diff --git a/src/HOL/Library/FSet.thy b/src/HOL/Library/FSet.thy
--- a/src/HOL/Library/FSet.thy
+++ b/src/HOL/Library/FSet.thy
@@ -1,1950 +1,1950 @@
 (*  Title:      HOL/Library/FSet.thy
     Author:     Ondrej Kuncar, TU Muenchen
     Author:     Cezary Kaliszyk and Christian Urban
     Author:     Andrei Popescu, TU Muenchen
 *)
 
 section \<open>Type of finite sets defined as a subtype of sets\<close>
 
 theory FSet
 imports Main Countable
 begin
 
 subsection \<open>Definition of the type\<close>
 
 typedef 'a fset = "{A :: 'a set. finite A}"  morphisms fset Abs_fset
 by auto
 
 setup_lifting type_definition_fset
 
 
 subsection \<open>Basic operations and type class instantiations\<close>
 
 (* FIXME transfer and right_total vs. bi_total *)
 instantiation fset :: (finite) finite
 begin
 instance by (standard; transfer; simp)
 end
 
 instantiation fset :: (type) "{bounded_lattice_bot, distrib_lattice, minus}"
 begin
 
 lift_definition bot_fset :: "'a fset" is "{}" parametric empty_transfer by simp
 
 lift_definition less_eq_fset :: "'a fset \<Rightarrow> 'a fset \<Rightarrow> bool" is subset_eq parametric subset_transfer
   .
 
 definition less_fset :: "'a fset \<Rightarrow> 'a fset \<Rightarrow> bool" where "xs < ys \<equiv> xs \<le> ys \<and> xs \<noteq> (ys::'a fset)"
 
 lemma less_fset_transfer[transfer_rule]:
   includes lifting_syntax
   assumes [transfer_rule]: "bi_unique A"
   shows "((pcr_fset A) ===> (pcr_fset A) ===> (=)) (\<subset>) (<)"
   unfolding less_fset_def[abs_def] psubset_eq[abs_def] by transfer_prover
 
 
 lift_definition sup_fset :: "'a fset \<Rightarrow> 'a fset \<Rightarrow> 'a fset" is union parametric union_transfer
   by simp
 
 lift_definition inf_fset :: "'a fset \<Rightarrow> 'a fset \<Rightarrow> 'a fset" is inter parametric inter_transfer
   by simp
 
 lift_definition minus_fset :: "'a fset \<Rightarrow> 'a fset \<Rightarrow> 'a fset" is minus parametric Diff_transfer
   by simp
 
 instance
   by (standard; transfer; auto)+
 
 end
 
 abbreviation fempty :: "'a fset" ("{||}") where "{||} \<equiv> bot"
 abbreviation fsubset_eq :: "'a fset \<Rightarrow> 'a fset \<Rightarrow> bool" (infix "|\<subseteq>|" 50) where "xs |\<subseteq>| ys \<equiv> xs \<le> ys"
 abbreviation fsubset :: "'a fset \<Rightarrow> 'a fset \<Rightarrow> bool" (infix "|\<subset>|" 50) where "xs |\<subset>| ys \<equiv> xs < ys"
 abbreviation funion :: "'a fset \<Rightarrow> 'a fset \<Rightarrow> 'a fset" (infixl "|\<union>|" 65) where "xs |\<union>| ys \<equiv> sup xs ys"
 abbreviation finter :: "'a fset \<Rightarrow> 'a fset \<Rightarrow> 'a fset" (infixl "|\<inter>|" 65) where "xs |\<inter>| ys \<equiv> inf xs ys"
 abbreviation fminus :: "'a fset \<Rightarrow> 'a fset \<Rightarrow> 'a fset" (infixl "|-|" 65) where "xs |-| ys \<equiv> minus xs ys"
 
 instantiation fset :: (equal) equal
 begin
 definition "HOL.equal A B \<longleftrightarrow> A |\<subseteq>| B \<and> B |\<subseteq>| A"
 instance by intro_classes (auto simp add: equal_fset_def)
 end
 
 instantiation fset :: (type) conditionally_complete_lattice
 begin
 
 context includes lifting_syntax
 begin
 
 lemma right_total_Inf_fset_transfer:
   assumes [transfer_rule]: "bi_unique A" and [transfer_rule]: "right_total A"
   shows "(rel_set (rel_set A) ===> rel_set A)
     (\<lambda>S. if finite (\<Inter>S \<inter> Collect (Domainp A)) then \<Inter>S \<inter> Collect (Domainp A) else {})
       (\<lambda>S. if finite (Inf S) then Inf S else {})"
     by transfer_prover
 
 lemma Inf_fset_transfer:
   assumes [transfer_rule]: "bi_unique A" and [transfer_rule]: "bi_total A"
   shows "(rel_set (rel_set A) ===> rel_set A) (\<lambda>A. if finite (Inf A) then Inf A else {})
     (\<lambda>A. if finite (Inf A) then Inf A else {})"
   by transfer_prover
 
 lift_definition Inf_fset :: "'a fset set \<Rightarrow> 'a fset" is "\<lambda>A. if finite (Inf A) then Inf A else {}"
 parametric right_total_Inf_fset_transfer Inf_fset_transfer by simp
 
 lemma Sup_fset_transfer:
   assumes [transfer_rule]: "bi_unique A"
   shows "(rel_set (rel_set A) ===> rel_set A) (\<lambda>A. if finite (Sup A) then Sup A else {})
   (\<lambda>A. if finite (Sup A) then Sup A else {})" by transfer_prover
 
 lift_definition Sup_fset :: "'a fset set \<Rightarrow> 'a fset" is "\<lambda>A. if finite (Sup A) then Sup A else {}"
 parametric Sup_fset_transfer by simp
 
 lemma finite_Sup: "\<exists>z. finite z \<and> (\<forall>a. a \<in> X \<longrightarrow> a \<le> z) \<Longrightarrow> finite (Sup X)"
 by (auto intro: finite_subset)
 
 lemma transfer_bdd_below[transfer_rule]: "(rel_set (pcr_fset (=)) ===> (=)) bdd_below bdd_below"
   by auto
 
 end
 
 instance
 proof
   fix x z :: "'a fset"
   fix X :: "'a fset set"
   {
     assume "x \<in> X" "bdd_below X"
     then show "Inf X |\<subseteq>| x" by transfer auto
   next
     assume "X \<noteq> {}" "(\<And>x. x \<in> X \<Longrightarrow> z |\<subseteq>| x)"
     then show "z |\<subseteq>| Inf X" by transfer (clarsimp, blast)
   next
     assume "x \<in> X" "bdd_above X"
     then obtain z where "x \<in> X" "(\<And>x. x \<in> X \<Longrightarrow> x |\<subseteq>| z)"
       by (auto simp: bdd_above_def)
     then show "x |\<subseteq>| Sup X"
       by transfer (auto intro!: finite_Sup)
   next
     assume "X \<noteq> {}" "(\<And>x. x \<in> X \<Longrightarrow> x |\<subseteq>| z)"
     then show "Sup X |\<subseteq>| z" by transfer (clarsimp, blast)
   }
 qed
 end
 
 instantiation fset :: (finite) complete_lattice
 begin
 
 lift_definition top_fset :: "'a fset" is UNIV parametric right_total_UNIV_transfer UNIV_transfer
   by simp
 
 instance
   by (standard; transfer; auto)
 
 end
 
 instantiation fset :: (finite) complete_boolean_algebra
 begin
 
 lift_definition uminus_fset :: "'a fset \<Rightarrow> 'a fset" is uminus
   parametric right_total_Compl_transfer Compl_transfer by simp
 
 instance
   by (standard; transfer) (simp_all add: Inf_Sup Diff_eq)
 end
 
 abbreviation fUNIV :: "'a::finite fset" where "fUNIV \<equiv> top"
 abbreviation fuminus :: "'a::finite fset \<Rightarrow> 'a fset" ("|-| _" [81] 80) where "|-| x \<equiv> uminus x"
 
 declare top_fset.rep_eq[simp]
 
 
 subsection \<open>Other operations\<close>
 
 lift_definition finsert :: "'a \<Rightarrow> 'a fset \<Rightarrow> 'a fset" is insert parametric Lifting_Set.insert_transfer
   by simp
 
 syntax
   "_insert_fset"     :: "args => 'a fset"  ("{|(_)|}")
 
 translations
   "{|x, xs|}" == "CONST finsert x {|xs|}"
   "{|x|}"     == "CONST finsert x {||}"
 
-lift_definition fmember :: "'a \<Rightarrow> 'a fset \<Rightarrow> bool" (infix "|\<in>|" 50) is Set.member
-  parametric member_transfer .
-
-lemma fmember_iff_member_fset: "x |\<in>| A \<longleftrightarrow> x \<in> fset A"
-  by (rule fmember.rep_eq)
-
-abbreviation notin_fset :: "'a \<Rightarrow> 'a fset \<Rightarrow> bool" (infix "|\<notin>|" 50) where "x |\<notin>| S \<equiv> \<not> (x |\<in>| S)"
+abbreviation fmember :: "'a \<Rightarrow> 'a fset \<Rightarrow> bool" (infix "|\<in>|" 50) where
+  "a |\<in>| A \<equiv> a \<in> fset A"
+
+abbreviation notin_fset :: "'a \<Rightarrow> 'a fset \<Rightarrow> bool" (infix "|\<notin>|" 50) where
+  "x |\<notin>| S \<equiv> \<not> (x |\<in>| S)"
 
 context includes lifting_syntax
 begin
 
+lemma fmember_transfer0[transfer_rule]:
+  assumes [transfer_rule]: "bi_unique A"
+  shows "(A ===> pcr_fset A ===> (=)) (\<in>) (|\<in>|)"
+  by transfer_prover
+
 lift_definition ffilter :: "('a \<Rightarrow> bool) \<Rightarrow> 'a fset \<Rightarrow> 'a fset" is Set.filter
   parametric Lifting_Set.filter_transfer unfolding Set.filter_def by simp
 
 lift_definition fPow :: "'a fset \<Rightarrow> 'a fset fset" is Pow parametric Pow_transfer
 by (simp add: finite_subset)
 
 lift_definition fcard :: "'a fset \<Rightarrow> nat" is card parametric card_transfer .
 
 lift_definition fimage :: "('a \<Rightarrow> 'b) \<Rightarrow> 'a fset \<Rightarrow> 'b fset" (infixr "|`|" 90) is image
   parametric image_transfer by simp
 
 lift_definition fthe_elem :: "'a fset \<Rightarrow> 'a" is the_elem .
 
 lift_definition fbind :: "'a fset \<Rightarrow> ('a \<Rightarrow> 'b fset) \<Rightarrow> 'b fset" is Set.bind parametric bind_transfer
 by (simp add: Set.bind_def)
 
 lift_definition ffUnion :: "'a fset fset \<Rightarrow> 'a fset" is Union parametric Union_transfer by simp
 
 lift_definition fBall :: "'a fset \<Rightarrow> ('a \<Rightarrow> bool) \<Rightarrow> bool" is Ball parametric Ball_transfer .
 lift_definition fBex :: "'a fset \<Rightarrow> ('a \<Rightarrow> bool) \<Rightarrow> bool" is Bex parametric Bex_transfer .
 
 lift_definition ffold :: "('a \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow> 'b \<Rightarrow> 'a fset \<Rightarrow> 'b" is Finite_Set.fold .
 
 lift_definition fset_of_list :: "'a list \<Rightarrow> 'a fset" is set by (rule finite_set)
 
 lift_definition sorted_list_of_fset :: "'a::linorder fset \<Rightarrow> 'a list" is sorted_list_of_set .
 
 
 subsection \<open>Transferred lemmas from Set.thy\<close>
 
 lemma fset_eqI: "(\<And>x. (x |\<in>| A) = (x |\<in>| B)) \<Longrightarrow> A = B"
   by (rule set_eqI[Transfer.transferred])
 
 lemma fset_eq_iff[no_atp]: "(A = B) = (\<forall>x. (x |\<in>| A) = (x |\<in>| B))"
   by (rule set_eq_iff[Transfer.transferred])
 
 lemma fBallI[intro!]: "(\<And>x. x |\<in>| A \<Longrightarrow> P x) \<Longrightarrow> fBall A P"
   by (rule ballI[Transfer.transferred])
 
 lemma fbspec[dest?]: "fBall A P \<Longrightarrow> x |\<in>| A \<Longrightarrow> P x"
   by (rule bspec[Transfer.transferred])
 
 lemma fBallE[elim]: "fBall A P \<Longrightarrow> (P x \<Longrightarrow> Q) \<Longrightarrow> (x |\<notin>| A \<Longrightarrow> Q) \<Longrightarrow> Q"
   by (rule ballE[Transfer.transferred])
 
 lemma fBexI[intro]: "P x \<Longrightarrow> x |\<in>| A \<Longrightarrow> fBex A P"
   by (rule bexI[Transfer.transferred])
 
 lemma rev_fBexI[intro?]: "x |\<in>| A \<Longrightarrow> P x \<Longrightarrow> fBex A P"
   by (rule rev_bexI[Transfer.transferred])
 
 lemma fBexCI: "(fBall A (\<lambda>x. \<not> P x) \<Longrightarrow> P a) \<Longrightarrow> a |\<in>| A \<Longrightarrow> fBex A P"
   by (rule bexCI[Transfer.transferred])
 
 lemma fBexE[elim!]: "fBex A P \<Longrightarrow> (\<And>x. x |\<in>| A \<Longrightarrow> P x \<Longrightarrow> Q) \<Longrightarrow> Q"
   by (rule bexE[Transfer.transferred])
 
 lemma fBall_triv[simp]: "fBall A (\<lambda>x. P) = ((\<exists>x. x |\<in>| A) \<longrightarrow> P)"
   by (rule ball_triv[Transfer.transferred])
 
 lemma fBex_triv[simp]: "fBex A (\<lambda>x. P) = ((\<exists>x. x |\<in>| A) \<and> P)"
   by (rule bex_triv[Transfer.transferred])
 
 lemma fBex_triv_one_point1[simp]: "fBex A (\<lambda>x. x = a) = (a |\<in>| A)"
   by (rule bex_triv_one_point1[Transfer.transferred])
 
 lemma fBex_triv_one_point2[simp]: "fBex A ((=) a) = (a |\<in>| A)"
   by (rule bex_triv_one_point2[Transfer.transferred])
 
 lemma fBex_one_point1[simp]: "fBex A (\<lambda>x. x = a \<and> P x) = (a |\<in>| A \<and> P a)"
   by (rule bex_one_point1[Transfer.transferred])
 
 lemma fBex_one_point2[simp]: "fBex A (\<lambda>x. a = x \<and> P x) = (a |\<in>| A \<and> P a)"
   by (rule bex_one_point2[Transfer.transferred])
 
 lemma fBall_one_point1[simp]: "fBall A (\<lambda>x. x = a \<longrightarrow> P x) = (a |\<in>| A \<longrightarrow> P a)"
   by (rule ball_one_point1[Transfer.transferred])
 
 lemma fBall_one_point2[simp]: "fBall A (\<lambda>x. a = x \<longrightarrow> P x) = (a |\<in>| A \<longrightarrow> P a)"
   by (rule ball_one_point2[Transfer.transferred])
 
 lemma fBall_conj_distrib: "fBall A (\<lambda>x. P x \<and> Q x) = (fBall A P \<and> fBall A Q)"
   by (rule ball_conj_distrib[Transfer.transferred])
 
 lemma fBex_disj_distrib: "fBex A (\<lambda>x. P x \<or> Q x) = (fBex A P \<or> fBex A Q)"
   by (rule bex_disj_distrib[Transfer.transferred])
 
 lemma fBall_cong[fundef_cong]: "A = B \<Longrightarrow> (\<And>x. x |\<in>| B \<Longrightarrow> P x = Q x) \<Longrightarrow> fBall A P = fBall B Q"
   by (rule ball_cong[Transfer.transferred])
 
 lemma fBex_cong[fundef_cong]: "A = B \<Longrightarrow> (\<And>x. x |\<in>| B \<Longrightarrow> P x = Q x) \<Longrightarrow> fBex A P = fBex B Q"
   by (rule bex_cong[Transfer.transferred])
 
 lemma fsubsetI[intro!]: "(\<And>x. x |\<in>| A \<Longrightarrow> x |\<in>| B) \<Longrightarrow> A |\<subseteq>| B"
   by (rule subsetI[Transfer.transferred])
 
 lemma fsubsetD[elim, intro?]: "A |\<subseteq>| B \<Longrightarrow> c |\<in>| A \<Longrightarrow> c |\<in>| B"
   by (rule subsetD[Transfer.transferred])
 
 lemma rev_fsubsetD[no_atp,intro?]: "c |\<in>| A \<Longrightarrow> A |\<subseteq>| B \<Longrightarrow> c |\<in>| B"
   by (rule rev_subsetD[Transfer.transferred])
 
 lemma fsubsetCE[no_atp,elim]: "A |\<subseteq>| B \<Longrightarrow> (c |\<notin>| A \<Longrightarrow> P) \<Longrightarrow> (c |\<in>| B \<Longrightarrow> P) \<Longrightarrow> P"
   by (rule subsetCE[Transfer.transferred])
 
 lemma fsubset_eq[no_atp]: "(A |\<subseteq>| B) = fBall A (\<lambda>x. x |\<in>| B)"
   by (rule subset_eq[Transfer.transferred])
 
 lemma contra_fsubsetD[no_atp]: "A |\<subseteq>| B \<Longrightarrow> c |\<notin>| B \<Longrightarrow> c |\<notin>| A"
   by (rule contra_subsetD[Transfer.transferred])
 
 lemma fsubset_refl: "A |\<subseteq>| A"
   by (rule subset_refl[Transfer.transferred])
 
 lemma fsubset_trans: "A |\<subseteq>| B \<Longrightarrow> B |\<subseteq>| C \<Longrightarrow> A |\<subseteq>| C"
   by (rule subset_trans[Transfer.transferred])
 
 lemma fset_rev_mp: "c |\<in>| A \<Longrightarrow> A |\<subseteq>| B \<Longrightarrow> c |\<in>| B"
   by (rule rev_subsetD[Transfer.transferred])
 
 lemma fset_mp: "A |\<subseteq>| B \<Longrightarrow> c |\<in>| A \<Longrightarrow> c |\<in>| B"
   by (rule subsetD[Transfer.transferred])
 
 lemma fsubset_not_fsubset_eq[code]: "(A |\<subset>| B) = (A |\<subseteq>| B \<and> \<not> B |\<subseteq>| A)"
   by (rule subset_not_subset_eq[Transfer.transferred])
 
 lemma eq_fmem_trans: "a = b \<Longrightarrow> b |\<in>| A \<Longrightarrow> a |\<in>| A"
   by (rule eq_mem_trans[Transfer.transferred])
 
 lemma fsubset_antisym[intro!]: "A |\<subseteq>| B \<Longrightarrow> B |\<subseteq>| A \<Longrightarrow> A = B"
   by (rule subset_antisym[Transfer.transferred])
 
 lemma fequalityD1: "A = B \<Longrightarrow> A |\<subseteq>| B"
   by (rule equalityD1[Transfer.transferred])
 
 lemma fequalityD2: "A = B \<Longrightarrow> B |\<subseteq>| A"
   by (rule equalityD2[Transfer.transferred])
 
 lemma fequalityE: "A = B \<Longrightarrow> (A |\<subseteq>| B \<Longrightarrow> B |\<subseteq>| A \<Longrightarrow> P) \<Longrightarrow> P"
   by (rule equalityE[Transfer.transferred])
 
 lemma fequalityCE[elim]:
   "A = B \<Longrightarrow> (c |\<in>| A \<Longrightarrow> c |\<in>| B \<Longrightarrow> P) \<Longrightarrow> (c |\<notin>| A \<Longrightarrow> c |\<notin>| B \<Longrightarrow> P) \<Longrightarrow> P"
   by (rule equalityCE[Transfer.transferred])
 
 lemma eqfset_imp_iff: "A = B \<Longrightarrow> (x |\<in>| A) = (x |\<in>| B)"
   by (rule eqset_imp_iff[Transfer.transferred])
 
 lemma eqfelem_imp_iff: "x = y \<Longrightarrow> (x |\<in>| A) = (y |\<in>| A)"
   by (rule eqelem_imp_iff[Transfer.transferred])
 
 lemma fempty_iff[simp]: "(c |\<in>| {||}) = False"
   by (rule empty_iff[Transfer.transferred])
 
 lemma fempty_fsubsetI[iff]: "{||} |\<subseteq>| x"
   by (rule empty_subsetI[Transfer.transferred])
 
 lemma equalsffemptyI: "(\<And>y. y |\<in>| A \<Longrightarrow> False) \<Longrightarrow> A = {||}"
   by (rule equals0I[Transfer.transferred])
 
 lemma equalsffemptyD: "A = {||} \<Longrightarrow> a |\<notin>| A"
   by (rule equals0D[Transfer.transferred])
 
 lemma fBall_fempty[simp]: "fBall {||} P = True"
   by (rule ball_empty[Transfer.transferred])
 
 lemma fBex_fempty[simp]: "fBex {||} P = False"
   by (rule bex_empty[Transfer.transferred])
 
 lemma fPow_iff[iff]: "(A |\<in>| fPow B) = (A |\<subseteq>| B)"
   by (rule Pow_iff[Transfer.transferred])
 
 lemma fPowI: "A |\<subseteq>| B \<Longrightarrow> A |\<in>| fPow B"
   by (rule PowI[Transfer.transferred])
 
 lemma fPowD: "A |\<in>| fPow B \<Longrightarrow> A |\<subseteq>| B"
   by (rule PowD[Transfer.transferred])
 
 lemma fPow_bottom: "{||} |\<in>| fPow B"
   by (rule Pow_bottom[Transfer.transferred])
 
 lemma fPow_top: "A |\<in>| fPow A"
   by (rule Pow_top[Transfer.transferred])
 
 lemma fPow_not_fempty: "fPow A \<noteq> {||}"
   by (rule Pow_not_empty[Transfer.transferred])
 
 lemma finter_iff[simp]: "(c |\<in>| A |\<inter>| B) = (c |\<in>| A \<and> c |\<in>| B)"
   by (rule Int_iff[Transfer.transferred])
 
 lemma finterI[intro!]: "c |\<in>| A \<Longrightarrow> c |\<in>| B \<Longrightarrow> c |\<in>| A |\<inter>| B"
   by (rule IntI[Transfer.transferred])
 
 lemma finterD1: "c |\<in>| A |\<inter>| B \<Longrightarrow> c |\<in>| A"
   by (rule IntD1[Transfer.transferred])
 
 lemma finterD2: "c |\<in>| A |\<inter>| B \<Longrightarrow> c |\<in>| B"
   by (rule IntD2[Transfer.transferred])
 
 lemma finterE[elim!]: "c |\<in>| A |\<inter>| B \<Longrightarrow> (c |\<in>| A \<Longrightarrow> c |\<in>| B \<Longrightarrow> P) \<Longrightarrow> P"
   by (rule IntE[Transfer.transferred])
 
 lemma funion_iff[simp]: "(c |\<in>| A |\<union>| B) = (c |\<in>| A \<or> c |\<in>| B)"
   by (rule Un_iff[Transfer.transferred])
 
 lemma funionI1[elim?]: "c |\<in>| A \<Longrightarrow> c |\<in>| A |\<union>| B"
   by (rule UnI1[Transfer.transferred])
 
 lemma funionI2[elim?]: "c |\<in>| B \<Longrightarrow> c |\<in>| A |\<union>| B"
   by (rule UnI2[Transfer.transferred])
 
 lemma funionCI[intro!]: "(c |\<notin>| B \<Longrightarrow> c |\<in>| A) \<Longrightarrow> c |\<in>| A |\<union>| B"
   by (rule UnCI[Transfer.transferred])
 
 lemma funionE[elim!]: "c |\<in>| A |\<union>| B \<Longrightarrow> (c |\<in>| A \<Longrightarrow> P) \<Longrightarrow> (c |\<in>| B \<Longrightarrow> P) \<Longrightarrow> P"
   by (rule UnE[Transfer.transferred])
 
 lemma fminus_iff[simp]: "(c |\<in>| A |-| B) = (c |\<in>| A \<and> c |\<notin>| B)"
   by (rule Diff_iff[Transfer.transferred])
 
 lemma fminusI[intro!]: "c |\<in>| A \<Longrightarrow> c |\<notin>| B \<Longrightarrow> c |\<in>| A |-| B"
   by (rule DiffI[Transfer.transferred])
 
 lemma fminusD1: "c |\<in>| A |-| B \<Longrightarrow> c |\<in>| A"
   by (rule DiffD1[Transfer.transferred])
 
 lemma fminusD2: "c |\<in>| A |-| B \<Longrightarrow> c |\<in>| B \<Longrightarrow> P"
   by (rule DiffD2[Transfer.transferred])
 
 lemma fminusE[elim!]: "c |\<in>| A |-| B \<Longrightarrow> (c |\<in>| A \<Longrightarrow> c |\<notin>| B \<Longrightarrow> P) \<Longrightarrow> P"
   by (rule DiffE[Transfer.transferred])
 
 lemma finsert_iff[simp]: "(a |\<in>| finsert b A) = (a = b \<or> a |\<in>| A)"
   by (rule insert_iff[Transfer.transferred])
 
 lemma finsertI1: "a |\<in>| finsert a B"
   by (rule insertI1[Transfer.transferred])
 
 lemma finsertI2: "a |\<in>| B \<Longrightarrow> a |\<in>| finsert b B"
   by (rule insertI2[Transfer.transferred])
 
 lemma finsertE[elim!]: "a |\<in>| finsert b A \<Longrightarrow> (a = b \<Longrightarrow> P) \<Longrightarrow> (a |\<in>| A \<Longrightarrow> P) \<Longrightarrow> P"
   by (rule insertE[Transfer.transferred])
 
 lemma finsertCI[intro!]: "(a |\<notin>| B \<Longrightarrow> a = b) \<Longrightarrow> a |\<in>| finsert b B"
   by (rule insertCI[Transfer.transferred])
 
 lemma fsubset_finsert_iff:
   "(A |\<subseteq>| finsert x B) = (if x |\<in>| A then A |-| {|x|} |\<subseteq>| B else A |\<subseteq>| B)"
   by (rule subset_insert_iff[Transfer.transferred])
 
 lemma finsert_ident: "x |\<notin>| A \<Longrightarrow> x |\<notin>| B \<Longrightarrow> (finsert x A = finsert x B) = (A = B)"
   by (rule insert_ident[Transfer.transferred])
 
 lemma fsingletonI[intro!,no_atp]: "a |\<in>| {|a|}"
   by (rule singletonI[Transfer.transferred])
 
 lemma fsingletonD[dest!,no_atp]: "b |\<in>| {|a|} \<Longrightarrow> b = a"
   by (rule singletonD[Transfer.transferred])
 
 lemma fsingleton_iff: "(b |\<in>| {|a|}) = (b = a)"
   by (rule singleton_iff[Transfer.transferred])
 
 lemma fsingleton_inject[dest!]: "{|a|} = {|b|} \<Longrightarrow> a = b"
   by (rule singleton_inject[Transfer.transferred])
 
 lemma fsingleton_finsert_inj_eq[iff,no_atp]: "({|b|} = finsert a A) = (a = b \<and> A |\<subseteq>| {|b|})"
   by (rule singleton_insert_inj_eq[Transfer.transferred])
 
 lemma fsingleton_finsert_inj_eq'[iff,no_atp]: "(finsert a A = {|b|}) = (a = b \<and> A |\<subseteq>| {|b|})"
   by (rule singleton_insert_inj_eq'[Transfer.transferred])
 
 lemma fsubset_fsingletonD: "A |\<subseteq>| {|x|} \<Longrightarrow> A = {||} \<or> A = {|x|}"
   by (rule subset_singletonD[Transfer.transferred])
 
 lemma fminus_single_finsert: "A |-| {|x|} |\<subseteq>| B \<Longrightarrow> A |\<subseteq>| finsert x B"
   by (rule Diff_single_insert[Transfer.transferred])
 
 lemma fdoubleton_eq_iff: "({|a, b|} = {|c, d|}) = (a = c \<and> b = d \<or> a = d \<and> b = c)"
   by (rule doubleton_eq_iff[Transfer.transferred])
 
 lemma funion_fsingleton_iff:
   "(A |\<union>| B = {|x|}) = (A = {||} \<and> B = {|x|} \<or> A = {|x|} \<and> B = {||} \<or> A = {|x|} \<and> B = {|x|})"
   by (rule Un_singleton_iff[Transfer.transferred])
 
 lemma fsingleton_funion_iff:
   "({|x|} = A |\<union>| B) = (A = {||} \<and> B = {|x|} \<or> A = {|x|} \<and> B = {||} \<or> A = {|x|} \<and> B = {|x|})"
   by (rule singleton_Un_iff[Transfer.transferred])
 
 lemma fimage_eqI[simp, intro]: "b = f x \<Longrightarrow> x |\<in>| A \<Longrightarrow> b |\<in>| f |`| A"
   by (rule image_eqI[Transfer.transferred])
 
 lemma fimageI: "x |\<in>| A \<Longrightarrow> f x |\<in>| f |`| A"
   by (rule imageI[Transfer.transferred])
 
 lemma rev_fimage_eqI: "x |\<in>| A \<Longrightarrow> b = f x \<Longrightarrow> b |\<in>| f |`| A"
   by (rule rev_image_eqI[Transfer.transferred])
 
 lemma fimageE[elim!]: "b |\<in>| f |`| A \<Longrightarrow> (\<And>x. b = f x \<Longrightarrow> x |\<in>| A \<Longrightarrow> thesis) \<Longrightarrow> thesis"
   by (rule imageE[Transfer.transferred])
 
 lemma Compr_fimage_eq: "{x. x |\<in>| f |`| A \<and> P x} = f ` {x. x |\<in>| A \<and> P (f x)}"
   by (rule Compr_image_eq[Transfer.transferred])
 
 lemma fimage_funion: "f |`| (A |\<union>| B) = f |`| A |\<union>| f |`| B"
   by (rule image_Un[Transfer.transferred])
 
 lemma fimage_iff: "(z |\<in>| f |`| A) = fBex A (\<lambda>x. z = f x)"
   by (rule image_iff[Transfer.transferred])
 
 lemma fimage_fsubset_iff[no_atp]: "(f |`| A |\<subseteq>| B) = fBall A (\<lambda>x. f x |\<in>| B)"
   by (rule image_subset_iff[Transfer.transferred])
 
 lemma fimage_fsubsetI: "(\<And>x. x |\<in>| A \<Longrightarrow> f x |\<in>| B) \<Longrightarrow> f |`| A |\<subseteq>| B"
   by (rule image_subsetI[Transfer.transferred])
 
 lemma fimage_ident[simp]: "(\<lambda>x. x) |`| Y = Y"
   by (rule image_ident[Transfer.transferred])
 
 lemma if_split_fmem1: "((if Q then x else y) |\<in>| b) = ((Q \<longrightarrow> x |\<in>| b) \<and> (\<not> Q \<longrightarrow> y |\<in>| b))"
   by (rule if_split_mem1[Transfer.transferred])
 
 lemma if_split_fmem2: "(a |\<in>| (if Q then x else y)) = ((Q \<longrightarrow> a |\<in>| x) \<and> (\<not> Q \<longrightarrow> a |\<in>| y))"
   by (rule if_split_mem2[Transfer.transferred])
 
 lemma pfsubsetI[intro!,no_atp]: "A |\<subseteq>| B \<Longrightarrow> A \<noteq> B \<Longrightarrow> A |\<subset>| B"
   by (rule psubsetI[Transfer.transferred])
 
 lemma pfsubsetE[elim!,no_atp]: "A |\<subset>| B \<Longrightarrow> (A |\<subseteq>| B \<Longrightarrow> \<not> B |\<subseteq>| A \<Longrightarrow> R) \<Longrightarrow> R"
   by (rule psubsetE[Transfer.transferred])
 
 lemma pfsubset_finsert_iff:
   "(A |\<subset>| finsert x B) =
     (if x |\<in>| B then A |\<subset>| B else if x |\<in>| A then A |-| {|x|} |\<subset>| B else A |\<subseteq>| B)"
   by (rule psubset_insert_iff[Transfer.transferred])
 
 lemma pfsubset_eq: "(A |\<subset>| B) = (A |\<subseteq>| B \<and> A \<noteq> B)"
   by (rule psubset_eq[Transfer.transferred])
 
 lemma pfsubset_imp_fsubset: "A |\<subset>| B \<Longrightarrow> A |\<subseteq>| B"
   by (rule psubset_imp_subset[Transfer.transferred])
 
 lemma pfsubset_trans: "A |\<subset>| B \<Longrightarrow> B |\<subset>| C \<Longrightarrow> A |\<subset>| C"
   by (rule psubset_trans[Transfer.transferred])
 
 lemma pfsubsetD: "A |\<subset>| B \<Longrightarrow> c |\<in>| A \<Longrightarrow> c |\<in>| B"
   by (rule psubsetD[Transfer.transferred])
 
 lemma pfsubset_fsubset_trans: "A |\<subset>| B \<Longrightarrow> B |\<subseteq>| C \<Longrightarrow> A |\<subset>| C"
   by (rule psubset_subset_trans[Transfer.transferred])
 
 lemma fsubset_pfsubset_trans: "A |\<subseteq>| B \<Longrightarrow> B |\<subset>| C \<Longrightarrow> A |\<subset>| C"
   by (rule subset_psubset_trans[Transfer.transferred])
 
 lemma pfsubset_imp_ex_fmem: "A |\<subset>| B \<Longrightarrow> \<exists>b. b |\<in>| B |-| A"
   by (rule psubset_imp_ex_mem[Transfer.transferred])
 
 lemma fimage_fPow_mono: "f |`| A |\<subseteq>| B \<Longrightarrow> (|`|) f |`| fPow A |\<subseteq>| fPow B"
   by (rule image_Pow_mono[Transfer.transferred])
 
 lemma fimage_fPow_surj: "f |`| A = B \<Longrightarrow> (|`|) f |`| fPow A = fPow B"
   by (rule image_Pow_surj[Transfer.transferred])
 
 lemma fsubset_finsertI: "B |\<subseteq>| finsert a B"
   by (rule subset_insertI[Transfer.transferred])
 
 lemma fsubset_finsertI2: "A |\<subseteq>| B \<Longrightarrow> A |\<subseteq>| finsert b B"
   by (rule subset_insertI2[Transfer.transferred])
 
 lemma fsubset_finsert: "x |\<notin>| A \<Longrightarrow> (A |\<subseteq>| finsert x B) = (A |\<subseteq>| B)"
   by (rule subset_insert[Transfer.transferred])
 
 lemma funion_upper1: "A |\<subseteq>| A |\<union>| B"
   by (rule Un_upper1[Transfer.transferred])
 
 lemma funion_upper2P: "B |\<subseteq>| A |\<union>| B"
   by (rule Un_upper2[Transfer.transferred])
 
 lemma funion_least: "A |\<subseteq>| C \<Longrightarrow> B |\<subseteq>| C \<Longrightarrow> A |\<union>| B |\<subseteq>| C"
   by (rule Un_least[Transfer.transferred])
 
 lemma finter_lower1: "A |\<inter>| B |\<subseteq>| A"
   by (rule Int_lower1[Transfer.transferred])
 
 lemma finter_lower2: "A |\<inter>| B |\<subseteq>| B"
   by (rule Int_lower2[Transfer.transferred])
 
 lemma finter_greatest: "C |\<subseteq>| A \<Longrightarrow> C |\<subseteq>| B \<Longrightarrow> C |\<subseteq>| A |\<inter>| B"
   by (rule Int_greatest[Transfer.transferred])
 
 lemma fminus_fsubset: "A |-| B |\<subseteq>| A"
   by (rule Diff_subset[Transfer.transferred])
 
 lemma fminus_fsubset_conv: "(A |-| B |\<subseteq>| C) = (A |\<subseteq>| B |\<union>| C)"
   by (rule Diff_subset_conv[Transfer.transferred])
 
 lemma fsubset_fempty[simp]: "(A |\<subseteq>| {||}) = (A = {||})"
   by (rule subset_empty[Transfer.transferred])
 
 lemma not_pfsubset_fempty[iff]: "\<not> A |\<subset>| {||}"
   by (rule not_psubset_empty[Transfer.transferred])
 
 lemma finsert_is_funion: "finsert a A = {|a|} |\<union>| A"
   by (rule insert_is_Un[Transfer.transferred])
 
 lemma finsert_not_fempty[simp]: "finsert a A \<noteq> {||}"
   by (rule insert_not_empty[Transfer.transferred])
 
 lemma fempty_not_finsert: "{||} \<noteq> finsert a A"
   by (rule empty_not_insert[Transfer.transferred])
 
 lemma finsert_absorb: "a |\<in>| A \<Longrightarrow> finsert a A = A"
   by (rule insert_absorb[Transfer.transferred])
 
 lemma finsert_absorb2[simp]: "finsert x (finsert x A) = finsert x A"
   by (rule insert_absorb2[Transfer.transferred])
 
 lemma finsert_commute: "finsert x (finsert y A) = finsert y (finsert x A)"
   by (rule insert_commute[Transfer.transferred])
 
 lemma finsert_fsubset[simp]: "(finsert x A |\<subseteq>| B) = (x |\<in>| B \<and> A |\<subseteq>| B)"
   by (rule insert_subset[Transfer.transferred])
 
 lemma finsert_inter_finsert[simp]: "finsert a A |\<inter>| finsert a B = finsert a (A |\<inter>| B)"
   by (rule insert_inter_insert[Transfer.transferred])
 
 lemma finsert_disjoint[simp,no_atp]:
   "(finsert a A |\<inter>| B = {||}) = (a |\<notin>| B \<and> A |\<inter>| B = {||})"
   "({||} = finsert a A |\<inter>| B) = (a |\<notin>| B \<and> {||} = A |\<inter>| B)"
   by (rule insert_disjoint[Transfer.transferred])+
 
 lemma disjoint_finsert[simp,no_atp]:
   "(B |\<inter>| finsert a A = {||}) = (a |\<notin>| B \<and> B |\<inter>| A = {||})"
   "({||} = A |\<inter>| finsert b B) = (b |\<notin>| A \<and> {||} = A |\<inter>| B)"
   by (rule disjoint_insert[Transfer.transferred])+
 
 lemma fimage_fempty[simp]: "f |`| {||} = {||}"
   by (rule image_empty[Transfer.transferred])
 
 lemma fimage_finsert[simp]: "f |`| finsert a B = finsert (f a) (f |`| B)"
   by (rule image_insert[Transfer.transferred])
 
 lemma fimage_constant: "x |\<in>| A \<Longrightarrow> (\<lambda>x. c) |`| A = {|c|}"
   by (rule image_constant[Transfer.transferred])
 
 lemma fimage_constant_conv: "(\<lambda>x. c) |`| A = (if A = {||} then {||} else {|c|})"
   by (rule image_constant_conv[Transfer.transferred])
 
 lemma fimage_fimage: "f |`| g |`| A = (\<lambda>x. f (g x)) |`| A"
   by (rule image_image[Transfer.transferred])
 
 lemma finsert_fimage[simp]: "x |\<in>| A \<Longrightarrow> finsert (f x) (f |`| A) = f |`| A"
   by (rule insert_image[Transfer.transferred])
 
 lemma fimage_is_fempty[iff]: "(f |`| A = {||}) = (A = {||})"
   by (rule image_is_empty[Transfer.transferred])
 
 lemma fempty_is_fimage[iff]: "({||} = f |`| A) = (A = {||})"
   by (rule empty_is_image[Transfer.transferred])
 
 lemma fimage_cong: "M = N \<Longrightarrow> (\<And>x. x |\<in>| N \<Longrightarrow> f x = g x) \<Longrightarrow> f |`| M = g |`| N"
   by (rule image_cong[Transfer.transferred])
 
 lemma fimage_finter_fsubset: "f |`| (A |\<inter>| B) |\<subseteq>| f |`| A |\<inter>| f |`| B"
   by (rule image_Int_subset[Transfer.transferred])
 
 lemma fimage_fminus_fsubset: "f |`| A |-| f |`| B |\<subseteq>| f |`| (A |-| B)"
   by (rule image_diff_subset[Transfer.transferred])
 
 lemma finter_absorb: "A |\<inter>| A = A"
   by (rule Int_absorb[Transfer.transferred])
 
 lemma finter_left_absorb: "A |\<inter>| (A |\<inter>| B) = A |\<inter>| B"
   by (rule Int_left_absorb[Transfer.transferred])
 
 lemma finter_commute: "A |\<inter>| B = B |\<inter>| A"
   by (rule Int_commute[Transfer.transferred])
 
 lemma finter_left_commute: "A |\<inter>| (B |\<inter>| C) = B |\<inter>| (A |\<inter>| C)"
   by (rule Int_left_commute[Transfer.transferred])
 
 lemma finter_assoc: "A |\<inter>| B |\<inter>| C = A |\<inter>| (B |\<inter>| C)"
   by (rule Int_assoc[Transfer.transferred])
 
 lemma finter_ac:
   "A |\<inter>| B |\<inter>| C = A |\<inter>| (B |\<inter>| C)"
   "A |\<inter>| (A |\<inter>| B) = A |\<inter>| B"
   "A |\<inter>| B = B |\<inter>| A"
   "A |\<inter>| (B |\<inter>| C) = B |\<inter>| (A |\<inter>| C)"
   by (rule Int_ac[Transfer.transferred])+
 
 lemma finter_absorb1: "B |\<subseteq>| A \<Longrightarrow> A |\<inter>| B = B"
   by (rule Int_absorb1[Transfer.transferred])
 
 lemma finter_absorb2: "A |\<subseteq>| B \<Longrightarrow> A |\<inter>| B = A"
   by (rule Int_absorb2[Transfer.transferred])
 
 lemma finter_fempty_left: "{||} |\<inter>| B = {||}"
   by (rule Int_empty_left[Transfer.transferred])
 
 lemma finter_fempty_right: "A |\<inter>| {||} = {||}"
   by (rule Int_empty_right[Transfer.transferred])
 
 lemma disjoint_iff_fnot_equal: "(A |\<inter>| B = {||}) = fBall A (\<lambda>x. fBall B ((\<noteq>) x))"
   by (rule disjoint_iff_not_equal[Transfer.transferred])
 
 lemma finter_funion_distrib: "A |\<inter>| (B |\<union>| C) = A |\<inter>| B |\<union>| (A |\<inter>| C)"
   by (rule Int_Un_distrib[Transfer.transferred])
 
 lemma finter_funion_distrib2: "B |\<union>| C |\<inter>| A = B |\<inter>| A |\<union>| (C |\<inter>| A)"
   by (rule Int_Un_distrib2[Transfer.transferred])
 
 lemma finter_fsubset_iff[no_atp, simp]: "(C |\<subseteq>| A |\<inter>| B) = (C |\<subseteq>| A \<and> C |\<subseteq>| B)"
   by (rule Int_subset_iff[Transfer.transferred])
 
 lemma funion_absorb: "A |\<union>| A = A"
   by (rule Un_absorb[Transfer.transferred])
 
 lemma funion_left_absorb: "A |\<union>| (A |\<union>| B) = A |\<union>| B"
   by (rule Un_left_absorb[Transfer.transferred])
 
 lemma funion_commute: "A |\<union>| B = B |\<union>| A"
   by (rule Un_commute[Transfer.transferred])
 
 lemma funion_left_commute: "A |\<union>| (B |\<union>| C) = B |\<union>| (A |\<union>| C)"
   by (rule Un_left_commute[Transfer.transferred])
 
 lemma funion_assoc: "A |\<union>| B |\<union>| C = A |\<union>| (B |\<union>| C)"
   by (rule Un_assoc[Transfer.transferred])
 
 lemma funion_ac:
   "A |\<union>| B |\<union>| C = A |\<union>| (B |\<union>| C)"
   "A |\<union>| (A |\<union>| B) = A |\<union>| B"
   "A |\<union>| B = B |\<union>| A"
   "A |\<union>| (B |\<union>| C) = B |\<union>| (A |\<union>| C)"
   by (rule Un_ac[Transfer.transferred])+
 
 lemma funion_absorb1: "A |\<subseteq>| B \<Longrightarrow> A |\<union>| B = B"
   by (rule Un_absorb1[Transfer.transferred])
 
 lemma funion_absorb2: "B |\<subseteq>| A \<Longrightarrow> A |\<union>| B = A"
   by (rule Un_absorb2[Transfer.transferred])
 
 lemma funion_fempty_left: "{||} |\<union>| B = B"
   by (rule Un_empty_left[Transfer.transferred])
 
 lemma funion_fempty_right: "A |\<union>| {||} = A"
   by (rule Un_empty_right[Transfer.transferred])
 
 lemma funion_finsert_left[simp]: "finsert a B |\<union>| C = finsert a (B |\<union>| C)"
   by (rule Un_insert_left[Transfer.transferred])
 
 lemma funion_finsert_right[simp]: "A |\<union>| finsert a B = finsert a (A |\<union>| B)"
   by (rule Un_insert_right[Transfer.transferred])
 
 lemma finter_finsert_left: "finsert a B |\<inter>| C = (if a |\<in>| C then finsert a (B |\<inter>| C) else B |\<inter>| C)"
   by (rule Int_insert_left[Transfer.transferred])
 
 lemma finter_finsert_left_ifffempty[simp]: "a |\<notin>| C \<Longrightarrow> finsert a B |\<inter>| C = B |\<inter>| C"
   by (rule Int_insert_left_if0[Transfer.transferred])
 
 lemma finter_finsert_left_if1[simp]: "a |\<in>| C \<Longrightarrow> finsert a B |\<inter>| C = finsert a (B |\<inter>| C)"
   by (rule Int_insert_left_if1[Transfer.transferred])
 
 lemma finter_finsert_right:
   "A |\<inter>| finsert a B = (if a |\<in>| A then finsert a (A |\<inter>| B) else A |\<inter>| B)"
   by (rule Int_insert_right[Transfer.transferred])
 
 lemma finter_finsert_right_ifffempty[simp]: "a |\<notin>| A \<Longrightarrow> A |\<inter>| finsert a B = A |\<inter>| B"
   by (rule Int_insert_right_if0[Transfer.transferred])
 
 lemma finter_finsert_right_if1[simp]: "a |\<in>| A \<Longrightarrow> A |\<inter>| finsert a B = finsert a (A |\<inter>| B)"
   by (rule Int_insert_right_if1[Transfer.transferred])
 
 lemma funion_finter_distrib: "A |\<union>| (B |\<inter>| C) = A |\<union>| B |\<inter>| (A |\<union>| C)"
   by (rule Un_Int_distrib[Transfer.transferred])
 
 lemma funion_finter_distrib2: "B |\<inter>| C |\<union>| A = B |\<union>| A |\<inter>| (C |\<union>| A)"
   by (rule Un_Int_distrib2[Transfer.transferred])
 
 lemma funion_finter_crazy:
   "A |\<inter>| B |\<union>| (B |\<inter>| C) |\<union>| (C |\<inter>| A) = A |\<union>| B |\<inter>| (B |\<union>| C) |\<inter>| (C |\<union>| A)"
   by (rule Un_Int_crazy[Transfer.transferred])
 
 lemma fsubset_funion_eq: "(A |\<subseteq>| B) = (A |\<union>| B = B)"
   by (rule subset_Un_eq[Transfer.transferred])
 
 lemma funion_fempty[iff]: "(A |\<union>| B = {||}) = (A = {||} \<and> B = {||})"
   by (rule Un_empty[Transfer.transferred])
 
 lemma funion_fsubset_iff[no_atp, simp]: "(A |\<union>| B |\<subseteq>| C) = (A |\<subseteq>| C \<and> B |\<subseteq>| C)"
   by (rule Un_subset_iff[Transfer.transferred])
 
 lemma funion_fminus_finter: "A |-| B |\<union>| (A |\<inter>| B) = A"
   by (rule Un_Diff_Int[Transfer.transferred])
 
 lemma ffunion_empty[simp]: "ffUnion {||} = {||}"
   by (rule Union_empty[Transfer.transferred])
 
 lemma ffunion_mono: "A |\<subseteq>| B \<Longrightarrow> ffUnion A |\<subseteq>| ffUnion B"
   by (rule Union_mono[Transfer.transferred])
 
 lemma ffunion_insert[simp]: "ffUnion (finsert a B) = a |\<union>| ffUnion B"
   by (rule Union_insert[Transfer.transferred])
 
 lemma fminus_finter2: "A |\<inter>| C |-| (B |\<inter>| C) = A |\<inter>| C |-| B"
   by (rule Diff_Int2[Transfer.transferred])
 
 lemma funion_finter_assoc_eq: "(A |\<inter>| B |\<union>| C = A |\<inter>| (B |\<union>| C)) = (C |\<subseteq>| A)"
   by (rule Un_Int_assoc_eq[Transfer.transferred])
 
 lemma fBall_funion: "fBall (A |\<union>| B) P = (fBall A P \<and> fBall B P)"
   by (rule ball_Un[Transfer.transferred])
 
 lemma fBex_funion: "fBex (A |\<union>| B) P = (fBex A P \<or> fBex B P)"
   by (rule bex_Un[Transfer.transferred])
 
 lemma fminus_eq_fempty_iff[simp,no_atp]: "(A |-| B = {||}) = (A |\<subseteq>| B)"
   by (rule Diff_eq_empty_iff[Transfer.transferred])
 
 lemma fminus_cancel[simp]: "A |-| A = {||}"
   by (rule Diff_cancel[Transfer.transferred])
 
 lemma fminus_idemp[simp]: "A |-| B |-| B = A |-| B"
   by (rule Diff_idemp[Transfer.transferred])
 
 lemma fminus_triv: "A |\<inter>| B = {||} \<Longrightarrow> A |-| B = A"
   by (rule Diff_triv[Transfer.transferred])
 
 lemma fempty_fminus[simp]: "{||} |-| A = {||}"
   by (rule empty_Diff[Transfer.transferred])
 
 lemma fminus_fempty[simp]: "A |-| {||} = A"
   by (rule Diff_empty[Transfer.transferred])
 
 lemma fminus_finsertffempty[simp,no_atp]: "x |\<notin>| A \<Longrightarrow> A |-| finsert x B = A |-| B"
   by (rule Diff_insert0[Transfer.transferred])
 
 lemma fminus_finsert: "A |-| finsert a B = A |-| B |-| {|a|}"
   by (rule Diff_insert[Transfer.transferred])
 
 lemma fminus_finsert2: "A |-| finsert a B = A |-| {|a|} |-| B"
   by (rule Diff_insert2[Transfer.transferred])
 
 lemma finsert_fminus_if: "finsert x A |-| B = (if x |\<in>| B then A |-| B else finsert x (A |-| B))"
   by (rule insert_Diff_if[Transfer.transferred])
 
 lemma finsert_fminus1[simp]: "x |\<in>| B \<Longrightarrow> finsert x A |-| B = A |-| B"
   by (rule insert_Diff1[Transfer.transferred])
 
 lemma finsert_fminus_single[simp]: "finsert a (A |-| {|a|}) = finsert a A"
   by (rule insert_Diff_single[Transfer.transferred])
 
 lemma finsert_fminus: "a |\<in>| A \<Longrightarrow> finsert a (A |-| {|a|}) = A"
   by (rule insert_Diff[Transfer.transferred])
 
 lemma fminus_finsert_absorb: "x |\<notin>| A \<Longrightarrow> finsert x A |-| {|x|} = A"
   by (rule Diff_insert_absorb[Transfer.transferred])
 
 lemma fminus_disjoint[simp]: "A |\<inter>| (B |-| A) = {||}"
   by (rule Diff_disjoint[Transfer.transferred])
 
 lemma fminus_partition: "A |\<subseteq>| B \<Longrightarrow> A |\<union>| (B |-| A) = B"
   by (rule Diff_partition[Transfer.transferred])
 
 lemma double_fminus: "A |\<subseteq>| B \<Longrightarrow> B |\<subseteq>| C \<Longrightarrow> B |-| (C |-| A) = A"
   by (rule double_diff[Transfer.transferred])
 
 lemma funion_fminus_cancel[simp]: "A |\<union>| (B |-| A) = A |\<union>| B"
   by (rule Un_Diff_cancel[Transfer.transferred])
 
 lemma funion_fminus_cancel2[simp]: "B |-| A |\<union>| A = B |\<union>| A"
   by (rule Un_Diff_cancel2[Transfer.transferred])
 
 lemma fminus_funion: "A |-| (B |\<union>| C) = A |-| B |\<inter>| (A |-| C)"
   by (rule Diff_Un[Transfer.transferred])
 
 lemma fminus_finter: "A |-| (B |\<inter>| C) = A |-| B |\<union>| (A |-| C)"
   by (rule Diff_Int[Transfer.transferred])
 
 lemma funion_fminus: "A |\<union>| B |-| C = A |-| C |\<union>| (B |-| C)"
   by (rule Un_Diff[Transfer.transferred])
 
 lemma finter_fminus: "A |\<inter>| B |-| C = A |\<inter>| (B |-| C)"
   by (rule Int_Diff[Transfer.transferred])
 
 lemma fminus_finter_distrib: "C |\<inter>| (A |-| B) = C |\<inter>| A |-| (C |\<inter>| B)"
   by (rule Diff_Int_distrib[Transfer.transferred])
 
 lemma fminus_finter_distrib2: "A |-| B |\<inter>| C = A |\<inter>| C |-| (B |\<inter>| C)"
   by (rule Diff_Int_distrib2[Transfer.transferred])
 
 lemma fUNIV_bool[no_atp]: "fUNIV = {|False, True|}"
   by (rule UNIV_bool[Transfer.transferred])
 
 lemma fPow_fempty[simp]: "fPow {||} = {|{||}|}"
   by (rule Pow_empty[Transfer.transferred])
 
 lemma fPow_finsert: "fPow (finsert a A) = fPow A |\<union>| finsert a |`| fPow A"
   by (rule Pow_insert[Transfer.transferred])
 
 lemma funion_fPow_fsubset: "fPow A |\<union>| fPow B |\<subseteq>| fPow (A |\<union>| B)"
   by (rule Un_Pow_subset[Transfer.transferred])
 
 lemma fPow_finter_eq[simp]: "fPow (A |\<inter>| B) = fPow A |\<inter>| fPow B"
   by (rule Pow_Int_eq[Transfer.transferred])
 
 lemma fset_eq_fsubset: "(A = B) = (A |\<subseteq>| B \<and> B |\<subseteq>| A)"
   by (rule set_eq_subset[Transfer.transferred])
 
 lemma fsubset_iff[no_atp]: "(A |\<subseteq>| B) = (\<forall>t. t |\<in>| A \<longrightarrow> t |\<in>| B)"
   by (rule subset_iff[Transfer.transferred])
 
 lemma fsubset_iff_pfsubset_eq: "(A |\<subseteq>| B) = (A |\<subset>| B \<or> A = B)"
   by (rule subset_iff_psubset_eq[Transfer.transferred])
 
 lemma all_not_fin_conv[simp]: "(\<forall>x. x |\<notin>| A) = (A = {||})"
   by (rule all_not_in_conv[Transfer.transferred])
 
 lemma ex_fin_conv: "(\<exists>x. x |\<in>| A) = (A \<noteq> {||})"
   by (rule ex_in_conv[Transfer.transferred])
 
 lemma fimage_mono: "A |\<subseteq>| B \<Longrightarrow> f |`| A |\<subseteq>| f |`| B"
   by (rule image_mono[Transfer.transferred])
 
 lemma fPow_mono: "A |\<subseteq>| B \<Longrightarrow> fPow A |\<subseteq>| fPow B"
   by (rule Pow_mono[Transfer.transferred])
 
 lemma finsert_mono: "C |\<subseteq>| D \<Longrightarrow> finsert a C |\<subseteq>| finsert a D"
   by (rule insert_mono[Transfer.transferred])
 
 lemma funion_mono: "A |\<subseteq>| C \<Longrightarrow> B |\<subseteq>| D \<Longrightarrow> A |\<union>| B |\<subseteq>| C |\<union>| D"
   by (rule Un_mono[Transfer.transferred])
 
 lemma finter_mono: "A |\<subseteq>| C \<Longrightarrow> B |\<subseteq>| D \<Longrightarrow> A |\<inter>| B |\<subseteq>| C |\<inter>| D"
   by (rule Int_mono[Transfer.transferred])
 
 lemma fminus_mono: "A |\<subseteq>| C \<Longrightarrow> D |\<subseteq>| B \<Longrightarrow> A |-| B |\<subseteq>| C |-| D"
   by (rule Diff_mono[Transfer.transferred])
 
 lemma fin_mono: "A |\<subseteq>| B \<Longrightarrow> x |\<in>| A \<longrightarrow> x |\<in>| B"
   by (rule in_mono[Transfer.transferred])
 
 lemma fthe_felem_eq[simp]: "fthe_elem {|x|} = x"
   by (rule the_elem_eq[Transfer.transferred])
 
 lemma fLeast_mono:
   "mono f \<Longrightarrow> fBex S (\<lambda>x. fBall S ((\<le>) x)) \<Longrightarrow> (LEAST y. y |\<in>| f |`| S) = f (LEAST x. x |\<in>| S)"
   by (rule Least_mono[Transfer.transferred])
 
 lemma fbind_fbind: "fbind (fbind A B) C = fbind A (\<lambda>x. fbind (B x) C)"
   by (rule Set.bind_bind[Transfer.transferred])
 
 lemma fempty_fbind[simp]: "fbind {||} f = {||}"
   by (rule empty_bind[Transfer.transferred])
 
 lemma nonfempty_fbind_const: "A \<noteq> {||} \<Longrightarrow> fbind A (\<lambda>_. B) = B"
   by (rule nonempty_bind_const[Transfer.transferred])
 
 lemma fbind_const: "fbind A (\<lambda>_. B) = (if A = {||} then {||} else B)"
   by (rule bind_const[Transfer.transferred])
 
 lemma ffmember_filter[simp]: "(x |\<in>| ffilter P A) = (x |\<in>| A \<and> P x)"
   by (rule member_filter[Transfer.transferred])
 
 lemma fequalityI: "A |\<subseteq>| B \<Longrightarrow> B |\<subseteq>| A \<Longrightarrow> A = B"
   by (rule equalityI[Transfer.transferred])
 
 lemma fset_of_list_simps[simp]:
   "fset_of_list [] = {||}"
   "fset_of_list (x21 # x22) = finsert x21 (fset_of_list x22)"
   by (rule set_simps[Transfer.transferred])+
 
 lemma fset_of_list_append[simp]: "fset_of_list (xs @ ys) = fset_of_list xs |\<union>| fset_of_list ys"
   by (rule set_append[Transfer.transferred])
 
 lemma fset_of_list_rev[simp]: "fset_of_list (rev xs) = fset_of_list xs"
   by (rule set_rev[Transfer.transferred])
 
 lemma fset_of_list_map[simp]: "fset_of_list (map f xs) = f |`| fset_of_list xs"
   by (rule set_map[Transfer.transferred])
 
 
 subsection \<open>Additional lemmas\<close>
 
 subsubsection \<open>\<open>ffUnion\<close>\<close>
 
 lemma ffUnion_funion_distrib[simp]: "ffUnion (A |\<union>| B) = ffUnion A |\<union>| ffUnion B"
   by (rule Union_Un_distrib[Transfer.transferred])
 
 
 subsubsection \<open>\<open>fbind\<close>\<close>
 
 lemma fbind_cong[fundef_cong]: "A = B \<Longrightarrow> (\<And>x. x |\<in>| B \<Longrightarrow> f x = g x) \<Longrightarrow> fbind A f = fbind B g"
 by transfer force
 
 
 subsubsection \<open>\<open>fsingleton\<close>\<close>
 
 lemma fsingletonE: " b |\<in>| {|a|} \<Longrightarrow> (b = a \<Longrightarrow> thesis) \<Longrightarrow> thesis"
   by (rule fsingletonD [elim_format])
 
 
 subsubsection \<open>\<open>femepty\<close>\<close>
 
 lemma fempty_ffilter[simp]: "ffilter (\<lambda>_. False) A = {||}"
 by transfer auto
 
 (* FIXME, transferred doesn't work here *)
 lemma femptyE [elim!]: "a |\<in>| {||} \<Longrightarrow> P"
   by simp
 
 
 subsubsection \<open>\<open>fset\<close>\<close>
 
 lemma fset_simps[simp]:
   "fset {||} = {}"
   "fset (finsert x X) = insert x (fset X)"
   by (rule bot_fset.rep_eq finsert.rep_eq)+
 
 lemma finite_fset [simp]:
   shows "finite (fset S)"
   by transfer simp
 
 lemmas fset_cong = fset_inject
 
 lemma filter_fset [simp]:
   shows "fset (ffilter P xs) = Collect P \<inter> fset xs"
   by transfer auto
 
-lemma notin_fset: "x |\<notin>| S \<longleftrightarrow> x \<notin> fset S"
-  by (simp add: fmember_iff_member_fset)
-
 lemma inter_fset[simp]: "fset (A |\<inter>| B) = fset A \<inter> fset B"
   by (rule inf_fset.rep_eq)
 
 lemma union_fset[simp]: "fset (A |\<union>| B) = fset A \<union> fset B"
   by (rule sup_fset.rep_eq)
 
 lemma minus_fset[simp]: "fset (A |-| B) = fset A - fset B"
   by (rule minus_fset.rep_eq)
 
 
 subsubsection \<open>\<open>ffilter\<close>\<close>
 
 lemma subset_ffilter:
   "ffilter P A |\<subseteq>| ffilter Q A = (\<forall> x. x |\<in>| A \<longrightarrow> P x \<longrightarrow> Q x)"
   by transfer auto
 
 lemma eq_ffilter:
   "(ffilter P A = ffilter Q A) = (\<forall>x. x |\<in>| A \<longrightarrow> P x = Q x)"
   by transfer auto
 
 lemma pfsubset_ffilter:
   "(\<And>x. x |\<in>| A \<Longrightarrow> P x \<Longrightarrow> Q x) \<Longrightarrow> (x |\<in>| A \<and> \<not> P x \<and> Q x) \<Longrightarrow>
     ffilter P A |\<subset>| ffilter Q A"
   unfolding less_fset_def by (auto simp add: subset_ffilter eq_ffilter)
 
 
 subsubsection \<open>\<open>fset_of_list\<close>\<close>
 
 lemma fset_of_list_filter[simp]:
   "fset_of_list (filter P xs) = ffilter P (fset_of_list xs)"
   by transfer (auto simp: Set.filter_def)
 
 lemma fset_of_list_subset[intro]:
   "set xs \<subseteq> set ys \<Longrightarrow> fset_of_list xs |\<subseteq>| fset_of_list ys"
   by transfer simp
 
 lemma fset_of_list_elem: "(x |\<in>| fset_of_list xs) \<longleftrightarrow> (x \<in> set xs)"
   by transfer simp
 
 
 subsubsection \<open>\<open>finsert\<close>\<close>
 
 (* FIXME, transferred doesn't work here *)
 lemma set_finsert:
   assumes "x |\<in>| A"
   obtains B where "A = finsert x B" and "x |\<notin>| B"
 using assms by transfer (metis Set.set_insert finite_insert)
 
 lemma mk_disjoint_finsert: "a |\<in>| A \<Longrightarrow> \<exists>B. A = finsert a B \<and> a |\<notin>| B"
   by (rule exI [where x = "A |-| {|a|}"]) blast
 
 lemma finsert_eq_iff:
   assumes "a |\<notin>| A" and "b |\<notin>| B"
   shows "(finsert a A = finsert b B) =
     (if a = b then A = B else \<exists>C. A = finsert b C \<and> b |\<notin>| C \<and> B = finsert a C \<and> a |\<notin>| C)"
   using assms by transfer (force simp: insert_eq_iff)
 
 
 subsubsection \<open>\<open>fimage\<close>\<close>
 
 lemma subset_fimage_iff: "(B |\<subseteq>| f|`|A) = (\<exists> AA. AA |\<subseteq>| A \<and> B = f|`|AA)"
 by transfer (metis mem_Collect_eq rev_finite_subset subset_image_iff)
 
 lemma fimage_strict_mono:
   assumes "inj_on f (fset B)" and "A |\<subset>| B"
   shows "f |`| A |\<subset>| f |`| B"
   \<comment> \<open>TODO: Configure transfer framework to lift @{thm Fun.image_strict_mono}.\<close>
 proof (rule pfsubsetI)
   from \<open>A |\<subset>| B\<close> have "A |\<subseteq>| B"
     by (rule pfsubset_imp_fsubset)
   thus "f |`| A |\<subseteq>| f |`| B"
     by (rule fimage_mono)
 next
   from \<open>A |\<subset>| B\<close> have "A |\<subseteq>| B" and "A \<noteq> B"
     by (simp_all add: pfsubset_eq)
 
   have "fset A \<noteq> fset B"
     using \<open>A \<noteq> B\<close>
     by (simp add: fset_cong)
   hence "f ` fset A \<noteq> f ` fset B"
     using \<open>A |\<subseteq>| B\<close>
     by (simp add: inj_on_image_eq_iff[OF \<open>inj_on f (fset B)\<close>] less_eq_fset.rep_eq)
   hence "fset (f |`| A) \<noteq> fset (f |`| B)"
     by (simp add: fimage.rep_eq)
   thus "f |`| A \<noteq> f |`| B"
     by (simp add: fset_cong)
 qed
 
 
 subsubsection \<open>bounded quantification\<close>
 
 lemma bex_simps [simp, no_atp]:
   "\<And>A P Q. fBex A (\<lambda>x. P x \<and> Q) = (fBex A P \<and> Q)"
   "\<And>A P Q. fBex A (\<lambda>x. P \<and> Q x) = (P \<and> fBex A Q)"
   "\<And>P. fBex {||} P = False"
   "\<And>a B P. fBex (finsert a B) P = (P a \<or> fBex B P)"
   "\<And>A P f. fBex (f |`| A) P = fBex A (\<lambda>x. P (f x))"
   "\<And>A P. (\<not> fBex A P) = fBall A (\<lambda>x. \<not> P x)"
 by auto
 
 lemma ball_simps [simp, no_atp]:
   "\<And>A P Q. fBall A (\<lambda>x. P x \<or> Q) = (fBall A P \<or> Q)"
   "\<And>A P Q. fBall A (\<lambda>x. P \<or> Q x) = (P \<or> fBall A Q)"
   "\<And>A P Q. fBall A (\<lambda>x. P \<longrightarrow> Q x) = (P \<longrightarrow> fBall A Q)"
   "\<And>A P Q. fBall A (\<lambda>x. P x \<longrightarrow> Q) = (fBex A P \<longrightarrow> Q)"
   "\<And>P. fBall {||} P = True"
   "\<And>a B P. fBall (finsert a B) P = (P a \<and> fBall B P)"
   "\<And>A P f. fBall (f |`| A) P = fBall A (\<lambda>x. P (f x))"
   "\<And>A P. (\<not> fBall A P) = fBex A (\<lambda>x. \<not> P x)"
 by auto
 
 lemma atomize_fBall:
     "(\<And>x. x |\<in>| A ==> P x) == Trueprop (fBall A (\<lambda>x. P x))"
 apply (simp only: atomize_all atomize_imp)
 apply (rule equal_intr_rule)
   by (transfer, simp)+
 
 lemma fBall_mono[mono]: "P \<le> Q \<Longrightarrow> fBall S P \<le> fBall S Q"
 by auto
 
 lemma fBex_mono[mono]: "P \<le> Q \<Longrightarrow> fBex S P \<le> fBex S Q"
 by auto
 
 end
 
 
 subsubsection \<open>\<open>fcard\<close>\<close>
 
 (* FIXME: improve transferred to handle bounded meta quantification *)
 
 lemma fcard_fempty:
   "fcard {||} = 0"
   by transfer (rule card.empty)
 
 lemma fcard_finsert_disjoint:
   "x |\<notin>| A \<Longrightarrow> fcard (finsert x A) = Suc (fcard A)"
   by transfer (rule card_insert_disjoint)
 
 lemma fcard_finsert_if:
   "fcard (finsert x A) = (if x |\<in>| A then fcard A else Suc (fcard A))"
   by transfer (rule card_insert_if)
 
 lemma fcard_0_eq [simp, no_atp]:
   "fcard A = 0 \<longleftrightarrow> A = {||}"
   by transfer (rule card_0_eq)
 
 lemma fcard_Suc_fminus1:
   "x |\<in>| A \<Longrightarrow> Suc (fcard (A |-| {|x|})) = fcard A"
   by transfer (rule card_Suc_Diff1)
 
 lemma fcard_fminus_fsingleton:
   "x |\<in>| A \<Longrightarrow> fcard (A |-| {|x|}) = fcard A - 1"
   by transfer (rule card_Diff_singleton)
 
 lemma fcard_fminus_fsingleton_if:
   "fcard (A |-| {|x|}) = (if x |\<in>| A then fcard A - 1 else fcard A)"
   by transfer (rule card_Diff_singleton_if)
 
 lemma fcard_fminus_finsert[simp]:
   assumes "a |\<in>| A" and "a |\<notin>| B"
   shows "fcard (A |-| finsert a B) = fcard (A |-| B) - 1"
 using assms by transfer (rule card_Diff_insert)
 
 lemma fcard_finsert: "fcard (finsert x A) = Suc (fcard (A |-| {|x|}))"
 by transfer (rule card.insert_remove)
 
 lemma fcard_finsert_le: "fcard A \<le> fcard (finsert x A)"
 by transfer (rule card_insert_le)
 
 lemma fcard_mono:
   "A |\<subseteq>| B \<Longrightarrow> fcard A \<le> fcard B"
 by transfer (rule card_mono)
 
 lemma fcard_seteq: "A |\<subseteq>| B \<Longrightarrow> fcard B \<le> fcard A \<Longrightarrow> A = B"
 by transfer (rule card_seteq)
 
 lemma pfsubset_fcard_mono: "A |\<subset>| B \<Longrightarrow> fcard A < fcard B"
 by transfer (rule psubset_card_mono)
 
 lemma fcard_funion_finter:
   "fcard A + fcard B = fcard (A |\<union>| B) + fcard (A |\<inter>| B)"
 by transfer (rule card_Un_Int)
 
 lemma fcard_funion_disjoint:
   "A |\<inter>| B = {||} \<Longrightarrow> fcard (A |\<union>| B) = fcard A + fcard B"
 by transfer (rule card_Un_disjoint)
 
 lemma fcard_funion_fsubset:
   "B |\<subseteq>| A \<Longrightarrow> fcard (A |-| B) = fcard A - fcard B"
 by transfer (rule card_Diff_subset)
 
 lemma diff_fcard_le_fcard_fminus:
   "fcard A - fcard B \<le> fcard(A |-| B)"
 by transfer (rule diff_card_le_card_Diff)
 
 lemma fcard_fminus1_less: "x |\<in>| A \<Longrightarrow> fcard (A |-| {|x|}) < fcard A"
 by transfer (rule card_Diff1_less)
 
 lemma fcard_fminus2_less:
   "x |\<in>| A \<Longrightarrow> y |\<in>| A \<Longrightarrow> fcard (A |-| {|x|} |-| {|y|}) < fcard A"
 by transfer (rule card_Diff2_less)
 
 lemma fcard_fminus1_le: "fcard (A |-| {|x|}) \<le> fcard A"
 by transfer (rule card_Diff1_le)
 
 lemma fcard_pfsubset: "A |\<subseteq>| B \<Longrightarrow> fcard A < fcard B \<Longrightarrow> A < B"
 by transfer (rule card_psubset)
 
 
 subsubsection \<open>\<open>sorted_list_of_fset\<close>\<close>
 
 lemma sorted_list_of_fset_simps[simp]:
   "set (sorted_list_of_fset S) = fset S"
   "fset_of_list (sorted_list_of_fset S) = S"
 by (transfer, simp)+
 
 
 subsubsection \<open>\<open>ffold\<close>\<close>
 
 (* FIXME: improve transferred to handle bounded meta quantification *)
 
 context comp_fun_commute
 begin
   lemma ffold_empty[simp]: "ffold f z {||} = z"
     by (rule fold_empty[Transfer.transferred])
 
   lemma ffold_finsert [simp]:
     assumes "x |\<notin>| A"
     shows "ffold f z (finsert x A) = f x (ffold f z A)"
     using assms by (transfer fixing: f) (rule fold_insert)
 
   lemma ffold_fun_left_comm:
     "f x (ffold f z A) = ffold f (f x z) A"
     by (transfer fixing: f) (rule fold_fun_left_comm)
 
   lemma ffold_finsert2:
     "x |\<notin>| A \<Longrightarrow> ffold f z (finsert x A) = ffold f (f x z) A"
     by (transfer fixing: f) (rule fold_insert2)
 
   lemma ffold_rec:
     assumes "x |\<in>| A"
     shows "ffold f z A = f x (ffold f z (A |-| {|x|}))"
     using assms by (transfer fixing: f) (rule fold_rec)
 
   lemma ffold_finsert_fremove:
     "ffold f z (finsert x A) = f x (ffold f z (A |-| {|x|}))"
      by (transfer fixing: f) (rule fold_insert_remove)
 end
 
 lemma ffold_fimage:
   assumes "inj_on g (fset A)"
   shows "ffold f z (g |`| A) = ffold (f \<circ> g) z A"
 using assms by transfer' (rule fold_image)
 
 lemma ffold_cong:
   assumes "comp_fun_commute f" "comp_fun_commute g"
   "\<And>x. x |\<in>| A \<Longrightarrow> f x = g x"
     and "s = t" and "A = B"
   shows "ffold f s A = ffold g t B"
   using assms[unfolded comp_fun_commute_def']
   by transfer (meson Finite_Set.fold_cong subset_UNIV)
 
 context comp_fun_idem
 begin
 
   lemma ffold_finsert_idem:
     "ffold f z (finsert x A) = f x (ffold f z A)"
     by (transfer fixing: f) (rule fold_insert_idem)
 
   declare ffold_finsert [simp del] ffold_finsert_idem [simp]
 
   lemma ffold_finsert_idem2:
     "ffold f z (finsert x A) = ffold f (f x z) A"
     by (transfer fixing: f) (rule fold_insert_idem2)
 
 end
 
 
 subsubsection \<open>@{term fsubset}\<close>
 
 lemma wfP_pfsubset: "wfP (|\<subset>|)"
 proof (rule wfP_if_convertible_to_nat)
   show "\<And>x y. x |\<subset>| y \<Longrightarrow> fcard x < fcard y"
     by (rule pfsubset_fcard_mono)
 qed
 
 
 subsubsection \<open>Group operations\<close>
 
 locale comm_monoid_fset = comm_monoid
 begin
 
 sublocale set: comm_monoid_set ..
 
 lift_definition F :: "('b \<Rightarrow> 'a) \<Rightarrow> 'b fset \<Rightarrow> 'a" is set.F .
 
 lemma cong[fundef_cong]: "A = B \<Longrightarrow> (\<And>x. x |\<in>| B \<Longrightarrow> g x = h x) \<Longrightarrow> F g A = F h B"
   by (rule set.cong[Transfer.transferred])
 
 lemma cong_simp[cong]:
   "\<lbrakk> A = B;  \<And>x. x |\<in>| B =simp=> g x = h x \<rbrakk> \<Longrightarrow> F g A = F h B"
 unfolding simp_implies_def by (auto cong: cong)
 
 end
 
 context comm_monoid_add begin
 
 sublocale fsum: comm_monoid_fset plus 0
   rewrites "comm_monoid_set.F plus 0 = sum"
   defines fsum = fsum.F
 proof -
   show "comm_monoid_fset (+) 0" by standard
 
   show "comm_monoid_set.F (+) 0 = sum" unfolding sum_def ..
 qed
 
 end
 
 
 subsubsection \<open>Semilattice operations\<close>
 
 locale semilattice_fset = semilattice
 begin
 
 sublocale set: semilattice_set ..
 
 lift_definition F :: "'a fset \<Rightarrow> 'a" is set.F .
 
 lemma eq_fold: "F (finsert x A) = ffold f x A"
   by transfer (rule set.eq_fold)
 
 lemma singleton [simp]: "F {|x|} = x"
   by transfer (rule set.singleton)
 
 lemma insert_not_elem: "x |\<notin>| A \<Longrightarrow> A \<noteq> {||} \<Longrightarrow> F (finsert x A) = x \<^bold>* F A"
   by transfer (rule set.insert_not_elem)
 
 lemma in_idem: "x |\<in>| A \<Longrightarrow> x \<^bold>* F A = F A"
   by transfer (rule set.in_idem)
 
 lemma insert [simp]: "A \<noteq> {||} \<Longrightarrow> F (finsert x A) = x \<^bold>* F A"
   by transfer (rule set.insert)
 
 end
 
 locale semilattice_order_fset = binary?: semilattice_order + semilattice_fset
 begin
 
 end
 
 
 context linorder begin
 
 sublocale fMin: semilattice_order_fset min less_eq less
   rewrites "semilattice_set.F min = Min"
   defines fMin = fMin.F
 proof -
   show "semilattice_order_fset min (\<le>) (<)" by standard
 
   show "semilattice_set.F min = Min" unfolding Min_def ..
 qed
 
 sublocale fMax: semilattice_order_fset max greater_eq greater
   rewrites "semilattice_set.F max = Max"
   defines fMax = fMax.F
 proof -
   show "semilattice_order_fset max (\<ge>) (>)"
     by standard
 
   show "semilattice_set.F max = Max"
     unfolding Max_def ..
 qed
 
 end
 
 lemma mono_fMax_commute: "mono f \<Longrightarrow> A \<noteq> {||} \<Longrightarrow> f (fMax A) = fMax (f |`| A)"
   by transfer (rule mono_Max_commute)
 
 lemma mono_fMin_commute: "mono f \<Longrightarrow> A \<noteq> {||} \<Longrightarrow> f (fMin A) = fMin (f |`| A)"
   by transfer (rule mono_Min_commute)
 
 lemma fMax_in[simp]: "A \<noteq> {||} \<Longrightarrow> fMax A |\<in>| A"
   by transfer (rule Max_in)
 
 lemma fMin_in[simp]: "A \<noteq> {||} \<Longrightarrow> fMin A |\<in>| A"
   by transfer (rule Min_in)
 
 lemma fMax_ge[simp]: "x |\<in>| A \<Longrightarrow> x \<le> fMax A"
   by transfer (rule Max_ge)
 
 lemma fMin_le[simp]: "x |\<in>| A \<Longrightarrow> fMin A \<le> x"
   by transfer (rule Min_le)
 
 lemma fMax_eqI: "(\<And>y. y |\<in>| A \<Longrightarrow> y \<le> x) \<Longrightarrow> x |\<in>| A \<Longrightarrow> fMax A = x"
   by transfer (rule Max_eqI)
 
 lemma fMin_eqI: "(\<And>y. y |\<in>| A \<Longrightarrow> x \<le> y) \<Longrightarrow> x |\<in>| A \<Longrightarrow> fMin A = x"
   by transfer (rule Min_eqI)
 
 lemma fMax_finsert[simp]: "fMax (finsert x A) = (if A = {||} then x else max x (fMax A))"
   by transfer simp
 
 lemma fMin_finsert[simp]: "fMin (finsert x A) = (if A = {||} then x else min x (fMin A))"
   by transfer simp
 
 context linorder begin
 
 lemma fset_linorder_max_induct[case_names fempty finsert]:
   assumes "P {||}"
   and     "\<And>x S. \<lbrakk>\<forall>y. y |\<in>| S \<longrightarrow> y < x; P S\<rbrakk> \<Longrightarrow> P (finsert x S)"
   shows "P S"
 proof -
   (* FIXME transfer and right_total vs. bi_total *)
   note Domainp_forall_transfer[transfer_rule]
   show ?thesis
   using assms by (transfer fixing: less) (auto intro: finite_linorder_max_induct)
 qed
 
 lemma fset_linorder_min_induct[case_names fempty finsert]:
   assumes "P {||}"
   and     "\<And>x S. \<lbrakk>\<forall>y. y |\<in>| S \<longrightarrow> y > x; P S\<rbrakk> \<Longrightarrow> P (finsert x S)"
   shows "P S"
 proof -
   (* FIXME transfer and right_total vs. bi_total *)
   note Domainp_forall_transfer[transfer_rule]
   show ?thesis
   using assms by (transfer fixing: less) (auto intro: finite_linorder_min_induct)
 qed
 
 end
 
 
 subsection \<open>Choice in fsets\<close>
 
 lemma fset_choice:
   assumes "\<forall>x. x |\<in>| A \<longrightarrow> (\<exists>y. P x y)"
   shows "\<exists>f. \<forall>x. x |\<in>| A \<longrightarrow> P x (f x)"
   using assms by transfer metis
 
 
 subsection \<open>Induction and Cases rules for fsets\<close>
 
 lemma fset_exhaust [case_names empty insert, cases type: fset]:
   assumes fempty_case: "S = {||} \<Longrightarrow> P"
   and     finsert_case: "\<And>x S'. S = finsert x S' \<Longrightarrow> P"
   shows "P"
   using assms by transfer blast
 
 lemma fset_induct [case_names empty insert]:
   assumes fempty_case: "P {||}"
   and     finsert_case: "\<And>x S. P S \<Longrightarrow> P (finsert x S)"
   shows "P S"
 proof -
   (* FIXME transfer and right_total vs. bi_total *)
   note Domainp_forall_transfer[transfer_rule]
   show ?thesis
   using assms by transfer (auto intro: finite_induct)
 qed
 
 lemma fset_induct_stronger [case_names empty insert, induct type: fset]:
   assumes empty_fset_case: "P {||}"
   and     insert_fset_case: "\<And>x S. \<lbrakk>x |\<notin>| S; P S\<rbrakk> \<Longrightarrow> P (finsert x S)"
   shows "P S"
 proof -
   (* FIXME transfer and right_total vs. bi_total *)
   note Domainp_forall_transfer[transfer_rule]
   show ?thesis
   using assms by transfer (auto intro: finite_induct)
 qed
 
 lemma fset_card_induct:
   assumes empty_fset_case: "P {||}"
   and     card_fset_Suc_case: "\<And>S T. Suc (fcard S) = (fcard T) \<Longrightarrow> P S \<Longrightarrow> P T"
   shows "P S"
 proof (induct S)
   case empty
   show "P {||}" by (rule empty_fset_case)
 next
   case (insert x S)
   have h: "P S" by fact
   have "x |\<notin>| S" by fact
   then have "Suc (fcard S) = fcard (finsert x S)"
     by transfer auto
   then show "P (finsert x S)"
     using h card_fset_Suc_case by simp
 qed
 
 lemma fset_strong_cases:
   obtains "xs = {||}"
     | ys x where "x |\<notin>| ys" and "xs = finsert x ys"
 by transfer blast
 
 lemma fset_induct2:
   "P {||} {||} \<Longrightarrow>
   (\<And>x xs. x |\<notin>| xs \<Longrightarrow> P (finsert x xs) {||}) \<Longrightarrow>
   (\<And>y ys. y |\<notin>| ys \<Longrightarrow> P {||} (finsert y ys)) \<Longrightarrow>
   (\<And>x xs y ys. \<lbrakk>P xs ys; x |\<notin>| xs; y |\<notin>| ys\<rbrakk> \<Longrightarrow> P (finsert x xs) (finsert y ys)) \<Longrightarrow>
   P xsa ysa"
   apply (induct xsa arbitrary: ysa)
   apply (induct_tac x rule: fset_induct_stronger)
   apply simp_all
   apply (induct_tac xa rule: fset_induct_stronger)
   apply simp_all
   done
 
 
 subsection \<open>Setup for Lifting/Transfer\<close>
 
 subsubsection \<open>Relator and predicator properties\<close>
 
 lift_definition rel_fset :: "('a \<Rightarrow> 'b \<Rightarrow> bool) \<Rightarrow> 'a fset \<Rightarrow> 'b fset \<Rightarrow> bool" is rel_set
 parametric rel_set_transfer .
 
 lemma rel_fset_alt_def: "rel_fset R = (\<lambda>A B. (\<forall>x.\<exists>y. x|\<in>|A \<longrightarrow> y|\<in>|B \<and> R x y)
   \<and> (\<forall>y. \<exists>x. y|\<in>|B \<longrightarrow> x|\<in>|A \<and> R x y))"
 apply (rule ext)+
 apply transfer'
 apply (subst rel_set_def[unfolded fun_eq_iff])
 by blast
 
 lemma finite_rel_set:
   assumes fin: "finite X" "finite Z"
   assumes R_S: "rel_set (R OO S) X Z"
   shows "\<exists>Y. finite Y \<and> rel_set R X Y \<and> rel_set S Y Z"
 proof -
   obtain f where f: "\<forall>x\<in>X. R x (f x) \<and> (\<exists>z\<in>Z. S (f x) z)"
   apply atomize_elim
   apply (subst bchoice_iff[symmetric])
   using R_S[unfolded rel_set_def OO_def] by blast
 
   obtain g where g: "\<forall>z\<in>Z. S (g z) z \<and> (\<exists>x\<in>X. R x (g z))"
   apply atomize_elim
   apply (subst bchoice_iff[symmetric])
   using R_S[unfolded rel_set_def OO_def] by blast
 
   let ?Y = "f ` X \<union> g ` Z"
   have "finite ?Y" by (simp add: fin)
   moreover have "rel_set R X ?Y"
     unfolding rel_set_def
     using f g by clarsimp blast
   moreover have "rel_set S ?Y Z"
     unfolding rel_set_def
     using f g by clarsimp blast
   ultimately show ?thesis by metis
 qed
 
 subsubsection \<open>Transfer rules for the Transfer package\<close>
 
 text \<open>Unconditional transfer rules\<close>
 
 context includes lifting_syntax
 begin
 
 lemma fempty_transfer [transfer_rule]:
   "rel_fset A {||} {||}"
   by (rule empty_transfer[Transfer.transferred])
 
 lemma finsert_transfer [transfer_rule]:
   "(A ===> rel_fset A ===> rel_fset A) finsert finsert"
   unfolding rel_fun_def rel_fset_alt_def by blast
 
 lemma funion_transfer [transfer_rule]:
   "(rel_fset A ===> rel_fset A ===> rel_fset A) funion funion"
   unfolding rel_fun_def rel_fset_alt_def by blast
 
 lemma ffUnion_transfer [transfer_rule]:
   "(rel_fset (rel_fset A) ===> rel_fset A) ffUnion ffUnion"
   unfolding rel_fun_def rel_fset_alt_def by transfer (simp, fast)
 
 lemma fimage_transfer [transfer_rule]:
   "((A ===> B) ===> rel_fset A ===> rel_fset B) fimage fimage"
   unfolding rel_fun_def rel_fset_alt_def by simp blast
 
 lemma fBall_transfer [transfer_rule]:
   "(rel_fset A ===> (A ===> (=)) ===> (=)) fBall fBall"
   unfolding rel_fset_alt_def rel_fun_def by blast
 
 lemma fBex_transfer [transfer_rule]:
   "(rel_fset A ===> (A ===> (=)) ===> (=)) fBex fBex"
   unfolding rel_fset_alt_def rel_fun_def by blast
 
 (* FIXME transfer doesn't work here *)
 lemma fPow_transfer [transfer_rule]:
   "(rel_fset A ===> rel_fset (rel_fset A)) fPow fPow"
   unfolding rel_fun_def
   using Pow_transfer[unfolded rel_fun_def, rule_format, Transfer.transferred]
   by blast
 
 lemma rel_fset_transfer [transfer_rule]:
   "((A ===> B ===> (=)) ===> rel_fset A ===> rel_fset B ===> (=))
     rel_fset rel_fset"
   unfolding rel_fun_def
   using rel_set_transfer[unfolded rel_fun_def,rule_format, Transfer.transferred, where A = A and B = B]
   by simp
 
 lemma bind_transfer [transfer_rule]:
   "(rel_fset A ===> (A ===> rel_fset B) ===> rel_fset B) fbind fbind"
   unfolding rel_fun_def
   using bind_transfer[unfolded rel_fun_def, rule_format, Transfer.transferred] by blast
 
 text \<open>Rules requiring bi-unique, bi-total or right-total relations\<close>
 
 lemma fmember_transfer [transfer_rule]:
   assumes "bi_unique A"
   shows "(A ===> rel_fset A ===> (=)) (|\<in>|) (|\<in>|)"
   using assms unfolding rel_fun_def rel_fset_alt_def bi_unique_def by metis
 
 lemma finter_transfer [transfer_rule]:
   assumes "bi_unique A"
   shows "(rel_fset A ===> rel_fset A ===> rel_fset A) finter finter"
   using assms unfolding rel_fun_def
   using inter_transfer[unfolded rel_fun_def, rule_format, Transfer.transferred] by blast
 
 lemma fminus_transfer [transfer_rule]:
   assumes "bi_unique A"
   shows "(rel_fset A ===> rel_fset A ===> rel_fset A) (|-|) (|-|)"
   using assms unfolding rel_fun_def
   using Diff_transfer[unfolded rel_fun_def, rule_format, Transfer.transferred] by blast
 
 lemma fsubset_transfer [transfer_rule]:
   assumes "bi_unique A"
   shows "(rel_fset A ===> rel_fset A ===> (=)) (|\<subseteq>|) (|\<subseteq>|)"
   using assms unfolding rel_fun_def
   using subset_transfer[unfolded rel_fun_def, rule_format, Transfer.transferred] by blast
 
 lemma fSup_transfer [transfer_rule]:
   "bi_unique A \<Longrightarrow> (rel_set (rel_fset A) ===> rel_fset A) Sup Sup"
   unfolding rel_fun_def
   apply clarify
   apply transfer'
   using Sup_fset_transfer[unfolded rel_fun_def] by blast
 
 (* FIXME: add right_total_fInf_transfer *)
 
 lemma fInf_transfer [transfer_rule]:
   assumes "bi_unique A" and "bi_total A"
   shows "(rel_set (rel_fset A) ===> rel_fset A) Inf Inf"
   using assms unfolding rel_fun_def
   apply clarify
   apply transfer'
   using Inf_fset_transfer[unfolded rel_fun_def] by blast
 
 lemma ffilter_transfer [transfer_rule]:
   assumes "bi_unique A"
   shows "((A ===> (=)) ===> rel_fset A ===> rel_fset A) ffilter ffilter"
   using assms unfolding rel_fun_def
   using Lifting_Set.filter_transfer[unfolded rel_fun_def, rule_format, Transfer.transferred] by blast
 
 lemma card_transfer [transfer_rule]:
   "bi_unique A \<Longrightarrow> (rel_fset A ===> (=)) fcard fcard"
   unfolding rel_fun_def
   using card_transfer[unfolded rel_fun_def, rule_format, Transfer.transferred] by blast
 
 end
 
 lifting_update fset.lifting
 lifting_forget fset.lifting
 
 
 subsection \<open>BNF setup\<close>
 
 context
 includes fset.lifting
 begin
 
 lemma rel_fset_alt:
   "rel_fset R a b \<longleftrightarrow> (\<forall>t \<in> fset a. \<exists>u \<in> fset b. R t u) \<and> (\<forall>t \<in> fset b. \<exists>u \<in> fset a. R u t)"
 by transfer (simp add: rel_set_def)
 
 lemma fset_to_fset: "finite A \<Longrightarrow> fset (the_inv fset A) = A"
 apply (rule f_the_inv_into_f[unfolded inj_on_def])
 apply (simp add: fset_inject)
 apply (rule range_eqI Abs_fset_inverse[symmetric] CollectI)+
 .
 
 lemma rel_fset_aux:
 "(\<forall>t \<in> fset a. \<exists>u \<in> fset b. R t u) \<and> (\<forall>u \<in> fset b. \<exists>t \<in> fset a. R t u) \<longleftrightarrow>
  ((BNF_Def.Grp {a. fset a \<subseteq> {(a, b). R a b}} (fimage fst))\<inverse>\<inverse> OO
   BNF_Def.Grp {a. fset a \<subseteq> {(a, b). R a b}} (fimage snd)) a b" (is "?L = ?R")
 proof
   assume ?L
   define R' where "R' =
     the_inv fset (Collect (case_prod R) \<inter> (fset a \<times> fset b))" (is "_ = the_inv fset ?L'")
   have "finite ?L'" by (intro finite_Int[OF disjI2] finite_cartesian_product) (transfer, simp)+
   hence *: "fset R' = ?L'" unfolding R'_def by (intro fset_to_fset)
   show ?R unfolding Grp_def relcompp.simps conversep.simps
   proof (intro CollectI case_prodI exI[of _ a] exI[of _ b] exI[of _ R'] conjI refl)
     from * show "a = fimage fst R'" using conjunct1[OF \<open>?L\<close>]
       by (transfer, auto simp add: image_def Int_def split: prod.splits)
     from * show "b = fimage snd R'" using conjunct2[OF \<open>?L\<close>]
       by (transfer, auto simp add: image_def Int_def split: prod.splits)
   qed (auto simp add: *)
 next
   assume ?R thus ?L unfolding Grp_def relcompp.simps conversep.simps
   apply (simp add: subset_eq Ball_def)
   apply (rule conjI)
   apply (transfer, clarsimp, metis snd_conv)
   by (transfer, clarsimp, metis fst_conv)
 qed
 
 bnf "'a fset"
   map: fimage
   sets: fset
   bd: natLeq
   wits: "{||}"
   rel: rel_fset
 apply -
           apply transfer' apply simp
          apply transfer' apply force
         apply transfer apply force
        apply transfer' apply force
       apply (rule natLeq_card_order)
        apply (rule natLeq_cinfinite)
   apply (rule regularCard_natLeq)
     apply transfer apply (metis finite_iff_ordLess_natLeq)
    apply (fastforce simp: rel_fset_alt)
  apply (simp add: Grp_def relcompp.simps conversep.simps fun_eq_iff rel_fset_alt
    rel_fset_aux[unfolded OO_Grp_alt])
 apply transfer apply simp
 done
 
 lemma rel_fset_fset: "rel_set \<chi> (fset A1) (fset A2) = rel_fset \<chi> A1 A2"
   by transfer (rule refl)
 
 end
 
 declare
   fset.map_comp[simp]
   fset.map_id[simp]
   fset.set_map[simp]
 
 
 subsection \<open>Size setup\<close>
 
 context includes fset.lifting begin
 lift_definition size_fset :: "('a \<Rightarrow> nat) \<Rightarrow> 'a fset \<Rightarrow> nat" is "\<lambda>f. sum (Suc \<circ> f)" .
 end
 
 instantiation fset :: (type) size begin
 definition size_fset where
   size_fset_overloaded_def: "size_fset = FSet.size_fset (\<lambda>_. 0)"
 instance ..
 end
 
 lemma size_fset_simps[simp]: "size_fset f X = (\<Sum>x \<in> fset X. Suc (f x))"
   by (rule size_fset_def[THEN meta_eq_to_obj_eq, THEN fun_cong, THEN fun_cong,
     unfolded map_fun_def comp_def id_apply])
 
 lemma size_fset_overloaded_simps[simp]: "size X = (\<Sum>x \<in> fset X. Suc 0)"
   by (rule size_fset_simps[of "\<lambda>_. 0", unfolded add_0_left add_0_right,
     folded size_fset_overloaded_def])
 
 lemma fset_size_o_map: "inj f \<Longrightarrow> size_fset g \<circ> fimage f = size_fset (g \<circ> f)"
   apply (subst fun_eq_iff)
   including fset.lifting by transfer (auto intro: sum.reindex_cong subset_inj_on)
 
 setup \<open>
 BNF_LFP_Size.register_size_global \<^type_name>\<open>fset\<close> \<^const_name>\<open>size_fset\<close>
   @{thm size_fset_overloaded_def} @{thms size_fset_simps size_fset_overloaded_simps}
   @{thms fset_size_o_map}
 \<close>
 
 lifting_update fset.lifting
 lifting_forget fset.lifting
 
 subsection \<open>Advanced relator customization\<close>
 
 text \<open>Set vs. sum relators:\<close>
 
 lemma rel_set_rel_sum[simp]:
 "rel_set (rel_sum \<chi> \<phi>) A1 A2 \<longleftrightarrow>
  rel_set \<chi> (Inl -` A1) (Inl -` A2) \<and> rel_set \<phi> (Inr -` A1) (Inr -` A2)"
 (is "?L \<longleftrightarrow> ?Rl \<and> ?Rr")
 proof safe
   assume L: "?L"
   show ?Rl unfolding rel_set_def Bex_def vimage_eq proof safe
     fix l1 assume "Inl l1 \<in> A1"
     then obtain a2 where a2: "a2 \<in> A2" and "rel_sum \<chi> \<phi> (Inl l1) a2"
     using L unfolding rel_set_def by auto
     then obtain l2 where "a2 = Inl l2 \<and> \<chi> l1 l2" by (cases a2, auto)
     thus "\<exists> l2. Inl l2 \<in> A2 \<and> \<chi> l1 l2" using a2 by auto
   next
     fix l2 assume "Inl l2 \<in> A2"
     then obtain a1 where a1: "a1 \<in> A1" and "rel_sum \<chi> \<phi> a1 (Inl l2)"
     using L unfolding rel_set_def by auto
     then obtain l1 where "a1 = Inl l1 \<and> \<chi> l1 l2" by (cases a1, auto)
     thus "\<exists> l1. Inl l1 \<in> A1 \<and> \<chi> l1 l2" using a1 by auto
   qed
   show ?Rr unfolding rel_set_def Bex_def vimage_eq proof safe
     fix r1 assume "Inr r1 \<in> A1"
     then obtain a2 where a2: "a2 \<in> A2" and "rel_sum \<chi> \<phi> (Inr r1) a2"
     using L unfolding rel_set_def by auto
     then obtain r2 where "a2 = Inr r2 \<and> \<phi> r1 r2" by (cases a2, auto)
     thus "\<exists> r2. Inr r2 \<in> A2 \<and> \<phi> r1 r2" using a2 by auto
   next
     fix r2 assume "Inr r2 \<in> A2"
     then obtain a1 where a1: "a1 \<in> A1" and "rel_sum \<chi> \<phi> a1 (Inr r2)"
     using L unfolding rel_set_def by auto
     then obtain r1 where "a1 = Inr r1 \<and> \<phi> r1 r2" by (cases a1, auto)
     thus "\<exists> r1. Inr r1 \<in> A1 \<and> \<phi> r1 r2" using a1 by auto
   qed
 next
   assume Rl: "?Rl" and Rr: "?Rr"
   show ?L unfolding rel_set_def Bex_def vimage_eq proof safe
     fix a1 assume a1: "a1 \<in> A1"
     show "\<exists> a2. a2 \<in> A2 \<and> rel_sum \<chi> \<phi> a1 a2"
     proof(cases a1)
       case (Inl l1) then obtain l2 where "Inl l2 \<in> A2 \<and> \<chi> l1 l2"
       using Rl a1 unfolding rel_set_def by blast
       thus ?thesis unfolding Inl by auto
     next
       case (Inr r1) then obtain r2 where "Inr r2 \<in> A2 \<and> \<phi> r1 r2"
       using Rr a1 unfolding rel_set_def by blast
       thus ?thesis unfolding Inr by auto
     qed
   next
     fix a2 assume a2: "a2 \<in> A2"
     show "\<exists> a1. a1 \<in> A1 \<and> rel_sum \<chi> \<phi> a1 a2"
     proof(cases a2)
       case (Inl l2) then obtain l1 where "Inl l1 \<in> A1 \<and> \<chi> l1 l2"
       using Rl a2 unfolding rel_set_def by blast
       thus ?thesis unfolding Inl by auto
     next
       case (Inr r2) then obtain r1 where "Inr r1 \<in> A1 \<and> \<phi> r1 r2"
       using Rr a2 unfolding rel_set_def by blast
       thus ?thesis unfolding Inr by auto
     qed
   qed
 qed
 
 
 subsubsection \<open>Countability\<close>
 
 lemma exists_fset_of_list: "\<exists>xs. fset_of_list xs = S"
 including fset.lifting
 by transfer (rule finite_list)
 
 lemma fset_of_list_surj[simp, intro]: "surj fset_of_list"
 proof -
   have "x \<in> range fset_of_list" for x :: "'a fset"
     unfolding image_iff
     using exists_fset_of_list by fastforce
   thus ?thesis by auto
 qed
 
 instance fset :: (countable) countable
 proof
   obtain to_nat :: "'a list \<Rightarrow> nat" where "inj to_nat"
     by (metis ex_inj)
   moreover have "inj (inv fset_of_list)"
     using fset_of_list_surj by (rule surj_imp_inj_inv)
   ultimately have "inj (to_nat \<circ> inv fset_of_list)"
     by (rule inj_compose)
   thus "\<exists>to_nat::'a fset \<Rightarrow> nat. inj to_nat"
     by auto
 qed
 
 
 subsection \<open>Quickcheck setup\<close>
 
 text \<open>Setup adapted from sets.\<close>
 
 notation Quickcheck_Exhaustive.orelse (infixr "orelse" 55)
 
 context
   includes term_syntax
 begin
 
 definition [code_unfold]:
 "valterm_femptyset = Code_Evaluation.valtermify ({||} :: ('a :: typerep) fset)"
 
 definition [code_unfold]:
 "valtermify_finsert x s = Code_Evaluation.valtermify finsert {\<cdot>} (x :: ('a :: typerep * _)) {\<cdot>} s"
 
 end
 
 instantiation fset :: (exhaustive) exhaustive
 begin
 
 fun exhaustive_fset where
 "exhaustive_fset f i = (if i = 0 then None else (f {||} orelse exhaustive_fset (\<lambda>A. f A orelse Quickcheck_Exhaustive.exhaustive (\<lambda>x. if x |\<in>| A then None else f (finsert x A)) (i - 1)) (i - 1)))"
 
 instance ..
 
 end
 
 instantiation fset :: (full_exhaustive) full_exhaustive
 begin
 
 fun full_exhaustive_fset where
 "full_exhaustive_fset f i = (if i = 0 then None else (f valterm_femptyset orelse full_exhaustive_fset (\<lambda>A. f A orelse Quickcheck_Exhaustive.full_exhaustive (\<lambda>x. if fst x |\<in>| fst A then None else f (valtermify_finsert x A)) (i - 1)) (i - 1)))"
 
 instance ..
 
 end
 
 no_notation Quickcheck_Exhaustive.orelse (infixr "orelse" 55)
 
 instantiation fset :: (random) random
 begin
 
 context
   includes state_combinator_syntax
 begin
 
 fun random_aux_fset :: "natural \<Rightarrow> natural \<Rightarrow> natural \<times> natural \<Rightarrow> ('a fset \<times> (unit \<Rightarrow> term)) \<times> natural \<times> natural" where
 "random_aux_fset 0 j = Quickcheck_Random.collapse (Random.select_weight [(1, Pair valterm_femptyset)])" |
 "random_aux_fset (Code_Numeral.Suc i) j =
   Quickcheck_Random.collapse (Random.select_weight
     [(1, Pair valterm_femptyset),
      (Code_Numeral.Suc i,
       Quickcheck_Random.random j \<circ>\<rightarrow> (\<lambda>x. random_aux_fset i j \<circ>\<rightarrow> (\<lambda>s. Pair (valtermify_finsert x s))))])"
 
 lemma [code]:
   "random_aux_fset i j =
     Quickcheck_Random.collapse (Random.select_weight [(1, Pair valterm_femptyset),
       (i, Quickcheck_Random.random j \<circ>\<rightarrow> (\<lambda>x. random_aux_fset (i - 1) j \<circ>\<rightarrow> (\<lambda>s. Pair (valtermify_finsert x s))))])"
 proof (induct i rule: natural.induct)
   case zero
   show ?case by (subst select_weight_drop_zero[symmetric]) (simp add: less_natural_def)
 next
   case (Suc i)
   show ?case by (simp only: random_aux_fset.simps Suc_natural_minus_one)
 qed
 
 definition "random_fset i = random_aux_fset i i"
 
 instance ..
 
 end
 
 end
 
 end
diff --git a/src/HOL/Probability/Fin_Map.thy b/src/HOL/Probability/Fin_Map.thy
--- a/src/HOL/Probability/Fin_Map.thy
+++ b/src/HOL/Probability/Fin_Map.thy
@@ -1,1351 +1,1351 @@
 (*  Title:      HOL/Probability/Fin_Map.thy
     Author:     Fabian Immler, TU München
 *)
 
 section \<open>Finite Maps\<close>
 
 theory Fin_Map
   imports "HOL-Analysis.Finite_Product_Measure" "HOL-Library.Finite_Map"
 begin
 
 text \<open>The \<^type>\<open>fmap\<close> type can be instantiated to \<^class>\<open>polish_space\<close>, needed for the proof of
   projective limit. \<^const>\<open>extensional\<close> functions are used for the representation in order to
   stay close to the developments of (finite) products \<^const>\<open>Pi\<^sub>E\<close> and their sigma-algebra
   \<^const>\<open>Pi\<^sub>M\<close>.\<close>
 
 type_notation fmap ("(_ \<Rightarrow>\<^sub>F /_)" [22, 21] 21)
 
 unbundle fmap.lifting
 
 
 subsection \<open>Domain and Application\<close>
 
 lift_definition domain::"('i \<Rightarrow>\<^sub>F 'a) \<Rightarrow> 'i set" is dom .
 
 lemma finite_domain[simp, intro]: "finite (domain P)"
   by transfer simp
 
 lift_definition proj :: "('i \<Rightarrow>\<^sub>F 'a) \<Rightarrow> 'i \<Rightarrow> 'a" ("'((_)')\<^sub>F" [0] 1000) is
   "\<lambda>f x. if x \<in> dom f then the (f x) else undefined" .
 
 declare [[coercion proj]]
 
 lemma extensional_proj[simp, intro]: "(P)\<^sub>F \<in> extensional (domain P)"
   by transfer (auto simp: extensional_def)
 
 lemma proj_undefined[simp, intro]: "i \<notin> domain P \<Longrightarrow> P i = undefined"
   using extensional_proj[of P] unfolding extensional_def by auto
 
 lemma finmap_eq_iff: "P = Q \<longleftrightarrow> (domain P = domain Q \<and> (\<forall>i\<in>domain P. P i = Q i))"
   apply transfer
   apply (safe intro!: ext)
   subgoal for P Q x
     by (cases "x \<in> dom P"; cases "P x") (auto dest!: bspec[where x=x])
   done
 
 
 subsection \<open>Constructor of Finite Maps\<close>
 
 lift_definition finmap_of::"'i set \<Rightarrow> ('i \<Rightarrow> 'a) \<Rightarrow> ('i \<Rightarrow>\<^sub>F 'a)" is
   "\<lambda>I f x. if x \<in> I \<and> finite I then Some (f x) else None"
   by (simp add: dom_def)
 
 lemma proj_finmap_of[simp]:
   assumes "finite inds"
   shows "(finmap_of inds f)\<^sub>F = restrict f inds"
   using assms
   by transfer force
 
 lemma domain_finmap_of[simp]:
   assumes "finite inds"
   shows "domain (finmap_of inds f) = inds"
   using assms
   by transfer (auto split: if_splits)
 
 lemma finmap_of_eq_iff[simp]:
   assumes "finite i" "finite j"
   shows "finmap_of i m = finmap_of j n \<longleftrightarrow> i = j \<and> (\<forall>k\<in>i. m k= n k)"
   using assms by (auto simp: finmap_eq_iff)
 
 lemma finmap_of_inj_on_extensional_finite:
   assumes "finite K"
   assumes "S \<subseteq> extensional K"
   shows "inj_on (finmap_of K) S"
 proof (rule inj_onI)
   fix x y::"'a \<Rightarrow> 'b"
   assume "finmap_of K x = finmap_of K y"
   hence "(finmap_of K x)\<^sub>F = (finmap_of K y)\<^sub>F" by simp
   moreover
   assume "x \<in> S" "y \<in> S" hence "x \<in> extensional K" "y \<in> extensional K" using assms by auto
   ultimately
   show "x = y" using assms by (simp add: extensional_restrict)
 qed
 
 subsection \<open>Product set of Finite Maps\<close>
 
 text \<open>This is \<^term>\<open>Pi\<close> for Finite Maps, most of this is copied\<close>
 
 definition Pi' :: "'i set \<Rightarrow> ('i \<Rightarrow> 'a set) \<Rightarrow> ('i \<Rightarrow>\<^sub>F 'a) set" where
   "Pi' I A = { P. domain P = I \<and> (\<forall>i. i \<in> I \<longrightarrow> (P)\<^sub>F i \<in> A i) } "
 
 syntax
   "_Pi'" :: "[pttrn, 'a set, 'b set] => ('a => 'b) set"  ("(3\<Pi>'' _\<in>_./ _)"   10)
 translations
   "\<Pi>' x\<in>A. B" == "CONST Pi' A (\<lambda>x. B)"
 
 subsubsection\<open>Basic Properties of \<^term>\<open>Pi'\<close>\<close>
 
 lemma Pi'_I[intro!]: "domain f = A \<Longrightarrow> (\<And>x. x \<in> A \<Longrightarrow> f x \<in> B x) \<Longrightarrow> f \<in> Pi' A B"
   by (simp add: Pi'_def)
 
 lemma Pi'_I'[simp]: "domain f = A \<Longrightarrow> (\<And>x. x \<in> A \<longrightarrow> f x \<in> B x) \<Longrightarrow> f \<in> Pi' A B"
   by (simp add:Pi'_def)
 
 lemma Pi'_mem: "f\<in> Pi' A B \<Longrightarrow> x \<in> A \<Longrightarrow> f x \<in> B x"
   by (simp add: Pi'_def)
 
 lemma Pi'_iff: "f \<in> Pi' I X \<longleftrightarrow> domain f = I \<and> (\<forall>i\<in>I. f i \<in> X i)"
   unfolding Pi'_def by auto
 
 lemma Pi'E [elim]:
   "f \<in> Pi' A B \<Longrightarrow> (f x \<in> B x \<Longrightarrow> domain f = A \<Longrightarrow> Q) \<Longrightarrow> (x \<notin> A \<Longrightarrow> Q) \<Longrightarrow> Q"
   by(auto simp: Pi'_def)
 
 lemma in_Pi'_cong:
   "domain f = domain g \<Longrightarrow> (\<And> w. w \<in> A \<Longrightarrow> f w = g w) \<Longrightarrow> f \<in> Pi' A B \<longleftrightarrow> g \<in> Pi' A B"
   by (auto simp: Pi'_def)
 
 lemma Pi'_eq_empty[simp]:
   assumes "finite A" shows "(Pi' A B) = {} \<longleftrightarrow> (\<exists>x\<in>A. B x = {})"
   using assms
   apply (simp add: Pi'_def, auto)
   apply (drule_tac x = "finmap_of A (\<lambda>u. SOME y. y \<in> B u)" in spec, auto)
   apply (cut_tac P= "%y. y \<in> B i" in some_eq_ex, auto)
   done
 
 lemma Pi'_mono: "(\<And>x. x \<in> A \<Longrightarrow> B x \<subseteq> C x) \<Longrightarrow> Pi' A B \<subseteq> Pi' A C"
   by (auto simp: Pi'_def)
 
 lemma Pi_Pi': "finite A \<Longrightarrow> (Pi\<^sub>E A B) = proj ` Pi' A B"
   apply (auto simp: Pi'_def Pi_def extensional_def)
   apply (rule_tac x = "finmap_of A (restrict x A)" in image_eqI)
   apply auto
   done
 
 subsection \<open>Topological Space of Finite Maps\<close>
 
 instantiation fmap :: (type, topological_space) topological_space
 begin
 
 definition open_fmap :: "('a \<Rightarrow>\<^sub>F 'b) set \<Rightarrow> bool" where
    [code del]: "open_fmap = generate_topology {Pi' a b|a b. \<forall>i\<in>a. open (b i)}"
 
 lemma open_Pi'I: "(\<And>i. i \<in> I \<Longrightarrow> open (A i)) \<Longrightarrow> open (Pi' I A)"
   by (auto intro: generate_topology.Basis simp: open_fmap_def)
 
 instance using topological_space_generate_topology
   by intro_classes (auto simp: open_fmap_def class.topological_space_def)
 
 end
 
 lemma open_restricted_space:
   shows "open {m. P (domain m)}"
 proof -
   have "{m. P (domain m)} = (\<Union>i \<in> Collect P. {m. domain m = i})" by auto
   also have "open \<dots>"
   proof (rule, safe, cases)
     fix i::"'a set"
     assume "finite i"
     hence "{m. domain m = i} = Pi' i (\<lambda>_. UNIV)" by (auto simp: Pi'_def)
     also have "open \<dots>" by (auto intro: open_Pi'I simp: \<open>finite i\<close>)
     finally show "open {m. domain m = i}" .
   next
     fix i::"'a set"
     assume "\<not> finite i" hence "{m. domain m = i} = {}" by auto
     also have "open \<dots>" by simp
     finally show "open {m. domain m = i}" .
   qed
   finally show ?thesis .
 qed
 
 lemma closed_restricted_space:
   shows "closed {m. P (domain m)}"
   using open_restricted_space[of "\<lambda>x. \<not> P x"]
   unfolding closed_def by (rule back_subst) auto
 
 lemma tendsto_proj: "((\<lambda>x. x) \<longlongrightarrow> a) F \<Longrightarrow> ((\<lambda>x. (x)\<^sub>F i) \<longlongrightarrow> (a)\<^sub>F i) F"
   unfolding tendsto_def
 proof safe
   fix S::"'b set"
   let ?S = "Pi' (domain a) (\<lambda>x. if x = i then S else UNIV)"
   assume "open S" hence "open ?S" by (auto intro!: open_Pi'I)
   moreover assume "\<forall>S. open S \<longrightarrow> a \<in> S \<longrightarrow> eventually (\<lambda>x. x \<in> S) F" "a i \<in> S"
   ultimately have "eventually (\<lambda>x. x \<in> ?S) F" by auto
   thus "eventually (\<lambda>x. (x)\<^sub>F i \<in> S) F"
     by eventually_elim (insert \<open>a i \<in> S\<close>, force simp: Pi'_iff split: if_split_asm)
 qed
 
 lemma continuous_proj:
   shows "continuous_on s (\<lambda>x. (x)\<^sub>F i)"
   unfolding continuous_on_def by (safe intro!: tendsto_proj tendsto_ident_at)
 
 instance fmap :: (type, first_countable_topology) first_countable_topology
 proof
   fix x::"'a\<Rightarrow>\<^sub>F'b"
   have "\<forall>i. \<exists>A. countable A \<and> (\<forall>a\<in>A. x i \<in> a) \<and> (\<forall>a\<in>A. open a) \<and>
     (\<forall>S. open S \<and> x i \<in> S \<longrightarrow> (\<exists>a\<in>A. a \<subseteq> S)) \<and> (\<forall>a b. a \<in> A \<longrightarrow> b \<in> A \<longrightarrow> a \<inter> b \<in> A)" (is "\<forall>i. ?th i")
   proof
     fix i from first_countable_basis_Int_stableE[of "x i"]
     obtain A where
       "countable A"
       "\<And>C. C \<in> A \<Longrightarrow> (x)\<^sub>F i \<in> C"
       "\<And>C. C \<in> A \<Longrightarrow> open C"
       "\<And>S. open S \<Longrightarrow> (x)\<^sub>F i \<in> S \<Longrightarrow> \<exists>A\<in>A. A \<subseteq> S"
       "\<And>C D. C \<in> A \<Longrightarrow> D \<in> A \<Longrightarrow> C \<inter> D \<in> A"
       by auto
     thus "?th i" by (intro exI[where x=A]) simp
   qed
   then obtain A
     where A: "\<forall>i. countable (A i) \<and> Ball (A i) ((\<in>) ((x)\<^sub>F i)) \<and> Ball (A i) open \<and>
       (\<forall>S. open S \<and> (x)\<^sub>F i \<in> S \<longrightarrow> (\<exists>a\<in>A i. a \<subseteq> S)) \<and> (\<forall>a b. a \<in> A i \<longrightarrow> b \<in> A i \<longrightarrow> a \<inter> b \<in> A i)"
     by (auto simp: choice_iff)
   hence open_sub: "\<And>i S. i\<in>domain x \<Longrightarrow> open (S i) \<Longrightarrow> x i\<in>(S i) \<Longrightarrow> (\<exists>a\<in>A i. a\<subseteq>(S i))" by auto
   have A_notempty: "\<And>i. i \<in> domain x \<Longrightarrow> A i \<noteq> {}" using open_sub[of _ "\<lambda>_. UNIV"] by auto
   let ?A = "(\<lambda>f. Pi' (domain x) f) ` (Pi\<^sub>E (domain x) A)"
   show "\<exists>A::nat \<Rightarrow> ('a\<Rightarrow>\<^sub>F'b) set. (\<forall>i. x \<in> (A i) \<and> open (A i)) \<and> (\<forall>S. open S \<and> x \<in> S \<longrightarrow> (\<exists>i. A i \<subseteq> S))"
   proof (rule first_countableI[of "?A"], safe)
     show "countable ?A" using A by (simp add: countable_PiE)
   next
     fix S::"('a \<Rightarrow>\<^sub>F 'b) set" assume "open S" "x \<in> S"
     thus "\<exists>a\<in>?A. a \<subseteq> S" unfolding open_fmap_def
     proof (induct rule: generate_topology.induct)
       case UNIV thus ?case by (auto simp add: ex_in_conv PiE_eq_empty_iff A_notempty)
     next
       case (Int a b)
       then obtain f g where
         "f \<in> Pi\<^sub>E (domain x) A" "Pi' (domain x) f \<subseteq> a" "g \<in> Pi\<^sub>E (domain x) A" "Pi' (domain x) g \<subseteq> b"
         by auto
       thus ?case using A
         by (auto simp: Pi'_iff PiE_iff extensional_def Int_stable_def
             intro!: bexI[where x="\<lambda>i. f i \<inter> g i"])
     next
       case (UN B)
       then obtain b where "x \<in> b" "b \<in> B" by auto
       hence "\<exists>a\<in>?A. a \<subseteq> b" using UN by simp
-      thus ?case using \<open>b \<in> B\<close> by blast
+      thus ?case using \<open>b \<in> B\<close> by (metis Sup_upper2)
     next
       case (Basis s)
       then obtain a b where xs: "x\<in> Pi' a b" "s = Pi' a b" "\<And>i. i\<in>a \<Longrightarrow> open (b i)" by auto
       have "\<forall>i. \<exists>a. (i \<in> domain x \<and> open (b i) \<and> (x)\<^sub>F i \<in> b i) \<longrightarrow> (a\<in>A i \<and> a \<subseteq> b i)"
         using open_sub[of _ b] by auto
       then obtain b'
         where "\<And>i. i \<in> domain x \<Longrightarrow> open (b i) \<Longrightarrow> (x)\<^sub>F i \<in> b i \<Longrightarrow> (b' i \<in>A i \<and> b' i \<subseteq> b i)"
           unfolding choice_iff by auto
       with xs have "\<And>i. i \<in> a \<Longrightarrow> (b' i \<in>A i \<and> b' i \<subseteq> b i)" "Pi' a b' \<subseteq> Pi' a b"
         by (auto simp: Pi'_iff intro!: Pi'_mono)
       thus ?case using xs
         by (intro bexI[where x="Pi' a b'"])
           (auto simp: Pi'_iff intro!: image_eqI[where x="restrict b' (domain x)"])
     qed
   qed (insert A,auto simp: PiE_iff intro!: open_Pi'I)
 qed
 
 subsection \<open>Metric Space of Finite Maps\<close>
 
 (* TODO: Product of uniform spaces and compatibility with metric_spaces! *)
 
 instantiation fmap :: (type, metric_space) dist
 begin
 
 definition dist_fmap where
   "dist P Q = Max (range (\<lambda>i. dist ((P)\<^sub>F i) ((Q)\<^sub>F i))) + (if domain P = domain Q then 0 else 1)"
 
 instance ..
 end
 
 instantiation fmap :: (type, metric_space) uniformity_dist
 begin
 
 definition [code del]:
   "(uniformity :: (('a, 'b) fmap \<times> ('a \<Rightarrow>\<^sub>F 'b)) filter) =
     (INF e\<in>{0 <..}. principal {(x, y). dist x y < e})"
 
 instance
   by standard (rule uniformity_fmap_def)
 end
 
 declare uniformity_Abort[where 'a="('a \<Rightarrow>\<^sub>F 'b::metric_space)", code]
 
 instantiation fmap :: (type, metric_space) metric_space
 begin
 
 lemma finite_proj_image': "x \<notin> domain P \<Longrightarrow> finite ((P)\<^sub>F ` S)"
   by (rule finite_subset[of _ "proj P ` (domain P \<inter> S \<union> {x})"]) auto
 
 lemma finite_proj_image: "finite ((P)\<^sub>F ` S)"
  by (cases "\<exists>x. x \<notin> domain P") (auto intro: finite_proj_image' finite_subset[where B="domain P"])
 
 lemma finite_proj_diag: "finite ((\<lambda>i. d ((P)\<^sub>F i) ((Q)\<^sub>F i)) ` S)"
 proof -
   have "(\<lambda>i. d ((P)\<^sub>F i) ((Q)\<^sub>F i)) ` S = (\<lambda>(i, j). d i j) ` ((\<lambda>i. ((P)\<^sub>F i, (Q)\<^sub>F i)) ` S)" by auto
   moreover have "((\<lambda>i. ((P)\<^sub>F i, (Q)\<^sub>F i)) ` S) \<subseteq> (\<lambda>i. (P)\<^sub>F i) ` S \<times> (\<lambda>i. (Q)\<^sub>F i) ` S" by auto
   moreover have "finite \<dots>" using finite_proj_image[of P S] finite_proj_image[of Q S]
     by (intro finite_cartesian_product) simp_all
   ultimately show ?thesis by (simp add: finite_subset)
 qed
 
 lemma dist_le_1_imp_domain_eq:
   shows "dist P Q < 1 \<Longrightarrow> domain P = domain Q"
   by (simp add: dist_fmap_def finite_proj_diag split: if_split_asm)
 
 lemma dist_proj:
   shows "dist ((x)\<^sub>F i) ((y)\<^sub>F i) \<le> dist x y"
 proof -
   have "dist (x i) (y i) \<le> Max (range (\<lambda>i. dist (x i) (y i)))"
     by (simp add: Max_ge_iff finite_proj_diag)
   also have "\<dots> \<le> dist x y" by (simp add: dist_fmap_def)
   finally show ?thesis .
 qed
 
 lemma dist_finmap_lessI:
   assumes "domain P = domain Q"
   assumes "0 < e"
   assumes "\<And>i. i \<in> domain P \<Longrightarrow> dist (P i) (Q i) < e"
   shows "dist P Q < e"
 proof -
   have "dist P Q = Max (range (\<lambda>i. dist (P i) (Q i)))"
     using assms by (simp add: dist_fmap_def finite_proj_diag)
   also have "\<dots> < e"
   proof (subst Max_less_iff, safe)
     fix i
     show "dist ((P)\<^sub>F i) ((Q)\<^sub>F i) < e" using assms
       by (cases "i \<in> domain P") simp_all
   qed (simp add: finite_proj_diag)
   finally show ?thesis .
 qed
 
 instance
 proof
   fix S::"('a \<Rightarrow>\<^sub>F 'b) set"
   have *: "open S = (\<forall>x\<in>S. \<exists>e>0. \<forall>y. dist y x < e \<longrightarrow> y \<in> S)" (is "_ = ?od")
   proof
     assume "open S"
     thus ?od
       unfolding open_fmap_def
     proof (induct rule: generate_topology.induct)
       case UNIV thus ?case by (auto intro: zero_less_one)
     next
       case (Int a b)
       show ?case
       proof safe
         fix x assume x: "x \<in> a" "x \<in> b"
         with Int x obtain e1 e2 where
           "e1>0" "\<forall>y. dist y x < e1 \<longrightarrow> y \<in> a" "e2>0" "\<forall>y. dist y x < e2 \<longrightarrow> y \<in> b" by force
         thus "\<exists>e>0. \<forall>y. dist y x < e \<longrightarrow> y \<in> a \<inter> b"
           by (auto intro!: exI[where x="min e1 e2"])
       qed
     next
       case (UN K)
       show ?case
       proof safe
         fix x X assume "x \<in> X" and X: "X \<in> K"
         with UN obtain e where "e>0" "\<And>y. dist y x < e \<longrightarrow> y \<in> X" by force
         with X show "\<exists>e>0. \<forall>y. dist y x < e \<longrightarrow> y \<in> \<Union>K" by auto
       qed
     next
       case (Basis s) then obtain a b where s: "s = Pi' a b" and b: "\<And>i. i\<in>a \<Longrightarrow> open (b i)" by auto
       show ?case
       proof safe
         fix x assume "x \<in> s"
         hence [simp]: "finite a" and a_dom: "a = domain x" using s by (auto simp: Pi'_iff)
         obtain es where es: "\<forall>i \<in> a. es i > 0 \<and> (\<forall>y. dist y (proj x i) < es i \<longrightarrow> y \<in> b i)"
           using b \<open>x \<in> s\<close> by atomize_elim (intro bchoice, auto simp: open_dist s)
         hence in_b: "\<And>i y. i \<in> a \<Longrightarrow> dist y (proj x i) < es i \<Longrightarrow> y \<in> b i" by auto
         show "\<exists>e>0. \<forall>y. dist y x < e \<longrightarrow> y \<in> s"
         proof (cases, rule, safe)
           assume "a \<noteq> {}"
           show "0 < min 1 (Min (es ` a))" using es by (auto simp: \<open>a \<noteq> {}\<close>)
           fix y assume d: "dist y x < min 1 (Min (es ` a))"
           show "y \<in> s" unfolding s
           proof
             show "domain y = a" using d s \<open>a \<noteq> {}\<close> by (auto simp: dist_le_1_imp_domain_eq a_dom)
             fix i assume i: "i \<in> a"
             hence "dist ((y)\<^sub>F i) ((x)\<^sub>F i) < es i" using d
               by (auto simp: dist_fmap_def \<open>a \<noteq> {}\<close> intro!: le_less_trans[OF dist_proj])
             with i show "y i \<in> b i" by (rule in_b)
           qed
         next
           assume "\<not>a \<noteq> {}"
           thus "\<exists>e>0. \<forall>y. dist y x < e \<longrightarrow> y \<in> s"
             using s \<open>x \<in> s\<close> by (auto simp: Pi'_def dist_le_1_imp_domain_eq intro!: exI[where x=1])
         qed
       qed
     qed
   next
     assume "\<forall>x\<in>S. \<exists>e>0. \<forall>y. dist y x < e \<longrightarrow> y \<in> S"
     then obtain e where e_pos: "\<And>x. x \<in> S \<Longrightarrow> e x > 0" and
       e_in:  "\<And>x y . x \<in> S \<Longrightarrow> dist y x < e x \<Longrightarrow> y \<in> S"
       unfolding bchoice_iff
       by auto
     have S_eq: "S = \<Union>{Pi' a b| a b. \<exists>x\<in>S. domain x = a \<and> b = (\<lambda>i. ball (x i) (e x))}"
     proof safe
       fix x assume "x \<in> S"
       thus "x \<in> \<Union>{Pi' a b| a b. \<exists>x\<in>S. domain x = a \<and> b = (\<lambda>i. ball (x i) (e x))}"
         using e_pos by (auto intro!: exI[where x="Pi' (domain x) (\<lambda>i. ball (x i) (e x))"])
     next
       fix x y
       assume "y \<in> S"
       moreover
       assume "x \<in> (\<Pi>' i\<in>domain y. ball (y i) (e y))"
       hence "dist x y < e y" using e_pos \<open>y \<in> S\<close>
         by (auto simp: dist_fmap_def Pi'_iff finite_proj_diag dist_commute)
       ultimately show "x \<in> S" by (rule e_in)
     qed
     also have "open \<dots>"
       unfolding open_fmap_def
       by (intro generate_topology.UN) (auto intro: generate_topology.Basis)
     finally show "open S" .
   qed
   show "open S = (\<forall>x\<in>S. \<forall>\<^sub>F (x', y) in uniformity. x' = x \<longrightarrow> y \<in> S)"
     unfolding * eventually_uniformity_metric
     by (simp del: split_paired_All add: dist_fmap_def dist_commute eq_commute)
 next
   fix P Q::"'a \<Rightarrow>\<^sub>F 'b"
   have Max_eq_iff: "\<And>A m. finite A \<Longrightarrow> A \<noteq> {} \<Longrightarrow> (Max A = m) = (m \<in> A \<and> (\<forall>a\<in>A. a \<le> m))"
     by (auto intro: Max_in Max_eqI)
   show "dist P Q = 0 \<longleftrightarrow> P = Q"
     by (auto simp: finmap_eq_iff dist_fmap_def Max_ge_iff finite_proj_diag Max_eq_iff
         add_nonneg_eq_0_iff
       intro!: Max_eqI image_eqI[where x=undefined])
 next
   fix P Q R::"'a \<Rightarrow>\<^sub>F 'b"
   let ?dists = "\<lambda>P Q i. dist ((P)\<^sub>F i) ((Q)\<^sub>F i)"
   let ?dpq = "?dists P Q" and ?dpr = "?dists P R" and ?dqr = "?dists Q R"
   let ?dom = "\<lambda>P Q. (if domain P = domain Q then 0 else 1::real)"
   have "dist P Q = Max (range ?dpq) + ?dom P Q"
     by (simp add: dist_fmap_def)
   also obtain t where "t \<in> range ?dpq" "t = Max (range ?dpq)" by (simp add: finite_proj_diag)
   then obtain i where "Max (range ?dpq) = ?dpq i" by auto
   also have "?dpq i \<le> ?dpr i + ?dqr i" by (rule dist_triangle2)
   also have "?dpr i \<le> Max (range ?dpr)" by (simp add: finite_proj_diag)
   also have "?dqr i \<le> Max (range ?dqr)" by (simp add: finite_proj_diag)
   also have "?dom P Q \<le> ?dom P R + ?dom Q R" by simp
   finally show "dist P Q \<le> dist P R + dist Q R" by (simp add: dist_fmap_def ac_simps)
 qed
 
 end
 
 subsection \<open>Complete Space of Finite Maps\<close>
 
 lemma tendsto_finmap:
   fixes f::"nat \<Rightarrow> ('i \<Rightarrow>\<^sub>F ('a::metric_space))"
   assumes ind_f:  "\<And>n. domain (f n) = domain g"
   assumes proj_g:  "\<And>i. i \<in> domain g \<Longrightarrow> (\<lambda>n. (f n) i) \<longlonglongrightarrow> g i"
   shows "f \<longlonglongrightarrow> g"
   unfolding tendsto_iff
 proof safe
   fix e::real assume "0 < e"
   let ?dists = "\<lambda>x i. dist ((f x)\<^sub>F i) ((g)\<^sub>F i)"
   have "eventually (\<lambda>x. \<forall>i\<in>domain g. ?dists x i < e) sequentially"
     using finite_domain[of g] proj_g
   proof induct
     case (insert i G)
     with \<open>0 < e\<close> have "eventually (\<lambda>x. ?dists x i < e) sequentially" by (auto simp add: tendsto_iff)
     moreover
     from insert have "eventually (\<lambda>x. \<forall>i\<in>G. dist ((f x)\<^sub>F i) ((g)\<^sub>F i) < e) sequentially" by simp
     ultimately show ?case by eventually_elim auto
   qed simp
   thus "eventually (\<lambda>x. dist (f x) g < e) sequentially"
     by eventually_elim (auto simp add: dist_fmap_def finite_proj_diag ind_f \<open>0 < e\<close>)
 qed
 
 instance fmap :: (type, complete_space) complete_space
 proof
   fix P::"nat \<Rightarrow> 'a \<Rightarrow>\<^sub>F 'b"
   assume "Cauchy P"
   then obtain Nd where Nd: "\<And>n. n \<ge> Nd \<Longrightarrow> dist (P n) (P Nd) < 1"
     by (force simp: Cauchy_altdef2)
   define d where "d = domain (P Nd)"
   with Nd have dim: "\<And>n. n \<ge> Nd \<Longrightarrow> domain (P n) = d" using dist_le_1_imp_domain_eq by auto
   have [simp]: "finite d" unfolding d_def by simp
   define p where "p i n = P n i" for i n
   define q where "q i = lim (p i)" for i
   define Q where "Q = finmap_of d q"
   have q: "\<And>i. i \<in> d \<Longrightarrow> q i = Q i" by (auto simp add: Q_def Abs_fmap_inverse)
   {
     fix i assume "i \<in> d"
     have "Cauchy (p i)" unfolding Cauchy_altdef2 p_def
     proof safe
       fix e::real assume "0 < e"
       with \<open>Cauchy P\<close> obtain N where N: "\<And>n. n\<ge>N \<Longrightarrow> dist (P n) (P N) < min e 1"
         by (force simp: Cauchy_altdef2 min_def)
       hence "\<And>n. n \<ge> N \<Longrightarrow> domain (P n) = domain (P N)" using dist_le_1_imp_domain_eq by auto
       with dim have dim: "\<And>n. n \<ge> N \<Longrightarrow> domain (P n) = d" by (metis nat_le_linear)
       show "\<exists>N. \<forall>n\<ge>N. dist ((P n) i) ((P N) i) < e"
       proof (safe intro!: exI[where x="N"])
         fix n assume "N \<le> n" have "N \<le> N" by simp
         have "dist ((P n) i) ((P N) i) \<le> dist (P n) (P N)"
           using dim[OF \<open>N \<le> n\<close>]  dim[OF \<open>N \<le> N\<close>] \<open>i \<in> d\<close>
           by (auto intro!: dist_proj)
         also have "\<dots> < e" using N[OF \<open>N \<le> n\<close>] by simp
         finally show "dist ((P n) i) ((P N) i) < e" .
       qed
     qed
     hence "convergent (p i)" by (metis Cauchy_convergent_iff)
     hence "p i \<longlonglongrightarrow> q i" unfolding q_def convergent_def by (metis limI)
   } note p = this
   have "P \<longlonglongrightarrow> Q"
   proof (rule metric_LIMSEQ_I)
     fix e::real assume "0 < e"
     have "\<exists>ni. \<forall>i\<in>d. \<forall>n\<ge>ni i. dist (p i n) (q i) < e"
     proof (safe intro!: bchoice)
       fix i assume "i \<in> d"
       from p[OF \<open>i \<in> d\<close>, THEN metric_LIMSEQ_D, OF \<open>0 < e\<close>]
       show "\<exists>no. \<forall>n\<ge>no. dist (p i n) (q i) < e" .
     qed
     then obtain ni where ni: "\<forall>i\<in>d. \<forall>n\<ge>ni i. dist (p i n) (q i) < e" ..
     define N where "N = max Nd (Max (ni ` d))"
     show "\<exists>N. \<forall>n\<ge>N. dist (P n) Q < e"
     proof (safe intro!: exI[where x="N"])
       fix n assume "N \<le> n"
       hence dom: "domain (P n) = d" "domain Q = d" "domain (P n) = domain Q"
         using dim by (simp_all add: N_def Q_def dim_def Abs_fmap_inverse)
       show "dist (P n) Q < e"
       proof (rule dist_finmap_lessI[OF dom(3) \<open>0 < e\<close>])
         fix i
         assume "i \<in> domain (P n)"
         hence "ni i \<le> Max (ni ` d)" using dom by simp
         also have "\<dots> \<le> N" by (simp add: N_def)
         finally show "dist ((P n)\<^sub>F i) ((Q)\<^sub>F i) < e" using ni \<open>i \<in> domain (P n)\<close> \<open>N \<le> n\<close> dom
           by (auto simp: p_def q N_def less_imp_le)
       qed
     qed
   qed
   thus "convergent P" by (auto simp: convergent_def)
 qed
 
 subsection \<open>Second Countable Space of Finite Maps\<close>
 
 instantiation fmap :: (countable, second_countable_topology) second_countable_topology
 begin
 
 definition basis_proj::"'b set set"
   where "basis_proj = (SOME B. countable B \<and> topological_basis B)"
 
 lemma countable_basis_proj: "countable basis_proj" and basis_proj: "topological_basis basis_proj"
   unfolding basis_proj_def by (intro is_basis countable_basis)+
 
 definition basis_finmap::"('a \<Rightarrow>\<^sub>F 'b) set set"
   where "basis_finmap = {Pi' I S|I S. finite I \<and> (\<forall>i \<in> I. S i \<in> basis_proj)}"
 
 lemma in_basis_finmapI:
   assumes "finite I" assumes "\<And>i. i \<in> I \<Longrightarrow> S i \<in> basis_proj"
   shows "Pi' I S \<in> basis_finmap"
   using assms unfolding basis_finmap_def by auto
 
 lemma basis_finmap_eq:
   assumes "basis_proj \<noteq> {}"
   shows "basis_finmap = (\<lambda>f. Pi' (domain f) (\<lambda>i. from_nat_into basis_proj ((f)\<^sub>F i))) `
     (UNIV::('a \<Rightarrow>\<^sub>F nat) set)" (is "_ = ?f ` _")
   unfolding basis_finmap_def
 proof safe
   fix I::"'a set" and S::"'a \<Rightarrow> 'b set"
   assume "finite I" "\<forall>i\<in>I. S i \<in> basis_proj"
   hence "Pi' I S = ?f (finmap_of I (\<lambda>x. to_nat_on basis_proj (S x)))"
     by (force simp: Pi'_def countable_basis_proj)
   thus "Pi' I S \<in> range ?f" by simp
 next
   fix x and f::"'a \<Rightarrow>\<^sub>F nat"
   show "\<exists>I S. (\<Pi>' i\<in>domain f. from_nat_into basis_proj ((f)\<^sub>F i)) = Pi' I S \<and>
     finite I \<and> (\<forall>i\<in>I. S i \<in> basis_proj)"
     using assms by (auto intro: from_nat_into)
 qed
 
 lemma basis_finmap_eq_empty: "basis_proj = {} \<Longrightarrow> basis_finmap = {Pi' {} undefined}"
   by (auto simp: Pi'_iff basis_finmap_def)
 
 lemma countable_basis_finmap: "countable basis_finmap"
   by (cases "basis_proj = {}") (auto simp: basis_finmap_eq basis_finmap_eq_empty)
 
 lemma finmap_topological_basis:
   "topological_basis basis_finmap"
 proof (subst topological_basis_iff, safe)
   fix B' assume "B' \<in> basis_finmap"
   thus "open B'"
     by (auto intro!: open_Pi'I topological_basis_open[OF basis_proj]
       simp: topological_basis_def basis_finmap_def Let_def)
 next
   fix O'::"('a \<Rightarrow>\<^sub>F 'b) set" and x
   assume O': "open O'" "x \<in> O'"
   then obtain a where a:
     "x \<in> Pi' (domain x) a" "Pi' (domain x) a \<subseteq> O'" "\<And>i. i\<in>domain x \<Longrightarrow> open (a i)"
     unfolding open_fmap_def
   proof (atomize_elim, induct rule: generate_topology.induct)
     case (Int a b)
     let ?p="\<lambda>a f. x \<in> Pi' (domain x) f \<and> Pi' (domain x) f \<subseteq> a \<and> (\<forall>i. i \<in> domain x \<longrightarrow> open (f i))"
     from Int obtain f g where "?p a f" "?p b g" by auto
     thus ?case by (force intro!: exI[where x="\<lambda>i. f i \<inter> g i"] simp: Pi'_def)
   next
     case (UN k)
     then obtain kk a where "x \<in> kk" "kk \<in> k" "x \<in> Pi' (domain x) a" "Pi' (domain x) a \<subseteq> kk"
       "\<And>i. i\<in>domain x \<Longrightarrow> open (a i)"
       by force
     thus ?case by blast
   qed (auto simp: Pi'_def)
   have "\<exists>B.
     (\<forall>i\<in>domain x. x i \<in> B i \<and> B i \<subseteq> a i \<and> B i \<in> basis_proj)"
   proof (rule bchoice, safe)
     fix i assume "i \<in> domain x"
     hence "open (a i)" "x i \<in> a i" using a by auto
     from topological_basisE[OF basis_proj this] obtain b'
       where "b' \<in> basis_proj" "(x)\<^sub>F i \<in> b'" "b' \<subseteq> a i"
       by blast
     thus "\<exists>y. x i \<in> y \<and> y \<subseteq> a i \<and> y \<in> basis_proj" by auto
   qed
   then obtain B where B: "\<forall>i\<in>domain x. (x)\<^sub>F i \<in> B i \<and> B i \<subseteq> a i \<and> B i \<in> basis_proj"
     by auto
   define B' where "B' = Pi' (domain x) (\<lambda>i. (B i)::'b set)"
   have "B' \<subseteq> Pi' (domain x) a" using B by (auto intro!: Pi'_mono simp: B'_def)
   also note \<open>\<dots> \<subseteq> O'\<close>
   finally show "\<exists>B'\<in>basis_finmap. x \<in> B' \<and> B' \<subseteq> O'" using B
     by (auto intro!: bexI[where x=B'] Pi'_mono in_basis_finmapI simp: B'_def)
 qed
 
 lemma range_enum_basis_finmap_imp_open:
   assumes "x \<in> basis_finmap"
   shows "open x"
   using finmap_topological_basis assms by (auto simp: topological_basis_def)
 
 instance proof qed (blast intro: finmap_topological_basis countable_basis_finmap topological_basis_imp_subbasis)
 
 end
 
 subsection \<open>Polish Space of Finite Maps\<close>
 
 instance fmap :: (countable, polish_space) polish_space proof qed
 
 
 subsection \<open>Product Measurable Space of Finite Maps\<close>
 
 definition "PiF I M \<equiv>
   sigma (\<Union>J \<in> I. (\<Pi>' j\<in>J. space (M j))) {(\<Pi>' j\<in>J. X j) |X J. J \<in> I \<and> X \<in> (\<Pi> j\<in>J. sets (M j))}"
 
 abbreviation
   "Pi\<^sub>F I M \<equiv> PiF I M"
 
 syntax
   "_PiF" :: "pttrn \<Rightarrow> 'i set \<Rightarrow> 'a measure \<Rightarrow> ('i => 'a) measure"  ("(3\<Pi>\<^sub>F _\<in>_./ _)"  10)
 translations
   "\<Pi>\<^sub>F x\<in>I. M" == "CONST PiF I (%x. M)"
 
 lemma PiF_gen_subset: "{(\<Pi>' j\<in>J. X j) |X J. J \<in> I \<and> X \<in> (\<Pi> j\<in>J. sets (M j))} \<subseteq>
     Pow (\<Union>J \<in> I. (\<Pi>' j\<in>J. space (M j)))"
   by (auto simp: Pi'_def) (blast dest: sets.sets_into_space)
 
 lemma space_PiF: "space (PiF I M) = (\<Union>J \<in> I. (\<Pi>' j\<in>J. space (M j)))"
   unfolding PiF_def using PiF_gen_subset by (rule space_measure_of)
 
 lemma sets_PiF:
   "sets (PiF I M) = sigma_sets (\<Union>J \<in> I. (\<Pi>' j\<in>J. space (M j)))
     {(\<Pi>' j\<in>J. X j) |X J. J \<in> I \<and> X \<in> (\<Pi> j\<in>J. sets (M j))}"
   unfolding PiF_def using PiF_gen_subset by (rule sets_measure_of)
 
 lemma sets_PiF_singleton:
   "sets (PiF {I} M) = sigma_sets (\<Pi>' j\<in>I. space (M j))
     {(\<Pi>' j\<in>I. X j) |X. X \<in> (\<Pi> j\<in>I. sets (M j))}"
   unfolding sets_PiF by simp
 
 lemma in_sets_PiFI:
   assumes "X = (Pi' J S)" "J \<in> I" "\<And>i. i\<in>J \<Longrightarrow> S i \<in> sets (M i)"
   shows "X \<in> sets (PiF I M)"
   unfolding sets_PiF
   using assms by blast
 
 lemma product_in_sets_PiFI:
   assumes "J \<in> I" "\<And>i. i\<in>J \<Longrightarrow> S i \<in> sets (M i)"
   shows "(Pi' J S) \<in> sets (PiF I M)"
   unfolding sets_PiF
   using assms by blast
 
 lemma singleton_space_subset_in_sets:
   fixes J
   assumes "J \<in> I"
   assumes "finite J"
   shows "space (PiF {J} M) \<in> sets (PiF I M)"
   using assms
   by (intro in_sets_PiFI[where J=J and S="\<lambda>i. space (M i)"])
       (auto simp: product_def space_PiF)
 
 lemma singleton_subspace_set_in_sets:
   assumes A: "A \<in> sets (PiF {J} M)"
   assumes "finite J"
   assumes "J \<in> I"
   shows "A \<in> sets (PiF I M)"
   using A[unfolded sets_PiF]
   apply (induct A)
   unfolding sets_PiF[symmetric] unfolding space_PiF[symmetric]
   using assms
   by (auto intro: in_sets_PiFI intro!: singleton_space_subset_in_sets)
 
 lemma finite_measurable_singletonI:
   assumes "finite I"
   assumes "\<And>J. J \<in> I \<Longrightarrow> finite J"
   assumes MN: "\<And>J. J \<in> I \<Longrightarrow> A \<in> measurable (PiF {J} M) N"
   shows "A \<in> measurable (PiF I M) N"
   unfolding measurable_def
 proof safe
   fix y assume "y \<in> sets N"
   have "A -` y \<inter> space (PiF I M) = (\<Union>J\<in>I. A -` y \<inter> space (PiF {J} M))"
     by (auto simp: space_PiF)
   also have "\<dots> \<in> sets (PiF I M)"
   proof (rule sets.finite_UN)
     show "finite I" by fact
     fix J assume "J \<in> I"
     with assms have "finite J" by simp
     show "A -` y \<inter> space (PiF {J} M) \<in> sets (PiF I M)"
       by (rule singleton_subspace_set_in_sets[OF measurable_sets[OF assms(3)]]) fact+
   qed
   finally show "A -` y \<inter> space (PiF I M) \<in> sets (PiF I M)" .
 next
   fix x assume "x \<in> space (PiF I M)" thus "A x \<in> space N"
     using MN[of "domain x"]
     by (auto simp: space_PiF measurable_space Pi'_def)
 qed
 
 lemma countable_finite_comprehension:
   fixes f :: "'a::countable set \<Rightarrow> _"
   assumes "\<And>s. P s \<Longrightarrow> finite s"
   assumes "\<And>s. P s \<Longrightarrow> f s \<in> sets M"
   shows "\<Union>{f s|s. P s} \<in> sets M"
 proof -
   have "\<Union>{f s|s. P s} = (\<Union>n::nat. let s = set (from_nat n) in if P s then f s else {})"
   proof safe
     fix x X s assume *: "x \<in> f s" "P s"
     with assms obtain l where "s = set l" using finite_list by blast
     with * show "x \<in> (\<Union>n. let s = set (from_nat n) in if P s then f s else {})" using \<open>P s\<close>
       by (auto intro!: exI[where x="to_nat l"])
   next
     fix x n assume "x \<in> (let s = set (from_nat n) in if P s then f s else {})"
     thus "x \<in> \<Union>{f s|s. P s}" using assms by (auto simp: Let_def split: if_split_asm)
   qed
   hence "\<Union>{f s|s. P s} = (\<Union>n. let s = set (from_nat n) in if P s then f s else {})" by simp
   also have "\<dots> \<in> sets M" using assms by (auto simp: Let_def)
   finally show ?thesis .
 qed
 
 lemma space_subset_in_sets:
   fixes J::"'a::countable set set"
   assumes "J \<subseteq> I"
   assumes "\<And>j. j \<in> J \<Longrightarrow> finite j"
   shows "space (PiF J M) \<in> sets (PiF I M)"
 proof -
   have "space (PiF J M) = \<Union>{space (PiF {j} M)|j. j \<in> J}"
     unfolding space_PiF by blast
   also have "\<dots> \<in> sets (PiF I M)" using assms
     by (intro countable_finite_comprehension) (auto simp: singleton_space_subset_in_sets)
   finally show ?thesis .
 qed
 
 lemma subspace_set_in_sets:
   fixes J::"'a::countable set set"
   assumes A: "A \<in> sets (PiF J M)"
   assumes "J \<subseteq> I"
   assumes "\<And>j. j \<in> J \<Longrightarrow> finite j"
   shows "A \<in> sets (PiF I M)"
   using A[unfolded sets_PiF]
   apply (induct A)
   unfolding sets_PiF[symmetric] unfolding space_PiF[symmetric]
   using assms
   by (auto intro: in_sets_PiFI intro!: space_subset_in_sets)
 
 lemma countable_measurable_PiFI:
   fixes I::"'a::countable set set"
   assumes MN: "\<And>J. J \<in> I \<Longrightarrow> finite J \<Longrightarrow> A \<in> measurable (PiF {J} M) N"
   shows "A \<in> measurable (PiF I M) N"
   unfolding measurable_def
 proof safe
   fix y assume "y \<in> sets N"
   have "A -` y = (\<Union>{A -` y \<inter> {x. domain x = J}|J. finite J})" by auto
   { fix x::"'a \<Rightarrow>\<^sub>F 'b"
     from finite_list[of "domain x"] obtain xs where "set xs = domain x" by auto
     hence "\<exists>n. domain x = set (from_nat n)"
       by (intro exI[where x="to_nat xs"]) auto }
   hence "A -` y \<inter> space (PiF I M) = (\<Union>n. A -` y \<inter> space (PiF ({set (from_nat n)}\<inter>I) M))"
     by (auto simp: space_PiF Pi'_def)
   also have "\<dots> \<in> sets (PiF I M)"
     apply (intro sets.Int sets.countable_nat_UN subsetI, safe)
     apply (case_tac "set (from_nat i) \<in> I")
     apply simp_all
     apply (rule singleton_subspace_set_in_sets[OF measurable_sets[OF MN]])
     using assms \<open>y \<in> sets N\<close>
     apply (auto simp: space_PiF)
     done
   finally show "A -` y \<inter> space (PiF I M) \<in> sets (PiF I M)" .
 next
   fix x assume "x \<in> space (PiF I M)" thus "A x \<in> space N"
     using MN[of "domain x"] by (auto simp: space_PiF measurable_space Pi'_def)
 qed
 
 lemma measurable_PiF:
   assumes f: "\<And>x. x \<in> space N \<Longrightarrow> domain (f x) \<in> I \<and> (\<forall>i\<in>domain (f x). (f x) i \<in> space (M i))"
   assumes S: "\<And>J S. J \<in> I \<Longrightarrow> (\<And>i. i \<in> J \<Longrightarrow> S i \<in> sets (M i)) \<Longrightarrow>
     f -` (Pi' J S) \<inter> space N \<in> sets N"
   shows "f \<in> measurable N (PiF I M)"
   unfolding PiF_def
   using PiF_gen_subset
   apply (rule measurable_measure_of)
   using f apply force
   apply (insert S, auto)
   done
 
 lemma restrict_sets_measurable:
   assumes A: "A \<in> sets (PiF I M)" and "J \<subseteq> I"
   shows "A \<inter> {m. domain m \<in> J} \<in> sets (PiF J M)"
   using A[unfolded sets_PiF]
 proof (induct A)
   case (Basic a)
   then obtain K S where S: "a = Pi' K S" "K \<in> I" "(\<forall>i\<in>K. S i \<in> sets (M i))"
     by auto
   show ?case
   proof cases
     assume "K \<in> J"
     hence "a \<inter> {m. domain m \<in> J} \<in> {Pi' K X |X K. K \<in> J \<and> X \<in> (\<Pi> j\<in>K. sets (M j))}" using S
       by (auto intro!: exI[where x=K] exI[where x=S] simp: Pi'_def)
     also have "\<dots> \<subseteq> sets (PiF J M)" unfolding sets_PiF by auto
     finally show ?thesis .
   next
     assume "K \<notin> J"
     hence "a \<inter> {m. domain m \<in> J} = {}" using S by (auto simp: Pi'_def)
     also have "\<dots> \<in> sets (PiF J M)" by simp
     finally show ?thesis .
   qed
 next
   case (Union a)
   have "\<Union>(a ` UNIV) \<inter> {m. domain m \<in> J} = (\<Union>i. (a i \<inter> {m. domain m \<in> J}))"
     by simp
   also have "\<dots> \<in> sets (PiF J M)" using Union by (intro sets.countable_nat_UN) auto
   finally show ?case .
 next
   case (Compl a)
   have "(space (PiF I M) - a) \<inter> {m. domain m \<in> J} = (space (PiF J M) - (a \<inter> {m. domain m \<in> J}))"
     using \<open>J \<subseteq> I\<close> by (auto simp: space_PiF Pi'_def)
   also have "\<dots> \<in> sets (PiF J M)" using Compl by auto
   finally show ?case by (simp add: space_PiF)
 qed simp
 
 lemma measurable_finmap_of:
   assumes f: "\<And>i. (\<exists>x \<in> space N. i \<in> J x) \<Longrightarrow> (\<lambda>x. f x i) \<in> measurable N (M i)"
   assumes J: "\<And>x. x \<in> space N \<Longrightarrow> J x \<in> I" "\<And>x. x \<in> space N \<Longrightarrow> finite (J x)"
   assumes JN: "\<And>S. {x. J x = S} \<inter> space N \<in> sets N"
   shows "(\<lambda>x. finmap_of (J x) (f x)) \<in> measurable N (PiF I M)"
 proof (rule measurable_PiF)
   fix x assume "x \<in> space N"
   with J[of x] measurable_space[OF f]
   show "domain (finmap_of (J x) (f x)) \<in> I \<and>
         (\<forall>i\<in>domain (finmap_of (J x) (f x)). (finmap_of (J x) (f x)) i \<in> space (M i))"
     by auto
 next
   fix K S assume "K \<in> I" and *: "\<And>i. i \<in> K \<Longrightarrow> S i \<in> sets (M i)"
   with J have eq: "(\<lambda>x. finmap_of (J x) (f x)) -` Pi' K S \<inter> space N =
     (if \<exists>x \<in> space N. K = J x \<and> finite K then if K = {} then {x \<in> space N. J x = K}
       else (\<Inter>i\<in>K. (\<lambda>x. f x i) -` S i \<inter> {x \<in> space N. J x = K}) else {})"
     by (auto simp: Pi'_def)
   have r: "{x \<in> space N. J x = K} = space N \<inter> ({x. J x = K} \<inter> space N)" by auto
   show "(\<lambda>x. finmap_of (J x) (f x)) -` Pi' K S \<inter> space N \<in> sets N"
     unfolding eq r
     apply (simp del: INT_simps add: )
     apply (intro conjI impI sets.finite_INT JN sets.Int[OF sets.top])
     apply simp apply assumption
     apply (subst Int_assoc[symmetric])
     apply (rule sets.Int)
     apply (intro measurable_sets[OF f] *) apply force apply assumption
     apply (intro JN)
     done
 qed
 
 lemma measurable_PiM_finmap_of:
   assumes "finite J"
   shows "finmap_of J \<in> measurable (Pi\<^sub>M J M) (PiF {J} M)"
   apply (rule measurable_finmap_of)
   apply (rule measurable_component_singleton)
   apply simp
   apply rule
   apply (rule \<open>finite J\<close>)
   apply simp
   done
 
 lemma proj_measurable_singleton:
   assumes "A \<in> sets (M i)"
   shows "(\<lambda>x. (x)\<^sub>F i) -` A \<inter> space (PiF {I} M) \<in> sets (PiF {I} M)"
 proof cases
   assume "i \<in> I"
   hence "(\<lambda>x. (x)\<^sub>F i) -` A \<inter> space (PiF {I} M) =
     Pi' I (\<lambda>x. if x = i then A else space (M x))"
     using sets.sets_into_space[OF ] \<open>A \<in> sets (M i)\<close> assms
     by (auto simp: space_PiF Pi'_def)
   thus ?thesis  using assms \<open>A \<in> sets (M i)\<close>
     by (intro in_sets_PiFI) auto
 next
   assume "i \<notin> I"
   hence "(\<lambda>x. (x)\<^sub>F i) -` A \<inter> space (PiF {I} M) =
     (if undefined \<in> A then space (PiF {I} M) else {})" by (auto simp: space_PiF Pi'_def)
   thus ?thesis by simp
 qed
 
 lemma measurable_proj_singleton:
   assumes "i \<in> I"
   shows "(\<lambda>x. (x)\<^sub>F i) \<in> measurable (PiF {I} M) (M i)"
   by (unfold measurable_def, intro CollectI conjI ballI proj_measurable_singleton assms)
      (insert \<open>i \<in> I\<close>, auto simp: space_PiF)
 
 lemma measurable_proj_countable:
   fixes I::"'a::countable set set"
   assumes "y \<in> space (M i)"
   shows "(\<lambda>x. if i \<in> domain x then (x)\<^sub>F i else y) \<in> measurable (PiF I M) (M i)"
 proof (rule countable_measurable_PiFI)
   fix J assume "J \<in> I" "finite J"
   show "(\<lambda>x. if i \<in> domain x then x i else y) \<in> measurable (PiF {J} M) (M i)"
     unfolding measurable_def
   proof safe
     fix z assume "z \<in> sets (M i)"
     have "(\<lambda>x. if i \<in> domain x then x i else y) -` z \<inter> space (PiF {J} M) =
       (\<lambda>x. if i \<in> J then (x)\<^sub>F i else y) -` z \<inter> space (PiF {J} M)"
       by (auto simp: space_PiF Pi'_def)
     also have "\<dots> \<in> sets (PiF {J} M)" using \<open>z \<in> sets (M i)\<close> \<open>finite J\<close>
       by (cases "i \<in> J") (auto intro!: measurable_sets[OF measurable_proj_singleton])
     finally show "(\<lambda>x. if i \<in> domain x then x i else y) -` z \<inter> space (PiF {J} M) \<in>
       sets (PiF {J} M)" .
   qed (insert \<open>y \<in> space (M i)\<close>, auto simp: space_PiF Pi'_def)
 qed
 
 lemma measurable_restrict_proj:
   assumes "J \<in> II" "finite J"
   shows "finmap_of J \<in> measurable (PiM J M) (PiF II M)"
   using assms
   by (intro measurable_finmap_of measurable_component_singleton) auto
 
 lemma measurable_proj_PiM:
   fixes J K ::"'a::countable set" and I::"'a set set"
   assumes "finite J" "J \<in> I"
   assumes "x \<in> space (PiM J M)"
   shows "proj \<in> measurable (PiF {J} M) (PiM J M)"
 proof (rule measurable_PiM_single)
   show "proj \<in> space (PiF {J} M) \<rightarrow> (\<Pi>\<^sub>E i \<in> J. space (M i))"
     using assms by (auto simp add: space_PiM space_PiF extensional_def sets_PiF Pi'_def)
 next
   fix A i assume A: "i \<in> J" "A \<in> sets (M i)"
   show "{\<omega> \<in> space (PiF {J} M). (\<omega>)\<^sub>F i \<in> A} \<in> sets (PiF {J} M)"
   proof
     have "{\<omega> \<in> space (PiF {J} M). (\<omega>)\<^sub>F i \<in> A} =
       (\<lambda>\<omega>. (\<omega>)\<^sub>F i) -` A \<inter> space (PiF {J} M)" by auto
     also have "\<dots> \<in> sets (PiF {J} M)"
       using assms A by (auto intro: measurable_sets[OF measurable_proj_singleton] simp: space_PiM)
     finally show ?thesis .
   qed simp
 qed
 
 lemma space_PiF_singleton_eq_product:
   assumes "finite I"
   shows "space (PiF {I} M) = (\<Pi>' i\<in>I. space (M i))"
   by (auto simp: product_def space_PiF assms)
 
 text \<open>adapted from @{thm sets_PiM_single}\<close>
 
 lemma sets_PiF_single:
   assumes "finite I" "I \<noteq> {}"
   shows "sets (PiF {I} M) =
     sigma_sets (\<Pi>' i\<in>I. space (M i))
       {{f\<in>\<Pi>' i\<in>I. space (M i). f i \<in> A} | i A. i \<in> I \<and> A \<in> sets (M i)}"
     (is "_ = sigma_sets ?\<Omega> ?R")
   unfolding sets_PiF_singleton
 proof (rule sigma_sets_eqI)
   interpret R: sigma_algebra ?\<Omega> "sigma_sets ?\<Omega> ?R" by (rule sigma_algebra_sigma_sets) auto
   fix A assume "A \<in> {Pi' I X |X. X \<in> (\<Pi> j\<in>I. sets (M j))}"
   then obtain X where X: "A = Pi' I X" "X \<in> (\<Pi> j\<in>I. sets (M j))" by auto
   show "A \<in> sigma_sets ?\<Omega> ?R"
   proof -
     from \<open>I \<noteq> {}\<close> X have "A = (\<Inter>j\<in>I. {f\<in>space (PiF {I} M). f j \<in> X j})"
       using sets.sets_into_space
       by (auto simp: space_PiF product_def) blast
     also have "\<dots> \<in> sigma_sets ?\<Omega> ?R"
       using X \<open>I \<noteq> {}\<close> assms by (intro R.finite_INT) (auto simp: space_PiF)
     finally show "A \<in> sigma_sets ?\<Omega> ?R" .
   qed
 next
   fix A assume "A \<in> ?R"
   then obtain i B where A: "A = {f\<in>\<Pi>' i\<in>I. space (M i). f i \<in> B}" "i \<in> I" "B \<in> sets (M i)"
     by auto
   then have "A = (\<Pi>' j \<in> I. if j = i then B else space (M j))"
     using sets.sets_into_space[OF A(3)]
     apply (auto simp: Pi'_iff split: if_split_asm)
     apply blast
     done
   also have "\<dots> \<in> sigma_sets ?\<Omega> {Pi' I X |X. X \<in> (\<Pi> j\<in>I. sets (M j))}"
     using A
     by (intro sigma_sets.Basic )
        (auto intro: exI[where x="\<lambda>j. if j = i then B else space (M j)"])
   finally show "A \<in> sigma_sets ?\<Omega> {Pi' I X |X. X \<in> (\<Pi> j\<in>I. sets (M j))}" .
 qed
 
 text \<open>adapted from @{thm PiE_cong}\<close>
 
 lemma Pi'_cong:
   assumes "finite I"
   assumes "\<And>i. i \<in> I \<Longrightarrow> f i = g i"
   shows "Pi' I f = Pi' I g"
 using assms by (auto simp: Pi'_def)
 
 text \<open>adapted from @{thm Pi_UN}\<close>
 
 lemma Pi'_UN:
   fixes A :: "nat \<Rightarrow> 'i \<Rightarrow> 'a set"
   assumes "finite I"
   assumes mono: "\<And>i n m. i \<in> I \<Longrightarrow> n \<le> m \<Longrightarrow> A n i \<subseteq> A m i"
   shows "(\<Union>n. Pi' I (A n)) = Pi' I (\<lambda>i. \<Union>n. A n i)"
 proof (intro set_eqI iffI)
   fix f assume "f \<in> Pi' I (\<lambda>i. \<Union>n. A n i)"
   then have "\<forall>i\<in>I. \<exists>n. f i \<in> A n i" "domain f = I" by (auto simp: \<open>finite I\<close> Pi'_def)
   from bchoice[OF this(1)] obtain n where n: "\<And>i. i \<in> I \<Longrightarrow> f i \<in> (A (n i) i)" by auto
   obtain k where k: "\<And>i. i \<in> I \<Longrightarrow> n i \<le> k"
     using \<open>finite I\<close> finite_nat_set_iff_bounded_le[of "n`I"] by auto
   have "f \<in> Pi' I (\<lambda>i. A k i)"
   proof
     fix i assume "i \<in> I"
     from mono[OF this, of "n i" k] k[OF this] n[OF this] \<open>domain f = I\<close> \<open>i \<in> I\<close>
     show "f i \<in> A k i " by (auto simp: \<open>finite I\<close>)
   qed (simp add: \<open>domain f = I\<close> \<open>finite I\<close>)
   then show "f \<in> (\<Union>n. Pi' I (A n))" by auto
 qed (auto simp: Pi'_def \<open>finite I\<close>)
 
 text \<open>adapted from @{thm sets_PiM_sigma}\<close>
 
 lemma sigma_fprod_algebra_sigma_eq:
   fixes E :: "'i \<Rightarrow> 'a set set" and S :: "'i \<Rightarrow> nat \<Rightarrow> 'a set"
   assumes [simp]: "finite I" "I \<noteq> {}"
     and S_union: "\<And>i. i \<in> I \<Longrightarrow> (\<Union>j. S i j) = space (M i)"
     and S_in_E: "\<And>i. i \<in> I \<Longrightarrow> range (S i) \<subseteq> E i"
   assumes E_closed: "\<And>i. i \<in> I \<Longrightarrow> E i \<subseteq> Pow (space (M i))"
     and E_generates: "\<And>i. i \<in> I \<Longrightarrow> sets (M i) = sigma_sets (space (M i)) (E i)"
   defines "P == { Pi' I F | F. \<forall>i\<in>I. F i \<in> E i }"
   shows "sets (PiF {I} M) = sigma_sets (space (PiF {I} M)) P"
 proof
   let ?P = "sigma (space (Pi\<^sub>F {I} M)) P"
   from \<open>finite I\<close>[THEN ex_bij_betw_finite_nat] obtain T where "bij_betw T I {0..<card I}" ..
   then have T: "\<And>i. i \<in> I \<Longrightarrow> T i < card I" "\<And>i. i\<in>I \<Longrightarrow> the_inv_into I T (T i) = i"
     by (auto simp add: bij_betw_def set_eq_iff image_iff the_inv_into_f_f simp del: \<open>finite I\<close>)
   have P_closed: "P \<subseteq> Pow (space (Pi\<^sub>F {I} M))"
     using E_closed by (auto simp: space_PiF P_def Pi'_iff subset_eq)
   then have space_P: "space ?P = (\<Pi>' i\<in>I. space (M i))"
     by (simp add: space_PiF)
   have "sets (PiF {I} M) =
       sigma_sets (space ?P) {{f \<in> \<Pi>' i\<in>I. space (M i). f i \<in> A} |i A. i \<in> I \<and> A \<in> sets (M i)}"
     using sets_PiF_single[of I M] by (simp add: space_P)
   also have "\<dots> \<subseteq> sets (sigma (space (PiF {I} M)) P)"
   proof (safe intro!: sets.sigma_sets_subset)
     fix i A assume "i \<in> I" and A: "A \<in> sets (M i)"
     have "(\<lambda>x. (x)\<^sub>F i) \<in> measurable ?P (sigma (space (M i)) (E i))"
     proof (subst measurable_iff_measure_of)
       show "E i \<subseteq> Pow (space (M i))" using \<open>i \<in> I\<close> by fact
       from space_P \<open>i \<in> I\<close> show "(\<lambda>x. (x)\<^sub>F i) \<in> space ?P \<rightarrow> space (M i)"
         by auto
       show "\<forall>A\<in>E i. (\<lambda>x. (x)\<^sub>F i) -` A \<inter> space ?P \<in> sets ?P"
       proof
         fix A assume A: "A \<in> E i"
         from T have *: "\<exists>xs. length xs = card I
           \<and> (\<forall>j\<in>I. (g)\<^sub>F j \<in> (if i = j then A else S j (xs ! T j)))"
           if "domain g = I" and "\<forall>j\<in>I. (g)\<^sub>F j \<in> (if i = j then A else S j (f j))" for g f
           using that by (auto intro!: exI [of _ "map (\<lambda>n. f (the_inv_into I T n)) [0..<card I]"])
         from A have "(\<lambda>x. (x)\<^sub>F i) -` A \<inter> space ?P = (\<Pi>' j\<in>I. if i = j then A else space (M j))"
           using E_closed \<open>i \<in> I\<close> by (auto simp: space_P Pi_iff subset_eq split: if_split_asm)
         also have "\<dots> = (\<Pi>' j\<in>I. \<Union>n. if i = j then A else S j n)"
           by (intro Pi'_cong) (simp_all add: S_union)
         also have "\<dots> = {g. domain g = I \<and> (\<exists>f. \<forall>j\<in>I. (g)\<^sub>F j \<in> (if i = j then A else S j (f j)))}"
           by (rule set_eqI) (simp del: if_image_distrib add: Pi'_iff bchoice_iff)
         also have "\<dots> = (\<Union>xs\<in>{xs. length xs = card I}. \<Pi>' j\<in>I. if i = j then A else S j (xs ! T j))"
           using * by (auto simp add: Pi'_iff split del: if_split)
         also have "\<dots> \<in> sets ?P"
         proof (safe intro!: sets.countable_UN)
           fix xs show "(\<Pi>' j\<in>I. if i = j then A else S j (xs ! T j)) \<in> sets ?P"
             using A S_in_E
             by (simp add: P_closed)
                (auto simp: P_def subset_eq intro!: exI[of _ "\<lambda>j. if i = j then A else S j (xs ! T j)"])
         qed
         finally show "(\<lambda>x. (x)\<^sub>F i) -` A \<inter> space ?P \<in> sets ?P"
           using P_closed by simp
       qed
     qed
     from measurable_sets[OF this, of A] A \<open>i \<in> I\<close> E_closed
     have "(\<lambda>x. (x)\<^sub>F i) -` A \<inter> space ?P \<in> sets ?P"
       by (simp add: E_generates)
     also have "(\<lambda>x. (x)\<^sub>F i) -` A \<inter> space ?P = {f \<in> \<Pi>' i\<in>I. space (M i). f i \<in> A}"
       using P_closed by (auto simp: space_PiF)
     finally show "\<dots> \<in> sets ?P" .
   qed
   finally show "sets (PiF {I} M) \<subseteq> sigma_sets (space (PiF {I} M)) P"
     by (simp add: P_closed)
   show "sigma_sets (space (PiF {I} M)) P \<subseteq> sets (PiF {I} M)"
     using \<open>finite I\<close> \<open>I \<noteq> {}\<close>
     by (auto intro!: sets.sigma_sets_subset product_in_sets_PiFI simp: E_generates P_def)
 qed
 
 lemma product_open_generates_sets_PiF_single:
   assumes "I \<noteq> {}"
   assumes [simp]: "finite I"
   shows "sets (PiF {I} (\<lambda>_. borel::'b::second_countable_topology measure)) =
     sigma_sets (space (PiF {I} (\<lambda>_. borel))) {Pi' I F |F. (\<forall>i\<in>I. F i \<in> Collect open)}"
 proof -
   from open_countable_basisE[OF open_UNIV] obtain S::"'b set set"
     where S: "S \<subseteq> (SOME B. countable B \<and> topological_basis B)" "UNIV = \<Union> S"
     by auto
   show ?thesis
   proof (rule sigma_fprod_algebra_sigma_eq)
     show "finite I" by simp
     show "I \<noteq> {}" by fact
     define S' where "S' = from_nat_into S"
     show "(\<Union>j. S' j) = space borel"
       using S
       apply (auto simp add: from_nat_into countable_basis_proj S'_def basis_proj_def)
       apply (metis (lifting, mono_tags) UNIV_I UnionE basis_proj_def countable_basis_proj countable_subset from_nat_into_surj)
       done
     show "range S' \<subseteq> Collect open"
       using S
       apply (auto simp add: from_nat_into countable_basis_proj S'_def)
       apply (metis UNIV_not_empty Union_empty from_nat_into subsetD topological_basis_open[OF basis_proj] basis_proj_def)
       done
     show "Collect open \<subseteq> Pow (space borel)" by simp
     show "sets borel = sigma_sets (space borel) (Collect open)"
       by (simp add: borel_def)
   qed
 qed
 
 lemma finmap_UNIV[simp]: "(\<Union>J\<in>Collect finite. \<Pi>' j\<in>J. UNIV) = UNIV" by auto
 
 lemma borel_eq_PiF_borel:
   shows "(borel :: ('i::countable \<Rightarrow>\<^sub>F 'a::polish_space) measure) =
     PiF (Collect finite) (\<lambda>_. borel :: 'a measure)"
   unfolding borel_def PiF_def
 proof (rule measure_eqI, clarsimp, rule sigma_sets_eqI)
   fix a::"('i \<Rightarrow>\<^sub>F 'a) set" assume "a \<in> Collect open" hence "open a" by simp
   then obtain B' where B': "B'\<subseteq>basis_finmap" "a = \<Union>B'"
     using finmap_topological_basis by (force simp add: topological_basis_def)
   have "a \<in> sigma UNIV {Pi' J X |X J. finite J \<and> X \<in> J \<rightarrow> sigma_sets UNIV (Collect open)}"
     unfolding \<open>a = \<Union>B'\<close>
   proof (rule sets.countable_Union)
     from B' countable_basis_finmap show "countable B'" by (metis countable_subset)
   next
     show "B' \<subseteq> sets (sigma UNIV
       {Pi' J X |X J. finite J \<and> X \<in> J \<rightarrow> sigma_sets UNIV (Collect open)})" (is "_ \<subseteq> sets ?s")
     proof
       fix x assume "x \<in> B'" with B' have "x \<in> basis_finmap" by auto
       then obtain J X where "x = Pi' J X" "finite J" "X \<in> J \<rightarrow> sigma_sets UNIV (Collect open)"
         by (auto simp: basis_finmap_def topological_basis_open[OF basis_proj])
       thus "x \<in> sets ?s" by auto
     qed
   qed
   thus "a \<in> sigma_sets UNIV {Pi' J X |X J. finite J \<and> X \<in> J \<rightarrow> sigma_sets UNIV (Collect open)}"
     by simp
 next
   fix b::"('i \<Rightarrow>\<^sub>F 'a) set"
   assume "b \<in> {Pi' J X |X J. finite J \<and> X \<in> J \<rightarrow> sigma_sets UNIV (Collect open)}"
   hence b': "b \<in> sets (Pi\<^sub>F (Collect finite) (\<lambda>_. borel))" by (auto simp: sets_PiF borel_def)
   let ?b = "\<lambda>J. b \<inter> {x. domain x = J}"
   have "b = \<Union>((\<lambda>J. ?b J) ` Collect finite)" by auto
   also have "\<dots> \<in> sets borel"
   proof (rule sets.countable_Union, safe)
     fix J::"'i set" assume "finite J"
     { assume ef: "J = {}"
       have "?b J \<in> sets borel"
       proof cases
         assume "?b J \<noteq> {}"
         then obtain f where "f \<in> b" "domain f = {}" using ef by auto
         hence "?b J = {f}" using \<open>J = {}\<close>
           by (auto simp: finmap_eq_iff)
         also have "{f} \<in> sets borel" by simp
         finally show ?thesis .
       qed simp
     } moreover {
       assume "J \<noteq> ({}::'i set)"
       have "(?b J) = b \<inter> {m. domain m \<in> {J}}" by auto
       also have "\<dots> \<in> sets (PiF {J} (\<lambda>_. borel))"
         using b' by (rule restrict_sets_measurable) (auto simp: \<open>finite J\<close>)
       also have "\<dots> = sigma_sets (space (PiF {J} (\<lambda>_. borel)))
         {Pi' (J) F |F. (\<forall>j\<in>J. F j \<in> Collect open)}"
         (is "_ = sigma_sets _ ?P")
        by (rule product_open_generates_sets_PiF_single[OF \<open>J \<noteq> {}\<close> \<open>finite J\<close>])
       also have "\<dots> \<subseteq> sigma_sets UNIV (Collect open)"
         by (intro sigma_sets_mono'') (auto intro!: open_Pi'I simp: space_PiF)
       finally have "(?b J) \<in> sets borel" by (simp add: borel_def)
     } ultimately show "(?b J) \<in> sets borel" by blast
   qed (simp add: countable_Collect_finite)
   finally show "b \<in> sigma_sets UNIV (Collect open)" by (simp add: borel_def)
 qed (simp add: emeasure_sigma borel_def PiF_def)
 
 subsection \<open>Isomorphism between Functions and Finite Maps\<close>
 
 lemma measurable_finmap_compose:
   shows "(\<lambda>m. compose J m f) \<in> measurable (PiM (f ` J) (\<lambda>_. M)) (PiM J (\<lambda>_. M))"
   unfolding compose_def by measurable
 
 lemma measurable_compose_inv:
   assumes inj: "\<And>j. j \<in> J \<Longrightarrow> f' (f j) = j"
   shows "(\<lambda>m. compose (f ` J) m f') \<in> measurable (PiM J (\<lambda>_. M)) (PiM (f ` J) (\<lambda>_. M))"
   unfolding compose_def by (rule measurable_restrict) (auto simp: inj)
 
 locale function_to_finmap =
   fixes J::"'a set" and f :: "'a \<Rightarrow> 'b::countable" and f'
   assumes [simp]: "finite J"
   assumes inv: "i \<in> J \<Longrightarrow> f' (f i) = i"
 begin
 
 text \<open>to measure finmaps\<close>
 
 definition "fm = (finmap_of (f ` J)) o (\<lambda>g. compose (f ` J) g f')"
 
 lemma domain_fm[simp]: "domain (fm x) = f ` J"
   unfolding fm_def by simp
 
 lemma fm_restrict[simp]: "fm (restrict y J) = fm y"
   unfolding fm_def by (auto simp: compose_def inv intro: restrict_ext)
 
 lemma fm_product:
   assumes "\<And>i. space (M i) = UNIV"
   shows "fm -` Pi' (f ` J) S \<inter> space (Pi\<^sub>M J M) = (\<Pi>\<^sub>E j \<in> J. S (f j))"
   using assms
   by (auto simp: inv fm_def compose_def space_PiM Pi'_def)
 
 lemma fm_measurable:
   assumes "f ` J \<in> N"
   shows "fm \<in> measurable (Pi\<^sub>M J (\<lambda>_. M)) (Pi\<^sub>F N (\<lambda>_. M))"
   unfolding fm_def
 proof (rule measurable_comp, rule measurable_compose_inv)
   show "finmap_of (f ` J) \<in> measurable (Pi\<^sub>M (f ` J) (\<lambda>_. M)) (PiF N (\<lambda>_. M)) "
     using assms by (intro measurable_finmap_of measurable_component_singleton) auto
 qed (simp_all add: inv)
 
 lemma proj_fm:
   assumes "x \<in> J"
   shows "fm m (f x) = m x"
   using assms by (auto simp: fm_def compose_def o_def inv)
 
 lemma inj_on_compose_f': "inj_on (\<lambda>g. compose (f ` J) g f') (extensional J)"
 proof (rule inj_on_inverseI)
   fix x::"'a \<Rightarrow> 'c" assume "x \<in> extensional J"
   thus "(\<lambda>x. compose J x f) (compose (f ` J) x f') = x"
     by (auto simp: compose_def inv extensional_def)
 qed
 
 lemma inj_on_fm:
   assumes "\<And>i. space (M i) = UNIV"
   shows "inj_on fm (space (Pi\<^sub>M J M))"
   using assms
   apply (auto simp: fm_def space_PiM PiE_def)
   apply (rule comp_inj_on)
   apply (rule inj_on_compose_f')
   apply (rule finmap_of_inj_on_extensional_finite)
   apply simp
   apply (auto)
   done
 
 text \<open>to measure functions\<close>
 
 definition "mf = (\<lambda>g. compose J g f) o proj"
 
 lemma mf_fm:
   assumes "x \<in> space (Pi\<^sub>M J (\<lambda>_. M))"
   shows "mf (fm x) = x"
 proof -
   have "mf (fm x) \<in> extensional J"
     by (auto simp: mf_def extensional_def compose_def)
   moreover
   have "x \<in> extensional J" using assms sets.sets_into_space
     by (force simp: space_PiM PiE_def)
   moreover
   { fix i assume "i \<in> J"
     hence "mf (fm x) i = x i"
       by (auto simp: inv mf_def compose_def fm_def)
   }
   ultimately
   show ?thesis by (rule extensionalityI)
 qed
 
 lemma mf_measurable:
   assumes "space M = UNIV"
   shows "mf \<in> measurable (PiF {f ` J} (\<lambda>_. M)) (PiM J (\<lambda>_. M))"
   unfolding mf_def
 proof (rule measurable_comp, rule measurable_proj_PiM)
   show "(\<lambda>g. compose J g f) \<in> measurable (Pi\<^sub>M (f ` J) (\<lambda>x. M)) (Pi\<^sub>M J (\<lambda>_. M))"
     by (rule measurable_finmap_compose)
 qed (auto simp add: space_PiM extensional_def assms)
 
 lemma fm_image_measurable:
   assumes "space M = UNIV"
   assumes "X \<in> sets (Pi\<^sub>M J (\<lambda>_. M))"
   shows "fm ` X \<in> sets (PiF {f ` J} (\<lambda>_. M))"
 proof -
   have "fm ` X = (mf) -` X \<inter> space (PiF {f ` J} (\<lambda>_. M))"
   proof safe
     fix x assume "x \<in> X"
     with mf_fm[of x] sets.sets_into_space[OF assms(2)] show "fm x \<in> mf -` X" by auto
     show "fm x \<in> space (PiF {f ` J} (\<lambda>_. M))" by (simp add: space_PiF assms)
   next
     fix y x
     assume x: "mf y \<in> X"
     assume y: "y \<in> space (PiF {f ` J} (\<lambda>_. M))"
     thus "y \<in> fm ` X"
       by (intro image_eqI[OF _ x], unfold finmap_eq_iff)
          (auto simp: space_PiF fm_def mf_def compose_def inv Pi'_def)
   qed
   also have "\<dots> \<in> sets (PiF {f ` J} (\<lambda>_. M))"
     using assms
     by (intro measurable_sets[OF mf_measurable]) auto
   finally show ?thesis .
 qed
 
 lemma fm_image_measurable_finite:
   assumes "space M = UNIV"
   assumes "X \<in> sets (Pi\<^sub>M J (\<lambda>_. M::'c measure))"
   shows "fm ` X \<in> sets (PiF (Collect finite) (\<lambda>_. M::'c measure))"
   using fm_image_measurable[OF assms]
   by (rule subspace_set_in_sets) (auto simp: finite_subset)
 
 text \<open>measure on finmaps\<close>
 
 definition "mapmeasure M N = distr M (PiF (Collect finite) N) (fm)"
 
 lemma sets_mapmeasure[simp]: "sets (mapmeasure M N) = sets (PiF (Collect finite) N)"
   unfolding mapmeasure_def by simp
 
 lemma space_mapmeasure[simp]: "space (mapmeasure M N) = space (PiF (Collect finite) N)"
   unfolding mapmeasure_def by simp
 
 lemma mapmeasure_PiF:
   assumes s1: "space M = space (Pi\<^sub>M J (\<lambda>_. N))"
   assumes s2: "sets M = sets (Pi\<^sub>M J (\<lambda>_. N))"
   assumes "space N = UNIV"
   assumes "X \<in> sets (PiF (Collect finite) (\<lambda>_. N))"
   shows "emeasure (mapmeasure M (\<lambda>_. N)) X = emeasure M ((fm -` X \<inter> extensional J))"
   using assms
   by (auto simp: measurable_cong_sets[OF s2 refl] mapmeasure_def emeasure_distr
     fm_measurable space_PiM PiE_def)
 
 lemma mapmeasure_PiM:
   fixes N::"'c measure"
   assumes s1: "space M = space (Pi\<^sub>M J (\<lambda>_. N))"
   assumes s2: "sets M = (Pi\<^sub>M J (\<lambda>_. N))"
   assumes N: "space N = UNIV"
   assumes X: "X \<in> sets M"
   shows "emeasure M X = emeasure (mapmeasure M (\<lambda>_. N)) (fm ` X)"
   unfolding mapmeasure_def
 proof (subst emeasure_distr, subst measurable_cong_sets[OF s2 refl], rule fm_measurable)
   have "X \<subseteq> space (Pi\<^sub>M J (\<lambda>_. N))" using assms by (simp add: sets.sets_into_space)
   from assms inj_on_fm[of "\<lambda>_. N"] subsetD[OF this] have "fm -` fm ` X \<inter> space (Pi\<^sub>M J (\<lambda>_. N)) = X"
     by (auto simp: vimage_image_eq inj_on_def)
   thus "emeasure M X = emeasure M (fm -` fm ` X \<inter> space M)" using s1
     by simp
   show "fm ` X \<in> sets (PiF (Collect finite) (\<lambda>_. N))"
     by (rule fm_image_measurable_finite[OF N X[simplified s2]])
 qed simp
 
 end
 
 end