_def is_wfrec_def M_is_recfun_def flip:setclass_iff)
 
 arity_theorem intermediate for "is_HAleph_fm"
 lemma arity_is_HAleph_fm: "arity(is_HAleph_fm(2, 1, 0)) = 3"
   using arity_fun_apply_fm[of "11" 0 1,simplified]
     arity_is_HAleph_fm' arity_ordinal_fm arity_is_If_fm
     arity_empty_fm arity_is_Limit_fm
     arity_is_If_fm
     arity_is_Limit_fm arity_empty_fm
     arity_Replace_fm[where i="12" and v=10 and n=3]
     pred_Un_distrib ord_simp_union
   by (simp add:FOL_arities)
 
 lemma arity_is_Aleph[arity]: "arity(is_Aleph_fm(0, 1)) = 2"
   unfolding is_Aleph_fm_def
   using arity_transrec_fm[OF _ _ _ _ arity_is_HAleph_fm] ord_simp_union
   by simp
 
 definition bex_Aleph_rel :: "[i\<Rightarrow>o,i,i] \<Rightarrow> o" where
   "bex_Aleph_rel(M,x) \<equiv> \<lambda>y. \<exists>z\<in>x. y = \<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"
 
 relationalize "bex_Aleph_rel" "is_bex_Aleph"
 
 schematic_goal sats_is_bex_Aleph_fm_auto:
   "a \<in> nat \<Longrightarrow> c \<in> nat \<Longrightarrow> env \<in> list(A) \<Longrightarrow>
   a < length(env) \<Longrightarrow> c < length(env) \<Longrightarrow> 0 \<in> A \<Longrightarrow>
   is_bex_Aleph(##A, nth(a, env), nth(c, env)) \<longleftrightarrow> A, env \<Turnstile> ?fm(a, c)"
   unfolding is_bex_Aleph_def
   by (rule iff_sats | simp)+
 
 synthesize_notc "is_bex_Aleph" from_schematic
 
 lemma is_bex_Aleph_fm_type [TC]:
     "x \<in> \<omega> \<Longrightarrow> z \<in> \<omega> \<Longrightarrow> is_bex_Aleph_fm(x, z) \<in> formula"
   unfolding is_bex_Aleph_fm_def by simp
 
 lemma sats_is_bex_Aleph_fm:
     "x \<in> \<omega> \<Longrightarrow>
     z \<in> \<omega> \<Longrightarrow> x < length(env) \<Longrightarrow> z < length(env) \<Longrightarrow>
     env \<in> list(Aa) \<Longrightarrow>
     0 \<in> Aa \<Longrightarrow>
     (Aa, env \<Turnstile> is_bex_Aleph_fm(x, z)) \<longleftrightarrow>
     is_bex_Aleph(##Aa,nth(x, env), nth(z, env))"
   using sats_is_bex_Aleph_fm_auto unfolding is_bex_Aleph_def is_bex_Aleph_fm_def
   by simp
 
 lemma is_bex_Aleph_iff_sats [iff_sats]:
     "nth(x, env) = xa \<Longrightarrow>
     nth(z, env) = za \<Longrightarrow>
     x \<in> \<omega> \<Longrightarrow>
     z \<in> \<omega> \<Longrightarrow> x < length(env) \<Longrightarrow> z < length(env) \<Longrightarrow>
     env \<in> list(Aa) \<Longrightarrow>
     0 \<in> Aa \<Longrightarrow>
     is_bex_Aleph(##Aa, xa, za) \<longleftrightarrow>
     Aa, env \<Turnstile> is_bex_Aleph_fm(x, z)"
   using sats_is_bex_Aleph_fm by simp
 
 arity_theorem for "is_bex_Aleph_fm"
 
 lemma (in M_ZF1_trans) separation_is_bex_Aleph:
   assumes "(##M)(A)"
   shows "separation(##M,is_bex_Aleph(##M, A))"
   using assms separation_in_ctm[where env="[A]" and \<phi>="is_bex_Aleph_fm(1,0)",
       OF _ _ _ is_bex_Aleph_iff_sats[symmetric],
       of "\<lambda>_.A"]
     nonempty arity_is_bex_Aleph_fm is_bex_Aleph_fm_type
   by (simp add:ord_simp_union)
 
 lemma (in M_pre_aleph) bex_Aleph_rel_abs:
   assumes "Ord(u)" "M(u)" "M(v)"
   shows "is_bex_Aleph(M, u, v) \<longleftrightarrow> bex_Aleph_rel(M,u,v)"
   unfolding is_bex_Aleph_def bex_Aleph_rel_def
   using assms is_Aleph_iff transM[of _ u] Ord_in_Ord
   by simp
 
-lemma (in M_ZF3_trans) separation_bex_Aleph_rel:
+lemma (in M_ZF2_trans) separation_bex_Aleph_rel:
   "Ord(x) \<Longrightarrow> (##M)(x) \<Longrightarrow> separation(##M, bex_Aleph_rel(##M,x))"
   using separation_is_bex_Aleph bex_Aleph_rel_abs
     separation_cong[where P="is_bex_Aleph(##M,x)" and M="##M",THEN iffD1]
   unfolding bex_Aleph_rel_def
   by simp
 
-sublocale M_ZF3_trans \<subseteq> M_aleph "##M"
+sublocale M_ZF2_trans \<subseteq> M_aleph "##M"
   using separation_bex_Aleph_rel[unfolded bex_Aleph_rel_def]
   by unfold_locales
 
-sublocale M_ZF2_trans \<subseteq> M_FiniteFun "##M"
+sublocale M_ZF1_trans \<subseteq> M_FiniteFun "##M"
   using separation_is_function separation_omfunspace
   by unfold_locales simp
 
-sublocale M_ZFC1_trans \<subseteq> M_AC "##M"
-  using choice_ax by (unfold_locales, simp_all)
-
-sublocale M_ZFC3_trans \<subseteq> M_cardinal_AC "##M"
+sublocale M_ZFC2_trans \<subseteq> M_cardinal_AC "##M"
   using lam_replacement_minimum
   by unfold_locales simp
 
 (* TopLevel *)
 
-lemma (in M_ZF2_trans) separation_cardinal_rel_lesspoll_rel:
+lemma (in M_ZF1_trans) separation_cardinal_rel_lesspoll_rel:
   "(##M)(\<kappa>) \<Longrightarrow> separation(##M, \<lambda>x. x \<prec>\<^bsup>M\<^esup> \<kappa>)"
   using separation_in_ctm[where \<phi>="( \<cdot>0 \<prec> 1\<cdot> )" and env="[\<kappa>]"]
     is_lesspoll_iff nonempty
     arity_is_cardinal_fm arity_is_lesspoll_fm arity_is_bij_fm ord_simp_union
   by (simp add:FOL_arities)
 
-sublocale M_ZFC3_trans \<subseteq> M_library "##M"
+sublocale M_ZFC2_trans \<subseteq> M_library "##M"
   using separation_cardinal_rel_lesspoll_rel lam_replacement_minimum
   by unfold_locales simp_all
 
-locale M_ZF4 = M_ZF3 +
+locale M_ZF3 = M_ZF2 +
   assumes
-    ground_replacements4:
+    ground_replacements3:
     "ground_replacement_assm(M,env,replacement_is_order_body_fm)"
     "ground_replacement_assm(M,env,wfrec_replacement_order_pred_fm)"
     "ground_replacement_assm(M,env,list_repl1_intf_fm)"
     "ground_replacement_assm(M,env,list_repl2_intf_fm)"
     "ground_replacement_assm(M,env,formula_repl2_intf_fm)"
     "ground_replacement_assm(M,env,eclose_repl2_intf_fm)"
     "ground_replacement_assm(M,env,wfrec_rank_fm)"
     "ground_replacement_assm(M,env,trans_repl_HVFrom_fm)"
     "ground_replacement_assm(M,env,tl_repl_intf_fm)"
     "ground_replacement_assm(M,env,formula_repl1_intf_fm)"
     "ground_replacement_assm(M,env,eclose_repl1_intf_fm)"
     "ground_replacement_assm(M,env,replacement_HAleph_wfrec_repl_body_fm)"
     "ground_replacement_assm(M,env,replacement_is_order_eq_map_fm)"
 
-definition instances4_fms where "instances4_fms \<equiv>
+definition instances3_fms where "instances3_fms \<equiv>
   { ground_repl_fm(replacement_is_order_body_fm),
     ground_repl_fm(wfrec_replacement_order_pred_fm),
     ground_repl_fm(list_repl1_intf_fm),
     ground_repl_fm(list_repl2_intf_fm),
     ground_repl_fm(formula_repl2_intf_fm),
     ground_repl_fm(eclose_repl2_intf_fm),
     ground_repl_fm(wfrec_rank_fm),
     ground_repl_fm(trans_repl_HVFrom_fm),
     ground_repl_fm(tl_repl_intf_fm),
     ground_repl_fm(formula_repl1_intf_fm),
     ground_repl_fm(eclose_repl1_intf_fm),
     ground_repl_fm(replacement_HAleph_wfrec_repl_body_fm),
     ground_repl_fm(replacement_is_order_eq_map_fm) }"
 
 text\<open>This set has $13$ internalized formulas, corresponding to the total
 count of previous replacement instances (apart from those $5$ in
 \<^term>\<open>instances_ground_fms\<close> and \<^term>\<open>instances_ground_notCH_fms\<close>,
 and \<^term>\<open>replacement_dcwit_repl_body_fm\<close>).\<close>
 
 definition overhead where
-  "overhead \<equiv> instances1_fms \<union> instances2_fms \<union> instances_ground_fms"
+  "overhead \<equiv> instances1_fms \<union> instances_ground_fms"
 
 definition overhead_notCH where
-  "overhead_notCH \<equiv> overhead \<union> instances3_fms \<union>
-     instances4_fms \<union> instances_ground_notCH_fms"
+  "overhead_notCH \<equiv> overhead \<union> instances2_fms \<union>
+     instances3_fms \<union> instances_ground_notCH_fms"
 
 definition overhead_CH where
   "overhead_CH \<equiv> overhead_notCH \<union> { replacement_dcwit_repl_body_fm }"
 
 text\<open>Hence, the “overhead” to create a proper extension of a ctm by forcing
 consists of $16$ replacement instances. To force $\neg\CH$,
 31 instances are need, and one further instance is required to
 force $\CH$.\<close>
 
-lemma instances3_fms_type[TC] : "instances3_fms \<subseteq> formula"
-  unfolding instances3_fms_def replacement_is_order_body_fm_def
-    wfrec_replacement_order_pred_fm_def replacement_is_aleph_fm_def
+lemma instances2_fms_type[TC] : "instances2_fms \<subseteq> formula"
+  unfolding instances2_fms_def replacement_instances2_defs
   by (auto simp del: Lambda_in_M_fm_def)
 
 lemma overhead_type: "overhead \<subseteq> formula"
-  using instances1_fms_type instances2_fms_type instances_ground_fms_type
-  unfolding overhead_def replacement_instances1_defs replacement_instances2_defs
+  using instances1_fms_type instances_ground_fms_type
+  unfolding overhead_def replacement_instances1_defs
   by simp
 
 lemma overhead_notCH_type: "overhead_notCH \<subseteq> formula"
   using overhead_type
   unfolding overhead_notCH_def replacement_transrec_apply_image_body_fm_def
     replacement_is_trans_apply_image_fm_def instances_ground_notCH_fms_def
-    instances3_fms_def instances4_fms_def
-  by (auto simp: replacement_instances1_defs replacement_instances2_defs
-      replacement_instances3_defs simp del: Lambda_in_M_fm_def)
+    instances2_fms_def instances3_fms_def
+  by (auto simp: replacement_instances1_defs
+      replacement_instances2_defs simp del: Lambda_in_M_fm_def)
 
 lemma overhead_CH_type: "overhead_CH \<subseteq> formula"
   using overhead_notCH_type unfolding overhead_CH_def replacement_dcwit_repl_body_fm_def
   by auto
 
-locale M_ZF4_trans = M_ZF3_trans + M_ZF4
-
-locale M_ZFC4 = M_ZFC3 + M_ZF4
+locale M_ZF3_trans = M_ZF2_trans + M_ZF3
 
-locale M_ZFC4_trans = M_ZFC3_trans + M_ZF4_trans
+locale M_ZFC3 = M_ZFC2 + M_ZF3
 
-locale M_ctm4 = M_ctm3 + M_ZF4_trans
+locale M_ZFC3_trans = M_ZFC2_trans + M_ZF3_trans + M_ZFC3
 
-locale M_ctm4_AC = M_ctm4 + M_ctm1_AC + M_ZFC4_trans
+locale M_ctm3 = M_ctm2 + M_ZF3_trans
 
-lemma M_satT_imp_M_ZF2: "(M \<Turnstile> ZF) \<Longrightarrow> M_ZF2(M)"
+locale M_ctm3_AC = M_ctm3 + M_ctm1_AC + M_ZFC3_trans
+
+lemma M_satT_imp_M_ZF2: "(M \<Turnstile> ZF) \<Longrightarrow> M_ZF1(M)"
 proof -
   assume "M \<Turnstile> ZF"
   then
   have fin: "upair_ax(##M)" "Union_ax(##M)" "power_ax(##M)"
     "extensionality(##M)" "foundation_ax(##M)" "infinity_ax(##M)"
     unfolding ZF_def ZF_fin_def ZFC_fm_defs satT_def
     using ZFC_fm_sats[of M] by simp_all
   {
     fix \<phi> env
     assume "\<phi> \<in> formula" "env\<in>list(M)"
     moreover from \<open>M \<Turnstile> ZF\<close>
     have "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_separation_fm(p)))"
       "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_replacement_fm(p)))"
       unfolding ZF_def ZF_schemes_def by auto
     moreover from calculation
     have "arity(\<phi>) \<le> succ(length(env)) \<Longrightarrow> separation(##M, \<lambda>x. (M, Cons(x, env) \<Turnstile> \<phi>))"
       "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
-      using sats_ZF_separation_fm_iff sats_ZF_replacement_fm_iff by simp_all
+      using sats_ZF_separation_fm_iff sats_ZF_replacement_fm_iff
+      unfolding replacement_assm_def by simp_all
   }
   with fin
-  show "M_ZF2(M)"
+  show "M_ZF1(M)"
     by unfold_locales (simp_all add:replacement_assm_def ground_replacement_assm_def)
 qed
 
-lemma M_satT_imp_M_ZFC2:
-  shows "(M \<Turnstile> ZFC) \<longrightarrow> M_ZFC2(M)"
+lemma M_satT_imp_M_ZFC1:
+  shows "(M \<Turnstile> ZFC) \<longrightarrow> M_ZFC1(M)"
 proof -
-  have "(M \<Turnstile> ZF) \<and> choice_ax(##M) \<longrightarrow> M_ZFC2(M)"
+  have "(M \<Turnstile> ZF) \<and> choice_ax(##M) \<longrightarrow> M_ZFC1(M)"
     using M_satT_imp_M_ZF2[of M]
-    unfolding M_ZF2_def M_ZFC1_def M_ZFC2_def M_ZC_basic_def M_ZF1_def M_AC_def
+    unfolding M_ZFC1_def M_ZC_basic_def M_ZF1_def M_AC_def
     by auto
   then
   show ?thesis
     unfolding ZFC_def by auto
 qed
 
-lemma M_satT_instances12_imp_M_ZF2:
-  assumes "(M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms \<union> instances2_fms})"
-  shows "M_ZF2(M)"
+lemma M_satT_instances1_imp_M_ZF1:
+  assumes "(M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms })"
+  shows "M_ZF1(M)"
 proof -
   from assms
   have fin: "upair_ax(##M)" "Union_ax(##M)" "power_ax(##M)"
     "extensionality(##M)" "foundation_ax(##M)" "infinity_ax(##M)"
     unfolding ZF_fin_def Zermelo_fms_def ZFC_fm_defs satT_def
     using ZFC_fm_sats[of M] by simp_all
   moreover
   {
     fix \<phi> env
-    from \<open>M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms \<union> instances2_fms}\<close>
+    from \<open>M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms }\<close>
     have "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_separation_fm(p)))"
       unfolding Zermelo_fms_def ZF_def instances1_fms_def
-        instances2_fms_def by auto
+      by auto
     moreover
     assume "\<phi> \<in> formula" "env\<in>list(M)"
     ultimately
     have "arity(\<phi>) \<le> succ(length(env)) \<Longrightarrow> separation(##M, \<lambda>x. (M, Cons(x, env) \<Turnstile> \<phi>))"
       using sats_ZF_separation_fm_iff by simp_all
   }
   moreover
   {
     fix \<phi> env
-    assume "\<phi> \<in> instances1_fms \<union> instances2_fms" "env\<in>list(M)"
-    moreover from this and \<open>M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms \<union> instances2_fms}\<close>
+    assume "\<phi> \<in> instances1_fms" "env\<in>list(M)"
+    moreover from this and \<open>M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms }\<close>
     have "M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>" by auto
     ultimately
     have "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
-      using sats_ZF_replacement_fm_iff[of \<phi>] instances1_fms_type instances2_fms_type by auto
+      using sats_ZF_replacement_fm_iff[of \<phi>] instances1_fms_type
+      unfolding replacement_assm_def by auto
   }
   ultimately
   show ?thesis
-    unfolding instances1_fms_def instances2_fms_def
+    unfolding instances1_fms_def
     by unfold_locales (simp_all add:replacement_assm_def ground_replacement_assm_def)
 qed
 
 theorem M_satT_imp_M_ZF_ground_trans:
   assumes "Transset(M)" "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead}"
   shows "M_ZF_ground_trans(M)"
 proof -
   from \<open>M \<Turnstile> \<cdot>Z\<cdot> \<union> _\<close>
-  have "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms \<union> instances2_fms}"
+  have "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms }"
        "M \<Turnstile> {\<cdot>Replacement(p)\<cdot> . p \<in> instances_ground_fms }"
     unfolding overhead_def by auto
   then
-  interpret M_ZF2 M
-    using M_satT_instances12_imp_M_ZF2
+  interpret M_ZF1 M
+    using M_satT_instances1_imp_M_ZF1
     by simp
   from \<open>Transset(M)\<close>
   interpret M_ZF1_trans M
     using M_satT_imp_M_ZF2
     by unfold_locales
   {
     fix \<phi> env
     assume "\<phi> \<in> instances_ground_fms" "env\<in>list(M)"
     moreover from this and \<open>M \<Turnstile> {\<cdot>Replacement(p)\<cdot> . p \<in> instances_ground_fms}\<close>
     have "M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>" by auto
     ultimately
     have "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
-      using sats_ZF_replacement_fm_iff[of \<phi>] instances_ground_fms_type by auto
+      using sats_ZF_replacement_fm_iff[of \<phi>] instances_ground_fms_type
+      unfolding replacement_assm_def by auto
   }
   then
   show ?thesis
     unfolding instances_ground_fms_def
     by unfold_locales (simp_all add:replacement_assm_def)
 qed
 
 theorem M_satT_imp_M_ZF_ground_notCH_trans:
   assumes
     "Transset(M)"
     "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}"
   shows "M_ZF_ground_notCH_trans(M)"
 proof -
   from assms
   interpret M_ZF_ground_trans M
     using M_satT_imp_M_ZF_ground_trans unfolding overhead_notCH_def by force
   {
     fix \<phi> env
     assume "\<phi> \<in> instances_ground_notCH_fms" "env\<in>list(M)"
     moreover from this and assms
     have "M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>"
       unfolding overhead_notCH_def by auto
     ultimately
     have "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
-      using sats_ZF_replacement_fm_iff[of \<phi>] instances_ground_notCH_fms_type by auto
+      using sats_ZF_replacement_fm_iff[of \<phi>] instances_ground_notCH_fms_type
+      unfolding replacement_assm_def by auto
   }
   then
   show ?thesis
     by unfold_locales (simp_all add:replacement_assm_def instances_ground_notCH_fms_def)
 qed
 
 theorem M_satT_imp_M_ZF_ground_CH_trans:
   assumes
     "Transset(M)"
     "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_CH }"
   shows "M_ZF_ground_CH_trans(M)"
 proof -
   from assms
   interpret M_ZF_ground_notCH_trans M
     using M_satT_imp_M_ZF_ground_notCH_trans unfolding overhead_CH_def by auto
   {
     fix env
     assume "env \<in> list(M)"
     moreover from assms
     have "M, [] \<Turnstile> \<cdot>Replacement(replacement_dcwit_repl_body_fm)\<cdot>"
       unfolding overhead_CH_def by auto
     ultimately
     have "arity(replacement_dcwit_repl_body_fm) \<le> succ(succ(length(env)))
       \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,replacement_dcwit_repl_body_fm,Cons(x,Cons(y, env))))"
       using sats_ZF_replacement_fm_iff[of replacement_dcwit_repl_body_fm]
+      unfolding replacement_assm_def
       by (auto simp:replacement_dcwit_repl_body_fm_def)
   }
   then
   show ?thesis
     by unfold_locales (simp_all add:replacement_assm_def)
 qed
 
 lemma (in M_Z_basic) M_satT_Zermelo_fms: "M \<Turnstile> \<cdot>Z\<cdot>"
   using upair_ax Union_ax power_ax extensionality foundation_ax
     infinity_ax separation_ax sats_ZF_separation_fm_iff
   unfolding Zermelo_fms_def ZF_fin_def
   by auto
 
 lemma (in M_ZFC1) M_satT_ZC: "M \<Turnstile> ZC"
   using upair_ax Union_ax power_ax extensionality foundation_ax
     infinity_ax separation_ax sats_ZF_separation_fm_iff choice_ax
   unfolding ZC_def Zermelo_fms_def ZF_fin_def
   by auto
 
 locale M_ZF = M_Z_basic +
   assumes
     replacement_ax:"replacement_assm(M,env,\<phi>)"
 
+sublocale M_ZF \<subseteq> M_ZF3
+  using replacement_ax
+  by unfold_locales (simp_all add:ground_replacement_assm_def)
+
 lemma M_satT_imp_M_ZF: " M \<Turnstile> ZF \<Longrightarrow> M_ZF(M)"
 proof -
   assume "M \<Turnstile> ZF"
   then
   have fin: "upair_ax(##M)" "Union_ax(##M)" "power_ax(##M)"
     "extensionality(##M)" "foundation_ax(##M)" "infinity_ax(##M)"
     unfolding ZF_def ZF_fin_def ZFC_fm_defs satT_def
     using ZFC_fm_sats[of M] by simp_all
   {
     fix \<phi> env
     assume "\<phi> \<in> formula" "env\<in>list(M)"
     moreover from \<open>M \<Turnstile> ZF\<close>
     have "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_separation_fm(p)))"
       "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_replacement_fm(p)))"
       unfolding ZF_def ZF_schemes_def by auto
     moreover from calculation
     have "arity(\<phi>) \<le> succ(length(env)) \<Longrightarrow> separation(##M, \<lambda>x. (M, Cons(x, env) \<Turnstile> \<phi>))"
       "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
-      using sats_ZF_separation_fm_iff sats_ZF_replacement_fm_iff by simp_all
+      using sats_ZF_separation_fm_iff sats_ZF_replacement_fm_iff
+      unfolding replacement_assm_def by simp_all
   }
   with fin
   show "M_ZF(M)"
     unfolding M_ZF_def M_Z_basic_def M_ZF_axioms_def replacement_assm_def by simp
 qed
 
 lemma (in M_ZF) M_satT_ZF: "M \<Turnstile> ZF"
   using upair_ax Union_ax power_ax extensionality foundation_ax
     infinity_ax separation_ax sats_ZF_separation_fm_iff
     replacement_ax sats_ZF_replacement_fm_iff
   unfolding ZF_def ZF_schemes_def ZF_fin_def replacement_assm_def
   by auto
 
 lemma M_ZF_iff_M_satT: "M_ZF(M) \<longleftrightarrow> (M \<Turnstile> ZF)"
   using M_ZF.M_satT_ZF M_satT_imp_M_ZF
   by auto
 
 locale M_ZFC = M_ZF + M_ZC_basic
 
+sublocale M_ZFC \<subseteq> M_ZFC3
+  by unfold_locales
+
 lemma M_ZFC_iff_M_satT:
   notes iff_trans[trans]
   shows "M_ZFC(M) \<longleftrightarrow> (M \<Turnstile> ZFC)"
 proof -
   have "M_ZFC(M) \<longleftrightarrow> (M \<Turnstile> ZF) \<and> choice_ax(##M)"
     using M_ZF_iff_M_satT
     unfolding M_ZFC_def M_ZC_basic_def M_AC_def M_ZF_def by auto
   also
   have " \<dots> \<longleftrightarrow> M \<Turnstile> ZFC"
     unfolding ZFC_def by auto
   ultimately
   show ?thesis by simp
 qed
 
-lemma M_satT_imp_M_ZF4: "(M \<Turnstile> ZF) \<longrightarrow> M_ZF4(M)"
+lemma M_satT_imp_M_ZF3: "(M \<Turnstile> ZF) \<longrightarrow> M_ZF3(M)"
 proof
   assume "M \<Turnstile> ZF"
   then
-  have fin: "upair_ax(##M)" "Union_ax(##M)" "power_ax(##M)"
-    "extensionality(##M)" "foundation_ax(##M)" "infinity_ax(##M)"
-    unfolding ZF_def ZF_fin_def ZFC_fm_defs satT_def
-    using ZFC_fm_sats[of M] by simp_all
-  {
-    fix \<phi> env
-    assume "\<phi> \<in> formula" "env\<in>list(M)"
-    moreover from \<open>M \<Turnstile> ZF\<close>
-    have "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_separation_fm(p)))"
-      "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_replacement_fm(p)))"
-      unfolding ZF_def ZF_schemes_def by auto
-    moreover from calculation
-    have "arity(\<phi>) \<le> succ(length(env)) \<Longrightarrow> separation(##M, \<lambda>x. (M, Cons(x, env) \<Turnstile> \<phi>))"
-      "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
-      using sats_ZF_separation_fm_iff sats_ZF_replacement_fm_iff by simp_all
-  }
-  with fin
-  show "M_ZF4(M)"
-    by unfold_locales (simp_all add:replacement_assm_def ground_replacement_assm_def)
+  interpret M_ZF M
+    using M_satT_imp_M_ZF by simp
+  show "M_ZF3(M)"
+    by unfold_locales
 qed
 
-lemma M_satT_imp_M_ZFC4:
-  shows "(M \<Turnstile> ZFC) \<longrightarrow> M_ZFC4(M)"
-proof -
-  have "(M \<Turnstile> ZF) \<and> choice_ax(##M) \<longrightarrow> M_ZFC4(M)"
-    using M_satT_imp_M_ZF4[of M] unfolding M_ZF4_def M_ZFC1_def M_ZFC4_def
-      M_ZF3_def M_ZFC3_def M_ZF2_def M_ZFC2_def
-      M_ZC_basic_def M_ZF1_def M_AC_def by auto
+lemma M_satT_imp_M_ZFC3:
+  shows "(M \<Turnstile> ZFC) \<longrightarrow> M_ZFC3(M)"
+proof
+  assume "M \<Turnstile> ZFC"
   then
-  show ?thesis
-    unfolding ZFC_def by auto
+  interpret M_ZFC M
+    using M_ZFC_iff_M_satT  by simp
+  show "M_ZFC3(M)"
+    by unfold_locales
 qed
 
-lemma M_satT_overhead_imp_M_ZF4:
-  "(M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}) \<longrightarrow> M_ZFC4(M)"
+lemma M_satT_overhead_imp_M_ZF3:
+  "(M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}) \<longrightarrow> M_ZFC3(M)"
 proof
   assume "M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}"
   then
   have fin: "upair_ax(##M)" "Union_ax(##M)" "power_ax(##M)" "choice_ax(##M)"
     "extensionality(##M)" "foundation_ax(##M)" "infinity_ax(##M)"
     unfolding ZC_def ZF_fin_def Zermelo_fms_def ZFC_fm_defs satT_def
     using ZFC_fm_sats[of M] by simp_all
   moreover
   {
     fix \<phi> env
     from \<open>M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}\<close>
     have "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_separation_fm(p)))"
       unfolding ZC_def Zermelo_fms_def ZF_def by auto
     moreover
     assume "\<phi> \<in> formula" "env\<in>list(M)"
     ultimately
     have "arity(\<phi>) \<le> succ(length(env)) \<Longrightarrow> separation(##M, \<lambda>x. (M, Cons(x, env) \<Turnstile> \<phi>))"
       using sats_ZF_separation_fm_iff by simp_all
   }
   moreover
   {
     fix \<phi> env
     assume "\<phi> \<in> overhead_notCH" "env\<in>list(M)"
     moreover from this and \<open>M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}\<close>
     have "M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>" by auto
     ultimately
     have "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
-      using sats_ZF_replacement_fm_iff[of \<phi>] overhead_notCH_type by auto
+      using sats_ZF_replacement_fm_iff[of \<phi>] overhead_notCH_type
+      unfolding replacement_assm_def by auto
   }
   ultimately
-  show "M_ZFC4(M)"
+  show "M_ZFC3(M)"
     unfolding overhead_def overhead_notCH_def instances1_fms_def
-      instances2_fms_def instances3_fms_def instances4_fms_def
+      instances2_fms_def instances3_fms_def
     by unfold_locales (simp_all add:replacement_assm_def ground_replacement_assm_def)
 qed
 
 end
\ No newline at end of file